spamassassin-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From dar...@chaosreigns.com
Subject Re: if you don't watch it, legit mail can be blocked
Date Thu, 21 Jul 2011 20:07:10 GMT
On 07/21, Michael Scheidell wrote:
> but, this rule seems to be way too aggressive.
> 
> 50_scores.cf:score FS_REPLICA 1.630 3.599 2.028 3.599 # n=2
> 50_scores.cf:score FS_REPLICAWATCH 3.237 1.715 1.733 3.015 # n=2

> 72_active.cf:header   FS_REPLICA             Subject =~ /replica/i

> 72_active.cf:describe FS_REPLICAWATCH        Subject says Replica watch

Scores are automatically generated based on optimal performance based on
actual emails:  http://wiki.apache.org/spamassassin/NightlyMassCheck

Statistics of the results are regularly generated:
http://ruleqa.spamassassin.org/?daterev=20110716&rule=%2FFS_REPLICA

   SPAM%     HAM%     S/O    RANK   SCORE  NAME  
  7.5986        0   1.000    0.92    3.24  FS_REPLICAWATCH  
  9.8513   0.0143   0.999    0.92    1.63  FS_REPLICA  

So FS_REPLICA hits 9.8513% of spam while hitting 0.0143% of ham.  That's
less than 1 in 2500 hams (0.04%), which is the overall false positive rate
SpamAssassin aims for.


But yes, it does look like this pair of rules could be improved.  It is an
unfortunate problem that score generation doesn't have a good way of
accounting for heavy overlap.  

> anyone else think that ANY rule that scores above a 3 is asking for trouble?

There has been talk of limiting that kind of thing.

-- 
"Where are you going and what do you wish?"
- The Old Moon, to Winkin' Blinkin' and Nod
http://www.ChaosReigns.com

Mime
View raw message