On Thu, 21 Jun 2007 03:30:00 -0400, "Daryl C. W. O'Shea"
wrote:

>Nigel Frankcom wrote:
>
>> I've been getting the same for weeks. I ended up manually updating
>> rules; especially the stock one since more and more seem to be
>> slipping through.
>>=20
>> The problems seemed to start after the DDoS on rulesemporium; since
>> then I've not been able to get any sense out of it via RDJ.
>>=20
>> When I manually update it all lint's clean. Time consuming but it
>> works

>
>Note that there haven't been any updates to 70_sare_stocks.cf since May=20
>7th and no updates at all since June 5th, so manual updates probably=20
>aren't worth the bother.
>
>Daryl
>
>
>[dos@wally channels]$ ls -l | grep -P "May|Jun"
>drwxrwxr-x 2 dos dos 4096 May 21 10:14 70_sare_adult.cf
>drwxrwxr-x 2 dos dos 4096 Jun 5 11:14 70_sare_obfu.cf
>drwxrwxr-x 2 dos dos 4096 Jun 4 21:14 70_sare_obfu0.cf
>drwxrwxr-x 2 dos dos 4096 Jun 4 21:14 70_sare_obfu1.cf
>drwxrwxr-x 2 dos dos 4096 May 7 00:24 70_sare_stocks.cf
>drwxrwxr-x 2 dos dos 12288 May 24 12:14 70_sc_top200.cf
>drwxrwxr-x 2 dos dos 4096 May 21 10:14 72_sare_bml_post25x.cf
>[dos@wally channels]$


It's good to know there's been no updates; though I'd guessed that
from the file time stamps on rulesemporium.

There still seems to be a problem with RDJ though. It looks like it's
pulling an entire page not just rules; I can't see any other reason
for the etc elements in the debug.

I'm still curious as to why so many stock spam are getting through (so
many being relative to normal). On the surface they don't look any
different from those that have been caught for ages.

Samples available if required.

Kind regards

Nigel