> Hello Oliver, > > Saturday, May 15, 2004, 2:23:28 PM, you wrote: > > OT> it seem this cf file "hits" some normal clients ? > OT> for example, RATWR10_MESSID matches on messageid's > OT> from Mozilla Thunderbird 0.5 (Windows/20040207) > OT> not a big problem, as those rules are not too high-scoring... > > There are many SARE rules which hit spam and only spam, and there are > many SARE rules which hit some ham and lots of spam. This is one of the > latter. > > This rule is one of the worse rules. On my corpus on 5/8, this rule hit > 657 spam and 327 ham. 2:1 is a horrible ratio, and does not warrant a > .646 score. > > I've just lowered the score to 0.111 at > http://www.rulesemporium.com/rules/70_sare_ratware.cf > > Your second email asked, > > if the title talks about "HEX", shouldn't the rule be [0-9A-F] instead > > of [0-9A-Z] ? > > Yes, if that's the intent rather than just incorrect documentation.
I suspect that was the intent. I altered my RATWR10 rule to reflect the documentation. Otherwise it would have a horrid spam/ham ratio such as seen.
{^_^}
Ratware 11 also talks about HEX Message-ID but has A-Z:-
Message-ID =~ /<[A-Z0-9]{30}\$[0-9a-z]{9}\@/On my corpus Ratware 10 matched 103 spam using either [0-9A-F] or [0-9A-Z], ie it didn't make any difference on spam. Did you find that changing it to [0-9A-F] lowered the FPs?
Is there any reason that these IDs are a spam sign? Or where they just created to match IDs found in a spam corpus? ie Are they really bogus or are they valid IDs and you'll get FPs all the time?
Thanks.
_________________________________________________________________
Get Extra Storage in 10MB, 25MB, 50MB and 100MB options now! Go to http://join.msn.com/?pgmarket=en-au&page=hotmail/es2
