Re: DCC worth it?
Based on how far their mailing lists go back, Razor and DCC have been around since the 2000/2001 time period, and as far as I can tell were independent projects. In fact, they're based on different goals/models, which is why it's useful to use both of them. Razor is interested in specifically identifying spam, so it provides a way to both report and revoke emails (technically hashes of emails). DCC determines how bulky or massive a bulk or mass mail is, not how spammy it is, which is why whitelisting is so important in DCC ( Perhaps you were thinking of Pyzor, which did come about because of Razor's semi-closed source nature? (and yes, I know all about top-posting being a no-no, but there was no obvious place to jump in to the following thread, and yet it seemed important for context) On Thu, 19 Oct 2006, Jo Rhett wrote: Matt Kettler wrote: Which policy change is that? And what community has DCC lost support in? (and then he answers his own question) that's not exactly recent. (Spring 2005) Sorry, after doing this for 20 years anything that happened a year ago is recent. Sorry if that confused you. I'd also not call that a policy decision, as that implies it was made Again, wording. Sorry. Decisions forced versus decision freely made are both decisions. You're right, I could have been more specific but I wans't aiming for that level of accuracy when I mumbled this. I've not seen anything resembling loss of community support for DCC as a result. shrug 2 years ago everyone I know used DCC. Now, my employer is the last remaining site that I know of using DCC. They were one of the first public DCC servers (2 digit number) and strongly support Vernon. And they are ~2 weeks away from shutting that down forever. which is pretty much why Razor sprang into existence. Your facts are pretty far off here. (snip) Sorry, level of accuracy was related to my own personal observations. Nobody that I know of used Razor until DCC became difficult. I know that we used to compile without razor support locally. I think I'll take my own advice and not reply on things that I don't know the in-depth details of. -- Public key #7BBC68D9 at| Shane Williams http://pgp.mit.edu/| System Admin - UT iSchool =--+--- All syllogisms contain three lines | [EMAIL PROTECTED] Therefore this is not a syllogism | www.ischool.utexas.edu/~shanew
Re: DCC worth it?
John Andersen wrote: Contemplating adding DCC to my SA config. I already do the SURBL tests and Razor2. Will I likely gain any thing via this? Does DCC catch what other tests miss? DCC and Razor are very similar in approach. DCC has recently lost a lot of community support due to policy decisions made by the guy who runs it, which is pretty much why Razor sprang into existence. We have them in parallel on one of our work systems, and I can't say that DCC is better than Razor. It catches some that Razor misses, but Razor seems to catch more than DCC misses. 95% of the time they are identical in result. -- Jo Rhett Network/Software Engineer Net Consonance
Re: DCC worth it?
In my experience (which is not statistically comfirmed), Razor catches more spam than DCC. Usually if DCC hits, then Razor will probably also hit. This is not true the other way around: if Razor hits, DCC regularly doesn't hit. Giampaolo's comments are also valid: if they both hit, you get higher scores, which may just be enough to push a spam above your required_score. Leander On 19-okt-2006, at 10:15, Jo Rhett wrote: John Andersen wrote: Contemplating adding DCC to my SA config. I already do the SURBL tests and Razor2. Will I likely gain any thing via this? Does DCC catch what other tests miss? DCC and Razor are very similar in approach. DCC has recently lost a lot of community support due to policy decisions made by the guy who runs it, which is pretty much why Razor sprang into existence. We have them in parallel on one of our work systems, and I can't say that DCC is better than Razor. It catches some that Razor misses, but Razor seems to catch more than DCC misses. 95% of the time they are identical in result. -- Jo Rhett Network/Software Engineer Net Consonance -- Leander Koornneef ICS B.V. [EMAIL PROTECTED] http://www.ic-s.nl ICS biedt Service Support, Development en Consultancy op uiteenlopende internet-gerelateerde platformen, met een voorliefde voor Open Source. Let op: mijn emailadres is gewijzigd naar: [EMAIL PROTECTED]
Re: DCC worth it?
Jo Rhett wrote: John Andersen wrote: Contemplating adding DCC to my SA config. I already do the SURBL tests and Razor2. Will I likely gain any thing via this? Does DCC catch what other tests miss? DCC and Razor are very similar in approach. DCC has recently lost a lot of community support due to policy decisions made by the guy who runs it, Which policy change is that? And what community has DCC lost support in? SA had to make DCC disabled by default due to licensing changes, but that's not exactly recent. (Spring 2005) I'd also not call that a policy decision, as that implies it was made by choice to suit his policy desires. DCC's technology base turned out to be patented by a company that clearly invented it first (patent filed Jan of 1999). DCC's policies changed to avoid Vernon being sued into the ground. And let's face it, the changes aren't really particularly egregious, and I've not seen anything resembling loss of community support for DCC as a result. which is pretty much why Razor sprang into existence. Your facts are pretty far off here. Razor did not spring into existence in reaction to DCC policy changes. In fact, Razor slightly pre-dates DCC. Razor was first created by Vipul in 1999, with it's first public release on of 0.24 May 22, 2000. DCC started in 2000 and did not enter production use until winter of 2000. Also, Razor support has been in SpamAssassin longer than DCC has. SpamAssassin 1.0 was released in September of 2001 and supported Razor (v1). It did not support DCC. We have them in parallel on one of our work systems, and I can't say that DCC is better than Razor. It catches some that Razor misses, but Razor seems to catch more than DCC misses. 95% of the time they are identical in result. I find they have quite different coverage. Particularly since razor added e8. That said, I've got a lot of problems with DCC false-positives on mass-volume mail, and I've not been able to make dcc whitelists work properly under my copy of SA.
Re: DCC worth it?
Jeff Moss wrote: pain in the butt. In particular dealing with its log files. By default it creates thousands of them a day. There is a way to cut that down to hundreds a day by editing the configuration file. But you still have to run a cron job to keep them from eating your hard drive. Not true. You can disable logging completely in your conf file. Something to the effect of leaving the following options empty... DCCM_LOGDIR= DCCM_LOG_AT= -- Robert Blayzor, BOFH INOC, LLC rblayzor\@(inoc.net|gmail.com) PGP: 0x66F90BFC @ http://pgp.mit.edu Key fingerprint = 6296 F715 038B 44C1 2720 292A 8580 500E 66F9 0BFC Any sufficiently advanced bug is indistinguishable from a feature. - Kulawiec
Re: DCC worth it?
I use DCC, Razor and Pyzor. I only installed Pyzor because I thought the more opinions I get on an email the better. By using all 3 I get more spam emails rejected than if I just use DCC and Razor. It helps raise the score of the spam emails. Bill - Original Message - From: John Andersen To: users@spamassassin.apache.org Sent: Thursday, October 19, 2006 3:07 AM Subject: DCC worth it? Contemplating adding DCC to my SA config. I already do the SURBL tests and Razor2. Will I likely gain any thing via this? Does DCC catch what other tests miss? -- _ John Andersen
Re: DCC worth it?
This seems to extreme to be true. I think you need to fix your DCC setup :-) On 19-okt-2006, at 15:19, Coffey, Neal wrote: John Andersen wrote: Contemplating adding DCC to my SA config. I already do the SURBL tests and Razor2. Will I likely gain any thing via this? Does DCC catch what other tests miss? For what it's worth, this is from seven days of logging on my company's mail server: $ zgrep RAZOR2_ spamc.log.?.gz |wc -l 49054 $ zgrep DCC_ spamc.log.?.gz |wc -l 0 And yes, I have DCC enabled. $ pwd /etc/mail/spamassassin $ grep ^loadplugin.*DCC * v310.pre:loadplugin Mail::SpamAssassin::Plugin::DCC Now, granted, there might be a problem loading or running the DCC plugin. I haven't looked to see, yet. I'm a little surprised that nothing's triggered it in the last week, but Razor2 has *always* been significantly more effective than DCC at my site, so I'm not at all worried by it. Incidentally, the breakdown looks like this: Type Total% --- All Messages 119528 100 Spam 9816882 Spam w/Razor2 4905441 Percent of Spam w/Razor250 -- Leander Koornneef ICS B.V. Stadhouderslaan 57 3583 JD Utrecht T: +31 30 63 55 730 F: +31 30 63 55 731 E: [EMAIL PROTECTED] I: http://www.ic-s.nl ICS biedt Service Support, Development en Consultancy op uiteenlopende internet-gerelateerde platformen, met een voorliefde voor Open Source. Let op: mijn emailadres is gewijzigd naar: [EMAIL PROTECTED]
Re: DCC worth it?
My statistics look like this. This is from one lower volume server and is only since logs rotated at 4am Sunday morning. DCC - 38,521 (DCC_CHECK) Razor - 52,596 (RAZOR2_CHECK) Pyzor - 11,201 (PYZOR_CHECK) And for the heck of it: DIGEST_MULTIPLE 38,562 Bill - Original Message - From: Giampaolo Tomassoni To: users@spamassassin.apache.org Sent: Thursday, October 19, 2006 8:23 AM Subject: R: DCC worth it? I use DCC, Razor and Pyzor. It is quite like my conf. I only installed Pyzor because I thought the more opinions I get on an email the better. By using all 3 I get more spam emails rejected than if I just use DCC and Razor. It helps raise the score of the spam emails. I have pyzor too, but I'm not shure it is actually working: I don't get anymore a PYZOR_something tag in suspicious e-mails. This started happening a couple of weeks ago. Also, anonymous reporting to pyzor seems simply ineffective to me. What's your feedback about this? Bill giampaolo - Original Message - From: John Andersen To: users@spamassassin.apache.org Sent: Thursday, October 19, 2006 3:07 AM Subject: DCC worth it? Contemplating adding DCC to my SA config. I already do the SURBL tests and Razor2. Will I likely gain any thing via this? Does DCC catch what other tests miss? -- _ John Andersen
RE: DCC worth it?
Leander Koornneef wrote: On 19-okt-2006, at 10:15, Jo Rhett wrote: John Andersen wrote: Contemplating adding DCC to my SA config. I already do the SURBL tests and Razor2. Will I likely gain any thing via this? Does DCC catch what other tests miss? DCC and Razor are very similar in approach. DCC has recently lost a lot of community support due to policy decisions made by the guy who runs it, which is pretty much why Razor sprang into existence. We have them in parallel on one of our work systems, and I can't say that DCC is better than Razor. It catches some that Razor misses, but Razor seems to catch more than DCC misses. 95% of the time they are identical in result. In my experience (which is not statistically comfirmed), Razor catches more spam than DCC. Usually if DCC hits, then Razor will probably also hit. This is not true the other way around: if Razor hits, DCC regularly doesn't hit. Giampaolo's comments are also valid: if they both hit, you get higher scores, which may just be enough to push a spam above your required_score. I see a few more hits for Razor than DCC, but they both do pretty good. # zgrep -c RAZOR2_ maillog.1.gz 2062 # zgrep -c DCC_ maillog.1.gz 1770 Razor and DCC are a bit different. Razor tracks messages that are considered to be spam. DCC doesn't care if the message is spam or not, all it cares about is volume. If the same message is sent to lots of recipients, you can expect to match it with DCC. I find using Razor and DCC together works quite well. I used Pyzor for a while, but it didn't catch as much and used more CPU than the other two, so I removed it. -- Bowie
Re: DCC worth it?
Matt Kettler wrote: Which policy change is that? And what community has DCC lost support in? (and then he answers his own question) that's not exactly recent. (Spring 2005) Sorry, after doing this for 20 years anything that happened a year ago is recent. Sorry if that confused you. I'd also not call that a policy decision, as that implies it was made Again, wording. Sorry. Decisions forced versus decision freely made are both decisions. You're right, I could have been more specific but I wans't aiming for that level of accuracy when I mumbled this. I've not seen anything resembling loss of community support for DCC as a result. shrug 2 years ago everyone I know used DCC. Now, my employer is the last remaining site that I know of using DCC. They were one of the first public DCC servers (2 digit number) and strongly support Vernon. And they are ~2 weeks away from shutting that down forever. which is pretty much why Razor sprang into existence. Your facts are pretty far off here. (snip) Sorry, level of accuracy was related to my own personal observations. Nobody that I know of used Razor until DCC became difficult. I know that we used to compile without razor support locally. I think I'll take my own advice and not reply on things that I don't know the in-depth details of. -- Jo Rhett Network/Software Engineer Net Consonance
Re: DCC worth it?
On Thursday 19 October 2006 01:01, Leander Koornneef wrote: . Giampaolo's comments are also valid: if they both hit, you get higher scores, which may just be enough to push a spam above your required_score. Ah, well then that's not an issue for me. If razor-50-100 hits its already spam as far as I'm concerned. The vary nature of razor says that particular body has been seen a large number of times already by a wide range of people. Defacto spam for my purposes. -- _ John Andersen
