On Wed, 2005-04-06 at 15:53 -0400, Kris Deugau wrote: > This WILL HAPPEN if you rely entirely on static rules - spammers adjust > their tactics to avoid those rules. That's why dynamic rules or systems > such as Bayes and SURBL are so important.
I religiously feed false negatives back into Bayes. I've a cron job that's polling a special folder in my IMAP account (i wrote a Perl script based on a CPAN IMAP module) and i just drag the spam there and forget about it. > The most common detail in most other reports like yours (you don't say > much beyond "It's broke. Fix it.") Increasing number of false negatives. > is that spam is hitting BAYES_99.... > and nothing else. In 2.6x, this wasn't a problem, BAYES_99 scored over > the threshold of 5 in the default setup, and spam would be correctly > tagged in that case. With 3.x, the BAYES_nn scores have been rather > reduced, and a number of people have reported good results from just > copying the 2.64 BAYES_nn scores. So what is the reason why BAYES_99 is scored so low? > I'm a little puzzled what you're asking for, then; addon rulesets are > available from SARE, and somewhere there's a tool to automatically check > for updates on those rules. My impression, after a quick perusal, was that any mentions about SARE and the like are pretty well "hidden" on the SA main website. Yes, there is a mention, but there's a big fat "Use at your own risk" warning at the top of the page. What would a new user think? > If you're really not interested in tweaking your SA setup <sigh> I've a fairly demanding job, i've a few pretty convoluted personal projects i'm involved in, i've a family and other details that typically show up if one is not an archetypal pale-faced geek-in-the-basement. I do try to take care of my personal webserver (to which i'm the sole admin), mailserver (SA, Postfix, Cyrus, Squirrelmail), VoIP PBX, etc., despite the schedule overload. And these days i was looking at SA and i'm, like, "it's not gonna happen, i don't have time for this." I chose to play the dumb user on purpose, just because i can't fix everything myself. I do apologize for not reporting the actual nature of the problem. -- Florin Andrei http://florin.myip.org/
