[EMAIL PROTECTED] wrote on 11/02/2006 02:48:03 PM: > On Thu, Nov 02, 2006 at 03:38:11PM +0100, Jakob Curdes wrote: > > Do you use Bayes in spamassassin ? Without a self-adapting filter such
> > as bayes or dspam a lot of stuff will slip through nowadays.You can tell > > SA to train bayes from the rule-based score. Then you get a quite good > > database without much manual traiing. Every spam case with slightly > > varying text is ideal for bayes. after a dozen or so messages bayes > > will have learnt the lesson. > > I beg to differ with you. On the contrary, there have been a number > of recent posts to the SA list from admins all of whose spam is now > identified as BAYES_00 and AWL, because they enabled autolearn and let > it run on its own while a lot of spam was slipping through. This was my issue and the reason I turned off Bayes and DSPAM, because of our lack of spending the time manually training it and leaving it on autolearn, it was causing more harm than good. We have a large user base, 5K+ users in different states/countries, it was not clear cut to implement a user mechanism where they could manually flag email as spam or ham and train the DB, additionally we use Notes on the back end. > > If significant amounts of spam are being missed in the first place, > they are ipso facto being scored low, so if you aren't *manually* > training them as spam they are more likely to get learned as ham than > as spam. > > > > >The content of the email is ASCII, no HTML, no images, pretty clean. > > >Currently we are using Fuzzy_OCR, DCC, Pyzor, all the reliable RBL's and > > >SBL's and they still slip under the radar. What are you guys doing to > > >block these? I've grabbed a couple of SARE rulesets (kam, sare_stocks) > > >and they still don't seem to catch these specific ones. > > > > > >I appreciate the help > > I know the kind of spam you mean, but I have not checked to see > what's catching or blocking it. > > How long ago did you grab the stocks ruleset? It was updated only a > couple weeks ago, and I've been having pretty good results since then. I grabbed them about 2 weeks ago but are up to date, they flag plenty of emails just not these specific ones. Again, I feel we have everything under control right now, except for these emails. > > It may also be that the recently added graylisting on our mailservers > is deflecting the spamware used by this particular stock spammer. > Graylisting does seem to offer a huge benefit. Greylisting is a doubled edged sword, although beneficial in defering illegitimate messages it also breaks misconfigured mail servers and the users scream bloody murder when they dont get email at the speed of IM. Sad to say this is my case here. We did however have it turned on (SQLgrey) for a month before it got voted off because of the latency it incurred. I do however use SQLgrey at other sites and it is still not stopping these emails :-( > > -- Clifton > > -- > Clifton Royston -- [EMAIL PROTECTED] / [EMAIL PROTECTED] > President - I and I Computing * http://www.iandicomputing.com/ > Custom programming, network design, systems and network consulting services > > ------------------------------------------------------------------------- > Using Tomcat but need to do more? Need to support web services, security? > Get stuff done quickly with pre-integrated technology to make your job easier > Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo > http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642 > _______________________________________________ > AMaViS-user mailing list > AMaViS-user@lists.sourceforge.net > https://lists.sourceforge.net/lists/listinfo/amavis-user > AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3 > AMaViS-HowTos:http://www.amavis.org/howto/ ------------------------------------------------------------------------- Using Tomcat but need to do more? Need to support web services, security? Get stuff done quickly with pre-integrated technology to make your job easier Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642 _______________________________________________ AMaViS-user mailing list AMaViS-user@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/amavis-user AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3 AMaViS-HowTos:http://www.amavis.org/howto/
