On 2025-03-14 at 02:46:06 UTC-0400 (Fri, 14 Mar 2025 02:46:06 -0400)
Jared Hall via users <ja...@jaredsec.com>
is rumored to have said:
SA 3.4.6
I see this negative scoring rule in many spams:
MAILING_LIST_MULTI=-1
Spamples appreciated.
Seems counter-intuitive but I could not find a score for this rule
anywhere.
Rules without explicit scores are scored by default at 1 for spam rules
and -1 for 'nice' (ham) rules, with adjustments made by the RuleQA
process.
Is this just an issue with version 3.4?
The default scores have existed since at least 2.x. MAILING_LIST_MULTI
was created a few years ago to address a FP pattern of well-known
standards-conforming "traditional" mailing list software (ezmlm,
Mailman, Lyris,etc) sending wanted mail to eager subscribers and getting
labeled as spam. It has helped reduce that problem substantially.
The rationale (beside the fact that RuleQA affirms its utility) is that
tools designed for conversational mailing lists usually present too much
of a setup and operational burden for spammers, relative to
designed-for-spam tools. A key high-level goal for SA is to keep
traditional consensual mailing lists (e.g. like this one) viable in an
environment where mailing many copies of the same message to many users
is almost always unwanted.
And I am 100% serious about wanting samples of spam hitting
MAILING_LIST_MULTI or ANY "protective" rule. We are shameless about
providing "special treatment" for specific sites and/or senders to get a
~80% rule like MAILING_LIST_MULTI to 90%+.
--
Bill Cole
b...@scconsult.com or billc...@apache.org
(AKA @grumpybozo@toad.social and many *@billmail.scconsult.com
addresses)
Not Currently Available For Hire
