Re: spam blocking engine

On Wed, 18 Dec 2002 23:08:11 -0500 Marcus Watts <mdw@umich.edu> wrote:
> Getting a good list of open relays is hard. The last time I looked

relays.visi.com was good, but it's been shut down.

while i have philosophical objections to the ORBS style active scanning, one of the children of ORBS, ORDB, seems to be pretty accurate.

> How
> good do you find the data from spews.org to be?

what i've seen of spews suggests that the initial listings may be of high quality, but mr. spews plays escallation games with intentional collateral damage affecting folks with adjacent netblocks. whether this is acceptable is again a matter of personal philosophy.

my question: would the source for ips to be blocked be something that's configurable via a DNSBL parameter in a config file? in this case, there could be a reasonable default which could be tweaked to taste, with a list of DNSBLs to be queried.

i also wonder what effect this code would have on abused proxies (squid, cacheflow servers, socks, etc.) if a "good" one by our lights, then being able to add, say, opm.blitzed.org to a list of DNSBLs would be a good thing.

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related openbsd.org Links advocacy announce bugs ipv6 misc ports ports-changes security-announce smp source-changes tech Request more information about Pantek

richard

--
Richard Welty                                         rwelty@averillpark.net
Averill Park Networking                                         518-573-7592
              Unix, Linux, IP Network Engineering, Security