I installed SpamAssassin about a week ago and really love it. However,
I seem to be getting a (presumably) unusally high number of false
positives. I'm up to 21 in the past week, on an input of 1540
messages. (Damn, I am on too many mailing lists.) This is about 1.3%,
which is almost an order of m
> I seem to be getting a (presumably) unusally high number of false
> positives. I'm up to 21 in the past week, on an input of 1540
> messages. (Damn, I am on too many mailing lists.) This is about 1.3%,
I think the list wisdom goes with whitelisting mailing lists. But
then you lose the ability
mike castleman said:
> 1) Any tips for reducing this number? Most of the messages are not
>especially private, so I can forward them or put them on the web
>somewhere if people want. I don't want to bombard the list with my
>mailspool though.
Sure, zip them up and mail them to me, I
On Sat, Jan 19, 2002 at 12:44:10AM -0500, mike castleman wrote:
> 2) And, for when false positives do occur, has anyone yet hacked up a
>mutt macro for running the message through spamassassin -d and
>moving the message to another folder?
So, there might be some prettier way, but here's w
> -Original Message-
> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]
>
> mike castleman said:
>
> > 1) Any tips for reducing this number? Most of the messages are not
> >especially private, so I can forward them or put them on the web
> >somewhere if people want. I don't wan
On Mon, 2002-01-21 at 01:42, Matt Sergeant wrote:
Anyway, I'm going to try and get the GA running here, though I'm not sure
how easy that will be since it seems to be targetted at mbox's, whereas I've
got Maildir's... But I'll figure it out.
mass-check should work fine with maildirs t
(I learned about this yesterday and have it going; very nice.)
Today I got a false positive which included among other things:
SPAM: Hit! (2.29 points) Cc: contains similar usernames at least 10 times
SPAM: Hit! (1.47 points) To: contains similar usernames at least 10 times
neither of which was
I believe I have found two instances where rules match incorrectly:
1. DOUBLE_CAPSWORD matches lines where there are no double capswords. This
is because it finds "URI:", which is text that spamassassin inserted itself
while processing the message.
2. REALLY_UNSAFE_JAVASCRIPT matches even body t
Conference announcements often contain the phrase "the following format"
when requesting submissions, which matches the THE_FOLLOWING_FORM rule,
which has a quite high score. Adding \W to the end of the pattern prevents
this, and seems safe in general.
Tom
__
At Wed, 20 Feb 2002 16:16:56 -0800 John Beck wrote:
> ...
> would trigger false positives on
>
> a@domain, b@domain, ..., k@domain
>
> i.e., 11 (not 10) of the same domain would trigger this regardless of the
> local parts. Well, the SUSPICIOUS_[CC_]RECIPS macros seemed good, so I
> tweaked the
+> ... would trigger false positives on
+> a@domain, b@domain, ..., k@domain
+> i.e., 11 (not 10) of the same domain would trigger this regardless of the
+> local parts. Well, the SUSPICIOUS_[CC_]RECIPS macros seemed good, so I
+> tweaked them ...
Tom> Coincidentally, I just sent fixes for the
David Young said:
> 1. DOUBLE_CAPSWORD matches lines where there are no double capswords. This
> is because it finds "URI:", which is text that spamassassin inserted itself
> while processing the message.
I don't know how long that rule's going to last, it gets loads of FPs ;)
> 2. REALLY_UNSA
Justin Mason wrote:
> David Young said:
>
>
>>1. DOUBLE_CAPSWORD matches lines where there are no double capswords. This
>>is because it finds "URI:", which is text that spamassassin inserted itself
>>while processing the message.
>
>
> I don't know how long that rule's going to last, it gets
> -Original Message-
> From: Tom Lipkis [mailto:[EMAIL PROTECTED]]
>
> Conference announcements often contain the phrase "the
> following format"
> when requesting submissions, which matches the
> THE_FOLLOWING_FORM rule,
> which has a quite high score. Adding \W to the end of the
> p
> > Conference announcements often contain the phrase "the
> > following format"
> > when requesting submissions, which matches the
> > THE_FOLLOWING_FORM rule,
> > which has a quite high score. Adding \W to the end of the
> > pattern prevents
> > this, and seems safe in general.
>
> \b would
As you can see from the email attached, this mail got flagged simply because
of 'received via relay' and 'confirmed spam source'
I received the mail from a mailing list. I do *not* want to add the mailing
list address to my whitelist as this mail would have been fine before
upgrading to 2.11
-
As you can see from the email attached, this mail got flagged simply because
of 'received via relay' and 'confirmed spam source'
I received the mail from a mailing list. I do *not* want to add the mailing
list address to my whitelist as this mail would have been fine before
upgrading to 2.11
-
The subject says it all. I am running SA2.01 on a mid-size ISP (~3000
"average joe" clients) and have been manually going through about 2500 spam
messages a day to ensure that no false positives are getting killfiled.
I get about 2-3 false positives per day, which really isn't bad. I've
modi
n't forget the pasta!"
- Original Message -
From: "Douglas J Hunley" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Wednesday, March 06, 2002 2:00 PM
Subject: [SAtalk] false positives since upgrading to 2.11 (2/7)
> As you can see from the email attached,
>As you can see from the email attached, this mail got flagged simply because
>of 'received via relay' and 'confirmed spam source'
>I received the mail from a mailing list. I do *not* want to add the mailing
>list address to my whitelist as this mail would have been fine before
>upgrading to 2.
Olivier Nicole spewed electrons into the ether that assembled into:
> The reports tells you that the mailing list is sent through a relay
> that is known to be used for spam.
>
> And this is confirmed by a second source, and the two sources maintain
> independant databases of relay used by spam.
>
iences
University of Northern Iowa
- -Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of
Douglas J Hunley
Sent: Thursday, March 07, 2002 3:13 PM
To: Olivier Nicole
Cc: [EMAIL PROTECTED]
Subject: Re: [SAtalk] false positives since upgrading to 2.11 (1/7)
Olivier Nicole sp
22 matches
Mail list logo
