RE: [Mimedefang] Subject block - good success - Anyone else tryin g it?

2005-07-18 Thread Cormack, Ken
From: Jason Gurtz [mailto:[EMAIL PROTECTED] > > I was curious to know if anyone else has been playing around with > > subject-line blocking, as discussed in the thread a week or so ago. > I haven't, but am interested. I'm just curious about what kind of false > positive rate might be experience

Re: [Mimedefang] Subject block - good success - Anyone else tryin g it?

2005-07-18 Thread David F. Skoll
Cormack, Ken wrote: > My users report any spam that slips through, to an Exchange public folder > called "spam". I then run a series of VB scripts against any such reported > spam, to extract relay Ips, subject lines, and other such things that I can > add to my various rules or databases. It se

RE: [Mimedefang] Subject block - good success - Anyone else tryin g it?

2005-07-18 Thread Cormack, Ken
From: David F. Skoll [mailto:[EMAIL PROTECTED] > It seems to me it would be far more productive and less labour-intensive > to simply feed those messages into a Bayesian analyzer. That may be the case. However, the VB scripts have done a pretty good job so far, are well known and understood by

Re: [Mimedefang] Subject block - good success - Anyone else tryin g it?

2005-07-18 Thread David F. Skoll
Cormack, Ken wrote: > Would a Bayes analyzer deal with a spammer's efforts to "personalize" or > vary a subject line, with things such as: > "Hey [EMAIL PROTECTED], claim your dream vacation - 07/15/05" > "Hey [EMAIL PROTECTED], claim your dream vacation - #GGFS85F" > ...any more effectively tha

Re: [Mimedefang] Subject block - good success - Anyone else trying it?

2005-07-18 Thread Kevin A. McGrail
In defense of Ken's subject-blocking system, my personal experience with Bayesian systems for large user bases has been subpar. In short, the benefits are severely outweighed by the server load. Of course, this is speaking about SpamAssassin's current Bayesian implementation. I know that CanIT h

Re: [Mimedefang] RE: Filtering on sender, recipient, and subject at the same time

2005-07-18 Thread Craig Green
McCarthy, Douglas J wrote: The good news is that it catches Out of Office AutoReplies exactly right! The bad new is that it's not catching the User-Agent or X-Mailer things at all. I know how to set them, and when they get delivered the headers are indeed there, but if I uncomment that VacDeb

Re: [Mimedefang] RE: Filtering on sender, recipient, and subject at the same time

2005-07-18 Thread alan premselaar
Craig Green wrote: ...snip... Note that since you're in filter_end, the HEADERS file *is* available, so you can just parse that if you'd prefer. There was nothing wrong with your initial logic; it's just that parsing the file on disk is slower *and* it takes more code than using the MIME enti