Note that by default razor will flag if *any* mime part matches a part that was on known spam. This means that a lot of messages containing null blocks, or common image attachments, etc, wind up being tagged, because a lot of spam has the same dumb mime block.
You can "fix" this feature of razor by changing the logic_method from 4 (match if any non-contention part is spam) to 5 (match only if all non-contention parts are spam). Of course, this reduces the hit rate. Eventually razor will be fixed to start ignoring null blocks (a byproduct of some mailers) but in the meantime nearly everything that has one matches unless you change the logic method.
and as far as I know, a cf of 5 is pretty low. A lot of "known spam" has cf's well over 20.
I have my min_cf set to 11 and my logic_method set to 5 still get a good amount of hits. (99 of 730 total emails inbound on my server in one particular batch I have on hand). Since making this change as far as I know there have been no more problems with false positives on razor here, except for one SA-Talk posting in which the body is almost entirely quote of a spam message.
At 02:58 PM 11/20/2002 -0600, Jon Gabrielson wrote:
Note: Emails authored under this address do not reflect the opinions of my employer unless otherwise stated. Facts contained are also prone to human error. If either of these statements are not humanly obvious to you, I suggest careful thought before leaping to any other conclusions.I received a false positive from discover card. the line that caused the false positive was:mail 1.1 e=4 sig=FOS353pJ7d8nosBKnYowlZ9MyWsA: Is spam: cf 5 >= min_cf 1 sorry, i can't send the entire message because it is personal in nature. Does anyone know why this would be in the razor database. I know that the razor database is suppose to ignore personalizations, but this seems a bit extreme. Also, a cf of 5 seems a bit high for something that should have only been reported by accident. Jon. ------------------------------------------------------- This sf.net email is sponsored by: Battle your brains against the best in the Thawte Crypto Challenge. Be the first to crack the code - register now: http://www.gothawte.com/rd521.html _______________________________________________ Razor-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/razor-users
-------------------------------------------------------
This sf.net email is sponsored by: Battle your brains against the best in the Thawte Crypto Challenge. Be the first to crack the code - register now: http://www.gothawte.com/rd521.html
_______________________________________________
Razor-users mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/razor-users
