> https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6660
On 09/25/2011 10:43 AM, John Hardin wrote on bugzilla: >> header __NSL_RCVD_FROM_41 X-Spam-Relays-External =~ / >> ip=41\./ > > Hrm. I'm now wondering whether having __NSL_RCVD_FROM_41 as a subset of > __RCVD_VIA_AFRINIC has any value... On Sun, 25 Sep 2011, John Hardin amended privately: > Actually, it's more a subset of __RCVD_VIA_AFRINIC_E since > __RCVD_VIA_AFRINIC is anchored on the last external. > > Would you be willing to remove the "nopublish" from > __RCVD_VIA_AFRINIC_E? That rule may be handy in metas. I have only one issue with releasing the rest of the __RCVD_VIA_* rules, which is a very stern reminder that using them is almost certainly a Bad Idea, with its apparent merits tainted by the limitations of our ham corpora. I'll say that again: we do not have enough ham from Africa or Latin America to understand how to properly use these rules. If you block based (in part or wholly) on __RCVD_VIA_AFRINIC_E, you doom South Africa to the same bucket as Nigeria. The 41/8 CIDR is restricted to just Nigeria and surrounding areas, which (until they improve their education and infrastructure) is pretty well correlated with advance-fee fraudsters. AfriNIC's entire dedicated space is not a fair target. Read these stats with a grain of salt: http://ruleqa.spamassassin.org/?daterev=20110926&rule=%2FRCVD_VIA SPAM% HAM% S/O RANK NAME 2.2063 0.0058 0.997 0.87 __RCVD_VIA_AFRINIC 2.3564 0.1116 0.955 0.75 __RCVD_VIA_AFRINIC_E 4.8714 0.7709 0.863 0.61 __RCVD_VIA_LACNIC 34.8814 3.0100 0.921 0.57 __RCVD_VIA_APNIC 35.6669 3.8372 0.903 0.56 __RCVD_VIA_APNIC_E 4.9684 1.7034 0.745 0.54 __RCVD_VIA_LACNIC_E 47.1530 14.6071 0.763 0.51 __RCVD_VIA_RIPE 0.0158 0.0010 0.943 0.50 __RCVD_VIA_NON_RIR_E 49.6605 21.5889 0.697 0.50 __RCVD_VIA_RIPE_E 0 0.0010 0.000 0.48 __RCVD_VIA_NON_RIR 10.6118 79.2411 0.118 0.41 __RCVD_VIA_ARIN_E 4.8754 73.0384 0.063 0.39 __RCVD_VIA_ARIN 0.0014 0.1577 0.009 0.32 __RCVD_VIA_IPV6 0.0072 1.8275 0.004 0.11 __RCVD_VIA_IPV6_E
signature.asc
Description: OpenPGP digital signature
