You make a good point with a reverse of your the "The best value to Sniffer would be to promote the lowest scoring things" argument. I too am worried about false positive which is why I would have been considering sending stuff that is 40 points (which is 9 points higher than my highest false positive). But such e-mail is overwhelmingly SPAM. It would usually have to fail at least 5 tests usually 10 or so to hit 40 points. In summary, I'm pretty much wasting my server's time and Message Sniffer time forwarding SPAM should be identifiable by other means.
P.S. I appreciate the fact you've made your filters public. I use a bunch of them, and they've certainly been learning tool in writing some of my own filters. Scott Fisher Director of IT Farm Progress Companies >>> [EMAIL PROTECTED] 03/26/04 11:32AM >>> This is generally a bad idea because you might be blacklisting something that others don't consider spam. I've seen experiments where someone built a DNSBL blacklist from things scoring over a certain weight and this had the effect of polluting the data with his local blacklisting settings which weren't perfectly universal. A large number of my false positives from Sniffer comes from manual submissions, and this is primarily due to what I consider to be spam, and what other administrators consider to be spam. The best value to Sniffer would be to promote the lowest scoring things. I submit everything that comes from a zombie or a non-unique source such as Nigerian scams that people report to me as having been passed. I maintain a local DNSBL for blacklisting static sources and generally don't submit those, though I may in the future. I guess what I'm saying is that as another Sniffer user, I would prefer that nominations outside of the spamtraps be manually verified, and that those submitting them take care to consider whether or not everyone would consider such things to be spam since a filter would affect everyone that uses their product. I'm sure Pete has some protections in place, but no one is perfect and more eyeballs don't hurt. Matt Scott Fisher wrote: >I've been pondering this. >I use Message Sniffer as one of my tests. I've been thinking about the possibility of >forwarding all mail to Message Sniffer that has a Message Sniffer return code of 0 >that also has a weight 40 (higher than the highest false positive weight I've seen). > >I don't know if this is a bad idea? So I'm throwing it out for other people's >opinions. >I also don't know if I can use a weight test in a testsfailed filter. >Another concern is that the original e-mail should also be held. > >Here's what I envision the code to look like: > >WEIGHT40 weight x x 40 0 >SNIFFER-NOTFOUND external 000 "D:\IMail\Declude\Sniffer\sniffer.exe code" 0 0 >SNIFFER-FORWARD filter D:\Snifferforward.txt x 0 0 >SNIFFER-FORWARD COPYTO spamaddress at messagesniffer > >snifferforward.txt: >TESTSFAILED 0 CONTAINS WEIGHT40,SNIFFER-NOTFOUND > >Scott Fisher >Director of IT >Farm Progress Companies > >--- >[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > >--- >This E-mail came from the Declude.JunkMail mailing list. To >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >type "unsubscribe Declude.JunkMail". The archives can be found >at http://www.mail-archive.com. > > > > -- ===================================================== MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ ===================================================== --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
