RE: Question about hit rate

[Mark A. DeMichele]

Thanks.  I have all those rules now that I fixed the “txt” extension problem earlier.  However, since I fixed it about an hour ago,  I received 9 spams.  6 were marked correctly and 3 made it through.  I know things are kind of working because when I look at their headers, they do in fact have scores.  Unfortunately the scores are less than 5.   Also, I found set of blacklist files at http://www.stearns.org/sa-blacklist/   The instructions to install them are kind of weird.  It seems to me that I can just put the sa-blacklist.current.cf and sa-blacklist.current.uri.cf files in  the rules folder and it should just work.   Does anyone know about these files?   BTW, I’m using No Spam Today! on windows as a SMTP proxy.  The way it’s set up, it shell’s out to spamassassin each and every time.  So when you change rules you don’t have to restart anything.  This doesn’t seem to be the most optimal setup, but it works.   Thanks again for your responses.   Mark DeMichele   P.S.   Also, can someone tell me if I can leave the senders e-mail addresses in my To: when I reply.   Thanks again.   From: Chris Santerre [mailto:[EMAIL PROTECTED] Sent: Monday, February 09, 2004 10:58 AM To: 'Paul Randall' Cc: Spamassassin-Talk (E-mail) Subject: RE: Question about hit rate   Sure, no problem. SA only updates its rules on upgrades. Therefore you would have to wait for the latest SA and upgrade to get new rules. Also New rules go thru what is called a GA run. Think of it as VERY intense testing. But the problem with all of this is spammers change way to often. 1 week after a Spamassassin release, they have changed methods to get around.   What we did was form the SARE (SpamAssassin Rule Emporium) which has about 15 people who constantly write, tweak, and test rules for SA. (Don't ask me who they are, I'll hurt myself replying!) We have some rulesets that work great and can be found at :   http://www.merchantsoverseas.com/wwwroot/gorilla/bigevil.cf http://www.merchantsoverseas.com/wwwroot/gorilla/99_FVGT_Tripwire.cf http://www.emtinc.net/includes/backhair.cf  (includes popcorn.cf now!) http://www.emtinc.net/includes/chickenpox.cf http://www.emtinc.net/includes/weeds_2.cf  http://www.yackley.org/sa-rules/evilnumbers.cf http://mywebpages.comcast.net/mkettler/sa/antidrug.cf Also check out the link in my sig. There is a small unofficial webring dealing with rules, wikis, and hampsterdance. :) Basically you just put these cf files into your /etc/mail/spamassassin directory for sitewide use. Restart spamd and *boom*! Some files are updated monthly, weekly, daily, and whenever the hell I feel like it.  :-) HTH, Chris Santerre System Admin and SA Custom Rules Emporium keeper http://www.merchantsoverseas.com/wwwroot/gorilla/sa_rules.htm 'It is not the strongest of the species that survives, not the most intelligent, but the one most responsive to change.' Charles Darwin -----Original Message----- From: Paul Randall [mailto:[EMAIL PROTECTED] Sent: Monday, February 09, 2004 10:29 AM To: Chris Santerre Subject: Re: Question about hit rate Hi Chris,   I wondered if you could tell me. I am pretty new to Spsmassassin. These rules for tripwire, bigevil ... etc that you mentioned. Are they installed by default in the curent Spamassassin distro?   If so then could you tell me where they are installed please? If not then where can I get them and is there a readme on how to install them?   Thanks loads for your help.   Paul Randall   On 9 Feb 2004, at 14:27, Chris Santerre wrote:   33%-50% of spam making it thru????? No that is not normal. tripwire, bigevil, evilnumbers, backhair.....ect alone should catch more then that. Are you sure they are working??? It should be more like 1-4 per 1000 spams slipping thru. --Chris -----Original Message----- From: Mark A. DeMichele [mailto:[EMAIL PROTECTED] Sent: Monday, February 09, 2004 8:05 AM To: [EMAIL PROTECTED] Subject: Question about hit rate   I'm new to this list and just go started using SpamAssassin a few weeks ago.  I'm currently not set up to use the Bayesian portion. I'm on a windows system and wanted to start off slow.  Plus, I don't quite understand the logic, though I'm there is some.  It seems that most critical part of the Bayesian portion if for users to communicate (some how) to the engine false negatives and positives.  Is this correct?  It seems without that salearn would mark urls of spams that get through as possibly good urls.   Which leads me to my major question. I've downloaded most of the rule files from the Rules Emporium, but even with those rules, 1 out of every 2 or 3 spams still gets through.  Is this normal?   Thanks,   Mark DeMichele