Mailing List Archive

On Tue, 2004-03-02 at 19:52, Adam Denenberg wrote:
> Like anti-drug, Backhair, BigEvil. My question is which of these have
> the highest spam hit rate relative to the lowest false positive rate.
> i need something that is not overly aggressive since false positives
> are actually worse then false negatives in my case.
>
> Any recommendations, especially with experience in using the custom
> rulesets would be greatly appreciated. Just seeing which rulesets
> people have had the most success vs FP ratio out there.
>

I use Tripwire, Obfu1, antidrug, bigevil, chickenpox, evilnumbers, and
popcorn with no FPs, even with my *very* aggressive 1.5 point
threshold.

- Jon

--
jon@tgpsolutions.com

Administrator, tgpsolutions
http://www.tgpsolutions.com

I run the very same with very low FP's. I've been running this for
several customers for some time with no complaints at all.

Gary Smith

-----Original Message-----
From: Jonathan Tai [mailto:jon@tgpsolutions.com]
Sent: Tuesday, March 02, 2004 8:21 PM
To: Adam Denenberg
Cc: spamassassin-users@incubator.apache.org
Subject: Re: best ruleset with lowest FP rate

On Tue, 2004-03-02 at 19:52, Adam Denenberg wrote:
> Like anti-drug, Backhair, BigEvil. My question is which of these
have
> the highest spam hit rate relative to the lowest false positive rate.

> i need something that is not overly aggressive since false positives
> are actually worse then false negatives in my case.
>
> Any recommendations, especially with experience in using the custom
> rulesets would be greatly appreciated. Just seeing which rulesets
> people have had the most success vs FP ratio out there.
>

I use Tripwire, Obfu1, antidrug, bigevil, chickenpox, evilnumbers, and
popcorn with no FPs, even with my *very* aggressive 1.5 point
threshold.

- Jon

--
jon@tgpsolutions.com

Administrator, tgpsolutions
http://www.tgpsolutions.com

great thanks for the input guys. Are these all posted on one site now
or are they still scattered around all over?

thanks
adam

On Wed, 2004-03-03 at 01:30, Gary Smith wrote:
> I run the very same with very low FP's. I've been running this for
> several customers for some time with no complaints at all.
>
> Gary Smith
>
> -----Original Message-----
> From: Jonathan Tai [mailto:jon@tgpsolutions.com]
> Sent: Tuesday, March 02, 2004 8:21 PM
> To: Adam Denenberg
> Cc: spamassassin-users@incubator.apache.org
> Subject: Re: best ruleset with lowest FP rate
>
> On Tue, 2004-03-02 at 19:52, Adam Denenberg wrote:
> > Like anti-drug, Backhair, BigEvil. My question is which of these
> have
> > the highest spam hit rate relative to the lowest false positive rate.
>
> > i need something that is not overly aggressive since false positives
> > are actually worse then false negatives in my case.
> >
> > Any recommendations, especially with experience in using the custom
> > rulesets would be greatly appreciated. Just seeing which rulesets
> > people have had the most success vs FP ratio out there.
> >
>
> I use Tripwire, Obfu1, antidrug, bigevil, chickenpox, evilnumbers, and
> popcorn with no FPs, even with my *very* aggressive 1.5 point
> threshold.
>
> - Jon

Adam Denenberg <adam@sa.dberg.org> wrote:
> [...]
> Any recommendations, especially with experience in using the
> custom rulesets would be greatly appreciated. Just seeing
> which rulesets people have had the most success vs FP ratio
> out there.

I'm using the better-known sets recommended in this thread with good success,
including regular updates to BIGEVIL TRIPWIRE ANTIDRUG EVILNUMBERS RANDOMVAL.
I've also got the last copies of Jennifer's BACKHAIR and WEEDS2 sets in play.

I've added some "best of" rules from other sets that DO have a fair incidence
of FPs, but I have them scoring very low (if at all). An FP isn't so bad so
long as no single rule causes mail to be scored as spam by itself. I then use
metas to score on the basis of COMBINATIONS of these rules, with scores that
will flag them as spam. I'm generally finding these to be as effective as
trying to roll up new rules to definitively match newly detected patterns.
These plus bayes have been very solid for me.

- Bob

At 09:01 AM 3/3/04 -0500, Adam Denenberg wrote:
>great thanks for the input guys. Are these all posted on one site now
>or are they still scattered around all over?

Scattered, but there's a "page of links" on the wiki:

http://wiki.spamassassin.org/w/CustomRulesets

I have them all on one page unfortunately I can't post it yet. Sorry, but
the short of it is, people would download other stuff on that page that just
isn't ready for public consumption....yet. So the SARE _will_ mirror all
rulesets that I can get my grubby little hands on.

In the words of every game developer....."soon." :)

--Chris

> -----Original Message-----
> From: Matt Kettler [mailto:mkettler_sa@comcast.net]
> Sent: Wednesday, March 03, 2004 9:50 AM
> To: adam@sa.dberg.org; SpamAssassin
> Subject: RE: best ruleset with lowest FP rate
>
>
> At 09:01 AM 3/3/04 -0500, Adam Denenberg wrote:
> >great thanks for the input guys. Are these all posted on
> one site now
> >or are they still scattered around all over?
>
> Scattered, but there's a "page of links" on the wiki:
>
> http://wiki.spamassassin.org/w/CustomRulesets
>

thanks Matt. How come a bunch of these rules say

NOTE: DO NOT DOWNLOAD VIA RULES DU JOUR OR ANY AUTOMATED SCRIPTS - This
set is no longer being updated

Does this mean they should not be used or just not being worked on any
longer? I especially noticed this with BackHair, Popcorn and Weeds..

thanks
adam


On Wed, 2004-03-03 at 09:49, Matt Kettler wrote:
> At 09:01 AM 3/3/04 -0500, Adam Denenberg wrote:
> >great thanks for the input guys. Are these all posted on one site now
> >or are they still scattered around all over?
>
> Scattered, but there's a "page of links" on the wiki:
>
> http://wiki.spamassassin.org/w/CustomRulesets
>

There's a setting in rules_du_jour to disable specific rules. Also, it's a good start is you need to add additional download of other rules in the future.

BTW, why isn't rules_du_jour being updated? It seems like a very usuable tool for the community.

Gary

-----Original Message-----
From: Adam Denenberg [mailto:adam@sa.dberg.org]
Sent: Wed 3/3/2004 8:51 AM
To: Matt Kettler
Cc: SpamAssassin
Subject: RE: best ruleset with lowest FP rate



thanks Matt. How come a bunch of these rules say

NOTE: DO NOT DOWNLOAD VIA RULES DU JOUR OR ANY AUTOMATED SCRIPTS - This
set is no longer being updated

Does this mean they should not be used or just not being worked on any
longer? I especially noticed this with BackHair, Popcorn and Weeds..

thanks
adam


On Wed, 2004-03-03 at 09:49, Matt Kettler wrote:
> At 09:01 AM 3/3/04 -0500, Adam Denenberg wrote:
> >great thanks for the input guys. Are these all posted on one site now
> >or are they still scattered around all over?
>
> Scattered, but there's a "page of links" on the wiki:
>
> http://wiki.spamassassin.org/w/CustomRulesets
>

> thanks Matt. How come a bunch of these rules say
>
> NOTE: DO NOT DOWNLOAD VIA RULES DU JOUR OR ANY AUTOMATED SCRIPTS -
This
> set is no longer being updated
>
> Does this mean they should not be used or just not being worked on
any
> longer? I especially noticed this with BackHair, Popcorn and Weeds..

they are not being worked on, but you can use them as they are. They
don’t require the regular updates like the rules with constantly
changing material (like the evil sets).

Jennifer


>
> thanks
> adam
>
>
> On Wed, 2004-03-03 at 09:49, Matt Kettler wrote:
> > At 09:01 AM 3/3/04 -0500, Adam Denenberg wrote:
> > >great thanks for the input guys. Are these all posted on one site
now
> > >or are they still scattered around all over?
> >
> > Scattered, but there's a "page of links" on the wiki:
> >
> > http://wiki.spamassassin.org/w/CustomRulesets
> >

Well it doesn't really update because it works as is I guess. :) It's more a
config thing then an update. Some of the rulesets, like weeds, don't need to
be looked at for updates anymore. They aren't going to change. However there
are some that continue to change, like Evilnumbers and Bigevil.

IMHO, I like rulesets that don't need to change. Jen's rules shall go down
in history in the halls of antispam. She may be lurking now, but she left a
lasting impression on how we look at rules. Fred's Tripwire as well.
Antidrug is sweet, and won't need much tweaking for months. Unless a whole
new batch of MR.Wiggly drugs come to the market.

Heck, as the group is cleaning up SARE, we see a bunch of rules for P@ris
H1lton spam. When is the last time you got one of those? Out it goes! We
have a set collection for coding and HTML tricks to look for. That *might*
need updating from time to time. Not sure yet.

anyway, I digres and I'm hungry :)

--Chris

> -----Original Message-----
> From: Gary Smith [mailto:gary@primeexalia.com]
> Sent: Wednesday, March 03, 2004 12:05 PM
> To: spamassassin-users@incubator.apache.org
> Subject: RE: best ruleset with lowest FP rate
>
>
> There's a setting in rules_du_jour to disable specific rules.
> Also, it's a good start is you need to add additional
> download of other rules in the future.
>
> BTW, why isn't rules_du_jour being updated? It seems like a
> very usuable tool for the community.
>
> Gary
>
> -----Original Message-----
> From: Adam Denenberg [mailto:adam@sa.dberg.org]
> Sent: Wed 3/3/2004 8:51 AM
> To: Matt Kettler
> Cc: SpamAssassin
> Subject: RE: best ruleset with lowest FP rate
>
>
>
> thanks Matt. How come a bunch of these rules say
>
> NOTE: DO NOT DOWNLOAD VIA RULES DU JOUR OR ANY
> AUTOMATED SCRIPTS - This
> set is no longer being updated
>
> Does this mean they should not be used or just not
> being worked on any
> longer? I especially noticed this with BackHair,
> Popcorn and Weeds..
>
> thanks
> adam
>
>
> On Wed, 2004-03-03 at 09:49, Matt Kettler wrote:
> > At 09:01 AM 3/3/04 -0500, Adam Denenberg wrote:
> > >great thanks for the input guys. Are these all
> posted on one site now
> > >or are they still scattered around all over?
> >
> > Scattered, but there's a "page of links" on the wiki:
> >
> > http://wiki.spamassassin.org/w/CustomRulesets
> >
>
>
>
>

so does that mean these rulesets are no longer being maintained?

adam

On Wed, 2004-03-03 at 12:04, Gary Smith wrote:
> There's a setting in rules_du_jour to disable specific rules. Also, it's a good start is you need to add additional download of other rules in the future.
>
> BTW, why isn't rules_du_jour being updated? It seems like a very usuable tool for the community.
>
> Gary
>
> -----Original Message-----
> From: Adam Denenberg [mailto:adam@sa.dberg.org]
> Sent: Wed 3/3/2004 8:51 AM
> To: Matt Kettler
> Cc: SpamAssassin
> Subject: RE: best ruleset with lowest FP rate
>
>
>
> thanks Matt. How come a bunch of these rules say
>
> NOTE: DO NOT DOWNLOAD VIA RULES DU JOUR OR ANY AUTOMATED SCRIPTS - This
> set is no longer being updated
>
> Does this mean they should not be used or just not being worked on any
> longer? I especially noticed this with BackHair, Popcorn and Weeds..
>
> thanks
> adam
>
>
> On Wed, 2004-03-03 at 09:49, Matt Kettler wrote:
> > At 09:01 AM 3/3/04 -0500, Adam Denenberg wrote:
> > >great thanks for the input guys. Are these all posted on one site now
> > >or are they still scattered around all over?
> >
> > Scattered, but there's a "page of links" on the wiki:
> >
> > http://wiki.spamassassin.org/w/CustomRulesets
> >
>
>
>

Well, yes and no. If there is a problem, the group will jump on it and fix.
But it is pretty much a done set. There isn't a hell of a lot that can be
added to it. Lots of things already taking into consideration, attchments,
PGP, ect.....

So one of us will always fix if needed.

--Chris

> -----Original Message-----
> From: Adam Denenberg [mailto:adam@sa.dberg.org]
> Sent: Wednesday, March 03, 2004 12:22 PM
> To: SpamAssassin
> Subject: RE: best ruleset with lowest FP rate
>
>
> so does that mean these rulesets are no longer being maintained?
>
> adam
>
> On Wed, 2004-03-03 at 12:04, Gary Smith wrote:
> > There's a setting in rules_du_jour to disable specific
> rules. Also, it's a good start is you need to add additional
> download of other rules in the future.
> >
> > BTW, why isn't rules_du_jour being updated? It seems like
> a very usuable tool for the community.
> >
> > Gary
> >
> > -----Original Message-----
> > From: Adam Denenberg [mailto:adam@sa.dberg.org]
> > Sent: Wed 3/3/2004 8:51 AM
> > To: Matt Kettler
> > Cc: SpamAssassin
> > Subject: RE: best ruleset with lowest FP rate
> >
> >
> >
> > thanks Matt. How come a bunch of these rules say
> >
> > NOTE: DO NOT DOWNLOAD VIA RULES DU JOUR OR ANY
> AUTOMATED SCRIPTS - This
> > set is no longer being updated
> >
> > Does this mean they should not be used or just not
> being worked on any
> > longer? I especially noticed this with BackHair,
> Popcorn and Weeds..
> >
> > thanks
> > adam
> >
> >
> > On Wed, 2004-03-03 at 09:49, Matt Kettler wrote:
> > > At 09:01 AM 3/3/04 -0500, Adam Denenberg wrote:
> > > >great thanks for the input guys. Are these all
> posted on one site now
> > > >or are they still scattered around all over?
> > >
> > > Scattered, but there's a "page of links" on the wiki:
> > >
> > > http://wiki.spamassassin.org/w/CustomRulesets
> > >
> >
> >
> >
>

Jennifer,

are they all equally agressive? I am trying to stay as far away from
FP's as possible.

thanks
adam

On Wed, 2004-03-03 at 12:15, jennifer wrote:
> > thanks Matt. How come a bunch of these rules say
> >
> > NOTE: DO NOT DOWNLOAD VIA RULES DU JOUR OR ANY AUTOMATED SCRIPTS -
> This
> > set is no longer being updated
> >
> > Does this mean they should not be used or just not being worked on
> any
> > longer? I especially noticed this with BackHair, Popcorn and Weeds..
>
> they are not being worked on, but you can use them as they are. They
> don¢t require the regular updates like the rules with constantly
> changing material (like the evil sets).
>
> Jennifer
>
>
> >
> > thanks
> > adam
> >
> >
> > On Wed, 2004-03-03 at 09:49, Matt Kettler wrote:
> > > At 09:01 AM 3/3/04 -0500, Adam Denenberg wrote:
> > > >great thanks for the input guys. Are these all posted on one site
> now
> > > >or are they still scattered around all over?
> > >
> > > Scattered, but there's a "page of links" on the wiki:
> > >
> > > http://wiki.spamassassin.org/w/CustomRulesets
> > >
>
>
>