On Fri, 2009-05-15 at 18:45 +0100, Jeremy Morton wrote:
> Here's another e-mail that got through SpamAssassin:
>
> http://rafb.net/p/cFMnIy61.html
Backscatter. These types of arbitrarily phrased "I changed my email
address" auto-responses are pretty much impossible to catch.
> As you can see I've effectively disabled the BAYES_00 rule as it's
> giving false credit to a ton of backscatter crud messages, but is there
Since BAYES_00 is a strong sign for ham, I would have at least given it
a low negative score, not positive. This is particular important, since
you severely lowered the required_score to a mere 3.0.
Moreover, this is not spam. Thus I recommend you pretty much ignore the
Bayes score here. Don't change the rule's score based on backscatter,
but ham and spam hits, if need be.
> really a way to block these kinds of backscatter? Is my Bayesian
> filtering screwed up? What score does your SA install give for this
> message?
Your Bayes *might* be skewed. Hard to tell from that sample. Do you
train it, manually? Would Spanish be a language you do get in ham?
Anyway, it's a backscatter. It doesn't show spam patterns, nor matches
the tokens seen in spam. That's why Bayes doesn't catch it. It simply
does not look like spam. And SA isn't designed to catch that stuff.
Also, again -- you are suffering from your catch-all! See my previous
post (in one of your various threads) for some thoughts regarding this.
--
char *t="\10pse\0r\0dtu...@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1:
(c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}
