From: "Matt Kettler" <[EMAIL PROTECTED]>
Dallas L. Engelken wrote:
-----Original Message-----
From: Matt Kettler [mailto:[EMAIL PROTECTED]
Sent: Thursday, February 16, 2006 22:50
To: Chris Santerre
Cc: users@spamassassin.apache.org
Subject: Re: Over-scoring of SURBL lists...
Chris Santerre wrote:
Matt Kettler wrote:
My FPs fall into two categories:
1) URIs that would likely never appear outside of a specialty
newsletter. I've had lots of hits on things like:
-Authors of programmer's tools
-producers of electronic parts
-producers of embedded computer systems (Note: embedded,
not normal
computers..
companies like versalogic.com that make parts that only a kiosk
manufacturer or extreme geek would use)
Agreed. And we have seen these be more JoeJobs. But some
are not. Some
simply hire mass emailers thinking they are legit, only to find out
they are not. Just because they are legit for you, doesn't
mean they
haven't spammed someone else. You ask, we remove.
Yes, the only problem is that I'm getting tired of having to
track down sample emails for FPs so I can find which URI a
URIBL FPed on.
But really, how often or not a URIBL FP's isn't really the
point. The point is they DO FP, and it's really quite common
for FP's to be multi-listed. That multi-listing wields some
hefty score biases, way beyond the power of any other rule in
spamassassin other than BLACKLIST_* and GTUBE.
I merely find it to be a big problem that URIBLs on the
general whole are rather FP prone, and prone to "cascades" of
FPs which unleashes havoc from the strong scores the
perceptron gave them.
I think the reason the perceptron gave them such high scores
is that a lot of URIBL FP problems get fixed fairly quickly,
within a matter of hours. Ditto for a lot of FN problems.
By the time the mass-checks are run, the URI's in the corpus
emails are likely well sorted by the reports given to the URIBLs.
Sounds like someone's having a bad day ;)
First, a pre-statement:
I'm only presenting evidence of accuracy problems in relation to why the
URIBLs collectively wield a great deal of power in SpamAssassin scoring.
I'm not really complaining about uribl.com, I'm complaining about URIBLs
as a whole. That's both uribl.com and surbl. Whenever I use the term
URIBL in all caps, I mean all URI dns-based blacklists. If you prefer,
I'll retract my uribl.com example, and point out that less than an hour
later, I got a ws.surbl.org FP.
And let me remind you.
Let me remind you,
1) you control which uribl's you run
2) you control how they score
And whitelist_from_rcvd works. If Ferzballer WANT to receive some
grozbitter spam then whitelist_from_rcvd the particular grosbittering
site Ferzballer wants to see. If Ferzballer do not believe a particular
list is "good" then downgrade it's score or disable it altogether.
Ferzballer is in charge of HIS scores. And ZZZZ_local_overrides.cf can
work on a global basis.
{^_^}
