Re: Spam Eating Monkey causing 100% false positives for large institutions

2011-03-23 Thread Karsten Bräckelmann
On Wed, 2011-03-23 at 11:08 -1000, Warren Togami Jr. wrote: > On 3/23/2011 10:58 AM, Karsten Bräckelmann wrote: > > Ugh, nasty boy. ;) You do realize they wouldn't be hammering the SEM > > DNS servers, if testrules wouldn't have slipped out accidentally -- by > > sa-update. > > > > Personally, I'

Re: Spam Eating Monkey causing 100% false positives for large institutions

2011-03-23 Thread Warren Togami Jr.
On 3/23/2011 10:58 AM, Karsten Bräckelmann wrote: On Wed, 2011-03-23 at 10:18 -1000, Warren Togami Jr. wrote: On 3/23/2011 7:38 AM, Blaine Fleming wrote: In the recent sa-updates, the Spam Eating Monkey rules were inappropriately enabled. [...] As soon as the bug was reported on the dev lis

Re: Spam Eating Monkey causing 100% false positives for large institutions

2011-03-23 Thread Karsten Bräckelmann
On Wed, 2011-03-23 at 10:18 -1000, Warren Togami Jr. wrote: > On 3/23/2011 7:38 AM, Blaine Fleming wrote: > > > In the recent sa-updates, the Spam Eating Monkey rules were > > > inappropriately enabled. [...] > > As soon as the bug was reported on the dev list I disabled the > > 127.0.0.255 respo

Re: Spam Eating Monkey causing 100% false positives for large institutions

2011-03-23 Thread Warren Togami Jr.
On 3/23/2011 7:38 AM, Blaine Fleming wrote: On 3/23/2011 9:56 AM, dar...@chaosreigns.com wrote: In the recent sa-updates, the Spam Eating Monkey rules were inappropriately enabled. If you hit them too much, they start returning 100% false positives. Their listed limits are "more than 100,000 q

Re: Spam Eating Monkey causing 100% false positives for large institutions

2011-03-23 Thread RW
On Wed, 23 Mar 2011 11:56:25 -0400 dar...@chaosreigns.com wrote: > In the recent sa-updates, the Spam Eating Monkey rules were > inappropriately enabled. If you hit them too much, they start > returning 100% false positives. On the bright side, anyone getting 100% false positives on any test ha

Re: Spam Eating Monkey causing 100% false positives for large institutions

2011-03-23 Thread darxus
On 03/23, Blaine Fleming wrote: > As soon as the bug was reported on the dev list I disabled the > 127.0.0.255 response code to avoid any additional issues. I will be That was very kind of you. > 3AM. Personally, I don't think it is unreasonable to start returning > this response code for someo

Re: Spam Eating Monkey causing 100% false positives for large institutions

2011-03-23 Thread Blaine Fleming
On 3/23/2011 9:56 AM, dar...@chaosreigns.com wrote: > In the recent sa-updates, the Spam Eating Monkey rules were > inappropriately enabled. If you hit them too much, they start returning > 100% false positives. Their listed limits are "more than 100,000 queries > per day or more than 5 queries p

Spam Eating Monkey causing 100% false positives for large institutions

2011-03-23 Thread darxus
In the recent sa-updates, the Spam Eating Monkey rules were inappropriately enabled. If you hit them too much, they start returning 100% false positives. Their listed limits are "more than 100,000 queries per day or more than 5 queries per second for more than a few minutes". To disable them, ad