[Gllug] Spam

[Jim Cheetham]

On Fri, Feb 22, 2002 at 12:30:37AM +0000, Chris Ball wrote:
> >>>>> "nix" == nix  <nix at esperi.demon.co.uk> writes:
> 
>     nix> Allow me to second this recommendation. Vipul's Razor in
>     nix> particular is very nifty (while SpamAssassin can easily be
>     nix> replaced with something like, say, the SpamBouncer, there is no
>     nix> real replacement for the Razor.)
> 
> I'm not as impressed with Razor.  Taking a hash is a good idea, but
> breaks as soon as you get spam that includes a random string in the
> subject/body - which is fairly common, lately.  SpamAssassin, on the

Although razor is currently moving towards nilsimsa hashes, which are
much more fuzzy (and longer) and "hopefully" less affected by random
content inserts.
http://lexx.shinn.net/cmeclax/nilsimsa.html

Razor also has no trust model on submission, and occasionally non-spam
messages get into the database. However, this is being addressed,
possibly triggered by someone submitting the razor-users list to
razor ... :-)

> other hand, seems to treat this as _indicative_ of spam.  Note also,
> below, that SpamAssassin doesn't treat presence in Razor as indicative
> of spam on its own - 3 points out of a 5 minimum for the mail to be
> spam.  This would make most false submissions to Razor ineffective.

Strongly agree - razor is an interesting technology, but not enough on
it's own. Spamassassin provides enough suitable sanity checks to make
false identification much less likely, although be careful before
passing mailing list traffic through it, because that can trigger
some of the rules.

Of course, you could tweak your own rule scoring and threshold values,
but the defaults are extremely effective on my traffic. Over 300
messages, I've had no false negatives, and only two false positives,
which were from a list that I'd forgotten to exclude.

-jim

-- 
Gllug mailing list  -  Gllug at linux.co.uk
http://list.ftech.net/mailman/listinfo/gllug