Just a few comments and corrections. On Sat, 2009-10-10 at 19:44 -0400, Warren Togami wrote: > The following is an apples to apples comparisons of DNSBL lastexternal
Minor nit: Not entirely correct. Different lists have different listing policies and criteria. A PBL listing for example does NOT necessarily indicate that IP ever has sent a single spam. While all (most) of these might be apples, I strongly prefer green ones over red. ;) > Overlap analysis shows the majority of XBL and PBL are also listed by > Barracuda. Furthermore Barracuda's list seems to have a similar hit % > as XBL + PBL combined. Is Barracuda known to aggregate Spamhaus data > with their own? No, they don't. They don't even list PBL style IPs just because of that. Barracuda BRBL appears to be an independently collected set, as one easily can find out about: http://www.barracudacentral.org/rbl > In related news, these results indicate that RCVD_IN_HOSTKARMA_BR and > RCVD_IN_SEMBACKSCATTER have so few hits that they are likely not worth > the overhead of the extra DNS query to use in production. Unless the > list owners object, I will remove them from the sandbox before next > Saturday's network masscheck. Hostkarma BROWN does NOT require a DNS query. It's a check_rbl_sub() eval rule, and thus comes essentially for free. Any possible Hostkarma listing is based on the very same, single DNS query. Backscatter is not spam. ;) -- char *t="\10pse\0r\0dtu...@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4"; main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1: (c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}
