You are viewing a plain text version of this content. The canonical link for it is here.

Posted to dev@spamassassin.apache.org by Justin Mason <jm...@jmason.org> on 2004/04/19 23:48:23 UTC

Re: followup comparison of 2.6x vs. 3.0

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


Daniel Quinlan writes:
> Bear in mind these comparisons only work for rules with names that
> haven't changed.

I did say at the time that renaming would cause these problems ;)

>   0.607   1.1867   0.0267    0.978   0.87    0.58  HTML_TABLE_THICK_BORD:1
>   0.470   0.9134   0.0267    0.972   0.85    0.58  HTML_TABLE_THICK_BORD:2
> 
> a bit disconcerting

Could be that the thick borders were from a single spammer, and they've
changed their design a little.

>   0.380   0.7601   0.0000    1.000   0.93    0.45  LOTS_OF_STUFF:1
>   0.043   0.0867   0.0000    1.000   0.93    0.45  LOTS_OF_STUFF:2
> 
> bad

very very wierd.

>   1.024   2.0401   0.0067    0.997   0.92    2.53  TRACKER_ID:1
>   0.814   1.6201   0.0067    0.996   0.92    2.53  TRACKER_ID:2
> 
> bad

almost definitely evasion.

- --j.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
Comment: Exmh CVS

iD8DBQFAhEknQTcbUG5Y7woRAktuAJ9Rbf+FfzLqtHRb2vrKct6CfvJg0QCgtuH9
g74H0W3PY5VPgrkxtMAC0q4=
=Hqya
-----END PGP SIGNATURE-----

Re: followup comparison of 2.6x vs. 3.0

Posted by Daniel Quinlan <qu...@pathname.com>.

jm@jmason.org (Justin Mason) writes:

> Could be that the thick borders were from a single spammer, and they've
> changed their design a little.

The test runs are on the same exact corpus.

Comparing results for an older corpus and a newer corpus would make it
impossible to find real problems.

Daniel

-- 
Daniel Quinlan                     anti-spam (SpamAssassin), Linux,
http://www.pathname.com/~quinlan/    and open source consulting