On 11/16, John Hardin wrote: > How so? If masscheck only considered the rules that hit when the > message was first received (or more properly, was first added to the > corpora), how would you ever test new rules against the existing > corpora?
They don't just use emails since the last mass check? > >DCC, Xen... so many things would get scored... not usefully. > > Only if and when the data expires. How long are DCC checksums kept? > And hosts stay on Zen until the ISP removes them. My concern is that they are far more accurate an hour or a day after the spam is received, due to others reporting them. At the very least, I expect tests against RBLs and things like DCC and razor at the time an email is received to correlate badly to tests on the same email weeks later. -- "Everything is sacred to us...so if you are sacred then you must treat yourself with respect, to do otherwise is to desecrate something that is holy." - ST:TNG 7x20 Journey's End http://www.ChaosReigns.com
