[EMAIL PROTECTED] schrieb:
arni wrote:
[EMAIL PROTECTED] <mailto:[EMAIL PROTECTED]> schrieb:
Sounds more like "if we didn't rely on other people to have seen this
particular abusive host before us and our learning system to have seen
past examples of spam that looks a whole lot like this one from headers
alone to detect this particular spam, we'd fail to catch it until we've
trained our system and the abusive host has been reported to various lists".
That's what makes policy (e.g. MTA checks, BOTNET) and behavior based
detection work as well as it does, it's proactive instead of reactive.
I have no spam that doesnt score at least BAYES_80 - BAYES_80 is 3.5
points here, BOTNET is 3 points here, makes 6.5 total and a bust.
Doesnt have anything to do with beeing a late reciever as i recieve this
spam on a whole lot of addresses and not just one - please dont tell me
you think i'm a late reciever on all.
arni
No all BAYES is saying you've received and trained spam in the past that
has bits and pieces that look like this new spam. If a spammer reduces
the amount of tokens that can match negatively and does nothing else
they'll end up with a meaningless bayes score (right around BAYES_50).
Add a bit of "likely to be trained as ham" bits from a common mailing
list from the day before, and use that in combination with an
image/attachment/short spam and you've got a nice low bayes score. Works
great against large site-wide bayes databases, not so much against
per-user unless the user happens to be subscribed to whatever ham source
the spammer is using. <joke>Maybe we should train all our mailing lists
as spam!</joke>
i will use one of the best quotes here that were ever created on the
internet:
"You make your mouth full of technical bullshit when only facts talk"
By some random guy
;-) arni
