I thought I'd pass this on to the users list. This is from work I was doing on bug 4105... a quick mass-check run of SPEWS rules:
It's not even worth finishing the mass-check...
OVERALL% SPAM% HAM% S/O RANK SCORE NAME 17895 9097 8798 0.508 0.00 0.00 (all messages) 100.000 50.8354 49.1646 0.508 0.00 0.00 (all messages as %) 12.422 21.6775 2.8529 0.884 0.00 0.01 T_RCVD_IN_L1SPEWS 12.814 22.3700 2.9325 0.884 0.00 0.01 T_RCVD_IN_L2SPEWS
Not going to add these, obviously.
Agreed, spews is pretty much useless as a spam criteria if you have any interest in accuracy. It's pretty much one step short of just unplugging your mailserver (hey guys, there's an idea that blocks 100% of spam with no false negatives! :) )
That said I do actually use spews L1 as a +0.01 rule in my spamassassin config. To me it's really more of an informational flag that the one of the ISPs involved is spam friendly, so don't waste any excess time trying to file abuse reports by hand and just issue standard spamcop report and trash the email because nobody will ever follow up on it.
Beyond the strictly informational "hosted by an ISP that is in some way spammer or spamvertizer friendly", I don't see much point in spews.
