Mailing List Archive: [RD] antidrug 0.50 posted

[RD] antidrug 0.50 posted

Feb 16, 2004, 6:54 PM

Post #1 of 6 (1115 views)

http://mywebpages.comcast.net/mkettler/sa/antidrug.cf

Massive improvements to hit rates of most all drug categories.

- Extensive variety of gapping-types used in the male dysfunction set.
- vastly Improved performance of maledysfunction_obfu (over 5x the hit
rate!!). There are some cases that used to hit that will no longer hit, but
it's much better overall now.
- Some of the most popular drugs in other categories have gapping and
obfuscation added.

The only "base" rule with no measured improvements in hit rate is
LOCAL_DRUGS_DEPRESSION.

Note: due to the _very_ extensive combinations of obfuscation that can be
detected here, there is some chance of FPs. Let me know if you see some.

Some micro-corpus mass-check results for the curious:
0.50
SPAM HAM NAME
7141 922 (all messages)
1563 0 LOCAL_DRUGS_MALEDYSFUNCTION
1075 0 LOCAL_DRUGS_MALDYSFUNCTION_OBFU
712 0 LOCAL_DRUGS_DIET
666 0 LOCAL_DRUGS_PAIN
627 0 LOCAL_DRUGS_DIET_MALEDYS
594 0 LOCAL_DRUGS_MUSCLE
569 0 LOCAL_DRUGS_MANYKINDS
465 0 LOCAL_DRUGS_PAIN_MALEDYS
463 0 LOCAL_DRUGS_DIET_PAIN
316 0 LOCAL_DRUGS_DEPRESSION
380 0 LOCAL_DRUGS_ANXIETY_MALEDYS
277 0 LOCAL_DRUGS_DEPRESSION_MALEDYS
531 1 LOCAL_DRUGS_ANXIETY
361 1 LOCAL_DRUGS_SLEEP

Re: [RD] antidrug 0.50 posted [ In reply to ]

gjensen at magma

Feb 16, 2004, 7:42 PM

Post #2 of 6 (1097 views)

Permalink

----- Original Message -----
From: "Matt Kettler" <mkettler@evi-inc.com>
To: <spamassassin-users@incubator.apache.org>
Sent: Monday, February 16, 2004 8:54 PM
Subject: [RD] antidrug 0.50 posted

> http://mywebpages.comcast.net/mkettler/sa/antidrug.cf
>
> 7141 922 (all messages)
> 1563 0 LOCAL_DRUGS_MALEDYSFUNCTION
> 1075 0 LOCAL_DRUGS_MALDYSFUNCTION_OBFU
^
-------------------------------------------E

Small typo - the E in "MALDYSFUNCTION_OBFU" is missing on the website too.

Looks like a great addition to the filter. Thanks Matt.

Re: [RD] antidrug 0.50 posted [ In reply to ]

DonovanA at weight-watchers

Feb 17, 2004, 8:00 AM

Post #3 of 6 (1102 views)

Permalink

It appears the spelling mistake is at least consistent, so shouldn't cause a problem.

>>> "Gorm Jensen" <gjensen@magma.ca> 02/16/04 09:42PM >>>

----- Original Message -----
From: "Matt Kettler" <mkettler@evi-inc.com>
To: <spamassassin-users@incubator.apache.org>
Sent: Monday, February 16, 2004 8:54 PM
Subject: [RD] antidrug 0.50 posted

> http://mywebpages.comcast.net/mkettler/sa/antidrug.cf
>
> 7141 922 (all messages)
> 1563 0 LOCAL_DRUGS_MALEDYSFUNCTION
> 1075 0 LOCAL_DRUGS_MALDYSFUNCTION_OBFU
^
-------------------------------------------E

Small typo - the E in "MALDYSFUNCTION_OBFU" is missing on the website too.

Looks like a great addition to the filter. Thanks Matt.

Re: [RD] antidrug 0.50 posted [ In reply to ]

mkettler at evi-inc

Feb 17, 2004, 9:35 AM

Post #4 of 6 (1099 views)

Permalink

Agreed, it's consistent, and has been there since the first release of
antidrug.cf.

However, it's still a typo.. I'll fix it next time I push a release out.

Then again, antidrug will likely wind up in a future SA release, so at that
point it won't matter.

At 10:00 AM 2/17/2004, Andy Donovan wrote:
>It appears the spelling mistake is at least consistent, so shouldn't cause
>a problem.
>
> >>> "Gorm Jensen" <gjensen@magma.ca> 02/16/04 09:42PM >>>
>
>----- Original Message -----
>From: "Matt Kettler" <mkettler@evi-inc.com>
>To: <spamassassin-users@incubator.apache.org>
>Sent: Monday, February 16, 2004 8:54 PM
>Subject: [RD] antidrug 0.50 posted
>
>
> > http://mywebpages.comcast.net/mkettler/sa/antidrug.cf
> >
> > 7141 922 (all messages)
> > 1563 0 LOCAL_DRUGS_MALEDYSFUNCTION
> > 1075 0 LOCAL_DRUGS_MALDYSFUNCTION_OBFU
> ^
>-------------------------------------------E
>
>Small typo - the E in "MALDYSFUNCTION_OBFU" is missing on the website too.
>
>Looks like a great addition to the filter. Thanks Matt.

RE: [RD] antidrug 0.50 posted [ In reply to ]

csanterre at MerchantsOverseas

Feb 17, 2004, 3:12 PM

Post #5 of 6 (1099 views)

Permalink

> -----Original Message-----
> From: Matt Kettler [mailto:mkettler@evi-inc.com]
> Sent: Tuesday, February 17, 2004 11:36 AM
> To: spamassassin-users@incubator.apache.org
> Subject: Re: [RD] antidrug 0.50 posted
>
>
> Agreed, it's consistent, and has been there since the first
> release of
> antidrug.cf.
>
> However, it's still a typo.. I'll fix it next time I push a
> release out.
>
> Then again, antidrug will likely wind up in a future SA
> release, so at that
> point it won't matter.
>

How does that effect Pharmacists? Or doctor's email? I still think
somethings should be left as an option. Maybe distribute antidrug with SA
and have instructions in the readme to use it? I don't know I'm a little
tired. :-)

--Chris

RE: [RD] antidrug 0.50 posted [ In reply to ]

mkettler at evi-inc

Feb 17, 2004, 3:24 PM

Post #6 of 6 (1102 views)

Permalink

At 05:12 PM 2/17/2004, Chris Santerre wrote:
>How does that effect Pharmacists? Or doctor's email? I still think
>somethings should be left as an option. Maybe distribute antidrug with SA
>and have instructions in the readme to use it? I don't know I'm a little
>tired. :-)

I'm going to push to try to only have some of the more suspicious ones
scored in the official release... ie: no scores for most single types, just
obfuscations, oddball combinations, and manykinds. But that's going to need
changes in the ruleset itself. Right now I implement this policy (for the
most part) in my hand scoring. It will take a little bit of change to
prevent the GA from undoing that.

However, SA has always been somewhat inappropriate for certain kinds of people.

The credit related rules make in inappropriate for lenders. Mortgage
lenders get double-hit.

Doctors will already be hit on occasion by STOP_SNORING and FREE_SAMPLE.

I don't think a battered women's shelter could use spamassassin, it would
wind up tagging a lot of the email they might receive. (some may sound like
violent porn to spamassassin).