On 2025-01-13 at 01:51:17 UTC-0500 (Mon, 13 Jan 2025 08:51:17 +0200)
Anders Gustafsson <anders.gustafs...@pedago.fi>
is rumored to have said:
Hi!
When collecting spam I frequently see multiple copies of the same
message, but with different fake senders.
In this case, should I feed just one or all to Bayes?
All.
Also: Is there a point in feeding such spam that is already flagged by
other rules than Bayes
Yes. The header and body rules match known patterns. Bayes works to
catch spam with more subtle commonalities that are unlikely to be
noticed by a human. Those still exist with mail that also matches rules,
so even if a spammer figures out how to evade explicit rules, they may
well not be able to get past Bayes.
and if so,
should I remove the additions that SA adds to the message? Ie: XSPAM
etc?
SA knows to ignore its own additions, in part because anyone could have
added them. X-Spam-* headers are ignored and we may also be ignoring
Spam-* headers.
One issue that may exist with manually feeding caught spam to Bayes is
if you use the "report_safe" feature which encapsulates identified spam
in a wrapper message with a warning. You should feed Bayes the
*original* message, not the encapsulation message. In principle SA
should be able to unwrap its own reports, but there are gaps there.
--
Bill Cole
b...@scconsult.com or billc...@apache.org
(AKA @grumpybozo@toad.social and many *@billmail.scconsult.com
addresses)
Not Currently Available For Hire
