Sought dedicated AND stock channel (was: Re: JM_SOUGHT_FRAUD)

[Karsten Bräckelmann <gu...@rudersport.de>]

> On Wed, 11 Aug 2010 17:30:40 -0400 Bowie Bailey <Bo...@BUC.com> wrote:
> >  On 8/11/2010 3:30 PM, John Hardin wrote:

> > > The current situation is: automatic rule updates are only generated
> > > when the corpa of recent messages used in the nightly masscheck is
> > > sufficiently large (150k+ of both spam and ham, IIRC), and that's
> > > been difficult to achieve for a while due to ham starvation. More
> > > volunteers to perform nightly local masschecks of fresh ham corpora
> > > and upload the results, or to maintain and upload non-private ham
> > > corpora to the nightly masscheck server, would be most welcome!

> > In case anyone else is following this...
> > 
> > The sa-update process made things a bit more complex than simply
> > renaming the file after updates.  If that's all you do, then sa-update
> > loses track of the file and will download a new copy on every run.
> > What I had to do is this:
> > 
> > 1) Rename the .cf file back to the original name so sa-update can
> > find it 2) Run sa-update
> > 3) Rename the .cf file to z_sought_rules_yerp_org.cf
> > 4) Restart spamd
> > 
> > You don't have to mess with the directory, just rename the main
> > sought_rules_yerp_org.cf file.
> 
> Would it not be simpler just to do something like this

Sadly, no.

The problem is, that not only the sub-rules change, but with them the
actually scored meta rules, combining these sub-rules by OR-ing them.

That means, stale meta rules in stock will override the fresh meta
rules, effectively discarding all fresh sub-rule matches.


Bottom line: If the dedicated sought channel is more up-to-date and
updated more frequently, using that one in *addition* to (faster) aging
stock rules currently needs careful hacks -- to preserver the precious
meta.

Or, well, any SA or channel provided method, to tweak the order. SA
method would be a new feature. Channel method would be a rename, to come
last in alphabetical order.

Bummer. :(  This is a real problem and worth filing a bug.


-- 
char *t="\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1:
(c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}

Re: Sought dedicated AND stock channel

[Bowie Bailey <Bo...@BUC.com>]

 On 8/12/2010 11:41 AM, Matus UHLAR - fantomas wrote:
>>  On 8/11/2010 6:15 PM, Karsten Bräckelmann wrote:
>>> The problem is, that not only the sub-rules change, but with them the
>>> actually scored meta rules, combining these sub-rules by OR-ing them.
>>>
>>> That means, stale meta rules in stock will override the fresh meta
>>> rules, effectively discarding all fresh sub-rule matches.
>>>
>>>
>>> Bottom line: If the dedicated sought channel is more up-to-date and
>>> updated more frequently, using that one in *addition* to (faster) aging
>>> stock rules currently needs careful hacks -- to preserver the precious
>>> meta.
>>>
>>> Or, well, any SA or channel provided method, to tweak the order. SA
>>> method would be a new feature. Channel method would be a rename, to come
>>> last in alphabetical order.
>>>
>>> Bummer. :(  This is a real problem and worth filing a bug.
> On 12.08.10 09:13, Bowie Bailey wrote:
>> Would it be a reasonable idea to always read the updates channel first
>> and then read any additional channels?
> would couse troubles if you sa-updated only official rules channel.

Why?  What I was suggesting was this:

1) read updates_spamassassin_org.cf
2) read any other .cf files in the directory

If all you have is the official updates channel, then #2 doesn't apply.

>>  Or maybe have sa-update store
>> the updates channel as 0_updates_ so it should always be first in the list?
> from my point of view, including JM_* rules into SA updates was a bad idea.

I think it is good to be able to include those rules for people who
don't bother looking for the 3rd party rule sets.  However it does cause
problems for people who want to use the official Sought channel.

Also, giving the rules a 0 score kind of defeats the purpose of
including them in the updates channel.  If it requires custom score
lines to enable the rules, you might as well just take them out of the
updates channel and let people enable the rules by adding the Sought
channel instead.

-- 
Bowie

Re: Sought dedicated AND stock channel

[Matus UHLAR - fantomas <uh...@fantomas.sk>]

>  On 8/11/2010 6:15 PM, Karsten Bräckelmann wrote:
> > The problem is, that not only the sub-rules change, but with them the
> > actually scored meta rules, combining these sub-rules by OR-ing them.
> >
> > That means, stale meta rules in stock will override the fresh meta
> > rules, effectively discarding all fresh sub-rule matches.
> >
> >
> > Bottom line: If the dedicated sought channel is more up-to-date and
> > updated more frequently, using that one in *addition* to (faster) aging
> > stock rules currently needs careful hacks -- to preserver the precious
> > meta.
> >
> > Or, well, any SA or channel provided method, to tweak the order. SA
> > method would be a new feature. Channel method would be a rename, to come
> > last in alphabetical order.
> >
> > Bummer. :(  This is a real problem and worth filing a bug.

On 12.08.10 09:13, Bowie Bailey wrote:
> Would it be a reasonable idea to always read the updates channel first
> and then read any additional channels?

would couse troubles if you sa-updated only official rules channel.

>  Or maybe have sa-update store
> the updates channel as 0_updates_ so it should always be first in the list?

from my point of view, including JM_* rules into SA updates was a bad idea.

-- 
Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
Boost your system's speed by 500% - DEL C:\WINDOWS\*.*

Re: Sought dedicated AND stock channel

[Bowie Bailey <Bo...@BUC.com>]

 On 8/11/2010 6:15 PM, Karsten Bräckelmann wrote:
>
> The problem is, that not only the sub-rules change, but with them the
> actually scored meta rules, combining these sub-rules by OR-ing them.
>
> That means, stale meta rules in stock will override the fresh meta
> rules, effectively discarding all fresh sub-rule matches.
>
>
> Bottom line: If the dedicated sought channel is more up-to-date and
> updated more frequently, using that one in *addition* to (faster) aging
> stock rules currently needs careful hacks -- to preserver the precious
> meta.
>
> Or, well, any SA or channel provided method, to tweak the order. SA
> method would be a new feature. Channel method would be a rename, to come
> last in alphabetical order.
>
> Bummer. :(  This is a real problem and worth filing a bug.

Would it be a reasonable idea to always read the updates channel first
and then read any additional channels?  Or maybe have sa-update store
the updates channel as 0_updates_ so it should always be first in the list?

-- 
Bowie