[Bug 6142] New: skip_rbl_checks does not disable commercial surbl/uribl queries

https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6142

           Summary: skip_rbl_checks does not disable commercial
                    surbl/uribl queries
           Product: Spamassassin
           Version: 3.2.5
          Platform: Other
               URL: http://www.mail-archive.com/users@....
                    org/msg27843.html
        OS/Version: All
            Status: NEW
          Severity: normal
          Priority: P5
         Component: Plugins
        AssignedTo: dev@...
        ReportedBy: dreas@...


We've enabled skip_rbl_checks on a low volume email filtering box running
SpamAssassin, assuming this would skip all DNSBL checks. We suddenly received a
warning email from URIBL that we would be blocked if we would continue to query
their list, and that we're required to pay for a datafeed. SURBL also recently
indicated they're going to become strict on policies and will start pushing
their commercial datafeed. We can easily disable the URIBL/SURBL queries now we
are aware of them of course, but it really seems like a bug that they're
queried at all.

I've read in the various discussions that this behavior is on purpose, however
I don't think the opensource SpamAssassin product should be used as a marketing
vehicle for such commercial projects, and would at least expect skip_rbl_checks
to skip the rbl checks.

--
Configure bugmail: https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6142


Tony Meyer <tony@...> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |tony@...




--
Configure bugmail: https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6142





--- Comment #1 from Justin Mason <jm@...>  2009-07-01 02:35:02 PST ---
this is a bit crappy alright.  Even if "skip_rbl_checks" doesn't turn off URIBL
querying, we should at least add a "skip_uribl_checks" similarly and refer to
it in the skip_rbl_checks documentation.

--
Configure bugmail: https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6142





--- Comment #2 from AXB <alex.uribl@...>  2009-07-01 02:35:10 PST ---
(In reply to comment #0)
> We've enabled skip_rbl_checks on a low volume email filtering box running
> SpamAssassin, assuming this would skip all DNSBL checks. We suddenly received a
> warning email from URIBL that we would be blocked if we would continue to query
> their list, and that we're required to pay for a datafeed. SURBL also recently
> indicated they're going to become strict on policies and will start pushing
> their commercial datafeed. We can easily disable the URIBL/SURBL queries now we
> are aware of them of course, but it really seems like a bug that they're
> queried at all.

neither SURBL nor URIBL.COM are commercial services. As with Spamhaus, if you
are a heavy traffic and/or commercial site you should get a datafeed as you are
obviously abusing donated resources. This permits the BLs continue offering a
free service to the smaller, low traffic sites.

Why should anybody donate his time/bandwidth/cpu cycles so you can "sell the
queries" for your spam filtering service?
Its only fair you share the costs incurred in running BLs or run your own.


> I've read in the various discussions that this behavior is on purpose, however
> I don't think the opensource SpamAssassin product should be used as a marketing
> vehicle for such commercial projects, and would at least expect skip_rbl_checks
> to skip the rbl checks.


You can disable whatever BLs you require by setting the score to 0

--
Configure bugmail: https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6142


Justin Mason <jm@...> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|Undefined                   |3.3.0




--- Comment #3 from Justin Mason <jm@...>  2009-07-01 02:35:38 PST ---
not sure if this is going to happen before 3.3.0 without a patch, but let's
target it anyway

--
Configure bugmail: https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6142





--- Comment #4 from Dreas van Donselaar <dreas@...>  2009-07-01 02:45:18 PST ---
Just to make that clear, I completely understand that they want to charge
commercial companies / heavy query users to be able to fund the service.
Nothing wrong with that. But now it looks like some "hidden" feature resulting
in me being "spammed" with a commercial request :) That's why we had the public
rbl checks skipped in the first place (or at least we thought so).

I'll try to see if I can get a patch written by someone.

--
Configure bugmail: https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6142





--- Comment #5 from Justin Mason <jm@...>  2009-07-01 03:43:01 PST ---
(In reply to comment #2)
> You can disable whatever BLs you require by setting the score to 0

this isn't the most usable way to deal with the problem, btw.  it requires
keeping up-to-date with the names of the BLs, future changes etc.

--
Configure bugmail: https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6142





--- Comment #6 from AXB <alex.uribl@...>  2009-07-01 04:02:14 PST ---
(In reply to comment #5)
> (In reply to comment #2)
> > You can disable whatever BLs you require by setting the score to 0
>
> this isn't the most usable way to deal with the problem, btw.  it requires
> keeping up-to-date with the names of the BLs, future changes etc.

100% agreed but there's hasn't been a better option.
As SA includes a load of BLs which may or not be wanted and most are enabled by
default, keeping track has become part of regular management routine.

with  the URI lists in mind, a "skip_uribl_checks" would be a a great addition.

--
Configure bugmail: https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6142





--- Comment #7 from Tony Meyer <tony@...>  2009-07-01 04:14:35 PST ---
(In reply to comment #6)
> (In reply to comment #5)
> > this isn't the most usable way to deal with the problem, btw.  it requires
> > keeping up-to-date with the names of the BLs, future changes etc.
>
> 100% agreed but there's hasn't been a better option.
> As SA includes a load of BLs which may or not be wanted and most are enabled by
> default, keeping track has become part of regular management routine.

ISTM (disclaimer: I work with the OP), that having a central option to turn off
*all* lists is worthwhile, though, for those that just want the other SA
features.  If you're picking and choosing your lists, then sure you'll have to
keep up to date and the score=0 solution is perhaps good enough.  Like Justin
said, it seems a lot if you just want to turn them all off.

For me, the name "skip_rbl_checks" implies "skip all rbl checks", rather than
"skip some rbl checks" (yes, this is an assumption).  I think it's reasonable
to think that other people would think that too, and that it would be
reasonable behaviour for the option.

However, I'd be just as happy with a set of options that turn off the various
checks in bulk, and cross-references in the documentation of the options.

The documentation for "skip_rbl_checks" says:

 skip_rbl_checks ( 0 | 1 ) (default: 0)
        By default, SpamAssassin will run RBL checks. If your ISP already
        does this for you, set this to 1.

If that also said "you'll need to set the score=0 for the SURBL and URIBL
checks as well", that would address 95% of this issue, IMO.

--
Configure bugmail: https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6142





--- Comment #8 from Dallas Engelken <dallase@...>  2009-07-01 06:57:57 PST ---
(In reply to comment #4)
>.But now it looks like some "hidden" feature resulting
> in me being "spammed" with a commercial request :)

Really, spammed?  Would you rather have not received the abuse report?  Would
you rather have dns timeouts in spamassassin and not know why?

The ACL notification email is hardly a commercial request.  It gives you all
the options from disabling the lookups, to decreasing volume, to datafeed
service.

Since you are the "spamexperts.com", you should have known what rules are
running and firing against your customers email.  Seeing URIBL_* or SURBL_*
hits in the logs should have been your first clue that you werent skipping the
tests.

Let me suggest to you...
http://www.rulesemporium.com/programs/sa-stats-1.0.txt

--
Configure bugmail: https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6142





--- Comment #9 from Dreas van Donselaar <dreas@...>  2009-07-02 00:14:37 PST ---
(In reply to comment #8)
> (In reply to comment #4)
> >.But now it looks like some "hidden" feature resulting
> > in me being "spammed" with a commercial request :)
>
> Really, spammed?  Would you rather have not received the abuse report?  Would
> you rather have dns timeouts in spamassassin and not know why?
I was being sarcastic. In this situation I was happy I received your email of
course to be informed of this unexpected SA behavior.

--
Configure bugmail: https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6142





--- Comment #10 from Billy Vierra <bvierra@...>  2009-08-19 03:30:57 PST ---
Created an attachment (id=4520)
 --> (https://issues.apache.org/SpamAssassin/attachment.cgi?id=4520)
Should add skip_uridnsbl_checks

This should add the config option skip_uridnsbl_checks if I was reading the
code correctly :)

--
Configure bugmail: https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6142


Billy Vierra <bvierra@...> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |bvierra@...




--
Configure bugmail: https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6142





--- Comment #11 from Justin Mason <jm@...>  2009-08-19 05:27:10 PST ---
(In reply to comment #10)
> Created an attachment (id=4520)
 --> (https://issues.apache.org/SpamAssassin/attachment.cgi?id=4520) [details]
> Should add skip_uridnsbl_checks
>
> This should add the config option skip_uridnsbl_checks if I was reading the
> code correctly :)

looks likely, but the patch is an RTF file! could you reattach as plain text?

--
Configure bugmail: https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6142





--- Comment #12 from Billy Vierra <bvierra@...>  2009-08-19 15:04:36 PST ---
Created an attachment (id=4521)
 --> (https://issues.apache.org/SpamAssassin/attachment.cgi?id=4521)
non rtf format

this is what happens when I program at 4am... oops

--
Configure bugmail: https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6142

Mark Martinec <Mark.Martinec@...> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|                            |FIXED

--- Comment #13 from Mark Martinec <Mark.Martinec@...> 2009-10-30 08:10:30 UTC ---
Bug 6142: add a config parameter skip_uribl_checks to the
URIDNSBL plugin, cross-document it with skip_rbl_checks.
Sending        lib/Mail/SpamAssassin/Conf.pm
Sending        lib/Mail/SpamAssassin/Plugin/URIDNSBL.pm
Committed revision 831320.

--
Configure bugmail: https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.