Recommendation on SARE rules to add.

[Robert Markin <ro...@themarkinfamily.com>]

SA 3.0

I was wondering if anybody had a recommendation for a initial SARE set 
of rules to add.  I am not exactly satisfied with my amount of FN's 
currently.  Any ideas would be appreciated.

Robert

Re: Recommendation on SARE rules to add.

[Vivek Khera <vi...@khera.org>]

On Apr 13, 2005, at 8:16 PM, Robert Menschel wrote:

> And since I haven't seen any specific rule set files, I'll offer my
> suggestions there:
>

Thanks for your list you posted a while back... it has been very  
helpful configuring my set of custom rules.

Question: what is your opinion on the SARE_fraud and SARE_obfu rule  
sets?


Also, the SARE_uri0 set checks for alpha-digit-alpha domain names.   
This will hit many messages sent via one of our services,  
MailerMailer.  All links in those messages are clicked thru the  
"m1e.net" domain.  If, for example, you request avalanche notices in  
the winter for the pacific northwest, you will get messages from us.   
Ditto if you're an auto mechanic taking exams from the ASE (which is  
just about every mechanic out there).   I think it has just been luck  
that no corpus has such messages so far :-)


Vivek Khera, Ph.D.
+1-301-869-4449 x806

Re: Recommendation on SARE rules to add.

[Robert Menschel <Ro...@Menschel.net>]

Hello Robert,

Tuesday, April 12, 2005, 10:24:54 PM, you wrote:

RM> SA 3.0

RM> I was wondering if anybody had a recommendation for a initial SARE set
RM> of rules to add.  I am not exactly satisfied with my amount of FN's
RM> currently.  Any ideas would be appreciated.

First -- I'm in full agreement with all of the other
suggestions/considerations offered that I've seen.

And since I haven't seen any specific rule set files, I'll offer my
suggestions there:

70_sare_evilnum0.cf
70_sare_genlsubj0.cf
70_sare_header0.cf
70_sare_html0.cf
70_sare_uri0.cf

These above are created and selected and regularly rechecked to avoid
any/all hits against ham. They should be safe for everyone.

70_sare_specific.cf
70_sare_oem.cf
70_sare_spoof.cf
70_sare_unsub.cf
70_sare_random.cf
72_sare_redirect_post3.0.0.cf
88_FVGT_Tripwire.cf

These aren't quite as safe, but still should be suitable for the great
majority of systems.

70_sare_adult.cf
70_sare_bayes_poison_nxm.cf
72_sare_bml_post25x.cf
chickenpox.cf
weeds_2.cf

A little bit more risky, and might FP if one of your users runs an
adult book store, is a mortgage broker, or likes to *em*pha*size*
words, etc.

70_sare_evilnum1.cf
70_sare_genlsubj1.cf
70_sare_header1.cf
70_sare_html1.cf
70_sare_uri1.cf

Like the first set, but a little bit more risky. Will hit ham, but
should not cause FPs.

If you are located in the USA/England/Canada/Australia, and do not
receive foreign-language non-spam, then you can also benefit from
70_sare_genlsubj_eng.cf
70_sare_header_eng.cf
70_sare_html_eng.cf
70_sare_uri_eng.cf

I guess we really should put SARE guidelines like this onto a page
linked to http://wiki.apache.org/spamassassin/CustomRulesets -- I'll
get that started, after as I've put my income taxes to bed...

Bob Menschel

Re: Recommendation on SARE rules to add.

[Jesse Houwing <j....@rulesemporium.com>]

-----Original Message-----
From: Jeff Chan <je...@surbl.org>
To: users@spamassassin.apache.org
Date: Wed, 13 Apr 2005 00:42:26 -0700
Subject: Re: Recommendation on SARE rules to add.

> On Tuesday, April 12, 2005, 10:24:54 PM, Robert Markin wrote:
> > SA 3.0
> 
> > I was wondering if anybody had a recommendation for a initial SARE
> set 
> > of rules to add.  I am not exactly satisfied with my amount of FN's 
> > currently.  Any ideas would be appreciated.
> 
> > Robert
> 
> It might be helpful to see a small, edited, sampling of the FNs
> you're seeing. 

There's a number of SARE people monitoring this list, so if you have
specific rules that don't work, you can always mail them directly. Almost
all of our rulesets have a maintainer mantioned at the top in the comments
(just open the rule file in notepad/vi). The maintainer is the first
person to contect in these cases.

Jesse
SARE Ninja!

Re: Recommendation on SARE rules to add.

[Jeff Chan <je...@surbl.org>]

On Tuesday, April 12, 2005, 10:24:54 PM, Robert Markin wrote:
> SA 3.0

> I was wondering if anybody had a recommendation for a initial SARE set 
> of rules to add.  I am not exactly satisfied with my amount of FN's 
> currently.  Any ideas would be appreciated.

> Robert

It might be helpful to see a small, edited, sampling of the FNs
you're seeing. 

Jeff C.
-- 
Jeff Chan
mailto:jeffc@surbl.org
http://www.surbl.org/