Re: [Declude.JunkMail] Huge reduction in hold queue
On Wednesday, March 30, 2005, 10:35:52 PM, Darin wrote: DC Pete, DC DC Have you make significant changes to the sniffer rulebase in the past couple of days? DC DC I'm seeing a _huge_ reduction in hold queue messages... DC roughly down 65%... while total message volume is steady. Only DC thing I can figure is that the rulebase is suddenly identifying DC most of the messages that fail other tests as well, pushing most DC over the delete limit or other tests like SpamCop, DC Mailpolice, etc. have made significant changes... I've checked a DC few sites for news, but am not seeing anything new. DC DC The sudden change has me a wee bit concerned...cautiously optimistic, but concerned. THis might be better asked on the Sniffer forum rather than Declude's though I'm sure they don't mind. The only thing I can think of is that there has been a greater use of message fragment rules over the past few days in response to some of the newer campaigns. I wouldn't call that a radical change - but it has been a moderately heavy shift. In particular there is a new snake oil campaign that is using a number of randomized obfuscated segments in their message and we've been capitalizing on that. I don't see any significant shifts in the statistics. What I do see is a subtle change in the shape of the new rule capture curve (see the left side of this chart): http://www.sortmonster.com/MessageSniffer/Performance/ChangeRates.jsp I have also seen higher spam rates and SNF capture rates in recent MDLP data on our system: http://www.sortmonster.com/MDLP/MDLP-Example-Short.html What counts in cases like these are false positive rates... If it seems that we're catching a lot more spam then lets be sure it really is spam. So far FP rates are nominal though there is a spike yesterday in the number (this appears to be an automated system that submits FPs from users -- the batch contains a larger than usual number of duplicate submissions -- this happens from time to time with this customer). http://www.sortmonster.com/MessageSniffer/Performance/FalseReportsRates.jsp Hope this helps, _M --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Huge reduction in hold queue
That is very significant, and could explain what I'm seeing. I'm going to increase my delete weight a bit for a while to make sure there are no high FPs. I do see the following detection rates from yesterday (3/30) AHBL 97.4% CBL 99.9% CSMA 97.1% CSMA-SBL 93.4% JAMMDNSBL 76.0% PSBL 96.9% SBL 99.5% SENDERDB-BL 96.4% SNIFFER 98.7% SPAMCOP 99.7% UCEPROTECT1 100% UCEPROTECT2 97.2% rates for all seem to have increased significantly over the past couple of days. BTW, I sent to the Junkmail in part so others could comment on other tests that may have significantly changed. Darin. - Original Message - From: Pete McNeil [EMAIL PROTECTED] To: Darin Cox Declude.JunkMail@declude.com Sent: Thursday, March 31, 2005 8:09 AM Subject: Re: [Declude.JunkMail] Huge reduction in hold queue On Wednesday, March 30, 2005, 10:35:52 PM, Darin wrote: DC Pete, DC DC Have you make significant changes to the sniffer rulebase in the past couple of days? DC DC I'm seeing a _huge_ reduction in hold queue messages... DC roughly down 65%... while total message volume is steady. Only DC thing I can figure is that the rulebase is suddenly identifying DC most of the messages that fail other tests as well, pushing most DC over the delete limit or other tests like SpamCop, DC Mailpolice, etc. have made significant changes... I've checked a DC few sites for news, but am not seeing anything new. DC DC The sudden change has me a wee bit concerned...cautiously optimistic, but concerned. THis might be better asked on the Sniffer forum rather than Declude's though I'm sure they don't mind. The only thing I can think of is that there has been a greater use of message fragment rules over the past few days in response to some of the newer campaigns. I wouldn't call that a radical change - but it has been a moderately heavy shift. In particular there is a new snake oil campaign that is using a number of randomized obfuscated segments in their message and we've been capitalizing on that. I don't see any significant shifts in the statistics. What I do see is a subtle change in the shape of the new rule capture curve (see the left side of this chart): http://www.sortmonster.com/MessageSniffer/Performance/ChangeRates.jsp I have also seen higher spam rates and SNF capture rates in recent MDLP data on our system: http://www.sortmonster.com/MDLP/MDLP-Example-Short.html What counts in cases like these are false positive rates... If it seems that we're catching a lot more spam then lets be sure it really is spam. So far FP rates are nominal though there is a spike yesterday in the number (this appears to be an automated system that submits FPs from users -- the batch contains a larger than usual number of duplicate submissions -- this happens from time to time with this customer). http://www.sortmonster.com/MessageSniffer/Performance/FalseReportsRates.jsp Hope this helps, _M --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re[2]: [Declude.JunkMail] Huge reduction in hold queue
On Thursday, March 31, 2005, 9:50:05 AM, Darin wrote: DC That is very significant, and could explain what I'm seeing. I'm going to DC increase my delete weight a bit for a while to make sure there are no high DC FPs. DC I do see the following detection rates from yesterday (3/30) DC AHBL 97.4% DC CBL 99.9% DC CSMA 97.1% DC CSMA-SBL 93.4% DC JAMMDNSBL 76.0% DC PSBL 96.9% DC SBL 99.5% DC SENDERDB-BL 96.4% DC SNIFFER 98.7% DC SPAMCOP 99.7% DC UCEPROTECT1 100% DC UCEPROTECT2 97.2% DC rates for all seem to have increased significantly over the past couple of DC days. WOW! That's weird. I do not show that at all and I've never seen those tests throw those kinds of numbers (except SNF looks about right): http://www.sortmonster.com/MDLP/MDLP-Example-Short.html For example (a quick spot check) - Data through last noon to midnight-- AHBL shows up at about 22% (21.8409) SPAMCOP shows up at about 64% (63.5114) UCEPROTECCMUL sows up at about 42% (41.6237) UCEPROTECRDO shows up at about 48% (48.0324) Long range data through last midnight-- AHBL shows up at about 16% (16.111) SPAMCOP shows up at about 62% (62.3942) UCEPROTECCMUL shows up at about 42% (41.7421) UCEPROTECRDO shows up at about 49% (48.6102) All in all these indicate nominal performance. Most likely there is something special about the mix of spam you are getting, something wrong with your reporting process, or something else going on that we haven't thought of. To be thorough I also checked some of the MDLP reports from other systems that are beta testing it. With few exceptions they show numbers similar to mine w/ regard to these tests. If I were you I would not make any substantive changes until I tracked down what was going on. No need to introduce additional variables by changing things ;-) DC BTW, I sent to the Junkmail in part so others could comment on DC other tests that may have significantly changed. It's all good :-) _M --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: Re[2]: [Declude.JunkMail] Huge reduction in hold queue
You know, I think was misleading/inaccurate in how I said it. I really meant accuracy, not detection rate. I was thinking detection rate as the number of messages detected as spam by the test that were actually spam, but I should have said accuracy. Sorry for the confusion...language is a funny thing... These are the best tests we run, in terms of catching the most spam, but they're not catching at the percentages below. There are others that are highly accurate as well, but these catch the most volume. My apologies again for the confusion. Darin. - Original Message - From: Pete McNeil [EMAIL PROTECTED] To: Darin Cox Declude.JunkMail@declude.com Sent: Thursday, March 31, 2005 10:36 AM Subject: Re[2]: [Declude.JunkMail] Huge reduction in hold queue On Thursday, March 31, 2005, 9:50:05 AM, Darin wrote: DC That is very significant, and could explain what I'm seeing. I'm going to DC increase my delete weight a bit for a while to make sure there are no high DC FPs. DC I do see the following detection rates from yesterday (3/30) DC AHBL 97.4% DC CBL 99.9% DC CSMA 97.1% DC CSMA-SBL 93.4% DC JAMMDNSBL 76.0% DC PSBL 96.9% DC SBL 99.5% DC SENDERDB-BL 96.4% DC SNIFFER 98.7% DC SPAMCOP 99.7% DC UCEPROTECT1 100% DC UCEPROTECT2 97.2% DC rates for all seem to have increased significantly over the past couple of DC days. WOW! That's weird. I do not show that at all and I've never seen those tests throw those kinds of numbers (except SNF looks about right): http://www.sortmonster.com/MDLP/MDLP-Example-Short.html For example (a quick spot check) - Data through last noon to midnight-- AHBL shows up at about 22% (21.8409) SPAMCOP shows up at about 64% (63.5114) UCEPROTECCMUL sows up at about 42% (41.6237) UCEPROTECRDO shows up at about 48% (48.0324) Long range data through last midnight-- AHBL shows up at about 16% (16.111) SPAMCOP shows up at about 62% (62.3942) UCEPROTECCMUL shows up at about 42% (41.7421) UCEPROTECRDO shows up at about 49% (48.6102) All in all these indicate nominal performance. Most likely there is something special about the mix of spam you are getting, something wrong with your reporting process, or something else going on that we haven't thought of. To be thorough I also checked some of the MDLP reports from other systems that are beta testing it. With few exceptions they show numbers similar to mine w/ regard to these tests. If I were you I would not make any substantive changes until I tracked down what was going on. No need to introduce additional variables by changing things ;-) DC BTW, I sent to the Junkmail in part so others could comment on DC other tests that may have significantly changed. It's all good :-) _M --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Beta protocols
Once upon a time, not so terribly long ago, there were Declude versions. Declude versions came in release and beta, and a user could run one or the other based on best practices decisions by that local user. It was unique in my [albeit limited] experiences, and it got betas groomed and features disseminated fast fast fast. It appears we have come full circle to a situation where selected insiders are testing betas, and the rest of the forum sees more infrequent releases. I recognize that as an obvious and common model, and I can't find specific fault with the approach ...except to note that it is one more aspect of the conversion of Declude from something unique to just another product. -- John Shacklett [EMAIL PROTECTED] [EMAIL PROTECTED] www.continentaloffice.com --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Beta protocols
On 31 Mar 2005 at 11:21, John Shacklett wrote: I fully agree. Especially on the 'insider' part. Declude grew as it did in a large part because of the input from this list - I for one have - as Declude is doing - kept my ideas to myself. -Nick Once upon a time, not so terribly long ago, there were Declude versions. Declude versions came in release and beta, and a user could run one or the other based on best practices decisions by that local user. It was unique in my [albeit limited] experiences, and it got betas groomed and features disseminated fast fast fast. It appears we have come full circle to a situation where selected insiders are testing betas, and the rest of the forum sees more infrequent releases. I recognize that as an obvious and common model, and I can't find specific fault with the approach ...except to note that it is one more aspect of the conversion of Declude from something unique to just another product. -- John Shacklett [EMAIL PROTECTED] [EMAIL PROTECTED] www.continentaloffice.com --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Beta protocols
IMO and I am sure others, Declude continues and will continue to be a unique product in is power and flexibility. You have to remember something here. Declude became to some degree a victim of its own success meaning that it became popular to the point were it could not please everyone all of the time, which is in a way what you are asking it to do. Example, if you are serving 10 people dinner, you can afford to have everyone help and be taste testers. If you are feeding 1000, you prepare a lot different. John T eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of John Shacklett Sent: Thursday, March 31, 2005 8:22 AM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] Beta protocols Once upon a time, not so terribly long ago, there were Declude versions. Declude versions came in release and beta, and a user could run one or the other based on best practices decisions by that local user. It was unique in my [albeit limited] experiences, and it got betas groomed and features disseminated fast fast fast. It appears we have come full circle to a situation where selected insiders are testing betas, and the rest of the forum sees more infrequent releases. I recognize that as an obvious and common model, and I can't find specific fault with the approach ...except to note that it is one more aspect of the conversion of Declude from something unique to just another product. -- John Shacklett [EMAIL PROTECTED] [EMAIL PROTECTED] www.continentaloffice.com --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Beta protocols
I'd like to speak out in favor of public betas. It would help CPHZ to weed out poor design decisions ahead of time, by testing against a broad number of configurations. I think it's better these things are found before the software is released. Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff (Lists) Sent: Thursday, March 31, 2005 12:41 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Beta protocols IMO and I am sure others, Declude continues and will continue to be a unique product in is power and flexibility. You have to remember something here. Declude became to some degree a victim of its own success meaning that it became popular to the point were it could not please everyone all of the time, which is in a way what you are asking it to do. Example, if you are serving 10 people dinner, you can afford to have everyone help and be taste testers. If you are feeding 1000, you prepare a lot different. John T eServices For You --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Beta protocols
Publicly available betas where you request or sign up to be included is one thing and which I support and look forward to. Being able to freely download betas (and interims) at will no longer works. John T eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Andy Schmidt Sent: Thursday, March 31, 2005 9:48 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Beta protocols I'd like to speak out in favor of public betas. It would help CPHZ to weed out poor design decisions ahead of time, by testing against a broad number of configurations. I think it's better these things are found before the software is released. Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff (Lists) Sent: Thursday, March 31, 2005 12:41 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Beta protocols IMO and I am sure others, Declude continues and will continue to be a unique product in is power and flexibility. You have to remember something here. Declude became to some degree a victim of its own success meaning that it became popular to the point were it could not please everyone all of the time, which is in a way what you are asking it to do. Example, if you are serving 10 people dinner, you can afford to have everyone help and be taste testers. If you are feeding 1000, you prepare a lot different. John T eServices For You --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Beta protocols
The main problem with the old system were the users that whined about the lack of documentation in the interims and the lack of notification of new interims. I am glad I don't have to sift through those posts anymore or see Scott for the thousandth time post that the interims are not meant for mass consumption. What I am NOT glad about is the new development speed. With the interims, we went a very long time between official releases, but the development was fast and furious so that by the time the next full release came out it was a vastly improved product rather than the incremental improvements we are getting (or not getting) now. New bug fixes were available for those that needed them, but those of us that didn't need them waited for something we DID need. But then ICS happened and Declude was sold and now the development MUST be different, because now they have to branch out from just Imail. Before, it was one platform, one solution. Now that is no longer the case. Scott had the time and ability to make quick changes to his code because he was intimately familiar with it and because he did not have to spend his time trying to integrate with other systems, nor seeing how such-and-such change affects this setup or that. The introduction of another (and hopefully more in the future) platform for Declude added many variables to the development process that simply weren't there before. So what am I saying? Like it or not, Declude IS different than it was. That doesn't mean it is worse, just different. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff (Lists) Sent: Thursday, March 31, 2005 1:48 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Beta protocols Publicly available betas where you request or sign up to be included is one thing and which I support and look forward to. Being able to freely download betas (and interims) at will no longer works. John T eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Andy Schmidt Sent: Thursday, March 31, 2005 9:48 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Beta protocols I'd like to speak out in favor of public betas. It would help CPHZ to weed out poor design decisions ahead of time, by testing against a broad number of configurations. I think it's better these things are found before the software is released. Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff (Lists) Sent: Thursday, March 31, 2005 12:41 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Beta protocols IMO and I am sure others, Declude continues and will continue to be a unique product in is power and flexibility. You have to remember something here. Declude became to some degree a victim of its own success meaning that it became popular to the point were it could not please everyone all of the time, which is in a way what you are asking it to do. Example, if you are serving 10 people dinner, you can afford to have everyone help and be taste testers. If you are feeding 1000, you prepare a lot different. John T eServices For You --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Lawsuits drive 'Spam King' Richter to bankruptcy
http://www.theregister.co.uk/2005/03/31/spam_king_bankrupt/ Fritz Frederick P. Squib, Jr. Network Operations Citizens Telephone Company of Kecksburg http://www.wpa.net () ascii ribbon campaign - against html email /\- against microsoft attachments --- [This E-mail scanned by Citizens Internet Services with Declude Virus.] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
