RATWARE_ZERO_TZ=4.1

[Steven Lamb <sp...@adiis.net>]

I have a false positive that I had to release two of today with this rule as 
what appears to be the offending rule. can someone explain to me what this 
rule checks for. so that I can try to fix it or just get rid of it

thanks

Steven Lamb 

Re[2]: RATWARE_ZERO_TZ=4.1

[Robert Menschel <Ro...@Menschel.net>]

Hello Steven,

Wednesday, November 16, 2005, 1:47:24 PM, you wrote:

SL> I guess if this is the case I need to lower
SL> the score for that rule as my kill value is a 3.5, ...

SpamAssassin scores are optimized for a "this is spam" threshold of 5.

Anyone who changes their threshold significantly away from 5 (say
above 7 or below 4.5) will NEED to modify several significant rule
scores.  Which rules, by how much, will vary by your specific needs.

(I used to run SA with a threshold of 9, and it worked extremely well
for me, after modifying about 25 rule scores.)

Moving the threshold down is much more sensitive to flagging errors
than moving the threshold up.

Yes, if you choose to have your threshold below the level at which one
rule scores spam, then you need to rescore that rule if you're
concerned about ham hits with that rule.

Bob Menschel

Re: RATWARE_ZERO_TZ=4.1

[Matt Kettler <mk...@evi-inc.com>]

Steven Lamb wrote:
> This is interesting. I would think that this rule could cause several
> false positives. For instance anyone that is a hotmail user and has a
> name that matches one of those patterns. I guess if this is the case I
> need to lower the score for that rule as my kill value is a 3.5, or even
> worse how about anyone that is from England that writes html / text
> email that has that kind of name.
> 

Your kill value is 3.5? ouch.

Perhaps you should adjust your kill value, rather than adjusting rule scores..

RE: RATWARE_ZERO_TZ=4.1

[Martin Hepworth <ma...@solid-state-logic.com>]

> -----Original Message-----
> From: Kelson [mailto:kelson@speed.net]
> Sent: 16 November 2005 22:42
> To: users@spamassassin.apache.org
> Subject: Re: RATWARE_ZERO_TZ=4.1
> 
> Steven Lamb wrote:
> > I guess if this is the case I
> > need to lower the score for that rule as my kill value is a 3.5
> 
> If you're going to use SARE rules, you probably shouldn't lower your
> threshold.  SARE, like the built-in SA rules, is calibrated for a
> threshold of 5.  If a legit message hits 4.9999, it's perfectly OK
> because it's been classified correctly.  Unless you re-score a bunch of
> rules, you should expect legit mail to hit in the 3.5-5.0 range from
> time to time, and likely at a higher rate than you'd see FPs at 5+.
> 
> --
> Kelson Vibber
> SpeedGate Communications <www.speed.net>

Yeah, my kill value is 10. values 5-10 I send, but subject tag...

--
Martin Hepworth 
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.	

**********************************************************************

Re: RATWARE_ZERO_TZ=4.1

[Kelson <ke...@speed.net>]

Steven Lamb wrote:
> I guess if this is the case I 
> need to lower the score for that rule as my kill value is a 3.5

If you're going to use SARE rules, you probably shouldn't lower your 
threshold.  SARE, like the built-in SA rules, is calibrated for a 
threshold of 5.  If a legit message hits 4.9999, it's perfectly OK 
because it's been classified correctly.  Unless you re-score a bunch of 
rules, you should expect legit mail to hit in the 3.5-5.0 range from 
time to time, and likely at a higher rate than you'd see FPs at 5+.

-- 
Kelson Vibber
SpeedGate Communications <www.speed.net>

Re: RATWARE_ZERO_TZ=4.1

[Steven Lamb <sp...@adiis.net>]

This is interesting. I would think that this rule could cause several false 
positives. For instance anyone that is a hotmail user and has a name that 
matches one of those patterns. I guess if this is the case I need to lower 
the score for that rule as my kill value is a 3.5, or even worse how about 
anyone that is from England that writes html / text email that has that kind 
of name.

Thanks for the info on this rule.

Steven Lamb
----- Original Message ----- 
From: "Matt Kettler" <mk...@evi-inc.com>
To: "Steven Lamb" <sp...@adiis.net>
Cc: <us...@spamassassin.apache.org>
Sent: Wednesday, November 16, 2005 1:34 PM
Subject: Re: RATWARE_ZERO_TZ=4.1


> Steven Lamb wrote:
>> I have a false positive that I had to release two of today with this
>> rule as what appears to be the offending rule. can someone explain to me
>> what this rule checks for. so that I can try to fix it or just get rid
>> of it
>>
>
> It's looking for a combination of 3 things:
>
> 1) Date: header in the +0000 timezone.
> 2) Content-Type: text/html
> 3) matching one of several specific patterns for the From: address, all of 
> which
> appear to be based on putting together fragments of the real name part 
> plus 2
> extra letters at the end. for the real name part "matt kettler" the 
> following
> addresses would match:
> <mk...@evi-inc.com>
> <ma...@evi-inc.com>
>
>
> All three criteria need to match, and 3) has 7 different patters it could 
> match on.
> 

Re: RATWARE_ZERO_TZ=4.1

[Matt Kettler <mk...@evi-inc.com>]

Steven Lamb wrote:
> I have a false positive that I had to release two of today with this
> rule as what appears to be the offending rule. can someone explain to me
> what this rule checks for. so that I can try to fix it or just get rid
> of it
> 

It's looking for a combination of 3 things:

1) Date: header in the +0000 timezone.
2) Content-Type: text/html
3) matching one of several specific patterns for the From: address, all of which
appear to be based on putting together fragments of the real name part plus 2
extra letters at the end. for the real name part "matt kettler" the following
addresses would match:
 <mk...@evi-inc.com>
 <ma...@evi-inc.com>


All three criteria need to match, and 3) has 7 different patters it could match on.