Re: [SAtalk] Spammers sneaking lower Bayes scores

[Greg A]

I have an issue with the whole Ham/Spam concept in SpamAssassin. I will define the terms in case you are not aware of the terminolgy used. 

 

Ham=good wanted email

Spam=bad unwanted email

 

SA gives supposed ham lower scores in a few areas, Bayes and auto-whitelist for instance.

 

I believe we should not care about ham at all and we should not attempt to identify ham. Anything that is not spam is by default ham anyway so trying to identify both ham and spam is more difficult and more error prone and expoitable than just trying to identify spam alone - in my opinion.

 

If you feel the same way simply disable all items in SA that can downgrade spam and make it look like and train like ham. For instance, set all bayes tests of 50% and below to a value of zero. Set auto-whitelist to disabled. Also set any SA test values that give a large negative score to zero. This should help make your SA install so that it is not expoitable.

 

I'm sure there are many things you can do to make your SA even more accurate. I have some other tricks but I won't tell you all that I do to custom configure my SA, it is best that we all define our own rules so that spammers always have a moving target. (Look for SA tests in the headers that would have correctly marked your spam and raise those scores for instance.) The nice thing is that the SA developers have made it so that you can customize SA any way you want it. I use SA in a sitewide corp environment.

 

 

 

 

 

Mike Batchelor <[EMAIL PROTECTED]> wrote:

Note the random words within the tags at the end of the spam. I
think they lowered its Bayes score, which dropped it below my threshold
overall. That, and the lack of any other text aside from the links...

Is this tactic likely to succeed for them, rendering our Bayesian
classifiers ineffective? What do you think?

---------- Forwarded Message ----------
Date: Wednesday, June 25, 2003 09:11:40 +0000
From: Octavia Hallee <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
Subject: The most amazing group action ever

Return-Path: <[EMAIL PROTECTED]>
X-Sieve: cmu-sieve 1.3
X-Mail-From: [EMAIL PROTECTED]
X-Relay: [203.2.119.22]
Return-Path: <[EMAIL PROTECTED]>
Received: from eternalserver.com ([203.2.119.22])
by u1.bv.to (8.12.2/8.12.2/20030506a) with SMTP id h5PKlkZK028732
for <[EMAIL PROTECTED]>; Wed, 25 Jun 2003 13:47:46 -0700 (PDT)
Received: (qmail 30393 invoked by uid 501); 25 Jun 2003 09:11:40 -0000
Delivered-To: [EMAIL PROTECTED]
Date: 25 Jun 2003 09:11:40 -0000
Message-ID: <[EMAIL PROTECTED]>
From: "Octavia Hallee" <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
Subject: The most amazing group action ever
Mime-Version: 1.0
Content-Type: multipart/mixed; boundary="----------=_1056574067-5815-191"
X-Spam-Status: No, hits=2.3 req=3.1,
tests=BAYES_40,HTML_70_80,HTML_FONT_COLOR_GRAY,HTML_IMAGE_ONLY_04,HTML_MESS
AGE,HTML_WEB_BUGS,MIME_HTML_ONLY X-Spam-Level: ** (2.3)
X-Scanned-By: MIMEDefang 2.33 (www . roaringpenguin . com / mimedefang)

This is a multi-part message in MIME format...

------------=_1056574067-5815-191
Content-Type: text/html;
charset="us-ascii"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

background="" topmargin="0"> align="center">

href=""> src="" border="0"> href=""> src="" border="0">

>




studs hairiness
miltonic waldo pseudoinstruction RzneXzvxrRzneXongpu.pbzRzneX
monocotyledon conceals rickshaws raising lutheranizers gels modulating
cautions bowed verbally storeyed tormenting dairy pruners height

------------=_1056574067-5815-191--

---------- End Forwarded Message ----------



---
"The avalanche has already begun. It is too late for the pebbles to vote."
-- Kosh


-------------------------------------------------------
This SF.Net email is sponsored by: INetU
Attention Web Developers & Consultants: Become An INetU Hosting Partner.
Refer Dedicated Servers. We Manage Them. You Get 10% Monthly Commission!
INetU Dedicated Managed Hosting http://www.inetu.net/partner/index.php
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk

---

Do you Yahoo!?
The New Yahoo! Search - Faster. Easier. Bingo.