Re: Hostkarma whitelist FP
Hi, > I don't see it as a perceptual problem. What rules are to lower the score of > ham. SA really needs more white rules. White rules can compensate for the > sins of black rules and enhances overall accuracy especially when protecting > ham take priority over blocking spam. Were you thinking of something like the SOUGHT rules for ham? Perhaps a set of rules that break down the headers of an email and continually add negative points for each meta rule that it catches? Regards, Alex
Re: Hostkarma whitelist FP
From: "Marc Perkel"
Sent: Wednesday, 2010/February/03 09:20
jdow wrote:
From: "Alex"
Sent: Monday, 2010/February/01 11:24
That's a bad thing for anyone, not just hospitals, but I doubt if the
system that sends regular email is in any way connected to the
internal patient system.
Not knowing what their system is I have to make sure that email sent
from
hospitals gets delivered. Passing ham takes precedence over blocking
spam.
Yes, agreed; I just wanted to point out to jdow that the internal
systems are much different than their public systems, so a compromise
of their public system doesn't necessarily mean patient records are at
risk.
It creates at least a perceptual problem, I believe.
{^_^}
I don't see it as a perceptual problem. What rules are to lower the
score of ham. SA really needs more white rules. White rules can
compensate for the sins of black rules and enhances overall accuracy
especially when protecting ham take priority over blocking spam.
In that regard I quite agree with you, especially since I mark up the
Bayes99 score to 5.001.
Meta rules come to my assistance there. I've isolated 99% of the mis-
scored email problem to mailing lists. Almost all their email is clean.
But some lists are cleaner than others. And in many lists I am on the
Bayes scores tend to be random but below Bayes80. So I use meta rules
to refactor Bayes scores around 80, increasing the spam score above
Bayes80 and reducing it below Bayes80. That way my other rules which
are also triggered by say the "random text gibberish" in the LKML are
neutralized while the spam scores are actually enhanced.
It requires care and feeding. (And, grin, Ubuntu has different rules
from Fedora and LKML.)
Regardless, for my needs I'd never run a HOSTKARMA_W score as far
negative as -5.0. Lately I ran across one escaped spam that was
particularly obnoxious to find in my clean mailbox.
{^_^}
Re: Hostkarma whitelist FP
jdow wrote:
From: "Alex"
Sent: Monday, 2010/February/01 11:24
That's a bad thing for anyone, not just hospitals, but I doubt if the
system that sends regular email is in any way connected to the
internal patient system.
Not knowing what their system is I have to make sure that email sent
from
hospitals gets delivered. Passing ham takes precedence over blocking
spam.
Yes, agreed; I just wanted to point out to jdow that the internal
systems are much different than their public systems, so a compromise
of their public system doesn't necessarily mean patient records are at
risk.
It creates at least a perceptual problem, I believe.
{^_^}
I don't see it as a perceptual problem. What rules are to lower the
score of ham. SA really needs more white rules. White rules can
compensate for the sins of black rules and enhances overall accuracy
especially when protecting ham take priority over blocking spam.
Re: Hostkarma whitelist FP
From: "Alex"
Sent: Monday, 2010/February/01 11:24
That's a bad thing for anyone, not just hospitals, but I doubt if the
system that sends regular email is in any way connected to the
internal patient system.
Not knowing what their system is I have to make sure that email sent from
hospitals gets delivered. Passing ham takes precedence over blocking
spam.
Yes, agreed; I just wanted to point out to jdow that the internal
systems are much different than their public systems, so a compromise
of their public system doesn't necessarily mean patient records are at
risk.
It creates at least a perceptual problem, I believe.
{^_^}
Re: Hostkarma whitelist FP
Hi, > Can we get this IP removed? > > (I was going to report this directly, but I lost the email address and > wasn't able to find anything on the junkemailfilter website.) I hoped I could use this thread to ask about emediausa.com. This is currently blacklisted on HK, but not on URIBL. This isn't a new domain. Shouldn't it also be blacklisted on there? It's not only registered in the UK (ironic, given its name), but they've been around for quite a while and seem to be established. I'd like to also blacklist them (the score is otherwise low here), but would like to see URIBL also include them. I have one from "Marketing Bulletin" with a score of 3.7: X-Spam-Status: No, hits=3.7 tagged_above=-300.0 required=5.0 use_bayes=1 tests=BAYES_50, DKIM_SIGNED, DKIM_VERIFIED, HTML_MESSAGE, MIME_HTML_ONLY, RCVD_IN_HOSTKARMA_BL, RCVD_IN_NIX_SPAM, RELAYCOUNTRY_US, SPF_HELO_PASS, SPF_PASS It also includes a "List-Unsubscribe:" link. I guess I just wanted to get the opinion of others on whether I should start training it as spam or just block it outright at the gateway. Thanks, Alex -
Re: Hostkarma whitelist FP
On Mon, 2010-02-01 at 10:52 -0800, Marc Perkel wrote: > > > Mike Cardwell wrote: > > > On 01/02/2010 17:31, Marc Perkel wrote: > > > > > > > > > Yep - sutterhealth.org is a hospital. Making sure good email gets > > > through is more important than a little bit of occasional spam. > > > > > > > > > http://wiki.junkemailfilter.com/index.php/Spam_DNS_Lists > > > > "And if you never send spam we want you to be on our whitelist." > > > > Please follow your own listing criteria and remove the host from your > > whitelist. Alternatively, update your documentation to reflect the real > > listing criteria. As it stands, I can understand sutterhealth.org being > > on your NOBL list, but not on a list which you define as hosts which > > "never send spam". > > > > > > > Never is a fuzzy line when it comes to institutions like hospitals. It > a matter of what is important and to us at Junk Email Filter making > sure medical email is delivered is far more important that blocking a > few spams. Never means exactly that, never, so your public documentation does need modification to reflect that your version of never doesn't equal the dictionaries and most peoples understanding of it. I can see your point though, however, and it seems if you apply it to one, questions remain as to who else you apply it to, it's just as well all white lists in SA are scored 0 on all mail servers I control so you don't/wont/can't decide white listing policies here. (No , im not totally anal, hospitals here all use domain name of health.$state.gov.au... they bypass SA and MTA tests altogether.)
Re: Hostkarma whitelist FP
Mike Cardwell wrote: On 01/02/2010 17:31, Marc Perkel wrote: Yep - sutterhealth.org is a hospital. Making sure good email gets through is more important than a little bit of occasional spam. http://wiki.junkemailfilter.com/index.php/Spam_DNS_Lists "And if you never send spam we want you to be on our whitelist." Please follow your own listing criteria and remove the host from your whitelist. Alternatively, update your documentation to reflect the real listing criteria. As it stands, I can understand sutterhealth.org being on your NOBL list, but not on a list which you define as hosts which "never send spam". I would suggest that "never" is a very wrong place to draw the whitelisting line. Perfection is a nice goal, but can't be achieved in practice. Even the best run systems may occasionally have a lapse. What matters most is whether they DEAL with it. Bob --
Re: Hostkarma whitelist FP
Alex wrote: That's a bad thing for anyone, not just hospitals, but I doubt if the system that sends regular email is in any way connected to the internal patient system. Not knowing what their system is I have to make sure that email sent from hospitals gets delivered. Passing ham takes precedence over blocking spam. Yes, agreed; I just wanted to point out to jdow that the internal systems are much different than their public systems, so a compromise of their public system doesn't necessarily mean patient records are at risk. Best, Alex I don't have any information about the structure of their email system. They may be emailing patients results of medical test and other important notifications, or doctors in other hospitals. My first job is to make sure the good email gets through and block only the email that I'm sure is not good.
Re: Hostkarma whitelist FP
>> That's a bad thing for anyone, not just hospitals, but I doubt if the >> system that sends regular email is in any way connected to the >> internal patient system. >> > Not knowing what their system is I have to make sure that email sent from > hospitals gets delivered. Passing ham takes precedence over blocking spam. Yes, agreed; I just wanted to point out to jdow that the internal systems are much different than their public systems, so a compromise of their public system doesn't necessarily mean patient records are at risk. Best, Alex
Re: Hostkarma whitelist FP
Alex wrote: Hi, They are the kind of people I email about these problems because it could signal they've been hacked. And that's a bad thing for hospitals. The sooner they know the sooner they can clean house. That's a bad thing for anyone, not just hospitals, but I doubt if the system that sends regular email is in any way connected to the internal patient system. Best, Alex Not knowing what their system is I have to make sure that email sent from hospitals gets delivered. Passing ham takes precedence over blocking spam.
Re: Hostkarma whitelist FP
Hi, > They are the kind of people I email about these problems because it could > signal they've been hacked. And that's a bad thing for hospitals. The > sooner they know the sooner they can clean house. That's a bad thing for anyone, not just hospitals, but I doubt if the system that sends regular email is in any way connected to the internal patient system. Best, Alex
Re: Hostkarma whitelist FP
Mike Cardwell wrote: On 01/02/2010 17:31, Marc Perkel wrote: Yep - sutterhealth.org is a hospital. Making sure good email gets through is more important than a little bit of occasional spam. http://wiki.junkemailfilter.com/index.php/Spam_DNS_Lists "And if you never send spam we want you to be on our whitelist." Please follow your own listing criteria and remove the host from your whitelist. Alternatively, update your documentation to reflect the real listing criteria. As it stands, I can understand sutterhealth.org being on your NOBL list, but not on a list which you define as hosts which "never send spam". Never is a fuzzy line when it comes to institutions like hospitals. It a matter of what is important and to us at Junk Email Filter making sure medical email is delivered is far more important that blocking a few spams.
Re: Hostkarma whitelist FP
On 01/02/2010 17:31, Marc Perkel wrote: > Yep - sutterhealth.org is a hospital. Making sure good email gets > through is more important than a little bit of occasional spam. http://wiki.junkemailfilter.com/index.php/Spam_DNS_Lists "And if you never send spam we want you to be on our whitelist." Please follow your own listing criteria and remove the host from your whitelist. Alternatively, update your documentation to reflect the real listing criteria. As it stands, I can understand sutterhealth.org being on your NOBL list, but not on a list which you define as hosts which "never send spam". -- Mike Cardwell: UK based IT Consultant, Perl developer, Linux admin Cardwell IT Ltd. : UK Company - http://cardwellit.com/ #06920226 Technical Blog : Tech Blog - https://secure.grepular.com/ Spamalyser : Spam Tool - http://spamalyser.com/
Re: Hostkarma whitelist FP
They are the kind of people I email about these problems because it could
signal they've been hacked. And that's a bad thing for hospitals. The
sooner they know the sooner they can clean house.
{^_^}
- Original Message -
From: "Marc Perkel"
Sent: Monday, 2010/February/01 09:31
Yep - sutterhealth.org is a hospital. Making sure good email gets
through is more important than a little bit of occasional spam.
Bowie Bailey wrote:
Even if they are emailing me regarding the amazingly large sum of money
some unknown person apparently left me in his will? :)
Marc Perkel wrote:
That's the outgoing email gateway for a hospital. It stays whitelisted.
Bowie Bailey wrote:
This was listed in the Hostkarma whitelist:
[198.217.64.52 listed in hostkarma.junkemailfilter.com]
Can we get this IP removed?
(I was going to report this directly, but I lost the email address and
wasn't able to find anything on the junkemailfilter website.)
Re: Hostkarma whitelist FP
Yep - sutterhealth.org is a hospital. Making sure good email gets through is more important than a little bit of occasional spam. Bowie Bailey wrote: Even if they are emailing me regarding the amazingly large sum of money some unknown person apparently left me in his will? :) Marc Perkel wrote: That's the outgoing email gateway for a hospital. It stays whitelisted. Bowie Bailey wrote: This was listed in the Hostkarma whitelist: [198.217.64.52 listed in hostkarma.junkemailfilter.com] Can we get this IP removed? (I was going to report this directly, but I lost the email address and wasn't able to find anything on the junkemailfilter website.)
Re: Hostkarma whitelist FP
Even if they are emailing me regarding the amazingly large sum of money some unknown person apparently left me in his will? :) Marc Perkel wrote: > That's the outgoing email gateway for a hospital. It stays whitelisted. > > Bowie Bailey wrote: >> This was listed in the Hostkarma whitelist: >> >> [198.217.64.52 listed in hostkarma.junkemailfilter.com] >> >> Can we get this IP removed? >> >> (I was going to report this directly, but I lost the email address and >> wasn't able to find anything on the junkemailfilter website.) >> >>
Re: Hostkarma whitelist FP
That's the outgoing email gateway for a hospital. It stays whitelisted. Bowie Bailey wrote: This was listed in the Hostkarma whitelist: [198.217.64.52 listed in hostkarma.junkemailfilter.com] Can we get this IP removed? (I was going to report this directly, but I lost the email address and wasn't able to find anything on the junkemailfilter website.)
Hostkarma whitelist FP
This was listed in the Hostkarma whitelist: [198.217.64.52 listed in hostkarma.junkemailfilter.com] Can we get this IP removed? (I was going to report this directly, but I lost the email address and wasn't able to find anything on the junkemailfilter website.) -- Bowie
