On 9/23/2008 5:25 PM, Rob McEwen wrote:
Yet Another Ninja wrote:
FIW:
12 hr stats / tiny traffic trap box - no ham
I use a couple of DNSWLs to reject traffic from potential hammy IPs
RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM
1 RCVD_BARRACUDA 19721 83.30 83.46 8.00
<SNIP>
Spam detection seems good - no idea how it does with HAM
What I'm about to say is probably part of the reason that Alex started
those stats out with "fwiw", but when running stats like that, the "ham"
column is tricky.
Why? Because these are either False Positives--which is a very bad thing.
Or, these could be "False-False Positives"... which is a very good thing
because that would mean that those were really spams that would have
scored "below threshold" without use of the new list. (or, some mix of
these two)
They're *false negatives*.
this box only accepts mail for *4* harvested tagged rcpt addresses.
NO real users who would have ever filled a form, etc.
