Re[2]: Effectiveness

[Robert Menschel <Ro...@Menschel.net>]

Hello Matt,

Wednesday, March 23, 2005, 12:47:12 PM, you wrote:

>> extra rules from www.rulesemporium.com/rules, auto updated with 
>> rules_du_jour.
>> make sure the surbl URI-RBL's are active.

M> They are.  Which rule sets should I choose from those below?  This domain is
M> for a small ISP so has a diversity of users.

M> # Here are some of the rulesets included in the 1.12 release:
M> # "MRWIGGLY BIGEVIL TRIPWIRE ANTIDRUG EVILNUMBERS BOGUSVIRUS SARE_ADULT
M> SARE_FRAUD SARE_BML SARE_RATWARE SARE_SPOOF SARE_BAYES_POISON_NXM SARE_OEM
M> SARE_RANDOM SARE_HEADER_ABUSE SARE_CODING_HTML";

I'm not sure what you mean by the 1.12 release -- We don't release
rules files as a family like that.

Looking at the current list at http://www.rulesemporium.com/rules.htm
    * Yes: redir
    * No:  bigevil
    * Yes: evilnumbers
    * Yes: bayes_poison_nxm
    * Some: html
    * Some: header
    * Yes: specific spammers
    * No:  ratware
    * Yes: adult
    * Yes: biz_market_learn
    * Yes: fraud
    * Yes: random
    * Yes: spoof
    * No:  sc_top200 (assuming SURBL and other net tests)
    * Yes: oem
    * Some: genlsubj
    * No:  highrisk
    * Yes: unsub
    * Some: uri

The ones I've marked "Some" have multiple files in side.  I'd suggest
files 0 and 1, and possibly the English file as well.

Looking at http://www.rulesemporium.com/other-rules.htm also use:
    * 99_FVGT_Tripwire.cf  (ver 1.18)
      (Fred -- is this your most current version?)
    * backhair.cf
    * chickenpox.cf
    * weeds_2.cf

Read the documentation in each of these files and decide for yourself.
Each system is different, as are each systems' users.  This set should
be AOK for the generic ISP in the USA, but we make no guarantees.

Bob Menschel