[SARE] Bigevil IMPORTANT update/test.

[Chris Santerre <cs...@MerchantsOverseas.com>]

Ok guys, sorry there have been little updates to BE for a while. I have been
working closely with SURBL project. We have got to the point where BE is now
generated from ws.surbl.org which is what I have been contributing domains
to instead of BE. Awaiting for this day. :)

So we now have BE auto generated from WS.surbl.org...however this is a LOT
more data! HUGE increase. There are now 2369 rules! 

TOP reports SIZE going from 22 megs to now 36 megs for spamd, however RSS
only went from 21 megs to 22 megs. 

I have no idea how this will effect systems under heavy load. Those systems
should definitely stay with SURBL as this is just a local regex copy of it.
But for those systems that can't/won't use SURBL and want a local copy of
this larger bigevil here is the link: (~600k)

www.rulesemporium.com/rules/bigevil2.cf

PLEASE report any findings to this list. It lints fine and I'm running it
today. Part of me is wondering if this is even worthwhile when SA 3.0 will
support SURBL direct. So these tests may be just to see the effect of such a
ruleset on SA right now. We may just do away with it and have everyone use
SURBL. 

The only updates I've been doing to the regular BE is removing a few FPs. I
will not officially make this new large file the regular Bigevil for at
least a week. 

Again, please give feedback. Thanks!

Chris Santerre 
System Admin and SARE Ninja
http://www.rulesemporium.com
http://www.surbl.org
'It is not the strongest of the species that survives,
not the most intelligent, but the one most responsive to change.'
Charles Darwin 

Re: [SURBL-Discuss] [SARE] Bigevil IMPORTANT update/test.

[Jeff Chan <je...@surbl.org>]

On Friday, June 25, 2004, 9:21:20 AM, Chris Santerre wrote:
> Ok guys, sorry there have been little updates to BE for a while. I have been
> working closely with SURBL project. We have got to the point where BE is now
> generated from ws.surbl.org which is what I have been contributing domains
> to instead of BE. Awaiting for this day. :)

> So we now have BE auto generated from WS.surbl.org...however this is a LOT
> more data! HUGE increase. There are now 2369 rules! 

Thanks for the updates on this Chris.  I'm going to go ahead
and announce the deprecation of be.surbl.org in favor of
ws.surbl.org since ws now contains the old be domains.

I'll leave it to you to announce when BigEvil.cf turns into
the version that has the ws.surbl.org domains in it, and
further down the road when you have a heavily wildcarded
ruleset ready of the entries that can't go into ws.surbl.org.

FWIW I've stopped feeding be.surbl.org domains into
ws.surbl.org and also stopped getting BigEvil.cf and
MidEvil.cf from the rulesemporium server.  If you have
a last version of BigEvil.cf before it turns into the
large version with the ws data, please let me know and
I'll be sure to get the final version.

Jeff C.

Re: [SARE] Bigevil IMPORTANT update/test.

[John Wilcock <jo...@tradoc.fr>]

On Fri, 25 Jun 2004 17:13:03 -0500, Jesse Regier wrote:
> BIGBIGEVIL: generated from the surbl list
> WILDLYEVIL: Wildcard only domains
> 
> and keep BIGEVIL the way it is for a few months or so?
> 
> I am currently using ws.surbl.org and the current BIGEVIL list 
> via rules_du_jour on several servers.  (I wanted to keep the wildcard domains.)
> If a lot of people are doing this they could be taken by surprise when the 
> BIGEVIL list suddelnly gets bigger.

Seconded. I don't use bigevil directly myself any more but I can see
people having a huge evil surprise, particularly if the proposed change
were to happen during the summer with many admins away on holiday
leaving their boxes in the hands of often less experienced backups. 

John.

-- 
-- Over 2400 webcams from ski resorts around the world - www.snoweye.com
-- Translate your technical documents and web pages    - www.tradoc.fr

Re: [SARE] Bigevil IMPORTANT update/test.

[Andy Jezierski <aj...@stepan.com>]

Chris Santerre <cs...@MerchantsOverseas.com> wrote on 06/25/2004
11:21:20 AM:

> I have no idea how this will effect systems under heavy load. Those
systems
> should definitely stay with SURBL as this is just a local regex copy of
it.
> But for those systems that can't/won't use SURBL and want a local copy of
> this larger bigevil here is the link: (~600k)
>

Will you be coming up with a MiniEvil that contains just the wildcard
rules?  Or have all the wildcard sites been added to surbl individually?

Andy

RE: [SARE] Bigevil IMPORTANT update/test.

["Colin A. Bartlett" <sp...@colinabartlett.com>]

Chris Santerre Sent: Friday, June 25, 2004 12:21 PM

> So we now have BE auto generated from WS.surbl.org...however
> this is a LOT more data! HUGE increase. There are now 2369 rules! 

Just curious... Is this larger size to do higher number of domains from more
submissions? Or because the  domains aren't boiled down to as few regex
because it's automatic.

cheers,
Colin

Colin A. Bartlett
Kinetic Web Solutions
www.kineticweb.biz 

Re: [SARE] Bigevil IMPORTANT update/test.

[Jesse Regier <jr...@accesshub.com>]

Wouldn't it make sense to create two new lists

BIGBIGEVIL: generated from the surbl list
WILDLYEVIL: Wildcard only domains

and keep BIGEVIL the way it is for a few months or so?

I am currently using ws.surbl.org and the current BIGEVIL list 
via rules_du_jour on several servers.  (I wanted to keep the wildcard domains.)
If a lot of people are doing this they could be taken by surprise when the 
BIGEVIL list suddelnly gets bigger.

Hey, thanks to you and all the ninjas, for all the good work!!

Jesse

On 25 Jun 2004 at 12:21, Chris Santerre wrote:
> 
> The only updates I've been doing to the regular BE is removing a few FPs. I
> will not officially make this new large file the regular Bigevil for at
> least a week. 

--------------------------------------------------
Jesse Regier              
Computer Systems, Inc.  
(402) 330-3600     
--------------------------------------------------