RulesDuJour Recommendation

[Joey <Jo...@Web56.Net>]

Hello everyone,
 
As I'm sure you are aware the spam these days seems to be getting worse.
In an attempt to be more aggressive we started using RulesDuJour.
What I would like to know is which rules are you using without too much
headache so that we can implement them into our configuration.
I didn't want to load them all because I felt that it may be too aggressive
and cause many client complaints.
 
Also if you have found any solutions for the recent barrage of image spam I
would appreciate you sharing them with me.
 
Thanks!!!
 
Joey
 

Re: RulesDuJour Recommendation

[Matt Kettler <mk...@evi-inc.com>]

Joey wrote:
> Hello everyone,
>  
> As I'm sure you are aware the spam these days seems to be getting worse.
> In an attempt to be more aggressive we started using RulesDuJour.
> What I would like to know is which rules are you using without too much
> headache so that we can implement them into our configuration.
> I didn't want to load them all because I felt that it may be too aggressive
> and cause many client complaints.
>  
> Also if you have found any solutions for the recent barrage of image spam I
> would appreciate you sharing them with me.
>  

My only advice is do not use RDJ for antidrug if you're using SA 3.0.0 or
higher. The antidrug.cf file is only for users of SA 2.6x and older, and the
rules are built into 3.0.0 and newer.

Re: RulesDuJour Recommendation

[Loren Wilton <lw...@earthlink.net>]

> I am, and have been for a while, using SARE_REDIRECT_POST300 SARE_HTML
> SARE_BAYES_POISON_NXM TRIPWIRE EVILNUMBERS SARE_RANDOM SARE_WHITELIST
> SARE_OBFU SARE_STOCKS SARE_SPOOF to good effect (though someone will
> probably tell me that at least one of those is no longer advisable).

Nope, all still good rulesets.  EvilNumbers isn't updated as often as it
really should be these days (I think), but they are all still live rulesets.

        Loren

Re: RulesDuJour Recommendation

[Craig McLean <cr...@fukka.co.uk>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Joey wrote:
> Hello everyone,
>  
> As I'm sure you are aware the spam these days seems to be getting worse.
> In an attempt to be more aggressive we started using RulesDuJour.
> What I would like to know is which rules are you using without too much
> headache so that we can implement them into our configuration.
> I didn't want to load them all because I felt that it may be too aggressive
> and cause many client complaints.
>  
> Also if you have found any solutions for the recent barrage of image spam I
> would appreciate you sharing them with me.

I am, and have been for a while, using SARE_REDIRECT_POST300 SARE_HTML
SARE_BAYES_POISON_NXM TRIPWIRE EVILNUMBERS SARE_RANDOM SARE_WHITELIST
SARE_OBFU SARE_STOCKS SARE_SPOOF to good effect (though someone will
probably tell me that at least one of those is no longer advisable).
I also have a bunch of homebrew rules which add weigh to the specific
types of spam I see here. They're on the website below if your interested.

If you are getting a lot of pump-and-dump stock/microcap image spam, I
can heartily recommend SARE_STOCKS. It's a masterpiece.

C.


- --
Craig McLean		http://fukka.co.uk
craig@fukka.co.uk	Where the fun never starts
	Powered by FreeBSD, and GIN!
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQFD6fHuMDDagS2VwJ4RAtCtAKDwILYsdZOAu0urBJ7pN2ZlqOHE1wCdGUPd
6vGN6heBBMSEUtKA755v8rE=
=tQw7
-----END PGP SIGNATURE-----