Matt Kettler wrote:
e.g. RCVD_IN_NJABL_PROXY has a value of 1.0 - and yet the FAQ on the
NJABL web site (of course) tells you to set "score NJABL_PROXY 3.0" :-)
But the wonderful authors of SA know far more than I do - so are the
current levels still deemed to be correct?
If one's wrong, they are ALL wrong.
By that do you mean that a false positive in one RBL tends to show up in
them all? Probably too much sharing of data/same sources?
SA's rule scores are evolved based on a real-world test of a
hand-sorted corpus of fresh spam and ham. The whole scoreset is
evolved simultaneously to optimize the placement pattern.
...and that's why I asked :-)
Thanks!
--
Cheers
Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone: +64 3 9635 377 Fax: +64 3 9635 417
PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1
