Re: Rule FH_RANDOM_SURE causing FPs

2014-01-17 Thread John Hardin
On Fri, 17 Jan 2014, Axb wrote: pillz with List-Unsubscribe: Hrm. Botched spammer tokenizing. I think that rule could be salvaged if you add a [^@\s]+% onto the end to catch the closing % delimiter, which a valid % email address won't have...

Re: Rule FH_RANDOM_SURE causing FPs

2014-01-17 Thread Axb
On 01/17/2014 04:17 PM, Kevin A. McGrail wrote: On 1/16/2014 11:26 PM, Chip M. wrote: I just checked the last six months of my most diverse corpus, and found: two Ham, zero spam. Both ham were sent via different ESPs, each of mediocre quality though with multiple legitimate (albeit Pakled-y) c

Re: Rule FH_RANDOM_SURE causing FPs

2014-01-17 Thread Kevin A. McGrail
On 1/16/2014 11:26 PM, Chip M. wrote: I just checked the last six months of my most diverse corpus, and found: two Ham, zero spam. Both ham were sent via different ESPs, each of mediocre quality though with multiple legitimate (albeit Pakled-y) customers. One was from "Marriott Rewards" with t

Re: Rule FH_RANDOM_SURE causing FPs

2014-01-16 Thread Chip M.
I just checked the last six months of my most diverse corpus, and found: two Ham, zero spam. Both ham were sent via different ESPs, each of mediocre quality though with multiple legitimate (albeit Pakled-y) customers. One was from "Marriott Rewards" with terse SA report: score=0.9 requi

Re: Rule FH_RANDOM_SURE causing FPs

2014-01-16 Thread Kevin A. McGrail
On 1/16/2014 6:20 PM, Axb wrote: latest 72_scores.cf score FH_RANDOM_SURE1.999 2.920 1.999 2.920 I'd say 0.5 pushes it very low. - can we agree on 1.5? Is it hitting on anything in your corpora?

Re: Rule FH_RANDOM_SURE causing FPs

2014-01-16 Thread Axb
On 01/17/2014 12:16 AM, Kevin A. McGrail wrote: On 1/16/2014 5:20 PM, Axb wrote: On 01/16/2014 11:03 PM, Brian Bebeau wrote: We're having a problem with the FH_RANDOM_SURE rule causing false positives. It has a subrule __ALL_RANDOM, which is: header __ALL_RANDOM ALL =~ /(?:[%\#\[\$

Re: Rule FH_RANDOM_SURE causing FPs

2014-01-16 Thread Kevin A. McGrail
On 1/16/2014 5:20 PM, Axb wrote: On 01/16/2014 11:03 PM, Brian Bebeau wrote: We're having a problem with the FH_RANDOM_SURE rule causing false positives. It has a subrule __ALL_RANDOM, which is: header __ALL_RANDOM ALL =~ /(?:[%\#\[\$]R?A?NDO?M?|\%(?:CUSTOM|FROM|PROXY|X?MESSA|MAKE

Re: Rule FH_RANDOM_SURE causing FPs

2014-01-16 Thread Axb
On 01/16/2014 11:03 PM, Brian Bebeau wrote: We're having a problem with the FH_RANDOM_SURE rule causing false positives. It has a subrule __ALL_RANDOM, which is: header __ALL_RANDOM ALL =~ /(?:[%\#\[\$]R?A?NDO?M?|\%(?:CUSTOM|FROM|PROXY|X?MESSA|MAKE_TXT|FROM_USER))/i We have a user