> I propose that these tests be done first and that they be
> considered preemptive, i.e. if a message scores high enough on
> blacklist/whitelist lookups and maybe some other tests, that further
processing
> be abandoned and the message declared spam. That will save a lot of cpu
cycles.
I suggest that to make this work that either SA or the rulsets designers
need a way to categorize negative scoring tests, so that all of them can be
run before other preemptive tests.
Note that explicit whitelists are not the only negative scoring tests;
anyone can write any sort of test with a negative score. Further, such a
negative scoring test might be a meta that depends on the previous running
of some other(s) positive scoring tests, requiring some unknown tree of
positive scoring tests to be run before the negative scoring test can be
run.
And as mentioned by others at various times, Bayes can score either
direction, so needs to be run before the cutoss decision can be made.
Of course, just because a mail hits one or more negative scoring tests, it
may still end up being classified quite correctly as spam. This implies
that is negative-scoring tests are run first, that this isn't sufficient for
anything other than negating an early shortcut out of further rule
processing.
This itself could be shortcutted (if that is a word) if SA could detemine
the maximium possible positive score that could be achieved with the current
rules. This would potentially allow an 'inverse gtube' where a rule could
have a sufficient negative score that no combination of other rules could
overcome the negative score and go over the spam threshold.
If all negative rules were run before all positive rules, it would be
possible to devise early cutoff points:
a) if the negative score cannot possibly be overcome by any combination
of positive scores. This can occur before all negative score rules are run.
b) if all negative scores plus the current positive score total causes
the mail to be spam.
Loren
