SpamTips.org, a website devoted to SpamAssassin Tips (SpamAssassin being the wildly popular open-source spam filter) recently posted a wonderful DNSBL Safety Report, showing hit rates against both spam and non-spam (false positives) for various blacklists commonly used in SpamAssassin.
Interestingly, they specifically warn AGAINST using UCEProtect and the Lashback UBL.
For Lashback's UBL, I'm not so surprised about the results. I don't mean that Lashback's list is broken -- it's just very specifically "IPs of somebody who mailed someone after they unsubscribed and should not have been mailed." There are probably a lot of ISP outbound mail servers that have had individual email messages or intermittent issues with spam emission that meet that criteria. It is probably more appropriate to use it for scoring/vetting reputation in certain scenarios only, moreso than using it to block mail outright.
With UCEProtect, it's disappointing to hear that they have a 1.7% false positive rate as measured against this specific email stream.
I've written about blacklists (and even similarly tracked their effectiveness) over on DNSBL Resource for many years -- so it's very nice to see somebody else doing something similar. The more data, the better, as far as I'm concerned.
SpamTips.org, a website devoted to SpamAssassin Tips (SpamAssassin being the wildly popular open-source spam filter) recently posted a wonderful DNSBL Safety Report, showing hit rates against both spam and non-spam (false positives) for various blacklists commonly used in SpamAssassin.
Interestingly, they specifically warn AGAINST using UCEProtect and the Lashback UBL.
For Lashback's UBL, I'm not so surprised about the results. I don't mean that Lashback's list is broken -- it's just very specifically "IPs of somebody who mailed someone after they unsubscribed and should not have been mailed." There are probably a lot of ISP outbound mail servers that have had individual email messages or intermittent issues with spam emission that meet that criteria. It is probably more appropriate to use it for scoring/vetting reputation in certain scenarios only, moreso than using it to block mail outright.
With UCEProtect, it's disappointing to hear that they have a 1.7% false positive rate as measured against this specific email stream.
I've written about blacklists (and even similarly tracked their effectiveness) over on DNSBL Resource for many years -- so it's very nice to see somebody else doing something similar. The more data, the better, as far as I'm concerned.
(H/T: Box of Meat)
Comments
Post a Comment
Comments policy: Al is always right. Kidding, mostly. Be polite, please and thank you.