On Wednesday 14 Sep 2005 22:44, jdow wrote:
> From: "Rob Skedgell" <[EMAIL PROTECTED]>
>
> On Tuesday 13 Sep 2005 21:15, Markus Eskola wrote:
> [...]
>
> > Just a quick question regarding the reporting... Do you guys report
> > all spam (including the once that SA allready caught) or only the
> > ones that got thru the net?
> >
> > Currently in my setup I have 3-4 diffrent users who move all the
> > spam that got thru into certain folders eg SPAM under IMAP. These
> > folders are scanned, emptied and reported once a night thru a
> > script. If someone has a more effectie way, I'd appreciate a hint
> > in the right direction.
>
> Most of it (5.0 <= score <= 30.0) gets LARTed by a java program that
> goes through the "confirmed spam" IMAP folder to the
^^^^^^^^^ e.g. *manually* confirmed as spam, not
just scored/flagged as such
[...]
> Ah, you are one of the people polluting the BLs. Thanks.... not.No. It was entirely my fault for not making it clearer that I do check the confirmed spam folder very carefully first, before running the reporting tool. It most certainly doesn't do anything like running from cron, nor will it ever do that. If the IMAP seen flag isn't set on a mail in that folder, it gets skipped as a safeguard against carelessness on my part - the last thing I want is a mail that's just been delivered to be reported without checking. > > Why not be a little saner and adopt a score higher than 5.0, a very > marginal spam score, for reporting. That way you are not reporting > false alarms and injuring innocent people. See above. It's actually (score>=5.0 && manually_confirmed_as_spam) I should stress that any mails I report are checked manually *first*. False positives do *not* go to NANAS, SpamCop, the originating ISP etc. False positives get dragged out of the spam folder, my whitelists fixed (sometimes via whitelist_from_rcvd, sometimes in the PostgreSQL database used by a couple of ACLs, depending on the context). You can check the NANAS posts here <http://groups.google.co.uk/groups?q=group:[EMAIL PROTECTED]&start=0&scoring=d&> if you like. See many false positives? No, nor me. I very rarely mis-identify a false positive as spam, and on those rare occasions the abuse contact who just got the LART in error gets a grovelling apology from me for wasting their time. -- Rob Skedgell <[EMAIL PROTECTED]>
pgp6PTjZDTQMD.pgp
Description: PGP signature
