On Tue, 25 Sep 2007, feral wrote: > Whatever the case, global bayes or not, or even bayes or not, how > could an email with the obvious porn words in the subject (as in > my examples) NOT get flagged?
If bayes was mistrained to consider such words hammy, then BAYES_00 could drag the score back down below the threshold, cancelling out the points added by HOT_NASTY and PORN_16. One response would be to make the HOT_NASTY and PORN_16 rules "poison pills" by raising their scores well above the threshold (i.e. to 20 or 30 or even 100) - but you would have to *really trust* those rules to do that. And I note that those rules didn't even hit on your first two examples. Both of the domains in those spams are listed in SURBL (but may not have been at the time you received them). URIBL network tests probably would have hit. So it looks to me like two major problems are present: 1) mistrained bayes 2) no network tests occurring (DNS RBLs, URI BLs, razor, etc.) And possibly: 3) not enough rules - add some from SARE? http://www.rulesemporium.com -- John Hardin KA7OHZ http://www.impsec.org/~jhardin/ [EMAIL PROTECTED] FALaholic #11174 pgpk -a [EMAIL PROTECTED] key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79 ----------------------------------------------------------------------- Pelley: Will you pledge not to test a nuclear weapon? Ahmadeinejad: CIA! Secret prison in Europe! Abu Ghraib! -- Mahmoud Ahmadeinejad clumsily dodges a question (60 minutes interview, 9/20/2007) ----------------------------------------------------------------------- 243 days until the Mars Phoenix lander arrives at Mars
