From: "Tim Philip" <[EMAIL PROTECTED]>
> Robert Menschel wrote:
> >
> > > Hello Oliver,
> > >
> > > Saturday, May 15, 2004, 2:23:28 PM, you wrote:
> > >
> > > OT> it seem this cf file "hits" some normal clients ?
> > > OT> for example, RATWR10_MESSID matches on messageid's
> > > OT> from Mozilla Thunderbird 0.5 (Windows/20040207)
> > > OT> not a big problem, as those rules are not too high-scoring...
> > >
> > > There are many SARE rules which hit spam and only spam, and there are
> > > many SARE rules which hit some ham and lots of spam. This is one of
the
> > > latter.
> > >
> > > This rule is one of the worse rules. On my corpus on 5/8, this rule
hit
> > > 657 spam and 327 ham. 2:1 is a horrible ratio, and does not warrant a
> > > .646 score.
> > >
> > > I've just lowered the score to 0.111 at
> > > http://www.rulesemporium.com/rules/70_sare_ratware.cf
> > >
> > > Your second email asked,
> > > > if the title talks about "HEX", shouldn't the rule be [0-9A-F]
instead
> > > > of [0-9A-Z] ?
> > >
> > > Yes, if that's the intent rather than just incorrect documentation.
> >
> >I suspect that was the intent. I altered my RATWR10 rule to reflect
> >the documentation. Otherwise it would have a horrid spam/ham ratio
> >such as seen.
> >
> >{^_^}
>
> Ratware 11 also talks about HEX Message-ID but has A-Z:-
>
> Message-ID =~ /<[A-Z0-9]{30}\$[0-9a-z]{9}\@/
>
> On my corpus Ratware 10 matched 103 spam using either [0-9A-F]
> or [0-9A-Z], ie it didn't make any difference on spam. Did you find
> that changing it to [0-9A-F] lowered the FPs?
>
> Is there any reason that these IDs are a spam sign? Or where they
> just created to match IDs found in a spam corpus? ie Are they really
> bogus or are they valid IDs and you'll get FPs all the time?
Since that's my signature glyph I'll note I have seen spams with the
number pattern that ratware 10 (and perhaps 11) seem designed to tag.
Cutting out the g-z portion probably cuts the ham bits. But I don't
have a corpus worth testing this on.
{^_^}
