* This is the modus mailing list * As a beta tester I don't remember anyone reporting a false positive problem in the 'normal' setting. Are You saying that you are willing to deal with false-positives generated by SA, but not by the SCA engine? I think you may be reading to much gloom and doom into the reports of false positives in total. While I haven't run my server in the 'normal' mode at all, I can hardly expect it would increase my false-positive level since my default is 'extreme'. And yes, I used to run SA as well but no longer. False positives are going to occur anytime the engine, whether it is SA or SCA begins to try and determine if an images only html message (the prefered porn spam format, and that of folks sending pictures of grandkids) are spam or not. Our customers prefer to have the porn in the quarantine as they have had enough inter-species sex education for their lifetime now. They use the whitelist the first time they find a problem with their kids and all is well. The alternative on either engine is to allow an entire class of spam the opportunity to slip through as though it is OK.
Also, while I appreciate the SA configuration, it was causing us severe issues when we were under a spam attack. It was not unusual to find the SA engine backed due to a simple dictionary attack on one of our domains. Since dropping the SA our inbound mail delay has not gone above 5 minutes more than once, and in that case is lasted for only a couple of minutes while our server fought off multiple spam attacks from a large number of different sights at the same time (finally saw that in the error logs). Mark Thornton San Marcos Internet, Inc 512-393-5300 ----- Original Message ----- From: "postmaster" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Thursday, November 20, 2003 6:37 AM Subject: [Modus] false positives * This is the modus mailing list * Sorry Micha�l, but I find all this info very irritating, as if SCA is not safe on "Normal" anymore, it leaves the "safe route" that Vircom did take with their former antispam engines. With Modus 2 people were absolutely safe when they used "Normal" as a blocking level, even "Strong" was as good as 100% safe against false positives. The users did not have to learn anything to use this level of protection - and did not have to "whitelist" anybody. Now with Modus 3 suddenly users report false positives on "normal level" and you suggest them to use whitelists against false positives. You even say: "Normal" doesn't mean it was caught on normal." What does it mean then? We still use Modus 2 together with a refined SpamAssassing 2.60 and see almost zero false positives while we catch almost all spam. I suggested our users to forward their spam to me and so I do receive about 2 or 3 per week. We found that SA combined with Modus 2 Sieve is they best and most safe solution against spam we ever used. This solution works so good that most of our users are protected without even knowing it - this is the way an optimal engine should work IMHO. Reading the enthusiastic report about Modus 3 we wanted to upgrade as soon as the first "refined" version comes out to benefit from an even stronger anti-spam level. But if we cannot use the "Normal" and "Strong" level from Modus anymore to have a *safe* backup for the spam stuff our SA engine misses to catch, than we cannot use Modus 3 SCA at all, as our users shall *not* have to learn anything, especially not have to think about whitelists, they shall not even have to know that we run antivirus and antispam protection for them if they prefer to "don't care" - what most people do. So please: make "Normal" safe again, otherwise we will rather have to stay a while longer with Modus 2, even though I *love* the availability to change the attachment/virus scanning sequence in Modus 3 (this would be our primary reason for an upgrade). Finally I want to say that this mailing list did become my first source for spam on some days in the last weeks. In former times people were posting only when they had something relevant to say, and most of it was so interesting that I even was reading what was not affecting us. Now there are days where I am tempted to unsubscribe to get away from some babble that blows up my inbox and eats up my working time. But as perhaps this is the way things take if you become successfull (and I really wish Vircom is), I vote for a Modus WWW forum with all kind of professional boards - and a party lounge for all people who do not have to work and rather have a strong desire to chat. Best regards Kai Fiebach Musikhochschule Luebeck, Germany http://www.mh-luebeck.de -----Original Message----- From: Micha�l Gaudette [mailto:[EMAIL PROTECTED] Sent: Wednesday, November 19, 2003 6:37 PM To: [EMAIL PROTECTED] Subject: [Modus] false positives * This is the modus mailing list * Hi Christian, > What about the spam level settings? All our spam is blocked > under the level "normal". We see no spam being blocked by > "strong" or "extreme"? > > Are the spam level settings still relevant? Yes they are still relevant, but the actual information reported is not. "Normal" doesn't mean it was caught on normal. We'll log this in our systems. ** To unsubscribe, send an Email to: [EMAIL PROTECTED] with the word "UNSUBSCRIBE" in the body or subject line. ** To unsubscribe, send an Email to: [EMAIL PROTECTED] with the word "UNSUBSCRIBE" in the body or subject line.
