On Mon, 6 Aug 2012, Kevin A. McGrail wrote:
On 8/6/2012 11:52 AM, John Hardin wrote:
All:
The masscheck corpora are persistently hovering just below the thresholds
needed for an automatic rules update to be generated, and the complaints
about the high scores for the 12LTRDOM and HDRS_LCASE rules are getting
louder.
I recommend the best immediate course of action would be to manually
update the 70_scores.cf file in the current updates tarball to set the
scores for these rules to advisory levels and release that as a new
update. I think this would be safer than pushing a manual rules update
using scores based on somewhat-starved corpora.
I'd be willing to do this but I don't know the details of where the master
update tarballs live or how to publish a new update to DNS.
Is there agreement that this is an appropriate course of action? Is
someone who does know the details willing to do this?
I don't think this is the right action, really. I think we have to get the
infrastructure for mass checks working. I know that's my focus (and I'm
making good strides at work towards being able to focus more).
I agree that's the best and correct long-term solution. I was more
concerned with fixing this specific issue immediately without introducing
a lot of possible problems from simply pushing a manual rules update using
the current rules and masscheck scores. When the masscheck system hits the
threshold limits a "correct" automatic update would go out and replace
this "hotfix" score patch update.
I think the key solution for people having problem is to run a slightly older
version of the update that has the better scores. If you identify a good
version, I believe there is a well document way to revert to that version.
In the specific case being discussed right now on the users list the
problematic SA host is the ASF mailing list server, which is apparently
rejecting ham from users in legitimate 12-letter domains.
Do any of the ASF dev team members have administrative access to that
server to roll it back to an older update?
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
[email protected] FALaholic #11174 pgpk -a [email protected]
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
Today: the 67th anniversary of the Hiroshima bombing
