John Wilcock wrote:
> It struck me that since individual tripwire rules are at risk of FPs,
> but that multiple tripwire hits on the same message are much less so,
> it might be worthwhile assigning a significantly higher score to
> messages that hit lots of tripwire rules.
>
> Since there are so many rules involved, I've created a set of
> intermediate meta rules, as follows:
*snip*
> Any comments? I don't get enough spam ("only" about 120 a day for an
> office of six people) to quickly judge whether this is more effective
> than merely scoring individual tripwire rules at 0.07 each or
> whatever.
>
> I've put a modified tripwire.cf (based on tripwire 1.16) at
> http://www.snoweye.com/john/metatripwire.cf if anyone is interested in
> trying this against a corpus in comparison with the standard tripwire
> set.
That would also help with the problem of the report exceeding Exim's header
size limit when a ton of TW or BH rules hit.
--
Matt
Systems Administrator
Local Access Communications
-------------------------------------------------------
The SF.Net email is sponsored by EclipseCon 2004
Premiere Conference on Open Tools Development and Integration
See the breadth of Eclipse activity. February 3-5 in Anaheim, CA.
http://www.eclipsecon.org/osdn
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
