Jo Rhett wrote:
And frankly I disagree with the logic that rules that hit wrongly
shouldn't be fixed unless it raises the score about 5.0. I simply
couldn't function with *ANY* of my mailboxes at 5.0 -- I'd be deleting
1-2 pieces of spam per minute. I run my public mailboxes at 3.8 and I'm
trying to determine if 3.2 is reasonable.
FWIW, I've been running customer mail at 5, and a few role accounts at 8
or 9. Over the long term (going on 5 years now, I think - when was
SA2.4 released?), it's worked pretty well. I've always looked to either:
-> add new rules that target messages that slip past at a threshold of
5; scored depending on how nasty the spam is and how much is coming
through.
-> bump scores on rules that seem to be hitting a lot of spam that's
getting through
-> (at least, once Bayes was part of SA <g>) feed missed spam back into
Bayes manually to complement the autolearning (which worked pretty well
for me, and without which I'd have very VERY little ham learned at all).
In the past I reported a fair chunk of spam to Razor, although I gave
that up shortly after they went commercial and the reporting process
was, erm, unreliable, for about 6 months.
Most third-party rules are scored to get spam over that threshold of 5
largely because, IME, most people seem to be quite happy to leave it at
5; if you're running a lower score, you WILL see FPs unless you *drop*
the scores on some of the heavier rules. I probably saw at one point;
what scores are these FPs getting on your system?
I've had ONE customer that I ended up dropping the threshold to 4.8,
because they kept getting spam that was *just* under 5. (I think I
bumped it back up to 4.9 because of FPs. *sigh*) IIRC they're also the
only customer that regularly seems to get pornspam (tagged or otherwise).
-kgd
- Re: complete false hits for BASE64 and LW_STOCK_SPAM4 Kris Deugau
-
