> I'd have to take this into account when optimising the scores. Then,
> since the scores would be optimised for multiple hits, spammers would
> only have to reduce the number of hits to evade SpamAssassin.
This strikes me as more of an implementation problem than an argument
against the concept.
The fact is that spammers do do some things in repeated manners in their
spams, and those repeats are good detections of spam. They could remove the
repeated things, but the spam might be less effective if they did. Or
alternately, they might not know how to remove the repeated things, in which
case the rule remains effective.
The fact that a spammer may be able to adapt to a spam catcher and work
around it in no way degrades the usefulness of the spam catcher in general.
It merely degrades it in specific, for those spammers able to work around
it.
Off the top of my head, I'd guess that between SARE, Fred, and I, we
probably have 30+ rules that are basically escalating scores for multiple
hits. They work well. And spammers aren't working around them; the rules
are still effective.
The only problem at the moment is you have to write those escalating rules
as a series of rules with increasing numbers of a repeated pattern, and then
adjust the separate scores to sum correctly. Overall it is more work for
the person generating rules, and it is more runtime effort for SA to run
multiple sets of what is essentially the same rule.
Having syntax for this sort of thing would eliminate both of those
annoyances.
Loren
