You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Ned Slider <ne...@unixmail.co.uk> on 2010/11/08 12:16:54 UTC
Re: Sought False Positives
On 21/08/10 21:51, Ned Slider wrote:
>
> I'm still seeing FP hits against these rules despite a few sought rule
> updates.
>
> It seems there's a few rules hitting on Facebook:
>
> # grep Facebook
> /var/lib/spamassassin/3.003001/sought_rules_yerp_org/20_sought.cf
> body __SEEK_YDK7NN / to unsubscribe\. Facebook, Inc/
> body __SEEK_GYJ_MA / If you do not wish to receive this type of email
> from Facebook in the future, please follow the link below to
> unsubscribe\. http:\/\/www\.facebook\.com\/ Facebook, Inc\. P\.O\. Box
> 10005, Palo Alto, CA 94303 /
> body __SEEK_Z4K_72 / sent you a message on Facebook/
> body __SEEK_A5_EMW /Find people from your Gmail address book on Facebook\!/
> body __SEEK_TKDQL_ /Sign in to Facebook and start connecting/
> body __SEEK_X4HOA8 /Didn\'t sign up for Facebook\? Please let us know\.
> If you do not wish to receive this type of email from Facebook in the
> future, please click here to unsubscribe\.Facebook, Inc\. P\.O\. Box
> 10005, Palo Alto, CA 94303/
>
>
Apologies for bumping an old thread...
I caught another FP yesterday for facebook:
/var/lib/spamassassin/3.003001/sought_rules_yerp_org/20_sought.cf:body
__SEEK_FMJXND /\. If you do not wish to receive this type of email from
Facebook in the future, please click here to unsubscribe\. Facebook,
Inc\. P\.O\. Box 10005, Palo Alto, CA 94303 /
But it's since been fixed (removed) in the latest update - good work on
the quick fix!
Re: Sought False Positives
Posted by Bowie Bailey <Bo...@BUC.com>.
On 11/9/2010 11:14 AM, Justin Mason wrote:
> On Tue, Nov 9, 2010 at 14:24, Bowie Bailey <Bo...@buc.com> wrote:
>>
>> I just checked my logs for the past two weeks and the Sought rules have
>> hit on just over 1% of my spam. They used to be the top rules in my
>> list. What happened?
> Sorry about that -- basically, I haven't had any time recently to
> curate my mail corpora. I suspect sought is now building from old
> data and I hadn't noticed....
No problem. Glad to hear that it is something simple rather than a
change in spam patterns causing it to be ineffective.
--
Bowie
Re: Sought False Positives
Posted by Justin Mason <jm...@jmason.org>.
On Tue, Nov 9, 2010 at 14:24, Bowie Bailey <Bo...@buc.com> wrote:
> On 11/8/2010 6:04 PM, Lawrence @ Rogers wrote:
>> On 08/11/2010 12:06 PM, Ned Slider wrote:
>>>
>>> Fair enough - fortunately I've not seen any of those here so assumed
>>> a genuine facebook mail had maybe slipped through into the corpus by
>>> mistake.
>>>
>>> Either way, it was fixed by the time I'd spotted it.
>> I've seen it as well, and disabled the Sought rules. They were causing
>> too many FPs and not hitting enough spam to be worthwhile.
>
> I haven't seen a lot of false positives, but you're right that they are
> not hitting much spam.
>
> I just checked my logs for the past two weeks and the Sought rules have
> hit on just over 1% of my spam. They used to be the top rules in my
> list. What happened?
Sorry about that -- basically, I haven't had any time recently to
curate my mail corpora. I suspect sought is now building from old
data and I hadn't noticed....
--j.
Re: Sought False Positives
Posted by Bowie Bailey <Bo...@BUC.com>.
On 11/8/2010 6:04 PM, Lawrence @ Rogers wrote:
> On 08/11/2010 12:06 PM, Ned Slider wrote:
>>
>> Fair enough - fortunately I've not seen any of those here so assumed
>> a genuine facebook mail had maybe slipped through into the corpus by
>> mistake.
>>
>> Either way, it was fixed by the time I'd spotted it.
> I've seen it as well, and disabled the Sought rules. They were causing
> too many FPs and not hitting enough spam to be worthwhile.
I haven't seen a lot of false positives, but you're right that they are
not hitting much spam.
I just checked my logs for the past two weeks and the Sought rules have
hit on just over 1% of my spam. They used to be the top rules in my
list. What happened?
--
Bowie
Re: Sought False Positives
Posted by "Lawrence @ Rogers" <la...@nl.rogers.com>.
On 08/11/2010 12:06 PM, Ned Slider wrote:
>
> Fair enough - fortunately I've not seen any of those here so assumed a
> genuine facebook mail had maybe slipped through into the corpus by
> mistake.
>
> Either way, it was fixed by the time I'd spotted it.
I've seen it as well, and disabled the Sought rules. They were causing
too many FPs and not hitting enough spam to be worthwhile.
Re: Sought False Positives
Posted by Ned Slider <ne...@unixmail.co.uk>.
On 08/11/10 15:24, João Gouveia wrote:
>
> ----- "Ned Slider"<ne...@unixmail.co.uk> wrote:
>
>>
>> __SEEK_FMJXND /\. If you do not wish to receive this type of email
>> from
>> Facebook in the future, please click here to unsubscribe\. Facebook,
>> Inc\. P\.O\. Box 10005, Palo Alto, CA 94303 /
>
> I'd guess this is caused by the spam wave that has been going on for some time now, which basically contains the same content as the Facebook mails but with spammy URIs instead.
> Because of the South rules nature, I'd say that this kind of FPs are likely to happen on such scenarios.
>
Fair enough - fortunately I've not seen any of those here so assumed a
genuine facebook mail had maybe slipped through into the corpus by mistake.
Either way, it was fixed by the time I'd spotted it.
Re: Sought False Positives
Posted by João Gouveia <jo...@anubisnetworks.com>.
----- "Ned Slider" <ne...@unixmail.co.uk> wrote:
> On 21/08/10 21:51, Ned Slider wrote:
> >
> > I'm still seeing FP hits against these rules despite a few sought
> rule
> > updates.
> >
> > It seems there's a few rules hitting on Facebook:
> >
> > # grep Facebook
> > /var/lib/spamassassin/3.003001/sought_rules_yerp_org/20_sought.cf
> > body __SEEK_YDK7NN / to unsubscribe\. Facebook, Inc/
> > body __SEEK_GYJ_MA / If you do not wish to receive this type of
> email
> > from Facebook in the future, please follow the link below to
> > unsubscribe\. http:\/\/www\.facebook\.com\/ Facebook, Inc\. P\.O\.
> Box
> > 10005, Palo Alto, CA 94303 /
> > body __SEEK_Z4K_72 / sent you a message on Facebook/
> > body __SEEK_A5_EMW /Find people from your Gmail address book on
> Facebook\!/
> > body __SEEK_TKDQL_ /Sign in to Facebook and start connecting/
> > body __SEEK_X4HOA8 /Didn\'t sign up for Facebook\? Please let us
> know\.
> > If you do not wish to receive this type of email from Facebook in
> the
> > future, please click here to unsubscribe\.Facebook, Inc\. P\.O\.
> Box
> > 10005, Palo Alto, CA 94303/
> >
> >
>
> Apologies for bumping an old thread...
>
> I caught another FP yesterday for facebook:
>
> /var/lib/spamassassin/3.003001/sought_rules_yerp_org/20_sought.cf:body
>
> __SEEK_FMJXND /\. If you do not wish to receive this type of email
> from
> Facebook in the future, please click here to unsubscribe\. Facebook,
> Inc\. P\.O\. Box 10005, Palo Alto, CA 94303 /
I'd guess this is caused by the spam wave that has been going on for some time now, which basically contains the same content as the Facebook mails but with spammy URIs instead.
Because of the South rules nature, I'd say that this kind of FPs are likely to happen on such scenarios.
> But it's since been fixed (removed) in the latest update - good work
> on
> the quick fix!
--
João Gouveia
AnubisNetworks