Matt, I do only use filters that work. There are a number of situations however that I believe make it impossible to effectively use only "off the shelf" filters. There are also valid reasons to perform my own analysis of filter effectiveness:
First, everyone's spam mix is different, just as their e-mail mix is different. That's the first thing that Scott and others try to make clear to a newbie who's looking for a canned solution. Second, not everyone class the same things as spam. I have clients who use dating services and others who don't want that type of e-mail. What kind of complaints would you get if you implemented Ipswitch's URL list "as is". I know that I'd have an FP rate that would hurt my effectiveness. I also provide secondary MX services for a number of clients and see a lot of spam attempting to back-door their mail servers. Third, I use many BODY and HEADER filters which range from a few lines to a few thousand lines. These consume a tremendous amount of processing overhead as Scott has pointed out, but I have found them to be the most effective at killing spam. They can be a pain to maintain without a database, ease of updating and dupe checking, automated filter file generation and analysis of effectiveness. Regarding analysis and sequencing of these filters and the use of SKIPIFWEIGHT and END in particular; if I can get 80% of the hits in the first 20% of the entries and eliminate the rest of the unneeded processing, I'd be pretty stupid not to. I was just bemoaning that I'd be giving up some data collection that's been a big help. Thanks to changes that Scott has made lately, at least at a LOGLEVEL HIGH, the ability to effectively use individual log lines for data collection have simplified and enhanced that process. Fourth, I like and use many "single function" filters, particularly Matt Bramble's and I thank him again for the time he has put into them and his generosity for sharing them freely. Every one of my clients has different needs and defines spam differently and the definitions, filters and actions have to reflect this. I, for one, will definitely pass on a "central repository" George > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Matt > Robertson > Sent: Monday, December 22, 2003 6:13 PM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.JunkMail] GIBBERISH 2.0.1, single file > filter with END functionality. functionality. > > > >My quandary now is to decide whether to use the new control > functions > >of SKIPIFWEIGHT, MAXWEIGHT and END to reduce processing > overhead or to > >collect a full set of evaluation data by letting everything > run. It's > >truly a catch-22 situation. > > I came into this thread late, so my comments may not be > strictly on point, but it seems to me the solution to this is > to only use filters that work. Duh, right? In other words > let the community validate and update Filter X and you simply > plug in what you please. > > That means a centralized filter storage, update and > distribution site. We actually aren't so far off that mark > now. Look at Kami Razvan's ftp site and you'll find a > treasure trove of filters there. > > A centralized filter repository would turn analysis of filter > results into an academic exercise to satisfy curiosity, > rather than the general necessity it is today. > > I implemented most of Kami's stuff last week (supplementing > most of the filters already installed that came from Matt > Bramble and the result is a massive surge in my > attach-to-kill ratio (on the kill side). There are so many I > had to aggressively reorganize my global.cfg, but the results > have been splendid, with the most processor-intensive filters > not kicking in unless needed. > > I wrote a ColdFusion routine that downloads my selected > filters, alters them to suit my skip and max weights, and > uploads them to my mail server (the filters are regularly > updated). Anyone who wants a copy let me know. > > > -- > ------------------------------------------- > Matt Robertson, [EMAIL PROTECTED] > MSB Designs, Inc. http://mysecretbase.com > ------------------------------------------- > > -- > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
