spamassassin-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From m@khonji.org
Subject Re: How do I get delisted from SORBS? [OT]
Date Fri, 08 Oct 2010 23:58:31 GMT
> It differs because I am saying they *should* remain listed forever.

False positives are far worst than false negatives for businesses. Some blacklists do not
tolerate a FP of more than 1%.

Blacklists are behind the line as they don't fight zero-hour attacks, and the only reason
why blacklists are appeasing is really their low FP rate. This is why Google made a blacklist
to fight phish and malware --- Google wanted FP that is well below 1% (0.04% IIRC)

A blacklist with high FP, such as SORBS, is no use. We'd better use heuristics, at least we
can fight zero hour attacks with <= FP rate.

My 0.02.


---
Mahmoud Khonji

Mime
View raw message