Re: [dspam-users] RABL Now LIVE!

Chris Ryland wrote:
> On Dec 13, 2005, at 11:35 AM, Ion-Mihai Tetcu wrote:
>
>> On Tue, 13 Dec 2005 09:24:12 -0500 Jonathan Zdziarski
>> <jonathan@nuclearelephant.com> wrote:
>>
>>> rabl is not online at the moment. i need to update the page.
>>> nobody's really shown much interest in becoming a writer.
>>
>> There's one thing stopping me from using it read or write: if a message
>> comes from a mailing list and is spam or retrained as spam the ml
>> server will be listed.
>>
>> If we can find a solution for this it's a meter of minutes to start
>> using it as a writer.
>
> But doesn't the RABL design allow for this? If there's not a constant
> barrage of spam from that address, there's a quick fall-off (6 hours?).
>
> Cheers!
> --Chris Ryland / Em Software, Inc. / www.emsoftware.com
Maybe not, if it's like greylisting, which would consider any
mail from that IP within six hours as being reason to touch
the ip file again. Would rabl do that? Hopefully when dspam
is set to innoculate on a rabl hit, that does not mean that
other mail from that ip will hit on those tokens so as to
start a loop of touching that ip in rabl every time legit
mail arrives from a once-blacklisted mail server.

It's possible to set the dspam.conf to a threshold higher
than one spam from source ip. Another way to re-validate
would be by ratio of spam to notspam from source, but
that would increase overhead.

-Bob
Received on Tue Dec 13 14:52:41 2005