RE: [Razor-users] Too many false positives

2004-07-28 Thread Andrew McNaughton
on people. How strong are the safeguards? Andrew On Mon, 26 Jul 2004 [EMAIL PROTECTED] wrote: Date: Mon, 26 Jul 2004 11:52:53 -0700 From: [EMAIL PROTECTED] To: [EMAIL PROTECTED], [EMAIL PROTECTED] Subject: RE: [Razor-users] Too many false positives Andrew, Can you give me some examples? 5% sounds way too

RE: [Razor-users] Too many false positives

2004-07-26 Thread Rob
> -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of > [EMAIL PROTECTED] > > We also discovered a bug in the backend implementation of Whiplash > that affects a small percentage of Whiplash signatures and can > potentially cause FPs. Again, example FP

RE: [Razor-users] Too many false positives

2004-07-26 Thread vipul
, July 26, 2004 12:26 AM To: [EMAIL PROTECTED] Subject: Re: [Razor-users] Too many false positives I've been poking around in the razor source code, and it appears that the identification of domains has a serious bug. http://www.greenpeace.org.nz/ is shortened to org.nz http://www.scoop.co.n

RE: [Razor-users] Too many false positives

2004-07-26 Thread vipul
Andrew, Can you give me some examples? 5% sounds way too high. We also discovered a bug in the backend implementation of Whiplash that affects a small percentage of Whiplash signatures and can potentially cause FPs. Again, example FPs would be helpful to determine if you are affected by this

Re: [Razor-users] Too many false positives

2004-07-26 Thread Theo Van Dinter
On Mon, Jul 26, 2004 at 07:26:21PM +1200, Andrew McNaughton wrote: > Does anyone know where to find an existing table or lookup system giving > the level at which various domains are made publically available? Is > there any sort of mechanism which could avoid having to maintain a list > like t

Re: [Razor-users] Too many false positives

2004-07-26 Thread Ketil Froyn
On Mon, 2004-07-26 at 08:26, Andrew McNaughton wrote: > I'm thinking this needs to be handled with a hash lookup on the top level > domain which returns the levle at which the domain is to be treated. That won't work, because some TLDs accept registrations on both the second and third level. And

Re: [Razor-users] Too many false positives

2004-07-26 Thread Andrew McNaughton
I've been poking around in the razor source code, and it appears that the identification of domains has a serious bug. http://www.greenpeace.org.nz/ is shortened to org.nz http://www.scoop.co.nz/ is shortened to co.nz Here's the problem code: # See if it's a non country domain. If so

Re: [Razor-users] Too many false positives...goodbye, razor

2003-02-12 Thread Theo Van Dinter
On Wed, Feb 12, 2003 at 01:26:05PM -0500, Matt Kettler wrote: > Nice, those numbers are quite informative Theo. Makes me think that I was > right to set my min_cf to 11, effectively eliminating the noise present in > range_01_10, which seems to have a pretty bad S/O. > > It also makes me think t

Re: [Razor-users] Too many false positives...goodbye, razor

2003-02-12 Thread Craig Hughes
On Tuesday, February 11, 2003, at 10:47 PM, Jot Powers wrote: inadequate job of compensating for them. I'm seeing far too many false positives, including Merriam-Webster's "Word of the Day", eBay outbid notification, and E*TRADE dividend notices...all of which are important personal messages or

Re: [Razor-users] Too many false positives...goodbye, razor

2003-02-12 Thread Matt Kettler
Nice, those numbers are quite informative Theo. Makes me think that I was right to set my min_cf to 11, effectively eliminating the noise present in range_01_10, which seems to have a pretty bad S/O. It also makes me think that upping my min_cf past 11 is also well worth it. Thanks for posting

Re: [Razor-users] Too many false positives...goodbye, razor

2003-02-11 Thread Jot Powers
> inadequate job of compensating for them. I'm seeing far too many > false positives, including Merriam-Webster's "Word of the Day", eBay > outbid notification, and E*TRADE dividend notices...all of which are > important personal messages or opt-in mailing lists. False positives The key is, are

Re: [Razor-users] Too many false positives...goodbye, razor

2003-02-11 Thread Theo Van Dinter
On Tue, Feb 11, 2003 at 06:30:46PM -0500, Matt Kettler wrote: > In general it seems to be rare that it FPs when the cf is very high, but > there's a LOT of flaky matches in the lower end. Well, based on ~90k messages (wow, that's not many...) that are from a recent spamassassin mass-check run: O

Re: [Razor-users] Too many false positives...goodbye, razor

2003-02-11 Thread Matt Kettler
I'll totaly agree that razor does need to do a bit more to comp-out the FPs.. I'm considering upping my production min_cf again (I'm currently at 11). In general it seems to be rare that it FPs when the cf is very high, but there's a LOT of flaky matches in the lower end. Today I got a false po