[sanesecurity] Re: Signature database available for testing...
- From: Bill Landry <bill@xxxxxxxxxxx>
- To: sanesecurity@xxxxxxxxxxxxx
- Date: Mon, 25 May 2009 19:33:25 -0700
jef moskot wrote:
> On Fri, 22 May 2009, Bill Landry wrote:
>> In the past 1.5 days here:
>> 1 HTML.Iframe-32
>> 1 MSRBL-Images.4-0-wx
>> 1 Sanesecurity.Casino
>> 1 Sanesecurity.Job
>> 1 Sanesecurity.Scam4
>> 2 Exploit.HTML
>> 2 Phishing.Heuristics
>> 3 Sanesecurity.Phishing
>> 3 Sanesecurity.ScamL
>> 13 Sanesecurity.SpamImg
>> 36 JS.Redirect-2
>> 38 Sanesecurity.Hdr
>> 221 Sanesecurity.Jurlbl
>> 392 Sanesecurity.Spam
>> 482 Sanesecurity.Junk
>> 551 INetMsg.Email
>
> This looks good. Have any of the testers experienced false positives?
>
> Is the list intended for outright blocking or for scoring?
Well, several sites are using it, and I haven't gotten any fp reports
either on-list or off-list. However, my personal opinion is that no
list should ever be used for outright blocking. I would recommend using
it in a scoring system. But try it out and see what you think.
It should be available via the Sanesecurity rsync servers very soon...
Bill
Other related posts:
