Jennifer Thanks for the response.
A good point with respect to the on/off nature of some of the rule sets. More info for the FAQ? I had been directed at your site and have installed those rules recommended by Bob Menschel. I wish to say a thank you to all the sa rules contributors for your contributions. It would take me a long time to come up with these myself and its definitely not my area of expertise. I've been having a private mail conversation with Bob this evening and the sven virus issue was easily resolved. Just as case of setting a different score for MICROSOFT_EXECUTABLE and me doing a some reading of the manual (that nearly always helps). regards Alan -----Original Message----- From: jennifer [mailto:[EMAIL PROTECTED] Sent: 23 November 2003 23:47 To: 'Alan Munday'; [EMAIL PROTECTED] Subject: RE: [SAtalk] Rules, rules and more rules Hi Alan > -----Original Message----- > From: [EMAIL PROTECTED] [mailto:spamassassin- > [EMAIL PROTECTED] On Behalf Of Alan Munday > Sent: Sunday, November 23, 2003 6:03 PM > To: [EMAIL PROTECTED] > Subject: RE: [SAtalk] Rules, rules and more rules > > Thanks to all who responded to me with hints and suggestions. > > I had seen all the web sites mentioned but had not completely understood > how > they all fitted together. Maybe a topic for the FAQ? > > I've tried adding a fair number of rules and, noting comments made, had > the > notion of asking if it would be a good idea if authors quoted the target > hit > values that their rules were designed for? If people knew what the target > the scores in the rules have been designed for they could be easily > recalculated by anyone for their own target. A good suggestion. I would guess though that everyone's spam limits don't vary terribly, and you can kind of guess if scores should be tweaked based on whether or not you've changed the default level for spam. I think it's best if when you add custom rules, set (or change) the scores to something low while you test them out in your environment. Then you can best determine the scores needed to get the effect you want out of the rules you're adding. I can tell you that the rule sets I shared are, for the most part, hit or miss. (popcorn etc) ..meaning big chunka score, or nothing, since they are based on techniques. So I would just leave the scores as is on those, or you can pay attention to which ones hit with greater frequency (you'll see the ones I'm talking about.) and raise those if you like. My 'personal-use' popcorn rules have varying scores, because spammer behavior seems to be a little pavlovian, and certain of them (rules in the set) will hit quite often. The sets I'm talking about are here in case you missed them. http://www.emtinc.net/spamhammers.htm and also here... (not sure when chris last updated his site so I don't know if he has the newest sets, but he has tons of other goodies from many people) http://www.merchantsoverseas.com/wwwroot/gorilla/sa_rules.htm > So far all the rules I've tried are fine as I mark as spam at 5.0, and > deliver, I don't deliver at 10.0 and above (I've seen no false positives > above 10.0). > > One set I've tried, the virus bounce, interested me as I'm being inundated > with Sven virus emails. These have increased dramatically recently as in > the > last week I have created a number of new email accounts just for maillist > postings and these are all now getting hit with Sven mails. Anyway, > looking > though the virus bounce rules I did not see any referring to Sven. Has > anyone written some or do they need doing? I'm no coding king (it's been > 20 > years since I did any serious programming) but I'll have a go if they need > doing. I remember some talk awhile back about viruses, but I'm a smidge outta the loop lately and don't recall which ones had rules done on them. I would check out chris' rules emporium (above) and the wiki http://www.exit0.us/ If you don't find anything, or have any other good rules and want to contribute, cool. :) Ideas generate ideas. Jennifer ------------------------------------------------------- This SF.net email is sponsored by: SF.net Giveback Program. Does SourceForge.net help you be more productive? Does it help you create better code? SHARE THE LOVE, and help us help YOU! Click Here: http://sourceforge.net/donate/ _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
