Re: [Declude.JunkMail] Sniffer vs. SURBL

[Darrell \([EMAIL PROTECTED])]

Title: Message

I think the one thing that keeps being overlooked is that URI lists such as SURBL have an advantage in catching very new spam since the listing of those URI's are very close to real time.  While Sniffer is the most effective test on my system I see a lot of SPAM that Sniffer does not catch that is caught against the SURBL lists.  I suspect that much of the SPAM that it(SURBL URI) catches occurs during the hours between new rule bases although I have no way to quantify that easily.   I find it odd how much you appear to be against SURBL URI checking.  If the SURBL URI lists help catch spam that was otherwise not being caught doesn't that make it worth using it?  I know it does for me.  This is nothing more than another tool to add to one's arsenal to combat spam.   Darrell   ----- Original Message ----- From: Matt To: Declude.JunkMail@declude.com Sent: Sunday, January 09, 2005 5:16 PM Subject: Re: [Declude.JunkMail] Sniffer vs. SURBL Andy, Again, Sniffer generally tags over 96% of all spam on my system.  That only leaves 4% that could possibly be tagged by something else that Sniffer didn't hit.  It is not likely that you are seeing 11% that isn't caught with Sniffer that is being caught with the URIBL app.  There is a small chance that Sniffer is having difficulties of some sort, or something way out of the ordinary is occurring for you to have generated those numbers, but it is impossible under ordinary conditions. Are you sure that you don't have something configured that skips Sniffer after a certain weight is reached? Matt Andy Schmidt wrote: Hi Matt:   >> Second, Sniffer does cross checking with SURBL for creating new rules of certain types <<   Which means once THEY see a URL they use SURBL to RESEARCH it.   Obviously, that leaves any URLs that THEY have not yet seen (both other people have).  There are an unknown number of URLs in SURBL that Sniffer has not yet encountered, thus couldn't research it...   As far as something being wrong... You are entitled to your opinion.   Sniffer is working great here - but it's not 100% effective in my environment.  I'm happy it is in your's and that you don't need to run any other tests.   My declude is set up so that any message that fails a combination of OTHER tests but didn't fail SNIFFER get's a certain header flag, which then get "flagged" in Outlook for easy recognition.  And just for my personal mailbox alone, I probably see 5 to 10 messages each day that Sniffer did NOT yet tag.  I have no reason to get into an argument with you. Whether you doubt my experience or not - but it doesn't change MY experience. Best Regards Andy Schmidt Phone:  +1 201 934-3414 x20 (Business) Fax:    +1 201 934-9206 -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Matt Sent: Sunday, January 09, 2005 03:20 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Sniffer vs. SURBL Let me re-summarize because I think that both you and Andy misunderstood different elements of what I said. First, Sniffer doesn't miss 11% of spam unless there was something wrong.  The stats provided were likely inaccurate for one reason or another. Second, Sniffer does cross checking with SURBL for creating new rules of certain types, though I'm not sure what the totality of the lists used.  One should be aware of the potential of double hitting based on pretty much the same data and weight accordingly. Matt Bill Landry wrote: ----- Original Message ----- From: "Matt" <[EMAIL PROTECTED]> My fault for mixing up names in this case. I was thinking about the combined URIBL zone and not your version of the checker. The issue that I was really intending to speak to was the combined zone (multi.surbl.org) that some people are using over SURBL alone. Multi is a bit-masked URIBL. It will return a single response for a single test match or multiple test match. The only difference in using multi versus the individual tests is a single query versus multiple. If you don't want to use all of the tests available via multi, don't define them all. Bill --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. -- ===================================================== MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ ===================================================== -- ===================================================== MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ =====================================================