Re: RCVD_NUMERIC_HELO

[Reindl Harald]

Am 03.03.2016 um 15:04 schrieb RW:

On Thu, 3 Mar 2016 13:58:30 +0100
Reindl Harald wrote:

Am 03.03.2016 um 13:47 schrieb RW:

On Wed, 2 Mar 2016 23:25:17 +0100
Reindl Harald wrote:

your expectation that the mass-test corpus can reproduce the whole
real world is fundamentally broken

Unbelievable.

If you think your bad experience with FSL_HELO_BARE_IP_2 is too
unusual for QA ever to pick-up on, then what are you complaining
about?

Your previous position was that it's normal for the rule to do more
harm than good, and it's such an obviously bad idea that it
shouldn't even have been tried in the first place

for deep-header-inspection it's an obviously bad idea as well as
RCVD_NUMERIC_HELO and there is no "previous position" - i said that
from the first moment on and ANYTHING doing HELO/PTR tests on any
foreign received header does more harm than good

my point is that you can't have it both ways. You've claimed that:

   1) The rule is an obviously bad idea, that causes a lot of FPs
      and usually does more harm than good.

   2) That adding more mail to the QA corpora wont help.

If (1) is true then it implies the corpora don't adequately reflect
mainstream email. In that case (2) is preposterous

i explain it different:



70% ham
30% spam







why?

if a in general wrong rule exists no matter how many people contribute to QA corpora it won't be fixed - FSL_HELO_BARE_IP_2 has *in total* 450 hits here the last 3 months the 30% spam had scores far above 10 points and would have been catched anyways - from that moment on it's worthless and even a single false positive giving the last points for mark as spam would have done much more harm then it ever could compensate how do you imagine that even blowing my whole inbound mail from hundrets of users (if it would be possible) would magically fix the rule it would at best end in the rule get such a low score that it is the same as disable it entirely - so the only correct thing to do is stop the foolish deep-header parsing because *then* it would no longer hit any relevant amount of ham and QA corpus over time could score it higher in a safe way

signature.asc
Description: OpenPGP digital signature