You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@spamassassin.apache.org by bu...@bugzilla.spamassassin.org on 2005/10/11 11:05:36 UTC
[Bug 4628] New: rfc-ignorant.org blacklists are overzealous
http://bugzilla.spamassassin.org/show_bug.cgi?id=4628
Summary: rfc-ignorant.org blacklists are overzealous
Product: Spamassassin
Version: 3.1.0
Platform: Other
OS/Version: FreeBSD
Status: NEW
Severity: normal
Priority: P5
Component: Rules (Eval Tests)
AssignedTo: dev@spamassassin.apache.org
ReportedBy: silby@silby.com
After fishing some FP ham out of my spam folder, I determined the cause - the
rfc-ignorant.org blacklists.
Here's a sampling of some of the domains now listed by them:
aol.com
buy.com
expedia.com
hotmail.com
microsoft.com
sbc.net
verizon.net
yahoo.com
It's almost like they've decided to list every commercial entity they can think
of. This is no longer a useful blacklist, and should be removed from future
releases of 3.1.
And yes, their criteria for listing may be correct, but it clearly has no
bearing on the actual spammyness of a message.
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
[Bug 4628] rfc-ignorant.org blacklists are overzealous
Posted by bu...@bugzilla.spamassassin.org.
http://bugzilla.spamassassin.org/show_bug.cgi?id=4628
------- Additional Comments From silby@silby.com 2005-10-11 14:13 -------
Perhaps you could whitelist the top 50 domains before doing rfc-ignorant
queries, as you do with uribl queries already.
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
[Bug 4628] remove some RFC-I rules
Posted by bu...@bugzilla.spamassassin.org.
http://issues.apache.org/SpamAssassin/show_bug.cgi?id=4628
jm@jmason.org changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |blentz@channing-bete.com
------- Additional Comments From jm@jmason.org 2006-11-17 09:38 -------
*** Bug 5192 has been marked as a duplicate of this bug. ***
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
[Bug 4628] rfc-ignorant.org blacklists are overzealous
Posted by bu...@bugzilla.spamassassin.org.
http://bugzilla.spamassassin.org/show_bug.cgi?id=4628
------- Additional Comments From jm@jmason.org 2005-10-11 13:01 -------
DNS_FROM_RFC_ABUSE gets a whopping 0.20 points, or 0.48 in set 1.
that rule is pretty trivial. FPs on the other rules are more notable...
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
[Bug 4628] rfc-ignorant.org blacklists are overzealous
Posted by bu...@bugzilla.spamassassin.org.
http://bugzilla.spamassassin.org/show_bug.cgi?id=4628
------- Additional Comments From silby@silby.com 2005-10-11 11:22 -------
Created an attachment (id=3181)
--> (http://bugzilla.spamassassin.org/attachment.cgi?id=3181&action=view)
A buy.com message that triggered the rule in question
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
[Bug 4628] rfc-ignorant.org blacklists are overzealous
Posted by bu...@bugzilla.spamassassin.org.
http://bugzilla.spamassassin.org/show_bug.cgi?id=4628
------- Additional Comments From silby@silby.com 2005-10-11 11:25 -------
Most of the true FPs I have are personal mail, and I would not like to post
them here. The least harmless one I have is this weekly mailing from buy.com
that triggered the DNS_FROM_RFC_ABUSE rule.
Rest assured, I have messages from yahoo.com, hotmail.com, and expedia.com
which all triggered other DNS_FROM_RFC_* rules in the last week.
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
[Bug 4628] remove some RFC-I rules
Posted by bu...@bugzilla.spamassassin.org.
http://issues.apache.org/SpamAssassin/show_bug.cgi?id=4628
jm@jmason.org changed:
What |Removed |Added
----------------------------------------------------------------------------
Severity|normal |major
Summary|rfc-ignorant.org blacklists |remove some RFC-I rules
|are overzealous |
Target Milestone|Undefined |3.2.0
------- Additional Comments From jm@jmason.org 2006-10-12 04:21 -------
some up-to-date data from the ruleqa system --
http://ruleqa.spamassassin.org/?daterev=20061007-r453869-n&s_defcorpus=on&rule=%2FRFC&srcpath=&s_zero=on&s_detail=+&g=Change
:
0.00000 3.7247 0.0540 0.986 0.85 2.60 DNS_FROM_RFC_DSN
0.00000 2.2447 0.1700 0.930 0.73 1.94 DNS_FROM_RFC_BOGUSMX
0.00000 15.1533 4.6068 0.767 0.51 1.45 DNS_FROM_RFC_POST
0.00000 18.6219 8.6003 0.684 0.49 1.71 DNS_FROM_RFC_ABUSE
0.00000 6.4258 4.0476 0.614 0.48 0.20 DNS_FROM_RFC_WHOIS
measured on a 260k spam, 63k ham corpus with 7 contributors.
I think we should keep DNS_FROM_RFC_DSN and DNS_FROM_RFC_BOGUSMX (98.6% and 93%
accurate respectively), but drop the other 3 rules.
They have a very high ham hit-rate, but are still assigned relatively high
scores by the perceptron; I'd prefer if the perceptron didn't have the option of
being misled by them at all... as this bug and mailing traffic attests, it's a
PITA to support.
2. an alternative would be a way to hint to the perceptron that these are
untrustworthy rules, "tflags weak" or whatever. but that would require
additional code and I think we're better off dropping the rules.
3. actually, another alternative: make them into meta subrules, so that future
rules can use them in metas. that may be useful. They're "free" anyway, since
DNS_FROM_RFC_* are all from one DNS lookup.
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
[Bug 4628] remove some RFC-I rules
Posted by bu...@bugzilla.spamassassin.org.
http://issues.apache.org/SpamAssassin/show_bug.cgi?id=4628
------- Additional Comments From schulz@adi.com 2007-02-01 06:14 -------
This change should really be done for 3.1.8. I believe that the supplied
patch is missing the changed scores, but that should be easy to pick up.
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
[Bug 4628] remove some RFC-I rules
Posted by bu...@bugzilla.spamassassin.org.
http://issues.apache.org/SpamAssassin/show_bug.cgi?id=4628
------- Additional Comments From schulz@adi.com 2006-11-17 11:12 -------
Should this be done for 3.1.8? Also, the patch does not appear to be complete.
Could you attach the complete patch?
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
[Bug 4628] remove some RFC-I rules
Posted by bu...@bugzilla.spamassassin.org.
http://issues.apache.org/SpamAssassin/show_bug.cgi?id=4628
------- Additional Comments From schulz@adi.com 2006-11-20 06:35 -------
Just a note on why I think that this patch should be done for 3.1.8. It looks
like the behavior of the RFC-I lists has changed quite a lot in the last few
months. Starting perhaps 4 months ago, all the email form our ISP is being hit
by these rules when it never were before. In the last 2 months or so, email
form our employees is being hit when sent from their home email accounts when
it never was before. I expect that the perceptron scored these correctly when
it was run, but the RFC-I lists are now much different and are now a problem.
As noted in comment 11, the patch is missing the removal of the scores. I just
edited my sore file and removed the scores, but a complete patch would be nice
for people who want to kill these rules before the next release.
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
[Bug 4628] remove some RFC-I rules
Posted by bu...@bugzilla.spamassassin.org.
http://issues.apache.org/SpamAssassin/show_bug.cgi?id=4628
------- Additional Comments From jm@jmason.org 2006-10-19 07:07 -------
Created an attachment (id=3720)
--> (http://issues.apache.org/SpamAssassin/attachment.cgi?id=3720&action=view)
patch
here's the patch, adopting approach #3; the bad rules are left as unscored meta
subrules.
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
[Bug 4628] rfc-ignorant.org blacklists are overzealous
Posted by bu...@bugzilla.spamassassin.org.
http://bugzilla.spamassassin.org/show_bug.cgi?id=4628
------- Additional Comments From jm@jmason.org 2005-10-11 09:57 -------
can you attach some FPs? we know rfci are overzealous, which is why we use them
in a way that's supposed to avoid those issues.
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
[Bug 4628] rfc-ignorant.org blacklists are overzealous
Posted by bu...@bugzilla.spamassassin.org.
http://bugzilla.spamassassin.org/show_bug.cgi?id=4628
------- Additional Comments From silby@silby.com 2005-10-11 02:08 -------
Oh, and before someone sidetracks this bug report by saying "the score from
DNS_FROM_RFC_POST alone wasn't enough to push the score past the 5.0 threshold",
yes, of course there were other rules that triggered. Don't sidetrack the bug. :)
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
[Bug 4628] remove some RFC-I rules
Posted by bu...@bugzilla.spamassassin.org.
http://issues.apache.org/SpamAssassin/show_bug.cgi?id=4628
jm@jmason.org changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |RESOLVED
Resolution| |FIXED
------- Additional Comments From jm@jmason.org 2006-10-27 06:27 -------
applied to 3.2.0.
Sending rules/20_dnsbl_tests.cf
Sending rules/30_text_de.cf
Sending rules/50_scores.cf
Transmitting file data ...
Committed revision 468372.
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.