* This is the modus mailing list * At 08:03 AM 11/20/2003 -0600, you wrote: >* This is the modus mailing list * > >As a beta tester I don't remember anyone reporting a false positive problem >in the 'normal' setting. Are You saying that you are willing to deal with >false-positives generated by SA, but not by the SCA engine? I think you may >be reading to much gloom and doom into the reports of false positives in >total. While I haven't run my server in the 'normal' mode at all, I can >hardly expect it would increase my false-positive level since my default is >'extreme'. And yes, I used to run SA as well but no longer. False positives >are going to occur anytime the engine, whether it is SA or SCA begins to try >and determine if an images only html message (the prefered porn spam format, >and that of folks sending pictures of grandkids) are spam or not. Our >customers prefer to have the porn in the quarantine as they have had enough >inter-species sex education for their lifetime now. They use the whitelist >the first time they find a problem with their kids and all is well. The >alternative on either engine is to allow an entire class of spam the >opportunity to slip through as though it is OK.
Mark, I agree that we had a lot of false positives with SA as well, but... We are set to Normal, and we are seeing way to many false positives, especially being in Normal mode. Prior to M3, we ran in Extreme mode. I expected false positives in Extreme mode. What I didn't expect is that we would see as many if not more false positives in Normal mode of M3. Prior to M3, most of our false positives were mailing list related. Rarely did we see plain old messages get stopped. Since M3, we rarely see a false positive that is a mailing list, yet see individual plain old messages being stopped. Michael had made a comment about using different fonts, smiles, graphics, etc. None of the false positives we have seen have those traits, and are simply email between two people. We do a lot of hand holding here, so we interface with our customers quite a bit. Maybe that's why we are hearing the complaints of false positives. We are a smaller shop, and talk to many of our customers weekly if not every few days. They have always been honest with us, and told us what they think. We encourage that. I can't help but wonder if some running M3 are so much larger, and don't have that communication with the customer, that they really don't know how many false positive issues their users are having. Just a thought...not saying it is that way, but there are several on this list that are having the problem, so it's not a fluke. I'm glad the beta testers didn't have these problems. I for one am very grateful of how well the beta testers did do with the M3 version. While there are issues, none are 'show stoppers'. Every single one of you that beta tested should have a lot of pride, as nothing major is broken, and overall, things have gone rather well with the roll-out of M3. The fact that the issues are all relatively minor, says a lot about how well this version was tested, and how well Vircom did. There are some issues though, and Vircom needs to listen to what others are saying now that M3 is being used by a broader audience. I have no doubt that Vircom will listen, and that we will see the issues corrected or revised as needed. Ultimately, everyone will get a better product from Vircom. :) Jim TDE Internet >Also, while I appreciate the SA configuration, it was causing us severe >issues when we were under a spam attack. It was not unusual to find the SA >engine backed due to a simple dictionary attack on one of our domains. Since >dropping the SA our inbound mail delay has not gone above 5 minutes more >than once, and in that case is lasted for only a couple of minutes while our >server fought off multiple spam attacks from a large number of different >sights at the same time (finally saw that in the error logs). > >Mark Thornton >San Marcos Internet, Inc >512-393-5300 > > >----- Original Message ----- >From: "postmaster" <[EMAIL PROTECTED]> >To: <[EMAIL PROTECTED]> >Sent: Thursday, November 20, 2003 6:37 AM >Subject: [Modus] false positives > > >* This is the modus mailing list * > >Sorry Micha�l, > >but I find all this info very irritating, as if SCA is not safe on "Normal" >anymore, it leaves the "safe route" that Vircom did take with their former >antispam engines. > >With Modus 2 people were absolutely safe when they used "Normal" as a >blocking level, even "Strong" was as good as 100% safe against false >positives. The users did not have to learn anything to use this level of >protection - and did not have to "whitelist" anybody. > >Now with Modus 3 suddenly users report false positives on "normal level" and >you suggest them to use whitelists against false positives. You even say: >"Normal" doesn't mean it was caught on normal." >What does it mean then? > >We still use Modus 2 together with a refined SpamAssassing 2.60 and see >almost zero false positives while we catch almost all spam. I suggested our >users to forward their spam to me and so I do receive about 2 or 3 per week. >We found that SA combined with Modus 2 Sieve is they best and most safe >solution against spam we ever used. This solution works so good that most of >our users are protected without even knowing it - this is the way an optimal >engine should work IMHO. > >Reading the enthusiastic report about Modus 3 we wanted to upgrade as soon >as the first "refined" version comes out to benefit from an even stronger >anti-spam level. But if we cannot use the "Normal" and "Strong" level from >Modus anymore to have a *safe* backup for the spam stuff our SA engine >misses to catch, than we cannot use Modus 3 SCA at all, as our users shall >*not* have to learn anything, especially not have to think about whitelists, >they shall not even have to know that we run antivirus and antispam >protection for them if they prefer to "don't care" - what most people do. > >So please: make "Normal" safe again, otherwise we will rather have to stay a >while longer with Modus 2, even though I *love* the availability to change >the attachment/virus scanning sequence in Modus 3 (this would be our primary >reason for an upgrade). > >Finally I want to say that this mailing list did become my first source for >spam on some days in the last weeks. In former times people were posting >only when they had something relevant to say, and most of it was so >interesting that I even was reading what was not affecting us. Now there are >days where I am tempted to unsubscribe to get away from some babble that >blows up my inbox and eats up my working time. But as perhaps this is the >way things take if you become successfull (and I really wish Vircom is), I >vote for a Modus WWW forum with all kind of professional boards - and a >party lounge for all people who do not have to work and rather have a strong >desire to chat. > >Best regards >Kai Fiebach >Musikhochschule Luebeck, Germany >http://www.mh-luebeck.de > > >-----Original Message----- >From: Micha�l Gaudette [mailto:[EMAIL PROTECTED] >Sent: Wednesday, November 19, 2003 6:37 PM >To: [EMAIL PROTECTED] >Subject: [Modus] false positives > > >* This is the modus mailing list * > >Hi Christian, > >> What about the spam level settings? All our spam is blocked >> under the level "normal". We see no spam being blocked by >> "strong" or "extreme"? >> >> Are the spam level settings still relevant? > >Yes they are still relevant, but the actual information reported is not. >"Normal" doesn't mean it was caught on normal. We'll log this in our >systems. > >** >To unsubscribe, send an Email to: [EMAIL PROTECTED] >with the word "UNSUBSCRIBE" in the body or subject line. > > >** >To unsubscribe, send an Email to: [EMAIL PROTECTED] >with the word "UNSUBSCRIBE" in the body or subject line. ** To unsubscribe, send an Email to: [EMAIL PROTECTED] with the word "UNSUBSCRIBE" in the body or subject line.
