Brad Knowles wrote:
A bit further down:At 3:59 PM -0400 2003/08/13, Chris Lewis wrote:=head2 Listings should be temporary Listings should all be temporary (suggested default listing period: 24 hours L</Footnote1>) so that if your blacklist doesn't get around to removing the entry then it times out at some point in the future.
Fine, but if the entry is removed and then you discover reason to put it back again (maybe because of a re-scan, or whatever), then the next timeout should be longer.
I'd recommend something like a bounded exponential backoff.
Moreover, I think I'd probably move someone from the "confirmed" list to the "probationary" list immediately, then investigate their claims of being cleaned up. They might have to stay on the probationary list for a while before I'd be willing to let them off completely. If they ever came back, they'd stay on the main list a lot longer, have to stay on the probationary list a lot longer the next time they claim to be cleaned-up, etc...We prefer an instant removal and relist upon subsequent re-detection or re-test. Tho, a delay algorithm on removal (initially zero) is reasonable.
Other than that, it seems to be reasonable. I look forward to seeing an expanded version that details tools and methods that can be used to run a real-world black list.I don't think BCPs should get too specific about methods/tools - especially because they're often obsoleted quickly. It's important to get the principles laid out.