Re: [Evolution-hackers] SA rules adjustment

[Radek Doulík <rodo ximian com>]

hi guenther,

On Sun, 2004-01-25 at 19:54 +0100, guenther wrote:
> cheers( hackers );
> 
> I want to propose some small changes to the default SA scores and rules.
> About two weeks ago Spammer(s) started to misuse the Habes [1] watermark
> to identify non-SPAM (aka HAM). Seems like there is currently a lot of
> SPAM with this faked headers.
> 
> The current score for this watermark is -8 [2]. This lets a lot of this
> kind of SPAM slip through (that would not otherwise) and there are even
> a lot of reports about auto-learning those messages as HAM on the SA
> mailing list.
> 
> The current score is based on the mass tests before this kind of SPAM
> was known and this watermark indeed was a sign of HAM those days. I
> suspect, most users will get more SPAM as HAM with this watermark today.
> :-/
> 
> 
> The attached adjustments would eliminate this issue.
> 
> 1) Setting the HABEAS_SWE rule to 0 effectively will disable this test.
> As a result, no valid Habes marked mails will get added HAM points, but
> the Spammers don't profit by it either.

I think we may temporarily zero it. The Habeas watermarking method
doesn't look very strong to me ;-)

> 2) Excluding the Habeas headers from Bayes would be good too. Otherwise,
> getting more SPAM as HAM with this faked headers will poison the Bayes
> database and HAM will get bad Bayes scores.

I am not sure about this. It may cause trouble in case the bayes db is
already poisoned. Otherwise it should work OK.

cheers
Radek