RE: Question about hit rate

[Chris Santerre]

Sure, no problem. SA only updates its rules on upgrades. Therefore you would have to wait for the latest SA and upgrade to get new rules. Also New rules go thru what is called a GA run. Think of it as VERY intense testing. But the problem with all of this is spammers change way to often. 1 week after a Spamassassin release, they have changed methods to get around.

 

What we did was form the SARE (SpamAssassin Rule Emporium) which has about 15 people who constantly write, tweak, and test rules for SA. (Don't ask me who they are, I'll hurt myself replying!) We have some rulesets that work great and can be found at :

 

http://www.merchantsoverseas.com/wwwroot/gorilla/bigevil.cf

http://www.merchantsoverseas.com/wwwroot/gorilla/99_FVGT_Tripwire.cf

http://www.emtinc.net/includes/backhair.cf  (includes popcorn.cf now!)

http://www.emtinc.net/includes/chickenpox.cf

http://www.emtinc.net/includes/weeds_2.cf 

http://www.yackley.org/sa-rules/evilnumbers.cf

http://mywebpages.comcast.net/mkettler/sa/antidrug.cf

Also check out the link in my sig. There is a small unofficial webring dealing with rules, wikis, and hampsterdance. :) Basically you just put these cf files into your /etc/mail/spamassassin directory for sitewide use. Restart spamd and *boom*!

Some files are updated monthly, weekly, daily, and whenever the hell I feel like it.  :-)

HTH,

Chris Santerre
System Admin and SA Custom Rules Emporium keeper
http://www.merchantsoverseas.com/wwwroot/gorilla/sa_rules.htm
'It is not the strongest of the species that survives,
not the most intelligent, but the one most responsive to change.'
Charles Darwin

-----Original Message-----
From: Paul Randall [mailto:[EMAIL PROTECTED]
Sent: Monday, February 09, 2004 10:29 AM
To: Chris Santerre
Subject: Re: Question about hit rate

Hi Chris,

I wondered if you could tell me. I am pretty new to Spsmassassin. These rules for tripwire, bigevil ... etc that you mentioned. Are they installed by default in the curent Spamassassin distro?

If so then could you tell me where they are installed please?

If not then where can I get them and is there a readme on how to install them?

Thanks loads for your help.

Paul Randall

On 9 Feb 2004, at 14:27, Chris Santerre wrote:

33%-50% of spam making it thru????? No that is not normal. tripwire, bigevil, evilnumbers, backhair.....ect alone should catch more then that. Are you sure they are working???

It should be more like 1-4 per 1000 spams slipping thru.

--Chris

-----Original Message-----

From: Mark A. DeMichele [mailto:[EMAIL PROTECTED]

Sent: Monday, February 09, 2004 8:05 AM

To: [EMAIL PROTECTED]

Subject: Question about hit rate

I'm new to this list and just go started using SpamAssassin a few weeks ago.  I'm currently not set up to use the Bayesian portion. I'm on a windows system and wanted to start off slow.  Plus, I don't quite understand the logic, though I'm there is some.  It seems that most critical part of the Bayesian portion if for users to communicate (some how) to the engine false negatives and positives.  Is this correct?  It seems without that salearn would mark urls of spams that get through as possibly good urls.

Which leads me to my major question. I've downloaded most of the rule files from the Rules Emporium, but even with those rules, 1 out of every 2 or 3 spams still gets through.  Is this normal?

Thanks,

Mark DeMichele