Den Thu, 19 Dec 2002 09:57:37 -0500, skrev du : >Razor uses hashes that detect messages that are similar, not necessarily >identical. So lets assume that I got this exact same message except with my >"personalized contents", and I mark it spam using SpamNet. Then when you >get it, Razor says it is spam because it is near identical to the message I >marked spam.
I could understand that with a 8 bit checksum, but if a sufficiently large checksum is used, the probability is very, very low for collisions. The length as far I see from the log below is 28*8 bits = 224 which is a fairly large number. Today I have received 2 false positives. That cannot be contributed to simple collisions of hashes although it is possible, especially not because these are not unique instances. I am seeing relatively frequent false positives. I believe the computation of signatures must somehow be biased. Here is a razor-check of the previous message posted, if anybody can tell anything from that. - J�rgen [root@vennely .razor]# cat xx|razor-check -d -dl=9 Razor-Log: Computed razorhome from env: /root/.razor Razor-Log: Found razorhome: /root/.razor Razor-Log: read_file: 14 items read from /root/.razor/razor-agent.conf Dec 19 16:07:28.238754 check[31569]: [ 1] [bootup] Logging initiated LogDebugLevel=9 to stdout Dec 19 16:07:28.240319 check[31569]: [ 5] computed razorhome=/root/.razor, conf=/root/.razor/razor-agent.conf, ident=/root/.razor/identity Dec 19 16:07:28.240952 check[31569]: [ 2] Razor-Agents v2.20 starting razor-check -d -dl=9 Dec 19 16:07:28.247908 check[31569]: [ 9] uname -a: Linux vennely 2.4.9-31 #1 Tue Feb 26 06:25:35 EST 2002 i586 unknown Dec 19 16:07:28.248982 check[31569]: [ 8] reading straight RFC822 mail from <stdin> Dec 19 16:07:28.250102 check[31569]: [ 6] read 1 mail Dec 19 16:07:28.251021 check[31569]: [ 8] Client supported_engines: 1 3 4 Dec 19 16:07:28.252667 check[31569]: [ 8] prep_mail done: mail 1 headers=622, mime0=1003 Dec 19 16:07:28.253619 check[31569]: [ 6] skipping whitelist file (empty?): /root/.razor/razor-whitelist Dec 19 16:07:28.254640 check[31569]: [ 5] read_file: 2 items read from /root/.razor/servers.discovery.lst Dec 19 16:07:28.255684 check[31569]: [ 5] read_file: 3 items read from /root/.razor/servers.nomination.lst Dec 19 16:07:28.256675 check[31569]: [ 5] read_file: 2 items read from /root/.razor/servers.catalogue.lst Dec 19 16:07:28.257916 check[31569]: [ 9] Assigning defaults to hubris.cloudmark.com Dec 19 16:07:28.258720 check[31569]: [ 9] Assigning defaults to conceit.cloudmark.com Dec 19 16:07:28.259550 check[31569]: [ 9] Assigning defaults to joy.cloudmark.com Dec 19 16:07:28.260335 check[31569]: [ 9] Assigning defaults to truth.cloudmark.com Dec 19 16:07:28.261070 check[31569]: [ 9] Assigning defaults to shock.cloudmark.com Dec 19 16:07:28.262784 check[31569]: [ 5] read_file: 10 items read from /root/.razor/server.ubik.cloudmark.com.conf Dec 19 16:07:28.264194 check[31569]: [ 5] read_file: 10 items read from /root/.razor/server.honor.cloudmark.com.conf Dec 19 16:07:28.265596 check[31569]: [ 5] read_file: 11 items read from /root/.razor/server.truth.cloudmark.com.conf Dec 19 16:07:28.268178 check[31569]: [ 5] 163915 seconds before closest server discovery Dec 19 16:07:28.269103 check[31569]: [ 6] truth.cloudmark.com is a Catalogue Server srl 61; computed min_cf=1, Server se: 0A Dec 19 16:07:28.270004 check[31569]: [ 8] Computed supported_engines: 4 Dec 19 16:07:28.270762 check[31569]: [ 8] Using next closest server truth.cloudmark.com:2703, cached info srl 61 Dec 19 16:07:28.271417 check[31569]: [ 8] mail 1 Subject: Your domain is about to expire - nordisk-maskinsalg.com Dec 19 16:07:28.275102 check[31569]: [ 6] preproc: mail 1.0 went from 1003 bytes to 965 Dec 19 16:07:28.275761 check[31569]: [ 6] computing sigs for mail 1.0, len 965 Dec 19 16:07:28.279882 check[31569]: [ 5] Connecting to truth.cloudmark.com ... Dec 19 16:07:31.939574 check[31569]: [ 8] Connection established Dec 19 16:07:31.940472 check[31569]: [ 4] truth.cloudmark.com >> 29 server greeting: sn=C&srl=61&ep4=7542-10&a=l Dec 19 16:07:31.941655 check[31569]: [ 6] truth.cloudmark.com is a Catalogue Server srl 61; computed min_cf=1, Server se: 0A Dec 19 16:07:31.942465 check[31569]: [ 8] Computed supported_engines: 4 Dec 19 16:07:31.943196 check[31569]: [ 8] mail 1.0 e4 sig: RiV9t_3thDvG9E8JYT5Hkh8hGwAA Dec 19 16:07:31.943987 check[31569]: [ 8] preparing 1 queries Dec 19 16:07:31.944795 check[31569]: [ 8] sending 1 batches Dec 19 16:07:31.945586 check[31569]: [ 4] truth.cloudmark.com << 52 Dec 19 16:07:31.946137 check[31569]: [ 6] a=c&e=4&ep4=7542-10&s=RiV9t_3thDvG9E8JYT5Hkh8hGwAA Dec 19 16:07:33.148905 check[31569]: [ 4] truth.cloudmark.com >> 10 Dec 19 16:07:33.149175 check[31569]: [ 6] response to sent.1 cf=7&p=1 Dec 19 16:07:33.150143 check[31569]: [ 6] mail 1.0 e=4 sig=RiV9t_3thDvG9E8JYT5Hkh8hGwAA: Is spam: cf 7 >= min_cf 1 Dec 19 16:07:33.150487 check[31569]: [ 7] method 4: mail 1.0: no-contention part, spam=1 Dec 19 16:07:33.150658 check[31569]: [ 7] method 4: mail 1: a non-contention part was spam, mail spam Dec 19 16:07:33.150820 check[31569]: [ 3] mail 1 is known spam. Dec 19 16:07:33.151016 check[31569]: [ 5] disconnecting from server truth.cloudmark.com Dec 19 16:07:33.151441 check[31569]: [ 4] truth.cloudmark.com << 5 Dec 19 16:07:33.151602 check[31569]: [ 6] a=q Dec 19 16:07:33.152052 check[31569]: [ 8] razor-check finished successfully. ------------------------------------------------------- This SF.NET email is sponsored by: Geek Gift Procrastinating? Get the perfect geek gift now! Before the Holidays pass you by. T H I N K G E E K . C O M http://www.thinkgeek.com/sf/ _______________________________________________ Razor-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/razor-users
