From: "Rune Kristian Viken" <[EMAIL PROTECTED]>
On Thursday 16 February 2006 02:22, Bill Landry wrote:
This makes me wonder if SA wouldn't be better off having some kind of
meta rules that simply count how many URIBLs the message is listed in, or
at least some kind of score-limiting feedback on multiple hits. This
would allow lists to score high individually, but prevent overlapping FPs
from being driven into astronomical score levels just for containing a
single URI that someone mis-reported to multiple sources.
Thoughts, concepts?
So, Matt, why is this any different than an IP addresses that gets listed
in many different RBLs and reported by SA?
Not Matt here, but I've got some input on my own.
...
The URL-lists are made in a different manner.
Take for example - a fully legit message from one friend to another that
contains something like this:
:::
Hi $name, god I'm getting tired of all the spam we're receiving about
http://uri-here/uri , I've noticed that they're actually located in the
neighbourhood - maybe we should pay them a visit and tell them what we
think about them?
regards,
$name
:::
.. that message is fully legit, and the only "wrong" thing about it is the
mentioning of the uri. It'll get blocked, while still violating nothing
more than one rule that in practice is repeated multiple times.
Rune, there are two canonical means of solving that petty issue. If
there is someone likely to send you such a message white list her. Or
simply munge the name, for example http://uri-here-M/uri/.
{o.o}
