On Sun, 13 Oct 2013, Stan Hoeppner wrote:
On 10/12/2013 9:28 PM, John Hardin wrote:
On Sat, 12 Oct 2013, Stan Hoeppner wrote:
Steve, the one who wrote this regex, would you please explain your
reasoning behind giving this rule a score so high as 2.8,
That score was auto-assigned by masscheck, where it is doing quite well:
http://ruleqa.spamassassin.org/?rule=FSL_HELO_BARE_IP_2
and engage in discussion WRT lowering the score, eliminating the
overlap with the other bare IP HELO rules, etc?
It seems that 94% of the ham hits in masscheck are against list mail,
and none of the spam hits are, so it would seem reasonable to add an
exclusion for list messages.
That seems to be what I'm seeing here. That exclusion would be nice.
Maddoc hasn't touched these rules since 2009, so I will go ahead and add
an exclusion for that.
Great. Thank you. I assume this exclusion will be picked up via the
daily update script?
Yes. It will take a day or two to make it through masscheck. And we've had
corpora starvation issues the last few weeks; if the ham corpus gets thin
again updates may be delayed.
On 10/12/2013 9:22 PM, John Hardin wrote:
On Sat, 12 Oct 2013, Stan Hoeppner wrote:
Content analysis details: (4.8 points, 4.2 required)
Why did you lower the required score?
Frankly, because I am not, and do not wish to become, an SA expert, with
all the time/effort that entails. Bringing the required score down
progressively until I found some "balance" seemed a better strategy,
less fraught with potential peril than modifying the scores of
individual stock rules, creating a bunch of custom rules, etc. Until
somewhat recently that strategy seemed to be working relatively well.
Lowering the required score *increases* potential peril, as you have seen.
The scores generated by the masscheck process are designed to optimize
detection with the required score set to 5 points. If you lower the
required score you increase the risk of FPs.
If you're seeing a particular type of spam that isn't quite scoring high
enough using the stock rules, let the list know. We can work out custom
rules for you and/or add new rules to the sandboxes for testing against
the masscheck corpora and possible inclusion in the standard rules.
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhar...@impsec.org FALaholic #11174 pgpk -a jhar...@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
The third basic rule of firearms safety:
Keep your booger hook off the bang switch!
-----------------------------------------------------------------------
500 days since the first successful private support mission to ISS (SpaceX)
