On Thursday 17 August 2006 03:42, jdow wrote: > From: "Nigel Henry" <cave.dnb@xxxxxxxxxx> > >> http://www.rulesemporium.com/ > >> > >> This may help other users. I suspect you're already welded in to > >> bogofilter. > >> > >> {o.o} > SpamAssassin works regardless of the MUA if it is done right. That way > there are no delays reading your mail. > > My setup uses "fetchmail->procmail->spamassassin->spool directory" And > it uses dovecot to read from the spool directory and feed it to whatever > MUA I might want to use. It also does this no matter where I am in the > world if I can make an internet connection thanks to pop3s. I never > have to transfer my rules. {^_-} > > Within my MUA I setup a lot of rules. But a little one liner SA rule is > all that is needed to shunt the spam aside to its own directory: > rewrite_header Subject *****SPAM***** _SCORE(00)_ ** > > That gives me spam headers that look like: > *****SPAM***** 023.4 <original subject> > > I can then sort that directory or folder for subject and review the least > spammy for false alarms and ignore (or laugh at) the others. > > I wonder how bogofilter is doing on the recent crop of image only spams > that are coming through. The jpg001 ones are being correctly identified as spam. > These are "mostly" caught by the BL rules that > score the BL hits for their reliability, other rules written by the > SARE ninjas, and some by Bayes if they include much text. For those who > tend to be in the first few minutes or hours of spam runs there is an > OCR plugin being developed that is showing some promise. We've also > generated an image characteristics based filter that shows some promise. > We're also collaborating to nail down vulnerability combinations that > some MUAs have. Some will display a gif image found anywhere in the > text. A simple test for malformed messages that claim a gif is plain > text has been proposed. I'm not sure of its disposition yet. > > Even with the image spam I've stayed below 1 in 200 escaped spams on > when I happen to be among the first getting the spam and otherwise about > 1 in 1000 escaped spams. Historically that was on 250-300 spams a day > and 1 in 1000 escaped. Of late spam has dropped off but the most pernicious > are still getting through - about 1 of a day's about 150 spams gets > through. > > 1) Rules REALLY help plug those holes Bayes alone can't touch. > 2) Used properly SpamAssassin is MUA independent. > 3) That means no scan time delays as you read your individual mail > messages, as one friend complained about. I helped him correct his setup. > {^_-} > > One downside for rabid open development people is that the SARE, > SpamAssassin Rules Emporium, rules development process takes place behind > closed doors. The rules are released Open Source once they are configured > and characterized to operate within parameters for the rule set in which > they fit. This delays the spammer's adaptation process. It's a war. And > every little edge helps. > > (If BogoFilter is more effective than SA's Bayes alone I wonder if > someone could hack it into SA in place of the SA Bayes. I don't think > it can be formally folded it SA's Bayes (which is exceptionally good) > due to Apache vs GPL issues.) > > {^_^} Apologies for the slow reply. I found that I had 270MB of updates for FC5 which runs on the same machine as FC2 that I use for emails, and on dialup that takes a while. It's difficult for me to say how SA compares to Bogofilter, as I havn't got SA setup on the other machine yet. Todays batch of mail resulted in: Inbox: 191 Spam: 2 Unsure: 14 All the unsures were clearly spam except for 1. That was Gene's, where he mentioned that word "levi", and the rest is here, "tra". That was on the DB wordlist, and Bogofilter obviously thought it a bit suspect. I can't say I'm too clued up on the finer points of spam filtering, but am willing to learn. Ideally spam should be stopped at source, but I don't suppose there's much chance of that happening. Nigel.
