mouss wrote: > Matt Kettler a écrit : > >> mouss wrote: >> >>> Matt Kettler a écrit : >>> >>> >>>> Brian J. Murrell wrote: >>>> >>>> >>>>> If I get a spam and I need to have SA learn that it's spam with >>>>> sa-learn, wouldn't it be useful to also skew the AWL for that sender so >>>>> that future uses of the AWL for that spammer will push the overall spam >>>>> score up? >>>>> >>>>> Thots? >>>>> >>>>> >>>>> >>>> If a spammer is using the same sending address over and over again, >>>> blacklist them entirely. >>>> >>>> That said, I've never seen a spammer re-use the same address twice. >>>> >>>> >>> My understanding is "the other side". you get a spam and awl gives it a >>> negative score. you run sa-learn and you want this to "nuke" the awl >>> entry because if awl gives a too negative score, then sa-learn is >>> useless (unless BAYES_99 is set to a very high value). >>> >>> >>> >> That sounds like you have a broken trust path. It seems unlikely you'd >> have gotten nonspam from the same address *AND* IP address before. >> >> > > I am thinking about this case: Joe the spammer bombs you with mail that > is not detected as spam. he gets a negative awl. That statement implies that there's a "score" for the user in the AWL.
The AWL score varies with what the current messages pre-awl score. The AWL can think a sender has a +50 average, ie: strong spam, and if a message comes in that scores +100, the AWL will set itself to -25. However, if the same message was 0 before the AWL ran, it would give it +25. Or were you talking about having a negative average because all the messages sent as a bomb had negative scores? > so the questions are: > > - if user passes all the message to sa-learn, will that nuke the > negative awl value? > sa-learn doesn't touch the AWL. At all. > - is it enough to pass few messages? (in short, does "manual" training > have more "weight" than automatic awl learning?) > There's no such thing as manual training of the AWL. Actually, there's no such thing as "training" for it either. The AWL averages scores. nothing more, nothing less. The message score is added when the message is scanned. The AWL has no concept of spam or not, just what the historical average is. You can force fake messages with +100 scores in using spamassassin --add-addr-to-blacklist, but that's not really "training" it's just shoving the average around. > >
