Matt, I think Fox was saying that he was in fact using Logic Method 5 to begin with.
Again Fox, even if limited to private mail, we'd like to understand the nature of the problem by learning one (or more) sets of the signatures in question. We all of course doubt a hash collision is occurring, but that's just as speculative as saying there is a collision without any proof or understanding of what's happening (versus a bug in the Unix razor-agents software, which has been known to happen ;-) ). --jordan On Wed, Jan 22, 2003 at 01:38:08PM -0500, Matt Kettler wrote: # Did the message original in question have any attachments or embedded # images? You've copy-pasted the text body, but that really gives us little # hint as to what the original mime-encoded message looked like. # # Razor will by default alert if *any* mime part of the email is in the # database, not just the "body". So if a spam message comes by with an # embedded background image and is reported by a few people both the message # and the background image will be listed as spam. If later a nonspam message # uses the same embedded image, it will be reported by razor-check as being # spam because of the image. # # Now, that sounds pretty bad, but razor does have the concept of # "contention" where the same mime part commonly appears in both spam and # nonspam and stops considering them spam parts, however this relies on you # revoking the messages that are false hits. # # You can see which mime part was matched if you look at the output of # razor-check -d. # # You can also force razor to only match if all non-contention mime parts are # spam, instead of any one part. This can cause the false negative rate to go # up a lot, but will drive the false positive rate down quite a lot too. # # In your razor-agent.conf you can set the logic_method to 5 to change this: # # #flag if any non-contention part listed (default setting) # #logic_method = 4 # #flag message only if all non-contention parts are listed # logic_method = 5 # # Personally I run razor with logic_method 5 because I'd much rather have a # razor setup that I can have a very strong confidence in it not being false # positive than one which catches a lot of spam. # # At 09:15 AM 1/22/2003 -0500, Fox wrote: # >This morning I have two razor false positives. I have -lm 5 running with # >2.20. # > # >One is a very confidential message between my company and our law firm # >about # >a specific case, which I cannot possibly post to this list or even talk # >about. Certainly not going to be a duplicate. And then there is the the # >one below. There _must_ be hash collisions going on. # > # >Fox # # # # ------------------------------------------------------- # This SF.net email is sponsored by: Scholarships for Techies! # Can't afford IT training? All 2003 ictp students receive scholarships. # Get hands-on training in Microsoft, Cisco, Sun, Linux/UNIX, and more. # www.ictp.com/training/sourceforge.asp # _______________________________________________ # Razor-users mailing list # [EMAIL PROTECTED] # https://lists.sourceforge.net/lists/listinfo/razor-users
msg00565/pgp00000.pgp
Description: PGP signature
