> -----Original Message----- > From: Matt Kettler [mailto:[EMAIL PROTECTED] > Sent: Thursday, February 16, 2006 22:50 > To: Chris Santerre > Cc: users@spamassassin.apache.org > Subject: Re: Over-scoring of SURBL lists... > > Chris Santerre wrote: > > Matt Kettler wrote: > > >> My FPs fall into two categories: > >> > >> 1) URIs that would likely never appear outside of a specialty > >> newsletter. I've had lots of hits on things like: > >> -Authors of programmer's tools > >> -producers of electronic parts > >> -producers of embedded computer systems (Note: embedded, > not normal > >> computers.. > >> companies like versalogic.com that make parts that only a kiosk > >> manufacturer or extreme geek would use) > > > > Agreed. And we have seen these be more JoeJobs. But some > are not. Some > > simply hire mass emailers thinking they are legit, only to find out > > they are not. Just because they are legit for you, doesn't > mean they > > haven't spammed someone else. You ask, we remove. > > Yes, the only problem is that I'm getting tired of having to > track down sample emails for FPs so I can find which URI a > URIBL FPed on. > > But really, how often or not a URIBL FP's isn't really the > point. The point is they DO FP, and it's really quite common > for FP's to be multi-listed. That multi-listing wields some > hefty score biases, way beyond the power of any other rule in > spamassassin other than BLACKLIST_* and GTUBE. > > I merely find it to be a big problem that URIBLs on the > general whole are rather FP prone, and prone to "cascades" of > FPs which unleashes havoc from the strong scores the > perceptron gave them. > > I think the reason the perceptron gave them such high scores > is that a lot of URIBL FP problems get fixed fairly quickly, > within a matter of hours. Ditto for a lot of FN problems. > > By the time the mass-checks are run, the URI's in the corpus > emails are likely well sorted by the reports given to the URIBLs. >
Sounds like someone's having a bad day ;) Let me remind you, 1) you control which uribl's you run 2) you control how they score If you have a FP problem and you don't feel like helping us solve it, then reduce the possibility of a "URIBL only FP" by either eliminating certains lists or adjust the scores. But don't yell when your spam accuracy drops. I'm all ears if you have a better mechanism for blocking text spam with single uri that are rotated hourly, daily, etc. If you do have something, its obviously not in SA right now because those f'ers fly right through without URIBLs. Dallas
