On Sunday, April 4, 2004, 8:34:25 AM, Marc Perkel wrote: > I've gotten very few but some false positives on this rule. And - I > can't tell what link produced the false positive and what to do about it > - which is a separate issue to address.
> The false positives are political in nature - mostly anti-war or > anti-bush stuff. At this point the best solution is probably for you to send me the FP domains to manually whitelist at: whitelist at surbl dot org Please send any you find if you get a chance. > However - many of these messages link to a variety of sites. From what I > understand - the way the current rule works is if ANY link matches then > the rule is triggered. Makes me wonder if there's a way to look at a > situation where if most of the links are not positive - the rules isn't > tripped. Yes any one URI matched against a spam domain will trigger the rule for a given message. One could implement your suggested solution by scoring links within a message, requiring a certain threshold or making the final score an accumulation or average of the individual link scores within a single message having multiple links. One issue with that might be that an average could reward Joe Jobs or invisible links. In other words, a spammer could beat an averaging rule by having say 20 invisible links to legitimate sites and one visible link to their spam site. I'm sure other people have other ideas on this.... Regarding white rules, the best one I can think of is whether a message is signed by someone on your public key ring.... That should get the message an automatic final score of 0. (Not sure why public key encryption has not taken off for mail. It seems entirely logical and useful to me....) Jeff C. -- Jeff Chan mailto:[EMAIL PROTECTED] http://www.surbl.org/
