Re: [sniffer] Surprising missed spam

[Matt]

Actually, we scan for many businesses as well as home users, and have clients with mail boxes on every continent except Antarctica.  To me it's really a matter of what classifies spam, and while these phrases are spammy, they are not accurate enough to use in my rulebase.  Pete knows what he is doing however, and you will note that most of his rules are based on 'payload' hits, which are generally links.  Without a payload, the message is merely a statement, and while that has happened (Nazi spamdemic), it is not the norm.  These guys do change their payloads around regularly, but the ones that use these sorts of phrases in spam are highly likely to also get tagged by other obfuscation techniques in Sniffer.  Of course there are also many blacklists that are good at tagging both zombie and static spam sources. My point was really that I prefer to tag spam based on a positive hit instead of a suggestive one, and for the most part, Sniffer does this.  It is especially effective in combination with other spam blocking techniques.  If for instance you have 3 hits on perfectly unassociated patterns, and each one is 99% accurate, or rather 1% inaccurate, the net result is that the combination of hits would produce a false positive rate 0.0001%.  A good example of this would be a message that is tagged by Sniffer for a link in the body, tagged by SpamCop for leaking spam by the IP, and forges the Mail From domain.  Unfortunately I do see false positives frequently enough when Sniffer hits in combination with some other less accurate test giving it enough points to be held on my system, many of which might fall into a gray category or results from a more generic/suggestive hit in combination with some technical shortcoming. Spam bothers me a whole bunch, that's why I'm in the business, but false positives bother me even more.  I do wish that over time Pete could further separate his rules into more positive and more suggestive ones so that things like known URL's would be examples of more positive ones and things like "horny teenagers" would be an example of a suggestive one.  Given that, I could weight accordingly. Matt Agid, Corby wrote: I suppose everyone's userbases have differenent requirements.  An ISP or private enterprise might worry about false postives on "horny teenagers" and "penis enlargement", but for our local government agency, it causes problems.    Corby From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Matt Sent: Monday, September 13, 2004 5:25 PM To: [EMAIL PROTECTED] Subject: Re: [sniffer] Surprising missed spam Corby, Personally, I'm a fan of leaving the generic stuff out due to the potential of false positives.  Those of us that are using Sniffer in addition to other spam blocking mechanisms can afford to lose some Sniffer hits on such phrases because they will be picked up by other means almost all of the time.  Including such phrases however would increase our false positive rate without a measurable benefit in spam capture rates.  I have even asked Pete to remove some phrase hits from my own rulebase for exactly this reason. Matt Agid, Corby wrote: Hello, I was surprised recently by some spam that got through without getting caught by the sniffer.   We've been getting some plain text messages that have obvious spam words in the subject line.   For example, a plain text message with "horny teenagers" came through.  The content was also very spammy, but all plain text.   I tried sending myself a few messages with standard spam phrases and none of them tripped any sniffer rules. Am I missing something? Corby -- ===================================================== MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ ===================================================== -- ===================================================== MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ =====================================================