[sniffer] Rulebots gone wild

2006-01-19 Thread Colbeck, Andrew 
By the way, Pete, thank you very much for publicly posting the URL where
we could download FPSigIDs.csv so that we could work on recovering our
own false positives. 

I was able to use this information to selectively re-test all of the
messages detected by those rules.  That was 2,449 messages.  More than
half of those were detected as spam by other Message Sniffer rules,
leaving me with 1,038 messages that I re-queued in my Declude JunkMail
Pro on Ipswitch Imail.

For what it's worth, that 1,038 messages that did not trigger any rules
in the new rulebase included 378 spam messages which were then caught by
my Declude JunkMail Pro configuration.

Andrew 8)



 -Original Message-
 From: [EMAIL PROTECTED] 
 [mailto:[EMAIL PROTECTED] On Behalf Of Pete McNeil
 Sent: Thursday, January 19, 2006 9:15 AM
 To: Jeff Alexander
 Subject: Re: [sniffer] How can I
 
 On Thursday, January 19, 2006, 8:37:01 AM, Jeff wrote:
 
 JA   
 JA  
 JA I have been having a lot of problems with the rules  since Friday.
 JA  
 JA How can I see what rules are set for  spamming.
 
 There are many thousands of rules. For security purposes we 
 don't expose their content freely. If you have false 
 positives, please follow the false positive process and as 
 part of that process, the rules involved with any particular 
 case will be shown to you.
 
 It's not clear from your note but most likely you're trouble 
 is part of a problem we had with our rule-bots a few days 
 ago. The rule-bots have been disabled and the bad rules they 
 created have been rolled out of the core rulebase.
 
 Hope this helps,
 
 _M
 
 
 
 This E-Mail came from the Message Sniffer mailing list. For 
 information and (un)subscription instructions go to 
 http://www.sortmonster.com/MessageSniffer/Help/Help.html
 


This E-Mail came from the Message Sniffer mailing list. For information and 
(un)subscription instructions go to 
http://www.sortmonster.com/MessageSniffer/Help/Help.html

RE: [sniffer] Rulebots gone wild

2006-01-19 Thread David Lewis-Waller 
Andrew

378:1038 is a pretty good ratio, we're seeing something like 7:2 where 7
aren't tagged by Sniffer (SNIIFER-NOTFOUND) but which are marked by Decludes
other tests and found to be SPAM. 

David

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
On Behalf Of Colbeck, Andrew
Sent: 19 January 2006 18:00
To: sniffer@SortMonster.com
Subject: [sniffer] Rulebots gone wild

By the way, Pete, thank you very much for publicly posting the URL where we
could download FPSigIDs.csv so that we could work on recovering our own
false positives. 

I was able to use this information to selectively re-test all of the
messages detected by those rules.  That was 2,449 messages.  More than half
of those were detected as spam by other Message Sniffer rules, leaving me
with 1,038 messages that I re-queued in my Declude JunkMail Pro on Ipswitch
Imail.

For what it's worth, that 1,038 messages that did not trigger any rules in
the new rulebase included 378 spam messages which were then caught by my
Declude JunkMail Pro configuration.

Andrew 8)



 -Original Message-
 From: [EMAIL PROTECTED]
 [mailto:[EMAIL PROTECTED] On Behalf Of Pete McNeil
 Sent: Thursday, January 19, 2006 9:15 AM
 To: Jeff Alexander
 Subject: Re: [sniffer] How can I
 
 On Thursday, January 19, 2006, 8:37:01 AM, Jeff wrote:
 
 JA   
 JA  
 JA I have been having a lot of problems with the rules  since Friday.
 JA  
 JA How can I see what rules are set for  spamming.
 
 There are many thousands of rules. For security purposes we don't 
 expose their content freely. If you have false positives, please 
 follow the false positive process and as part of that process, the 
 rules involved with any particular case will be shown to you.
 
 It's not clear from your note but most likely you're trouble is part 
 of a problem we had with our rule-bots a few days ago. The rule-bots 
 have been disabled and the bad rules they created have been rolled out 
 of the core rulebase.
 
 Hope this helps,
 
 _M
 
 
 
 This E-Mail came from the Message Sniffer mailing list. For 
 information and (un)subscription instructions go to 
 http://www.sortmonster.com/MessageSniffer/Help/Help.html
 


This E-Mail came from the Message Sniffer mailing list. For information and
(un)subscription instructions go to
http://www.sortmonster.com/MessageSniffer/Help/Help.html



This E-Mail came from the Message Sniffer mailing list. For information and 
(un)subscription instructions go to 
http://www.sortmonster.com/MessageSniffer/Help/Help.html