Re: [SA-dev] [Bug 6660] __NSL_RCVD_FROM_41 should include test for (41. in addition to [41.

[Adam Katz <an...@khopis.com>]

> https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6660

On 09/25/2011 10:43 AM, John Hardin wrote on bugzilla:
>> header          __NSL_RCVD_FROM_41        X-Spam-Relays-External =~ / ip=41\./
> 
> Hrm. I'm now wondering whether having __NSL_RCVD_FROM_41 as a subset of
> __RCVD_VIA_AFRINIC has any value...

On Sun, 25 Sep 2011, John Hardin amended privately:
> Actually, it's more a subset of __RCVD_VIA_AFRINIC_E since 
> __RCVD_VIA_AFRINIC is anchored on the last external.
> 
> Would you be willing to remove the "nopublish" from 
> __RCVD_VIA_AFRINIC_E? That rule may be handy in metas.

I have only one issue with releasing the rest of the __RCVD_VIA_* rules,
which is a very stern reminder that using them is almost certainly a Bad
Idea, with its apparent merits tainted by the limitations of our ham
corpora.

I'll say that again:  we do not have enough ham from Africa or Latin
America to understand how to properly use these rules.

If you block based (in part or wholly) on __RCVD_VIA_AFRINIC_E, you doom
South Africa to the same bucket as Nigeria.  The 41/8 CIDR is restricted
to just Nigeria and surrounding areas, which (until they improve their
education and infrastructure) is pretty well correlated with advance-fee
fraudsters.  AfriNIC's entire dedicated space is not a fair target.

Read these stats with a grain of salt:

http://ruleqa.spamassassin.org/?daterev=20110926&rule=%2FRCVD_VIA
   SPAM%     HAM%     S/O    RANK   NAME
  2.2063   0.0058   0.997    0.87   __RCVD_VIA_AFRINIC
  2.3564   0.1116   0.955    0.75   __RCVD_VIA_AFRINIC_E
  4.8714   0.7709   0.863    0.61   __RCVD_VIA_LACNIC
 34.8814   3.0100   0.921    0.57   __RCVD_VIA_APNIC
 35.6669   3.8372   0.903    0.56   __RCVD_VIA_APNIC_E
  4.9684   1.7034   0.745    0.54   __RCVD_VIA_LACNIC_E
 47.1530  14.6071   0.763    0.51   __RCVD_VIA_RIPE
  0.0158   0.0010   0.943    0.50   __RCVD_VIA_NON_RIR_E
 49.6605  21.5889   0.697    0.50   __RCVD_VIA_RIPE_E
       0   0.0010   0.000    0.48   __RCVD_VIA_NON_RIR
 10.6118  79.2411   0.118    0.41   __RCVD_VIA_ARIN_E
  4.8754  73.0384   0.063    0.39   __RCVD_VIA_ARIN
  0.0014   0.1577   0.009    0.32   __RCVD_VIA_IPV6
  0.0072   1.8275   0.004    0.11   __RCVD_VIA_IPV6_E