On Sun, 2014-10-12 at 01:28 +0200, Reindl Harald wrote:
> Am 12.10.2014 um 01:09 schrieb Karsten Bräckelmann:
> >>>>> it hits again and i doubt that sourceforge is a new domain
> > However, what I am much more annoyed about is your rambling, claiming
> > DOB would list sourceforge.net -- and by that, particularly with this
> > thread's topic, giving the impression of DOB again listing the world.
> > Which it doesn't.
>
> it seems to hit randomly which is even more worse because listing the
> world is more obvious - i claim that it is not trustable currently, not
> more and not less, may anybody make his own decision, i told mine and
> there is nothing worng with that
You have exactly one false positive listing. That is not even close to
"hit randomly".
Please stop the repeated, false accusations on this list.
> > Obviously, you did not check facts or investigate the issue at all.
>
> don't get me wrong, there ist not much to investigate if it hits legit
> mailing-list messages
Correct, there is not much to investigate. The *only* thing would be to
verify *which* domain hit the DOB listing, and whether it actually is a
bad or warranted listing. Besides, that one is absolutely crucial to
check before claiming a false positive.
A single thing to verify. You did not.
Besides, it is just a coincidence that another domain in your log paste
actually was listed when I checked. Any other domain from the body could
have been the culprit. And still potentially can, since you only posted
logs -- no SA headers, body, or list of URIs.
> > With a configuration of "add_header all Report _REPORT_", the listed
> > domain even is included in the report, without any need for manual
> > post-processing.
> >
> > * 0.3 URIBL_RHS_DOB Contains an URI of a new domain (Day Old Bread)
> > * [URIs: tieman.se]
>
> which is just not true - the domain is way older
Yes, that seems to be a DOB false positive listing (and the only one
known right now, see above). Get over it.
And BTW, that was meant as a helpful hint for you and anyone else
reading this thread, about getting crucial details while investigating
(or reporting) issues. No need to bark at me, and repeat yet again
that's the one bad listing you encountered. The above is "how to do it"
and "what you get".
> and the SBL hit because
> "support-intelligence.net" makes things not better
>
> URIBL_SBL Contains an URL's NS IP listed in the SBL blocklist *
> [URIs: tieman.se.dob.sibl.support-intelligence.net]
That is a SpamHaus listing. Support Intelligence is not responsible for
it, but the "victim".
This is entirely unrelated to URIBL_RHS_DOB and this thread's topic.
--
char *t="\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1:
(c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}
