Mailing List Archive: SpamAssassin: users

Hostkarma White list Updated and Improved

Index | Next | Previous | View Threaded

marc at perkel

Oct 5, 2009, 8:47 AM

Post #1 of 5 (575 views)
Permalink

Hostkarma White list Updated and Improved

In the last week I've put a lot of effort into improving the accuracy of
my white lists. Especially for those of you who are critical of the
accuracy of hostkarma white list I'd like you all to test it now and
tell me how it works now. I have to admit that I have been less
motivated in the past about getting the white list right than the black
list because people complain a lot more about good email getting blocked
than bad email getting through.

Also looking for suggestions about how to make my white list bigger and
better.

One thing that is different about my white lists is that it is supposed
to be only sites that send good email. Most other white lists are just
for keeping IPs off of black lists. Our white list is supposed to be a
source of pure good email. So if spam comes for any of the white listed
IPs then it's an error. Sites like yahoo, gmail, hotmail, etc. would be
on our yellow list because they send mixed spam/ham email.

jhardin at impsec

Oct 5, 2009, 9:17 AM

Post #2 of 5 (530 views)
Permalink

Re: Hostkarma White list Updated and Improved [In reply to]

On Mon, 5 Oct 2009, Marc Perkel wrote:

> Our white list is supposed to be a source of pure good email. So if spam
> comes for any of the white listed IPs then it's an error.

Whose? Yours or theirs?

Meaning: is a single spam reason for an IP to be dropped from the
hostkarma whitelist?

--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin [at] impsec FALaholic #11174 pgpk -a jhardin [at] impsec
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
Vista is at best mildly annoying and at worst makes you want to
rush to Redmond, Wash. and rip somebody's liver out. -- Forbes
-----------------------------------------------------------------------
Approximately 9185280 firearms legally purchased in the U.S. this year

marc at perkel

Oct 5, 2009, 11:32 AM

Post #3 of 5 (527 views)
Permalink

Re: Hostkarma White list Updated and Improved [In reply to]

John Hardin wrote:
> On Mon, 5 Oct 2009, Marc Perkel wrote:
>
>> Our white list is supposed to be a source of pure good email. So if
>> spam comes for any of the white listed IPs then it's an error.
>
> Whose? Yours or theirs?
>
> Meaning: is a single spam reason for an IP to be dropped from the
> hostkarma whitelist?
>
It depends on what kind of spam it is. If it is a virus generated spam -
then yes. If it's a spam determined by message content - no.

jon at radscan

Oct 5, 2009, 5:09 PM

Post #4 of 5 (519 views)
Permalink

Re: Hostkarma White list Updated and Improved [In reply to]

On Mon, 5 Oct 2009, Marc Perkel wrote:

>
>
> John Hardin wrote:
>> On Mon, 5 Oct 2009, Marc Perkel wrote:
>>
>>> Our white list is supposed to be a source of pure good email. So if spam
>>> comes for any of the white listed IPs then it's an error.
>>
>> Whose? Yours or theirs?
>>
>> Meaning: is a single spam reason for an IP to be dropped from the hostkarma
>> whitelist?
>>
> It depends on what kind of spam it is. If it is a virus generated spam - then
> yes. If it's a spam determined by message content - no.
>

Sorry if I missed this in the thread, but how do you determine
whether a spam originates from a bot-net vs. a 'lone wolf'?

--
"I drank what?" | Jon Trulson
-Socrates | mailto:jon [at] radscan
| A828 C19D A087 F20B DFED
| 67C9 6F32 31AB E647 B345

marc at perkel

Oct 6, 2009, 3:59 AM

Post #5 of 5 (515 views)
Permalink

Re: Hostkarma White list Updated and Improved [In reply to]

Jon Trulson wrote:
> On Mon, 5 Oct 2009, Marc Perkel wrote:
>
>>
>>
>> John Hardin wrote:
>>> On Mon, 5 Oct 2009, Marc Perkel wrote:
>>>
>>>> Our white list is supposed to be a source of pure good email. So if
>>>> spam comes for any of the white listed IPs then it's an error.
>>>
>>> Whose? Yours or theirs?
>>>
>>> Meaning: is a single spam reason for an IP to be dropped from the
>>> hostkarma whitelist?
>>>
>> It depends on what kind of spam it is. If it is a virus generated
>> spam - then yes. If it's a spam determined by message content - no.
>>
>
> Sorry if I missed this in the thread, but how do you determine
> whether a spam originates from a bot-net vs. a 'lone wolf'?
>
>
A combination of several factors including hitting my tarbaby server AND
not using QUIT to close the connection AND some HELO sins. I'm catching
near 100% of botnet spam.

Index | Next | Previous | View Threaded

Interested in having your list archived? Contact Gossamer Threads