KHOP_RCVD_UNTRUST

2009-10-19 Thread Bowie Bailey
After testing the khop rules for a few days, I noticed one oddity.

TOP HAM RULES FIRED

RANKRULE NAME   COUNT %OFRULES %OFMAIL %OFSPAM 
%OFHAM

   8KHOP_RCVD_UNTRUST 410 3.27   11.400.20  
19.39


This is a 1-point rule which is hitting 19% of my ham and almost no
spam.  Should this rule be removed, or at least scored lower?

-- 
Bowie



Re: KHOP_RCVD_UNTRUST

2009-10-19 Thread Warren Togami

On 10/19/2009 10:11 AM, Bowie Bailey wrote:

After testing the khop rules for a few days, I noticed one oddity.

TOP HAM RULES FIRED

RANKRULE NAME   COUNT %OFRULES %OFMAIL %OFSPAM
%OFHAM

8KHOP_RCVD_UNTRUST 410 3.27   11.400.20
19.39


This is a 1-point rule which is hitting 19% of my ham and almost no
spam.  Should this rule be removed, or at least scored lower?



KHOP rules contained some useful ideas, but many appeared to be suspect 
to me so I didn't use it myself.  They need to be tested in nightly 
masscheck to determine their true safety and efficacy.


Warren Togami
wtog...@redhat.com


Re: KHOP_RCVD_UNTRUST

2009-10-19 Thread Adam Katz
Bowie Bailey wrote:
 After testing the khop rules for a few days, I noticed one oddity.
 
 TOP HAM RULES FIRED
 -
 RANKRULE NAME   COUNT %OFRULES %OFMAIL %OFSPAM %OFHAM
 -
8KHOP_RCVD_UNTRUST 410 3.27   11.400.20  19.39
 -
 
 This is a 1-point rule which is hitting 19% of my ham and almost
 no spam.  Should this rule be removed, or at least scored lower?

It fires only on mail passing through third-party-whitelisted relays
like HostKarma-W and DNSWL.  That one point is merely limiting the 2+
negative points assigned by the relays, so the net is still negative.

However, I've been noticing those third-party-whitelisting relays
steadily improve over time.  My numbers don't lean quite as favorably
towards ham as yours, but they've moved quite a bit from the original
ratio.