Mailing List Archive

Some real anti-bayes stuffing
This one would have got through, but it was caught due to certain objectionable keywords (deleted). My well-trained Bayes filter didn't complain a bit. It's obviously machine generated text from lists of common ham words, formed into crude sentences. We'll probably be seeing a lot more of this.

Pierre Thomson
BIC


-----Original Message-----

... [deleted url and one-liner ad]...

Whose soft kitchen is angry and perhaps the well-crafted round-shaped camera got an idea.
Any round-shaped laptop spit.
His odd shaped carpet fidgeting.
Their soft camera prepare for fight.
Her daughters well-crafted red paper stinks.
Mine tall ipaq walks.
A given beautiful well-crafted sony is angry.
Our children small magazine spit however, any purple mp3 player calms-down and still his brothers white magazine falls.
Our noisy silver noisy round small well-crafted boots is angry.
His beautiful t-shirt snores.
Our odd shaped shining carpet is on fire.
A given round laptop stares.
Any given red house adheres.
Any given red soda got an idea while his brothers expensive ipaq stares.
Our expensive door calms-down.
Any given round-shaped small soft binocyles walks and our children hairy caw spit and perhaps a round-shaped baby stands-still as soon as the green house stands-sti!
ll.
Whose expensive glasses lies.
Mine hairy camera is on fire.
Re: Some real anti-bayes stuffing [ In reply to ]
I have one email that included 2 pages of text from Tom Sawyer.

It didn't get caught.

- pat
UW Madison GS

>>> "Pierre Thomson" <PierreThomson@bruderhof.com> 2/13/2004 11:04 AM
>>>
This one would have got through, but it was caught due to certain
objectionable keywords (deleted). My well-trained Bayes filter didn't
complain a bit. It's obviously machine generated text from lists of
common ham words, formed into crude sentences. We'll probably be seeing
a lot more of this.

Pierre Thomson
BIC


-----Original Message-----

... [deleted url and one-liner ad]...

Whose soft kitchen is angry and perhaps the well-crafted round-shaped
camera got an idea.
Any round-shaped laptop spit.
His odd shaped carpet fidgeting.
Their soft camera prepare for fight.
Her daughters well-crafted red paper stinks.
Mine tall ipaq walks.
A given beautiful well-crafted sony is angry.
Our children small magazine spit however, any purple mp3 player
calms-down and still his brothers white magazine falls.
Our noisy silver noisy round small well-crafted boots is angry.
His beautiful t-shirt snores.
Our odd shaped shining carpet is on fire.
A given round laptop stares.
Any given red house adheres.
Any given red soda got an idea while his brothers
expensive ipaq stares.
Our expensive door calms-down.
Any given round-shaped small soft binocyles walks and our children
hairy caw spit and perhaps a round-shaped baby stands-still as soon as
the green house stands-sti!
ll.
Whose expensive glasses lies.
Mine hairy camera is on fire.
Re: Some real anti-bayes stuffing [ In reply to ]
Pat Noordsij wrote:
> I have one email that included 2 pages of text from Tom Sawyer.
>
> It didn't get caught.

There are also sentence-writing AI programs conveniently available for
spammers. Finally they found a way to foil Bayesian filters.
Congratulations.

Welp, time to find a new anti-spam mechanism. What is it this time?
Re: Some real anti-bayes stuffing [ In reply to ]
On Fri, Feb 13, 2004 at 01:24:19PM -0500, Dan Melomedman is rumored to have said:
>
> There are also sentence-writing AI programs conveniently available for
> spammers. Finally they found a way to foil Bayesian filters.
> Congratulations.

Bayes is still working dandy for me. I've only had one or two get past it in the last couple of months.


> Welp, time to find a new anti-spam mechanism. What is it this time?

A 12-Gauge? ;) (j/k... sort of)


--
"I heard someone tried the monkeys-on-typewriters bit trying for the plays of W. Shakespeare, but all they got was the collected works of Francis Bacon."
- Bill Hirst
Re: Some real anti-bayes stuffing [ In reply to ]
Dan Melomedman <dan@devonit.com> wrote:
> Pat Noordsij wrote:
>> I have one email that included 2 pages of text from Tom
>> Sawyer.
>>
>> It didn't get caught.
>
> There are also sentence-writing AI programs conveniently
> available for spammers. Finally they found a way to foil
> Bayesian filters. Congratulations.
>
> Welp, time to find a new anti-spam mechanism. What is it this
> time?

Hey wait... this has come up repeatedly. With a well trained bayes, you should
still have good odds of catching these. There are enough words that will ONLY
show up in spam, PLUS THE OTHER characteristics of the messages to detect
"spammy" messages. And the add-on rule sets should add even more teeth as new
techniques evolve.

I wouldn't give up just yet, but maybe modify how I train bayes.

Do you have any example messages handy?

- Bob
Re: Some real anti-bayes stuffing [ In reply to ]
Steve Thomas wrote:
> Bayes is still working dandy for me. I've only had one or two get past it in the last couple of months.

It's only a matter of time now. Spammers are less technical than
sysadmins and antispammers, but they effectively catch up eventually every
time. Tremendous amount of time and effort is wasted writing rules and
devising new methods to filter. It's a wrong approach to solve this
problem. It's a never-ending arms race.
RE: Some real anti-bayes stuffing [ In reply to ]
Bob George <mailings02@ttlexceeded.com> wrote:

>Dan Melomedman <dan@devonit.com> wrote:
>> Pat Noordsij wrote:
>>> I have one email that included 2 pages of text from Tom
>>> Sawyer.
>>>
>>> It didn't get caught.
>>
>> There are also sentence-writing AI programs conveniently
>> available for spammers. Finally they found a way to foil
>> Bayesian filters. Congratulations.
>>
>> Welp, time to find a new anti-spam mechanism. What is it this
>> time?
>
>Hey wait... this has come up repeatedly. With a well trained bayes, you should
>still have good odds of catching these. There are enough words that will ONLY
>show up in spam, PLUS THE OTHER characteristics of the messages to detect
>"spammy" messages. And the add-on rule sets should add even more teeth as new
>techniques evolve.
>
>I wouldn't give up just yet, but maybe modify how I train bayes.

I'm not saying Bayes isn't working most of the time, but it does seem possible to craft sentences that skew it strongly towards ham. The faked sentences in the original posting contained plenty of hammish words, but there were a few that would eventually end up as spam markers with training. For example, the improperly hyphenated "calms-down" and "stands-still", as well as "caw" and "binocycles".

Pierre Thomson
BIC
Re: Some real anti-bayes stuffing [ In reply to ]
Pierre Thomson <PierreThomson@bruderhof.com> wrote:
> [...]
> I'm not saying Bayes isn't working most of the time, but it
> does seem possible to craft sentences that skew it strongly
> towards ham.

Oh, and I should clarify that I don't think it's as much of a problem for SA as
for "pure bayes" solutions. Since SA uses a variable number of OTHER rules for
detecting spammish characteristics, I find that the combination is quite
effective. Other rules detect the spam, those are fed into sa-learn, and
eventually bayes figures out that other traits mark those messages. At least
based on my small setup.

> The faked sentences in the original posting
> contained plenty of hammish words, but there were a few that
> would eventually end up as spam markers with training. For
> example, the improperly hyphenated "calms-down" and
> "stands-still", as well as "caw" and "binocycles".

Again, as long as I don't start subscribing to literary lists, I think I'm safe
with SA. :)

One of the reasons I've been going through all the gyrations with procmail,
antivirus and SA is to try running a couple head-to-head. I hope to configure
bogofilter and a couple of other bayes-only tools and run them in parallel.

- Bob
RE: Some real anti-bayes stuffing [ In reply to ]
> -----Original Message-----
> From: Pierre Thomson [mailto:PierreThomson@bruderhof.com]
> Sent: Friday, February 13, 2004 12:05 PM
> To: spamassassin-users@incubator.apache.org
> Subject: Some real anti-bayes stuffing
>
>
> This one would have got through, but it was caught due to
> certain objectionable keywords (deleted). My well-trained
> Bayes filter didn't complain a bit. It's obviously machine
> generated text from lists of common ham words, formed into
> crude sentences. We'll probably be seeing a lot more of this.
>
> Pierre Thomson
> BIC
>
>
*snip*

> Mine hairy camera is on fire.

Ahahahahahahahahah ahahahahha .....hhahahahaha.....ha ah ah hhhah aaa ahah
a

*wipes tear*

Oh man that was some funny stuff! Hell I'd actually like to read more!
Someone steal the code just so I can generate random stories :)

--Chris
RE: Some real anti-bayes stuffing [ In reply to ]
> -----Original Message-----
> From: Pierre Thomson [mailto:PierreThomson@bruderhof.com]
> Sent: Friday, February 13, 2004 12:05 PM
> To: spamassassin-users@incubator.apache.org
> Subject: Some real anti-bayes stuffing
>
>
> This one would have got through, but it was caught due to
> certain objectionable keywords (deleted). My well-trained
> Bayes filter didn't complain a bit. It's obviously machine
> generated text from lists of common ham words, formed into
> crude sentences. We'll probably be seeing a lot more of this.
>
> Pierre Thomson
> BIC
>
>
> -----Original Message-----
>
> ... [deleted url and one-liner ad]...
>
> Whose soft kitchen is angry and perhaps the well-crafted
> round-shaped camera got an idea.
> Any round-shaped laptop spit.
*snip more*

Upon further and more serious inspection I see what this is doing. For one,
it defeats us using the rules that look for words without things like "the,
a, and, is, was, as, of, ......."

However I agree with Bob George. This is only for pure Bayes installs. I'm
still not using it at all and catch 99.9% of spam. So this is a feeble
attempt to stop us using Bayes Fodder as a tag now. It won't be long before
someone sees a pattern on this as well. (Fred I'm looking in your
direction!!....OK, I'm really looking at my shoes.)

Look at how many sentances begin with "Any" or "is on fire" appears.

I'm really not worried. I'm surprised it took them this long to figure this
part out.

--Chris
RE: Some real anti-bayes stuffing [ In reply to ]
This is exactly what I was talking about in a previous post.

If spammers start doing this and they make sure this bogus section is
larger than the actual spam section, the bayes filter will probably mark
it as ham. What's worst is if you then force the bayes filter to learn
this as spam, now you just increased the spam score for each of these
good words. If this happens over and over again, I would imagine that
the bayes filter would malfunction. At least that's my opinion, but
feel free to disagree.

Thanks,
Mark DeMichele

> -----Original Message-----
> From: Pierre Thomson [mailto:PierreThomson@bruderhof.com]
> Sent: Friday, February 13, 2004 12:05 PM
> To: spamassassin-users@incubator.apache.org
> Subject: Some real anti-bayes stuffing
>
> This one would have got through, but it was caught due to certain
> objectionable keywords (deleted). My well-trained Bayes filter didn't
> complain a bit. It's obviously machine generated text from lists of
> common ham words, formed into crude sentences. We'll probably be
seeing a
> lot more of this.
>
> Pierre Thomson
> BIC
>
>
> -----Original Message-----
>
> ... [deleted url and one-liner ad]...
>
> Whose soft kitchen is angry and perhaps the well-crafted round-shaped
> camera got an idea.
> Any round-shaped laptop spit.
> His odd shaped carpet fidgeting.
> Their soft camera prepare for fight.
> Her daughters well-crafted red paper stinks.
> Mine tall ipaq walks.
> A given beautiful well-crafted sony is angry.
> Our children small magazine spit however, any purple mp3 player
calms-
> down and still his brothers white magazine falls.
> Our noisy silver noisy round small well-crafted boots is angry.
> His beautiful t-shirt snores.
> Our odd shaped shining carpet is on fire.
> A given round laptop stares.
> Any given red house adheres.
> Any given red soda got an idea while his brothers
> expensive ipaq stares.
> Our expensive door calms-down.
> Any given round-shaped small soft binocyles walks and our children
hairy
> caw spit and perhaps a round-shaped baby stands-still as soon as the
green
> house stands-sti!
> ll.
> Whose expensive glasses lies.
> Mine hairy camera is on fire.
>
>
Re: Some real anti-bayes stuffing [ In reply to ]
Mark A. DeMichele wrote:
> This is exactly what I was talking about in a previous post.
>
> If spammers start doing this and they make sure this bogus section is
> larger than the actual spam section, the bayes filter will probably mark
> it as ham. What's worst is if you then force the bayes filter to learn
> this as spam, now you just increased the spam score for each of these
> good words. If this happens over and over again, I would imagine that
> the bayes filter would malfunction. At least that's my opinion, but
> feel free to disagree.
>
> Thanks,
> Mark DeMichele

I agree. We should contact Paul Graham, and ask him to suggest a new
statistical filtering mechanism. This is really asking for artificial
intelligence in both filters and spam. I guess that's the future.

How bad does it need to get before people will realize our current email
infrastructure needs a complete redesign?
Re: Some real anti-bayes stuffing [ In reply to ]
On Fri, Feb 13, 2004 at 05:34:38PM -0500, Dan Melomedman is rumored to have said:
>
> How bad does it need to get before people will realize our current email
> infrastructure needs a complete redesign?

People realize it.

As soon as you develop a new spamproof system that's as robust and reliable as SMTP, distributed (i.e. no central CA), and based on open standards, along with the deployment scheme to make the transition from SMTP completely painless and transparent, let me know. I'll hop right on board.

I'm not trying to shoot down the idea of a new system - I agree that something's needed. I'm just pointing out that there are very significant hurdles to overcome before the world can turn off their SMTP servers for good and that there *are* people working on it.


--
"I can write better than anybody who can write faster, and I can write faster than anybody who can write better."
- A. J. Liebling (1904-1963)
Re: Some real anti-bayes stuffing [ In reply to ]
Steve Thomas wrote:
> As soon as you develop a new spamproof system that's as robust and reliable as SMTP, distributed (i.e. no central CA), and based on open standards, along with the deployment scheme to make the transition from SMTP completely painless and transparent, let me know. I'll hop right on board.

SMTP is just a part of the infrastructure design, but it's not robust.
Some people have recommended better designs, but nothing has been
finalized yet. See cr.yp.to/im2000.html for instance.
Re: Some real anti-bayes stuffing [ In reply to ]
On Fri, Feb 13, 2004 at 06:18:17PM -0500, Dan Melomedman is rumored to have said:
>
> SMTP is just a part of the infrastructure design, but it's not robust.

I disagree. It was designed in such a way so that no message could ever be completely lost, barring a catastrophic event (disk crash, alien invasion.. ;)

> Some people have recommended better designs, but nothing has been
> finalized yet. See cr.yp.to/im2000.html for instance.

Interesting, but I don't see how it's a better design. It might help curb the spam problem, but in no way is it robust. What it does is make e-mail slow and unreliable. Storing messages on the sender's server is (IMHO) not a good solution.

For instance... Let's say that 100 people send me 100 messages (one each) in a day, and that I check my mail once per day in the evenings. That means that 100 machines have to be up *at the same instant that I check my mail*, which is the same instant that lots of other people in my time zone are checking their mail. Consider the privacy/security issues involved - there's no reason that someone who sends me mail needs to be able to learn my IP when I retrieve it. Bandwidth... With the current system, those 100 messages can trickle in throughout the day. A sending server can be having issues and be down for four hours and I'd never know it, because when it came back up, it would continue trying to send to my server until the message was received. With the IM2k system, all that mail is being retrieved from various places all over the net, all at once - along with my neighbor's mail, their neighbor's mail, etc.

St-

--
" The best way to predict the future is to invent it."
- Alan Kay
Re: Some real anti-bayes stuffing [ In reply to ]
Steve Thomas wrote:
> > SMTP is just a part of the infrastructure design, but it's not robust.
>
> I disagree. It was designed in such a way so that no message could ever be completely lost, barring a catastrophic event (disk crash, alien invasion.. ;)

You are not talking about SMTP, you are talking about the
infrastructure in that sentence.
>
> > Some people have recommended better designs, but nothing has been
> > finalized yet. See cr.yp.to/im2000.html for instance.
>
> Interesting, but I don't see how it's a better design. It might help curb the spam problem, but in no way is it robust. What it does is make e-mail slow and unreliable. Storing messages on the sender's server is (IMHO) not a good solution.

Reread that page, you obviously don't understand it.
Re: Some real anti-bayes stuffing [ In reply to ]
On Fri, Feb 13, 2004 at 03:47:27PM -0800, Raquel Rice wrote:
> On Fri, 13 Feb 2004 18:31:53 -0500
> Dan Melomedman <dan@devonit.com> wrote:
>
> > Raquel Rice wrote:
>
> > > On Fri, Feb 13, 2004 at 05:34:38PM -0500
> > > Dan Melomedman <dan@devonit.com> wrote:
>
> > > > I agree. We should contact Paul Graham, and ask him to suggest
> > > > a new statistical filtering mechanism. This is really asking
> > > > for artificial intelligence in both filters and spam. I guess
> > > > that's the future.
> > > >
> > > > How bad does it need to get before people will realize our
> > > > current email infrastructure needs a complete redesign?
>
>
> > > "Oh my goodness!" said Chicken Little. "The sky is falling! I
> > > must go and tell the king."
> >
> > So you want to be an asshole?
> >
>
> Please, there's no need to be sending me notes by private mail,
> especially notes with that kind of language and implied threats.
>
> This is a spamassassin-user list. I thought it was a list for
> questions about spamassassin. I'm just here to learn about
> spamassassin and try to help in whatever small way I'm able.

This guy looks like a troll. After responding to one of his posts
I've been ignoring him; others might well consider same.

--
Dan Wilder
Re: Some real anti-bayes stuffing [ In reply to ]
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


Mark A. DeMichele writes:
> This is exactly what I was talking about in a previous post.
>
> If spammers start doing this and they make sure this bogus section is
> larger than the actual spam section, the bayes filter will probably mark
> it as ham. What's worst is if you then force the bayes filter to learn
> this as spam, now you just increased the spam score for each of these
> good words. If this happens over and over again, I would imagine that
> the bayes filter would malfunction. At least that's my opinion, but
> feel free to disagree.

Good, will do.

The idea of bayes is that you train it on

1. *YOUR* ham
2. *YOUR* spam

Unless spammers figure out what *YOU* call ham, they can add random words,
bits of Russian literature, snippets of Tom Sawyer until the cows come
home.

For spammers to effectively "poison" bayes, they need to figure out what
kind of text *YOU* have trained on. If I don't receive copies of Tom
Sawyer by email normally, then sure, 19th-century US lit will become a
spam sign.

But I don't care because *I DON'T* receive copies of Tom Sawyer by email,
normally. (I reserve that honour for snailmail, or occasionally by FTP.)
So it's not going to wind up misclassifying anything as a result.

In the worst case, they'll find one or two strong ham-sign words -- like
'Kits', or 'entries' (for my corpus). Worst case? I retrain on their
mail, and those tokens become about even ham and spam counts, 0.5
probability, and are *ignored* by the Bayes calculation in future.

*PLEASE* read up on how Bayes works. READ John Graham-Cumming's
presentation from the last Spam Conf, and NOTICE how it took him thousands
of iterations of bayes-poisoning, sending a mail each time with a direct
feedback loop, to get a single spam through.

The sky is NOT falling, guys!

- --j.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (GNU/Linux)
Comment: Exmh CVS

iD8DBQFALWYuQTcbUG5Y7woRAuzOAKCRRNOx7r2SD/PpyKRAIcthNsC9JgCg7drd
468mo+BQ7BGH/Ix5OfEXg/E=
=w6ao
-----END PGP SIGNATURE-----
Re: Some real anti-bayes stuffing [ In reply to ]
Dan Wilder wrote:
> > > > "Oh my goodness!" said Chicken Little. "The sky is falling! I
> > > > must go and tell the king."
> > >
> > > So you want to be an asshole?
> > >
> >
> > Please, there's no need to be sending me notes by private mail,
> > especially notes with that kind of language and implied threats.
> >
> > This is a spamassassin-user list. I thought it was a list for
> > questions about spamassassin. I'm just here to learn about
> > spamassassin and try to help in whatever small way I'm able.
>
> This guy looks like a troll. After responding to one of his posts
> I've been ignoring him; others might well consider same.
>
> --
> Dan Wilder

First, I responded privately to an insult, then you had the audacity to
violate netiquette and dump my above private message to the mailing list,
and call me a troll. You sir, are truelly an ass!
Re: Some real anti-bayes stuffing [ In reply to ]
On Fri, Feb 13, 2004 at 07:05:53PM -0500, Dan Melomedman wrote:

[ Content confirming my claim deleted ]

Mr. Melomedman, you may ignore this if you wish. For anybody
else who cares, one of my favorite links on such:

http://rhyolite.com/anti-spam/you-might-be.html

--
Dan Wilder
Re: Some real anti-bayes stuffing [ In reply to ]
On Fri, Feb 13, 2004 at 06:47:57PM -0500, Dan Melomedman is rumored to have said:
>
> Steve Thomas wrote:
> > > SMTP is just a part of the infrastructure design, but it's not robust.
> >
> > I disagree. It was designed in such a way so that no message could ever be completely lost, barring a catastrophic event (disk crash, alien invasion.. ;)
>
> You are not talking about SMTP, you are talking about the
> infrastructure in that sentence.

Actually, I _am_ talking about SMTP. From RFC2821 "Simple Mail Transfer Protocol":

"The objective of the Simple Mail Transfer Protocol (SMTP) is to
transfer mail reliably and efficiently."

"...a formal handoff of responsibility for the message occurs: the
protocol requires that a server accept responsibility for either
delivering a message or properly reporting the failure to do so."

"SMTP is widely deployed and high-quality implementations have proven
to be very robust."

etc..

Sendmail, exim, postfix, etc. are just pieces of software that follow a set of rules. Like accounting software, all it has to do is follow a pre-defined set of rules in order to do its job effectively. Everything else is just gravy, and a lot of bells and whistles does not an MTA make... if it breaks the rules, it's either a poor piece of software or a good piece of software that's poorly configured.


> > > Some people have recommended better designs, but nothing has been
> > > finalized yet. See cr.yp.to/im2000.html for instance.
> >
> > Interesting, but I don't see how it's a better design. It might help curb the spam problem, but in no way is it robust. What it does is make e-mail slow and unreliable. Storing messages on the sender's server is (IMHO) not a good solution.
>
> Reread that page, you obviously don't understand it.

What's not to understand?

"Each message is stored under the sender's disk quota at the
sender's ISP."

"The sender's ISP, rather than the receiver's ISP, is the
always-online post office from which the receiver picks up
the message."

Seems pretty clear to me. You (the sender) send me a message. Your ISP stores it in a special part of your mail spool and somehow (this part hasn't been figured out) notifies me of a waiting message. When I check my mail, I connect to your ISPs server and download your message.

Like I said, it's an interesting idea, but I don't see it as a very good one.

I wouldn't mind continuing this conversation, as it's an interesting topic, but I think we should take it off-list. It doesn't have anything to do with SA at this point.

St-


--
"But at my back I always hear Time's winged chariot hurrying near."
- Andrew Marvell (1621-1678)
Re: Some real anti-bayes stuffing [ In reply to ]
On Fri, 13 Feb 2004, Dan Melomedman wrote:

> Steve Thomas wrote:
> > > SMTP is just a part of the infrastructure design, but it's not robust.
> >
> > I disagree. It was designed in such a way so that no message could ever be completely lost, barring a catastrophic event (disk crash, alien invasion.. ;)
>
> You are not talking about SMTP, you are talking about the
> infrastructure in that sentence.

No, Steve has it right. He's talking about the formal specifications
of the Simple Mail Transfer Protocol (SMTP).

If you were to actually read RFC-2821, you would find implementation
INDEPENDENT statements of how mail should be handled.
It includes such statements as:

6.1 Reliable Delivery and Replies by Email

When the receiver-SMTP accepts a piece of mail (by sending a "250 OK"
message in response to DATA), it is accepting responsibility for
delivering or relaying the message. It must take this responsibility
seriously. It MUST NOT lose the message for frivolous reasons, such
as because the host later crashes or because of a predictable
resource shortage.

If there is a delivery failure after acceptance of a message, the
receiver-SMTP MUST formulate and mail a notification message.

Note that there's no language about HOW to go about doing this, just
statements of behaivors you must implement if you are going to
legitimatly claim to be an SMTP server.

So you could implement an SMTP system using scribes and signal flags,
so long as you met the specs for the resultant system characteristics.

I do agree that there are mail systems that are not robust, but
in a strict sense they cannot claim to speak SMTP unless they
comply with the letter of the specs.

--
Dave Funk University of Iowa
<dbfunk (at) engineering.uiowa.edu> College of Engineering
319/335-5751 FAX: 319/384-0549 1256 Seamans Center
Sys_admin/Postmaster/cell_admin Iowa City, IA 52242-1527
#include <std_disclaimer.h>
Better is not better, 'standard' is better. B{
Re: Some real anti-bayes stuffing [ In reply to ]
Hi,

On Fri, 13 Feb 2004 16:18:54 -0800 Dan Wilder <dan@ssc.com> wrote:

> On Fri, Feb 13, 2004 at 07:05:53PM -0500, Dan Melomedman wrote:
>
> [ Content confirming my claim deleted ]
>
> Mr. Melomedman, you may ignore this if you wish. For anybody
> else who cares, one of my favorite links on such:
>
> http://rhyolite.com/anti-spam/you-might-be.html

Sobering. After reading that, I switched to restaurant-grade tinfoil for
my hat lining. I now make my own gravy!

Mmm, gravy and stuffing, just like Anti-Bayes used to make....

-- Bob

(praying someone beats this thread to death with a shovel and buries it
in the crawlspace under some quicklime)
Re: Some real anti-bayes stuffing [ In reply to ]
From: "Raquel Rice" <raquel@thericehouse.net>
> On Fri, 13 Feb 2004 18:31:53 -0500
> Dan Melomedman <dan@devonit.com> wrote:
...
> Please, there's no need to be sending me notes by private mail,
> especially notes with that kind of language and implied threats.
>
> This is a spamassassin-user list. I thought it was a list for
> questions about spamassassin. I'm just here to learn about
> spamassassin and try to help in whatever small way I'm able.
>
> --
> Raquel

Please read the way the headers for this list are constructed. It
takes special effort to REMOVE you from the reply. It also requires
remembering to reply to all rather than just the Reply-to: address.
Your whining becomes tedious.

{^_^}
Re: Some real anti-bayes stuffing [ In reply to ]
If you think about it like this though, that the 'speech' in the Bayes
poison is NOTHING like the way people write email. Sure it can be text
out of books, but no one writes emails that way. In my experience there
is a LOT of net slang and contractions that are NEVER seen in spam.
I've only trained about 8000 spam and 6000 ham and my Bayes is VERY,
VERY effective.

But remember, the strength of SA is not Bayes alone, but the sum of the
parts. If Bayes scores are low, then Razor is there as are the RBLs,
evilnumbers and other specialized rulesets. In my opinion, the game is
on our side. Look at how the spammers are so desperate that they have
to go to GREAT lengths to try to obfuscate the actual in such a way
that it is EASILY ignored as nonsense by the average person.

This type of obfuscation greatly reduces a spammers effective return on
spam delivered... in other words, even if it is delivered, its as
though it wasn't because it is so poorly readable!

When I first started using SA a long time ago, I really missed this
significance. I elected not to install Razor then. But man, I LIKE
having multiple options. Its GREAT that there are so many RBL's out
there. I'm considering going to the trouble of adding Pyzor AND even
DCC as well,

The MORE ways that a spammer can get caught, the better!

On Feb 13, 2004, at 1:42 PM, Pierre Thomson wrote:

>> I wouldn't give up just yet, but maybe modify how I train bayes.
>
> I'm not saying Bayes isn't working most of the time, but it does seem
> possible to craft sentences that skew it strongly towards ham. The
> faked sentences in the original posting contained plenty of hammish
> words, but there were a few that would eventually end up as spam
> markers with training. For example, the improperly hyphenated
> "calms-down" and "stands-still", as well as "caw" and "binocycles".
>
> Pierre Thomson
> BIC
>
>

Kindest regards,

Ron

"What shall we do? What shall we do?" he cried, "Escaping goblins to be
caught by wolves!" - Bilbo Baggins

The Hobbit by J. R. R. Tolkein
http://www.apple.com/trailers/newline/returnoftheking/trailer_large.html

1 2  View All