You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by John Andersen <js...@pen.homeip.net> on 2006/10/19 10:07:25 UTC
DCC worth it?
Contemplating adding DCC to my SA config.
I already do the SURBL tests and Razor2.
Will I likely gain any thing via this? Does DCC catch what other
tests miss?
--
_____________________________________
John Andersen
Re: DCC worth it?
Posted by Bill <ad...@vci.net>.
My statistics look like this. This is from one lower volume server and
is only since logs rotated at 4am Sunday morning.
DCC - 38,521 (DCC_CHECK)
Razor - 52,596 (RAZOR2_CHECK)
Pyzor - 11,201 (PYZOR_CHECK)
And for the heck of it:
DIGEST_MULTIPLE 38,562
Bill
----- Original Message -----
From: Giampaolo Tomassoni
To: users@spamassassin.apache.org
Sent: Thursday, October 19, 2006 8:23 AM
Subject: R: DCC worth it?
> I use DCC, Razor and Pyzor.
It is quite like my conf.
> I only installed Pyzor because I
> thought the
> more opinions I get on an email the better. By using all 3 I get more spam
> emails rejected than if I just use DCC and Razor. It helps raise the score
> of the spam emails.
I have pyzor too, but I'm not shure it is actually working: I don't get
anymore a PYZOR_something tag in suspicious e-mails. This started happening
a couple of weeks ago. Also, anonymous reporting to pyzor seems simply
ineffective to me.
What's your feedback about this?
> Bill
giampaolo
>
>
>
>
> ----- Original Message -----
> From: John Andersen
> To: users@spamassassin.apache.org
> Sent: Thursday, October 19, 2006 3:07 AM
> Subject: DCC worth it?
>
>
> Contemplating adding DCC to my SA config.
>
> I already do the SURBL tests and Razor2.
> Will I likely gain any thing via this? Does DCC catch what other
> tests miss?
>
> --
> _____________________________________
> John Andersen
>
R: DCC worth it?
Posted by Giampaolo Tomassoni <g....@libero.it>.
> I use DCC, Razor and Pyzor.
It is quite like my conf.
> I only installed Pyzor because I
> thought the
> more opinions I get on an email the better. By using all 3 I get more spam
> emails rejected than if I just use DCC and Razor. It helps raise the score
> of the spam emails.
I have pyzor too, but I'm not shure it is actually working: I don't get anymore a PYZOR_something tag in suspicious e-mails. This started happening a couple of weeks ago. Also, anonymous reporting to pyzor seems simply ineffective to me.
What's your feedback about this?
> Bill
giampaolo
>
>
>
>
> ----- Original Message -----
> From: John Andersen
> To: users@spamassassin.apache.org
> Sent: Thursday, October 19, 2006 3:07 AM
> Subject: DCC worth it?
>
>
> Contemplating adding DCC to my SA config.
>
> I already do the SURBL tests and Razor2.
> Will I likely gain any thing via this? Does DCC catch what other
> tests miss?
>
> --
> _____________________________________
> John Andersen
>
Re: DCC worth it?
Posted by Bill <ad...@vci.net>.
I use DCC, Razor and Pyzor. I only installed Pyzor because I thought the
more opinions I get on an email the better. By using all 3 I get more spam
emails rejected than if I just use DCC and Razor. It helps raise the score
of the spam emails.
Bill
----- Original Message -----
From: John Andersen
To: users@spamassassin.apache.org
Sent: Thursday, October 19, 2006 3:07 AM
Subject: DCC worth it?
Contemplating adding DCC to my SA config.
I already do the SURBL tests and Razor2.
Will I likely gain any thing via this? Does DCC catch what other
tests miss?
--
_____________________________________
John Andersen
Re: DCC worth it?
Posted by John Andersen <js...@pen.homeip.net>.
On Thursday 19 October 2006 01:01, Leander Koornneef wrote:
> . Giampaolo's comments are
> also valid: if they both
> hit, you get higher scores, which may just be enough to push a spam
> above your required_score.
Ah, well then that's not an issue for me.
If razor-50-100 hits its already spam as far as I'm concerned.
The vary nature of razor says that particular body has been seen
a large number of times already by a wide range of people.
Defacto spam for my purposes.
--
_____________________________________
John Andersen
Re: DCC worth it?
Posted by Leander Koornneef <l....@ic-s.nl>.
In my experience (which is not statistically comfirmed), Razor
catches more spam than DCC.
Usually if DCC hits, then Razor will probably also hit. This is not
true the other way around:
if Razor hits, DCC regularly doesn't hit. Giampaolo's comments are
also valid: if they both
hit, you get higher scores, which may just be enough to push a spam
above your required_score.
Leander
On 19-okt-2006, at 10:15, Jo Rhett wrote:
> John Andersen wrote:
>> Contemplating adding DCC to my SA config. I already do the SURBL
>> tests and Razor2.
>> Will I likely gain any thing via this? Does DCC catch what other
>> tests miss?
>
> DCC and Razor are very similar in approach. DCC has recently lost
> a lot of community support due to policy decisions made by the guy
> who runs it, which is pretty much why Razor sprang into existence.
>
> We have them in parallel on one of our work systems, and I can't
> say that DCC is better than Razor. It catches some that Razor
> misses, but Razor seems to catch more than DCC misses. 95% of the
> time they are identical in result.
>
> --
> Jo Rhett
> Network/Software Engineer
> Net Consonance
>
--
Leander Koornneef
IC&S B.V.
l.koornneef@ic-s.nl
http://www.ic-s.nl
IC&S biedt Service & Support, Development en Consultancy op
uiteenlopende
internet-gerelateerde platformen, met een voorliefde voor Open Source.
Let op: mijn emailadres is gewijzigd naar: l.koornneef@ic-s.nl
Re: DCC worth it?
Posted by Shane Williams <sh...@shanew.net>.
Based on how far their mailing lists go back, Razor and DCC have been
around since the 2000/2001 time period, and as far as I can tell were
independent projects.
In fact, they're based on different goals/models, which is why it's
useful to use both of them. Razor is interested in specifically
identifying spam, so it provides a way to both report and revoke
emails (technically hashes of emails). DCC determines how bulky or
massive a bulk or mass mail is, not how spammy it is, which is why
whitelisting is so important in DCC (
Perhaps you were thinking of Pyzor, which did come about because of
Razor's semi-closed source nature?
(and yes, I know all about top-posting being a no-no, but there was no
obvious place to jump in to the following thread, and yet it seemed
important for context)
On Thu, 19 Oct 2006, Jo Rhett wrote:
> Matt Kettler wrote:
>> Which policy change is that? And what community has DCC lost support in?
> (and then he answers his own question)
>
>> that's not exactly recent. (Spring 2005)
>
> Sorry, after doing this for 20 years anything that happened a year ago is
> "recent". Sorry if that confused you.
>
>> I'd also not call that a "policy decision", as that implies it was made
>
> Again, wording. Sorry. Decisions forced versus decision freely made are both
> decisions. You're right, I could have been more specific but I wans't aiming
> for that level of accuracy when I mumbled this.
>
>> I've not seen anything resembling "loss of community support" for DCC as
>> a result.
>
> <shrug> 2 years ago everyone I know used DCC. Now, my employer is the last
> remaining site that I know of using DCC. They were one of the first public
> DCC servers (2 digit number) and strongly support Vernon. And they are ~2
> weeks away from shutting that down forever.
>
>> > which is pretty much why Razor sprang into existence.
>
>> Your facts are pretty far off here. (snip)
>
> Sorry, level of accuracy was related to my own personal observations. Nobody
> that I know of used Razor until DCC became difficult. I know that we used to
> compile without razor support locally.
>
> I think I'll take my own advice and not reply on things that I don't know the
> in-depth details of.
>
>
--
Public key #7BBC68D9 at | Shane Williams
http://pgp.mit.edu/ | System Admin - UT iSchool
=----------------------------------+-------------------------------
All syllogisms contain three lines | shanew@shanew.net
Therefore this is not a syllogism | www.ischool.utexas.edu/~shanew
Re: DCC worth it?
Posted by Jo Rhett <jr...@netconsonance.com>.
Matt Kettler wrote:
> Which policy change is that? And what community has DCC lost support in?
(and then he answers his own question)
> that's not exactly recent. (Spring 2005)
Sorry, after doing this for 20 years anything that happened a year ago
is "recent". Sorry if that confused you.
> I'd also not call that a "policy decision", as that implies it was made
Again, wording. Sorry. Decisions forced versus decision freely made are
both decisions. You're right, I could have been more specific but I
wans't aiming for that level of accuracy when I mumbled this.
> I've not seen anything resembling "loss of community support" for DCC as
> a result.
<shrug> 2 years ago everyone I know used DCC. Now, my employer is the
last remaining site that I know of using DCC. They were one of the
first public DCC servers (2 digit number) and strongly support Vernon.
And they are ~2 weeks away from shutting that down forever.
>> which is pretty much why Razor sprang into existence.
> Your facts are pretty far off here. (snip)
Sorry, level of accuracy was related to my own personal observations.
Nobody that I know of used Razor until DCC became difficult. I know
that we used to compile without razor support locally.
I think I'll take my own advice and not reply on things that I don't
know the in-depth details of.
--
Jo Rhett
Network/Software Engineer
Net Consonance
Re: DCC worth it?
Posted by Matt Kettler <mk...@verizon.net>.
Jo Rhett wrote:
> John Andersen wrote:
>> Contemplating adding DCC to my SA config.
>> I already do the SURBL tests and Razor2.
>> Will I likely gain any thing via this? Does DCC catch what other
>> tests miss?
>
> DCC and Razor are very similar in approach. DCC has recently lost a
> lot of community support due to policy decisions made by the guy who
> runs it,
Which policy change is that? And what community has DCC lost support in?
SA had to make DCC disabled by default due to licensing changes, but
that's not exactly recent. (Spring 2005)
I'd also not call that a "policy decision", as that implies it was made
by choice to suit his policy desires. DCC's technology base turned out
to be patented by a company that clearly invented it first (patent filed
Jan of 1999). DCC's policies changed to avoid Vernon being sued into the
ground.
And let's face it, the changes aren't really particularly egregious, and
I've not seen anything resembling "loss of community support" for DCC as
a result.
> which is pretty much why Razor sprang into existence.
Your facts are pretty far off here.
Razor did not "spring into existence" in reaction to DCC policy
changes. In fact, Razor slightly pre-dates DCC. Razor was first created
by Vipul in 1999, with it's first public release on of 0.24 May 22,
2000. DCC started in 2000 and did not enter production use until winter
of 2000.
Also, Razor support has been in SpamAssassin longer than DCC has.
SpamAssassin 1.0 was released in September of 2001 and supported Razor
(v1). It did not support DCC.
>
> We have them in parallel on one of our work systems, and I can't say
> that DCC is better than Razor. It catches some that Razor misses, but
> Razor seems to catch more than DCC misses. 95% of the time they are
> identical in result.
I find they have quite different coverage. Particularly since razor
added e8.
That said, I've got a lot of problems with DCC false-positives on
mass-volume mail, and I've not been able to make dcc whitelists work
properly under my copy of SA.
R: DCC worth it?
Posted by Giampaolo Tomassoni <g....@libero.it>.
> John Andersen wrote:
> > Contemplating adding DCC to my SA config.
> >
> > I already do the SURBL tests and Razor2.
> > Will I likely gain any thing via this? Does DCC catch what other
> > tests miss?
>
> DCC and Razor are very similar in approach. DCC has recently lost a lot
> of community support due to policy decisions made by the guy who runs
> it, which is pretty much why Razor sprang into existence.
>
> We have them in parallel on one of our work systems, and I can't say
> that DCC is better than Razor. It catches some that Razor misses, but
> Razor seems to catch more than DCC misses. 95% of the time they are
> identical in result.
I think it wouldn't be worth to have only DCC, but it is having both Razor2 and DCC: when both report an e-mail as spam, the minimum score it gets is 4.5 on a standard installation: RAZOR2_CF_RANGE_E8_51_100 + RAZOR2_CHECK + RAZOR2_CF_RANGE_51_100 + DCC_CHECK + DIGEST_MULTIPLE.
giampaolo
>
> --
> Jo Rhett
> Network/Software Engineer
> Net Consonance
Re: DCC worth it?
Posted by Jo Rhett <jr...@netconsonance.com>.
John Andersen wrote:
> Contemplating adding DCC to my SA config.
>
> I already do the SURBL tests and Razor2.
> Will I likely gain any thing via this? Does DCC catch what other
> tests miss?
DCC and Razor are very similar in approach. DCC has recently lost a lot
of community support due to policy decisions made by the guy who runs
it, which is pretty much why Razor sprang into existence.
We have them in parallel on one of our work systems, and I can't say
that DCC is better than Razor. It catches some that Razor misses, but
Razor seems to catch more than DCC misses. 95% of the time they are
identical in result.
--
Jo Rhett
Network/Software Engineer
Net Consonance
Re: DCC worth it?
Posted by Leander Koornneef <l....@ic-s.nl>.
This seems to extreme to be true. I think you need to fix your DCC
setup :-)
On 19-okt-2006, at 15:19, Coffey, Neal wrote:
> John Andersen wrote:
>> Contemplating adding DCC to my SA config.
>>
>> I already do the SURBL tests and Razor2.
>> Will I likely gain any thing via this? Does DCC catch what other
>> tests miss?
>
> For what it's worth, this is from seven days of logging on my
> company's
> mail server:
>
> $ zgrep "RAZOR2_" spamc.log.?.gz |wc -l
> 49054
> $ zgrep "DCC_" spamc.log.?.gz |wc -l
> 0
>
> And yes, I have DCC enabled.
>
> $ pwd
> /etc/mail/spamassassin
> $ grep "^loadplugin.*DCC" *
> v310.pre:loadplugin Mail::SpamAssassin::Plugin::DCC
>
> Now, granted, there might be a problem loading or running the DCC
> plugin. I haven't looked to see, yet. I'm a little surprised that
> nothing's triggered it in the last week, but Razor2 has *always* been
> significantly more effective than DCC at my site, so I'm not at all
> worried by it.
>
> Incidentally, the breakdown looks like this:
>
> Type Total %
> -----------------------------------
> All Messages 119528 100
> Spam 98168 82
> Spam w/Razor2 49054 41
>
> Percent of Spam w/Razor2 50
>
--
Leander Koornneef
IC&S B.V.
Stadhouderslaan 57
3583 JD Utrecht
T: +31 30 63 55 730
F: +31 30 63 55 731
E: l.koornneef@ic-s.nl
I: http://www.ic-s.nl
IC&S biedt Service & Support, Development en Consultancy op
uiteenlopende
internet-gerelateerde platformen, met een voorliefde voor Open Source.
Let op: mijn emailadres is gewijzigd naar: l.koornneef@ic-s.nl
RE: DCC worth it?
Posted by "Coffey, Neal" <nc...@langeveld.com>.
John Andersen wrote:
> Contemplating adding DCC to my SA config.
>
> I already do the SURBL tests and Razor2.
> Will I likely gain any thing via this? Does DCC catch what other
> tests miss?
For what it's worth, this is from seven days of logging on my company's
mail server:
$ zgrep "RAZOR2_" spamc.log.?.gz |wc -l
49054
$ zgrep "DCC_" spamc.log.?.gz |wc -l
0
And yes, I have DCC enabled.
$ pwd
/etc/mail/spamassassin
$ grep "^loadplugin.*DCC" *
v310.pre:loadplugin Mail::SpamAssassin::Plugin::DCC
Now, granted, there might be a problem loading or running the DCC
plugin. I haven't looked to see, yet. I'm a little surprised that
nothing's triggered it in the last week, but Razor2 has *always* been
significantly more effective than DCC at my site, so I'm not at all
worried by it.
Incidentally, the breakdown looks like this:
Type Total %
-----------------------------------
All Messages 119528 100
Spam 98168 82
Spam w/Razor2 49054 41
Percent of Spam w/Razor2 50