You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@spamassassin.apache.org by bu...@bugzilla.spamassassin.org on 2008/11/17 12:00:13 UTC
[Bug 6018] New: FP on ASP dot net
https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6018
Summary: FP on ASP dot net
Product: Spamassassin
Version: 3.2.4
Platform: Other
OS/Version: other
Status: NEW
Severity: enhancement
Priority: P5
Component: Rules
AssignedTo: dev@spamassassin.apache.org
ReportedBy: James.Wilkinson@sparex.co.uk
Hi there.
Microsoft has a technology that they call "ASP net" (except there's a dot in
there instead of a space). SpamAssassin considers (properly) that this may be a
domain, and checks it against URIBLs.
At time of writing, this hits SBL 69554:
dig -t txt +short 126.238.55.65.sbl.spamhaus.org
"http://www.spamhaus.org/SBL/sbl.lasso?query=SBL69554"
This means that anyone mentioning this technology in their e-mails is likely to
have their e-mail blocked. Since it's a Microsoft technology, it's likely to be
mentioned a fair bit.
Would it be possible to add the various dot-NET technologies to the
uribl_skip_domain list in 25_uribl.cf?
Thanks,
James.
--
Configure bugmail: https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
[Bug 6018] FP on ASP dot net
Posted by bu...@bugzilla.spamassassin.org.
https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6018
--- Comment #5 from James Wilkinson <Ja...@sparex.co.uk> 2008-11-17 08:56:21 PST ---
> Well, URIBL_SBL fired for me on the Bugzilla e-mail with Sydney's comment in
> it.
Point being, in case that's not clear, that it looks as though URIBL_SBL *does*
fire if one merely mentions asp.net in text/plain.
--
Configure bugmail: https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
[Bug 6018] FP on ASP dot net
Posted by bu...@bugzilla.spamassassin.org.
https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6018
--- Comment #6 from Sidney Markowitz <si...@sidney.com> 2008-11-17 10:06:45 PST ---
(reply to comment #5)
> Point being, in case that's not clear, that it looks as though
> URIBL_SBL *does* fire if one merely mentions asp.net in text/plain.
Probably because my test environment includes the fixes for bug #5813 and bug
#5780 which are each in review waiting for one more vote (hint, hint) before I
can commit them to the 3.2 branch.
I would not object to adding asp.net to the urible whitelist even if we did
commit those fixes, but it would not be so likely to FP if we did.
--
Configure bugmail: https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
[Bug 6018] FP on ASP dot net
Posted by bu...@bugzilla.spamassassin.org.
https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6018
--- Comment #1 from Justin Mason <jm...@jmason.org> 2008-11-17 03:41:07 PST ---
asp.net is an MSFT property, and shouldn't be spammy. have you reported this
as an FP to spamhaus? it certainly sounds like one!
--
Configure bugmail: https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
[Bug 6018] FP on ASP dot net
Posted by bu...@bugzilla.spamassassin.org.
https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6018
--- Comment #7 from Justin Mason <jm...@jmason.org> 2008-11-17 12:20:55 PST ---
(In reply to comment #6)
> (reply to comment #5)
> > Point being, in case that's not clear, that it looks as though
> > URIBL_SBL *does* fire if one merely mentions asp.net in text/plain.
>
> Probably because my test environment includes the fixes for bug #5813 and bug
> #5780 which are each in review waiting for one more vote (hint, hint) before I
> can commit them to the 3.2 branch.
>
> I would not object to adding asp.net to the urible whitelist even if we did
> commit those fixes, but it would not be so likely to FP if we did.
I wonder if it'd be acceptable to consider them ok, since they haven't been
vetoed in 9 months... ;)
--
Configure bugmail: https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
[Bug 6018] FP on ASP dot net
Posted by bu...@bugzilla.spamassassin.org.
https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6018
--- Comment #4 from James Wilkinson <Ja...@sparex.co.uk> 2008-11-17 06:26:33 PST ---
Created an attachment (id=4391)
--> (https://issues.apache.org/SpamAssassin/attachment.cgi?id=4391)
E-mail showing
Well, URIBL_SBL fired for me on the Bugzilla e-mail with Sydney's comment in
it. I'm attaching that here.
I even checked on a Fedora box running 3.2.5...
1.5 URIBL_SBL Contains an URL listed in the SBL blocklist
[URIs: asp.net]
--
Configure bugmail: https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
[Bug 6018] FP on ASP dot net
Posted by bu...@bugzilla.spamassassin.org.
https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6018
--- Comment #2 from James Wilkinson <Ja...@sparex.co.uk> 2008-11-17 04:22:10 PST ---
Unfortunately, Microsoft do have a fairly large spam problem -- not on the
corporate sites, but from places like spaces live com, livefilestore com, and
hotmail.com. It's currently number 7 on Spamhaus' "World's Worst Spam Service
ISPs" (http://www.spamhaus.org/statistics/networks.lasso).
The problem for URIBL_SBL is that it looks up the nameservers' IP addresses,
and Microsoft use the same nameservers for the main corporate sites and the
infested service-provider sites.
In this case, it looks like a valid listing for live com, but what is actually
listed is ns5 msft net, which is also a nameserver for asp net.
So either Microsoft needs to rearrange its nameservers so its spammy
service-provider operations don't affect the reputation of its corporate sites
(the ideal answer, but good luck persuading them of that), or Spamhaus needs to
stop listing Microsoft sites even though they're currently a major problem (not
likely, and certainly not ideal), or Spamhaus needs to come up with a
traditional URIBL which lists domain names as an alternative way of listing
particular problematic sites.
Or SpamAssassin can special-case the blighters, or we can live with Microsoft
incompetence making their product names look like spam signs.
(In any case, I received no response last time I queried a Spamhaus listing,
presumably because I was neither an ISP representative nor an ISP customer).
--
Configure bugmail: https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
[Bug 6018] FP on ASP dot net
Posted by bu...@bugzilla.spamassassin.org.
https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6018
--- Comment #3 from Sidney Markowitz <si...@sidney.com> 2008-11-17 06:11:48 PST ---
If we know that asp.net is not a domain that will be used in a spam link and
that there will be strings that look like URLs that contain asp.net, then that
by itself could be justification for adding it to the 25_uribl.cf whitelist. If
in addition it causes FPs because the domain is served by the same nameservers
as live.com, then that is just that much more reason to whitelist it.
I agree with James that we can't expect either Microsoft or Spamhaus to change
the policies that are resulting in these FPs.
James, I do have a question: What does the string look like that causes the FP?
How is "asp.net" being used in a way that looks like a URL? Just saying
something about "asp.net" wold not trigger the rule.
--
Configure bugmail: https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
[Bug 6018] FP on ASP dot net
Posted by bu...@bugzilla.spamassassin.org.
https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6018
--- Comment #8 from Sidney Markowitz <si...@sidney.com> 2008-11-17 13:25:36 PST ---
(in reply to comment #7)
> consider them ok, since they haven't been
> vetoed in 9 months... ;)
We could adopt a "pregnant pause" rule that produces one vote 9 months after
the two consenting votes start the process if there is no veto to terminate it
:-)
--
Configure bugmail: https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.