Re: [SAtalk] False Negative Corpus

2002-11-22 Thread Kenneth Porter
--On Friday, November 22, 2002 4:36 PM -0500 Vivek Khera <[EMAIL PROTECTED]> wrote: > I think it is about as useful as reporting virii missed by several > months old antivirus software... SA has advanced significantly since > 2.31, and spam has evolved since then too. I ran his corpus through my

Re: [SAtalk] False Negative Corpus

2002-11-22 Thread Matt Kettler
Agreed, using 2.31 isn't a particularly useful baseline. But the data may be somewhat useful. It's not hard to run a mass check against this with 2.43 and screen out the ones that are still FN. I'll try doing that when I have a chance, and try to post some statistics, and maybe make the result

Re: [SAtalk] False Negative Corpus

2002-11-22 Thread Vivek Khera
> "MB" == Mathew Binkley <[EMAIL PROTECTED]> writes: MB> Hi everyone. I've been putting Spamassassin 2.31-16 through it's paces MB> using the never-ending source of spam that is Hotmail. I have been [ ... ] MB> I hope it's of use to the SA guys. I think it is about as useful as reporting

[SAtalk] False Negative Corpus

2002-11-22 Thread Mathew Binkley
Hi everyone. I've been putting Spamassassin 2.31-16 through it's paces using the never-ending source of spam that is Hotmail. I have been using Gotmail to fetch my email and pipe it through SA. I have been using the RedHat 8.0 defaults (spamassassin score > 5 = spam). In four weeks I have re

Re: *****SPAM***** [SAtalk] false negative

2002-11-18 Thread Claudio Clemens
On Mon, Nov 18, 2002 at 02:33:23PM -0600, Jon Gabrielson wrote: > SPAM: Start SpamAssassin results > SPAM: 7.6 hits, 5 required; > SPAM: * -0.5 -- BODY: Contains 'Dear Somebody' > SPAM: * 2.5 -- BODY: Por Apenas muita grana > SPAM: * 2.7 -- BODY: Claims you can be removed from the list > SPA

[SAtalk] false negative

2002-11-18 Thread Jon Gabrielson
Here is a false negative i received today. I already reported it to razor. Is this the best place to report it for spamassassin? Jon. --- Begin Message --- Dear Sirs/Madam We found your company on www.directfreight.com's website and believe that our Hong Kong Fax Line service will assist your c

Re: [SAtalk] false negative and suggestion for new test.

2002-11-08 Thread Theo Van Dinter
On Fri, Nov 08, 2002 at 06:54:20PM -0600, Jon Gabrielson wrote: > Reply to: [EMAIL PROTECTED] > > Anyways, This would probably be a good > blacklist address to add because I can't > imagine it ever being a valid reply address. > opt-out maybe, but not opt-in FYI: In 2.50, there's a rule that ca

[SAtalk] false negative and suggestion for new test.

2002-11-08 Thread Jon Gabrielson
I have started to receive alot of spams with Reply to: [EMAIL PROTECTED] I assume it is a way to attempt to legally say: "when they replied and asked to be removed we thought they were opting in" Anyways, This would probably be a good blacklist address to add because I can't imagine it ever

Re: [SAtalk] false negative

2002-01-21 Thread Justin Mason
dman said: > On Mon, Jan 21, 2002 at 03:50:15PM +1100, Justin Mason wrote: > | dman said: > | > | > A spam got through, but this addition catches it : > | > > | > header INVALID_DATE_STAR Date =~ /\*+/ > | > describeINVALID_DATE_STAR Date: contains '*' > | > score INVALID_DAT

Re: [SAtalk] false negative

2002-01-21 Thread dman
On Mon, Jan 21, 2002 at 03:50:15PM +1100, Justin Mason wrote: | dman said: | | > A spam got through, but this addition catches it : | > | > header INVALID_DATE_STAR Date =~ /\*+/ | > describeINVALID_DATE_STAR Date: contains '*' | > score INVALID_DATE_STAR 3.2 | > | | could

Re: [SAtalk] false negative

2002-01-20 Thread Justin Mason
dman said: > A spam got through, but this addition catches it : > > header INVALID_DATE_STAR Date =~ /\*+/ > describeINVALID_DATE_STAR Date: contains '*' > score INVALID_DATE_STAR 3.2 > could you forward the spam on? That's a wierd one. --j. ___

Re: [SAtalk] false negative

2002-01-19 Thread Olivier M.
On Sat, Jan 19, 2002 at 01:13:05PM -0500, dman wrote: > bodyDEAR_SIR_MADAM_b/Dear Sir\/Madam:/ > describeDEAR_SIR_MADAM_bMessage contains "Dear Sir/Madam:" > score DEAR_SIR_MADAM_b2.0 Mmm, it would catch many of my "non-spam" mails... So ok, but with a score of 0.5 m

Re: [SAtalk] false negative

2002-01-19 Thread dman
On Sat, Jan 19, 2002 at 01:13:05PM -0500, dman wrote: | While we're in the business of tagging junk mail, this helps too, | sometimes. (obviously it doesn't work with mime or html messages) | | bodyBLANK_MESSAGE /^(\w)*$/ | describeBLANK_MESSAGE The message has no contents. | s

[SAtalk] false negative

2002-01-19 Thread dman
A spam got through, but this addition catches it : bodyDEAR_SIR_MADAM_b/Dear Sir\/Madam:/ describeDEAR_SIR_MADAM_bMessage contains "Dear Sir/Madam:" score DEAR_SIR_MADAM_b2.0 header DEAR_SIR_MADAM_tTo =~ /Dear Sir\/Madam/ describeDEAR_SIR_MADAM_tT