[Bug 6178] New: some suggestions for URIBL checking to avoid possible FP causes

[bu...@bugzilla.spamassassin.org]

https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6178

           Summary: some suggestions for URIBL checking to avoid possible
                    FP causes
           Product: Spamassassin
           Version: 3.3.0
          Platform: Other
        OS/Version: All
            Status: NEW
          Severity: minor
          Priority: P5
         Component: Plugins
        AssignedTo: dev@spamassassin.apache.org
        ReportedBy: jm@jmason.org


someone from SURBL asked me to make some changes to how our ruleqa nightly
mass-checks work regarding their rules:


> 4. Corpora containing old ham. Domains get re-used by spammers and this is why
> old ham corpora can theoretically cause fp's.

we may need to add a meta rule to check that mail is (relatively)
recent with the URIBL_*_SURBL rules, to avoid that.  good point.

> 5. 127.0.0.2 in example URL's. This loopback IP is a test point IP, and it
> will return hit for all SURBL lists. Therefore this should be flagged only if
> the filter is in test mode.

ok, we should probably remove such messages too, considering that
similar to case #1.

> Our suggestions are:
> 1. Remove ham discussing spam from ham corpora.

not relevant to this bug.

> 2. Use proper name servers. Filters should verify returned RR IP's to match
> 127/8 or 127.0.0.0/24 or selected individual lists codes.

ok, can do that

> 3. Save domains/ip's that cause a trigger in ham.

ditto. 

> 4. Check if domains found in old ham are no longer in the hands of white hats,
> or limit the age of ham.

the latter.

> 5. Don't check 127.0.0.2 in URL's unless the filter is in test mode. Don't
> check any other private IP*.

ok.

-- 
Configure bugmail: https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.