<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div class="">Please be aware that my understanding is of the general principles employed by the various Spamhaus block lists. I have no role in compiling the block lists — that is the remit of a completely different team. I can talk to the generalities but not to specifics as I have no more insight into specifics than anyone else with access to the Spamhaus Projects' Blocklist Removal Centre at <<a href="https://www.spamhaus.org/lookup/" class="">https://www.spamhaus.org/lookup/</a>>.</div><div class=""><br class=""></div><div class="">And I’ll decline to post the rest of my reply following the abuse up thread.</div><div class=""><br class=""></div><div class="">All the best</div><div class=""><br class=""></div><div class="">Simon</div><div class=""><br class=""></div><br class=""><div><blockquote type="cite" class=""><div class="">On 30 Jan 2017, at 09:39, Simon Forster <<a href="mailto:simon-lists@ldml.com" class="">simon-lists@ldml.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class=""><br class=""><blockquote type="cite" class="">On 30 Jan 2017, at 06:13, ox <<a href="mailto:andre@ox.co.za" class="">andre@ox.co.za</a>> wrote:<br class=""><br class="">Hello All,<br class=""><br class="">May I please solicit some comments about Abuse Block lists<br class="">(Without detracting from RFC 5782 and RFC 6471 or :<br class=""><a href="https://www.ripe.net/publications/docs/ripe-409" class="">https://www.ripe.net/publications/docs/ripe-409</a> )<br class=""><br class="">Firstly, the background for the start of this thread is simply: As the<br class="">use of machine learning technology is now also applied and adapted for<br class="">the use of cyber criminals (including spammers, scammers, etc) the<br class="">rules and what is socially acceptable is and has changed. Global<br class="">politics, protectionism, nationalism and the other 'isms' are also<br class="">causing change.<br class=""><br class="">Considering that DNSBL tech is "reactive" (after he abuse)<br class=""></blockquote><br class="">This statement appears to be exclusionary — and is one often levelled against DNSBLs. All DNSBLs are not wholly reactive.<br class=""><br class="">Firstly, one needs to acknowledge that all DNSBLs are not they same.<br class=""><br class="">Secondly, some listings in some DNSBLs are proactive. i.e. Made before abuse is seen. As I work for the commercial arm of Spamhaus, I know their offerings quite well and can confidently state that some of the Spamhaus block lists contain proactive and/or precautionary listings. I imagine SURBL does likewise. Other block lists probably have similar policies / inputs.<br class=""><br class="">Simon<br class=""><br class=""><br class=""><blockquote type="cite" class="">The block time policies of RBLs <br class="">***********************************<br class="">There are two main types of block lists: No automatic removal and<br class="">automatic removal<br class=""><br class="">Is the policy to auto de-list after a period of time, still accurate? <br class=""><br class="">Considering the change in abuse patterns and technology, should the<br class="">block times be increased or de-creased?<br class=""><br class="">Does society require more specialist non auto de-list DNSBLs?<br class="">(Would it be helpful to law enforcement to have a "child pornography"<br class="">dnsbl? or a phish dnsbl? - or is the reactive time to high in order<br class="">for dynamic ipv4? - but on ipv6 allocations to devices could be more<br class="">'permanent'? etc)<br class=""><br class="">Andre</blockquote></div></div></blockquote></div></body></html>