Some observations on Spam Assasin

Post #160,701 by dmarker 6/20/04 10:35:44 PM Reply	Some observations on Spam Assasin SA home website = [link\|http://spamassassin.taint.org/\|http://spamassassin.taint.org/] SA current rules = [link\|http://spamassassin.taint.org/tests.html\|http://spamassassin.taint.org/tests.html] At first SA looked very promising. My website default score was set to 5.0 and it seemed to be taking out 90-95% of the spam coming thru. I now have the default score reduced to 2.5 as it seems to have dropped its effectiveness to more like 50%-60% filtering of spam. The stuff getting thru is clearly crap. Am looking into the way I am using it to see if I have it wrong. I am using it as follows ... 1) On my own website I have set up 4 accounts. 3 are then forwarded to the 4th. 2) I have 3 external email addresses that are each redirected to one of the above 3 (1-3). 3) I access my email from the 4th account. My theory was that S.A. would filter the other redirected email. On the surface SA looks very powerful. Am not sure why the effectiveness may have swung from 90%s down to 60% range. Doug M _________________________________________________________ "Blinding ignorance does mislead us. O! Wretched mortals, open your eyes!". -- Leonardo Da Vinci
Post #160,703 by folkert 6/20/04 11:00:57 PM 6/21/04 8:48:52 PM Reply	Look up RulesDuJour (updated with good news) [link\|http://www.exit0.us/index.php/RulesDuJour\|RulesDuJour](RDJ) I recently added them... Not one single Spam gotten through, no False Negatives or False Positives since either. Here is a recently graded SPAM: [link\|http://www.gregfolkert.net/files/UltimateSpam.txt\|Ultimate Spam] 52.4 SPAM Score The SARE stuff and a few other things are RulesDuJour. [link\|http://www.gregfolkert.net/files/NewUltimateSpam.txt\|New Ultimate Spam] 73.3 SPAM Score, getting tricky... [link\|http://www.gregfolkert.net/files/AnotherSpam.txt\|Another Spam] 65.0 SPAM Score. I have noticed that SPAM is typically falling into one of these three categories since I installed RDJ. You can see the techniques now. Look at them. The odd tripletts are not much alone so things like Technical Docs usually will be able to get through... but you will see a significant reduction in SPAM. Have gotten ONE false positive, but it was to a Debian Mailing List from a dyndns.org mail server which in and of itself, wouldn't trip it, but with all the "technical terms" in the e-mail and number of "set of headers" (fw: re: re: fw: etc...) it got scored apropos. :) -- [link\|mailto:greg@gregfolkert.net\|greg], [link\|http://www.iwethey.org/ed_curry\|REMEMBER ED CURRY!] @ *i_wethey* Heard near the SCOG employee entry/exit way: `Security: We got another Mass Exodus Doorway Jam.` Edited by folkert June 21, 2004, 01:57:52 PM EDT Edited by folkert June 21, 2004, 02:14:42 PM EDT Edited by folkert June 21, 2004, 08:48:32 PM EDT Edited by folkert June 21, 2004, 08:48:52 PM EDT Expand All History
Post #160,706 by FuManChu 6/21/04 12:42:41 AM Reply	Thanks! Hafta look at that (AFTER vacation :)
Post #160,709 by dmarker 6/21/04 1:25:34 AM Reply	That looks very promising - will follow thru - tks _________________________________________________________ "Blinding ignorance does mislead us. O! Wretched mortals, open your eyes!". -- Leonardo Da Vinci
Post #160,962 by pwhysall 6/22/04 2:08:26 AM Reply	This rocks. Thanks. I'm in control again! Whee! Peter [link\|http://www.debian.org\|Shill For Hire] [link\|http://www.kuro5hin.org\|There is no K5 Cabal] [link\|http://guildenstern.dyndns.org\|Blog]
Post #161,094 by dmarker 6/22/04 5:36:50 PM Reply	Tried to figure out how I could use this but my ISP who runs the site seems to have the control over Spam Assasin. I hace CPANEL access to my website & can set some values for S.A. but they only seem to be sites that are either black or white listed (5 of each). Seems I may not have enough control to modify S.A. rules :-( Cheers Doug _________________________________________________________ "Blinding ignorance does mislead us. O! Wretched mortals, open your eyes!". -- Leonardo Da Vinci
Post #161,117 by folkert 6/22/04 8:05:48 PM Reply	Point them to it. And Make it an option to use... Easy for them too. -- [link\|mailto:greg@gregfolkert.net\|greg], [link\|http://www.iwethey.org/ed_curry\|REMEMBER ED CURRY!] @ *i_wethey* Heard near the SCOG employee entry/exit way: `Security: We got another Mass Exodus Doorway Jam.`
Post #161,145 by dmarker 6/22/04 11:06:24 PM Reply	Their help line is very good - maybe they will do it I can only but ask them. Tks Doug _________________________________________________________ "Blinding ignorance does mislead us. O! Wretched mortals, open your eyes!". -- Leonardo Da Vinci
Post #161,794 by dmarker 6/27/04 2:47:13 AM Reply	You bewdy mate ! - dunno if they took the advice but. Spam traffic seems to be the best level of filtering I've seen yet. Today it jumped to beter than 95+% I assume they followed thru on the link I sent them that you provided. Thanks Doug _________________________________________________________ "Blinding ignorance does mislead us. O! Wretched mortals, open your eyes!". -- Leonardo Da Vinci

Welcome to IWETHEY!