Re[2]: [OT] Spam FIREWALL software

[Robert Menschel <Ro...@Menschel.net>]

Hello Camis,

Tuesday, August 24, 2004, 12:01:15 PM, you wrote:

C> Dave Schneider wrote:
>> Am I the only one that chokes on the "1 false positive out of 25000" 
>> ??!! Thats like..hundreds an hour in my environments...
>> Ill stick to my schema..

C> 40 mails out of 1 million mails.. Thats not *THAT* bad.. does anyone
C> have any idea what type of ratio SA has?

I process about 11k emails a month, 10k spam, 1k ham. I hit approximately
one FP every other month.  1/22k is pretty close to what they're
claiming.

Mine is a heavily modified system, required-hits 9.0 instead of 5.0, with
lots of score overrides and lots of SARE and personal rules.

Bob Menschel

Re: Re[2]: [OT] Spam FIREWALL software

[Lucas Albers <ad...@cs.montana.edu>]

Robert Menschel said:

> Mine is a heavily modified system, required-hits 9.0 instead of 5.0, with
> lots of score overrides and lots of SARE and personal rules.
>
> Bob Menschel

Howdy Bob,
I've set mind to 10.5 and my average spam volume per last couple hundred
thousand email has been:

70% of all incoming mail is blocked as spam, scoring 10.5 or higher.
2%  of all incoming mail is detected as spammy scoring 6.0 or higher.

So 2% of incoming mail by volume is spammy but get's through.

95%-97% of the incoming spam is blocked depending on the day.

So i've found using a higher score with some custom blackbox rules appears
to have a good enough block rate, with low enough fp rate.

I think it's better to have a lower fp rate and lower spam block rate by
rasing the block score.

Surbl works great.
Some blackbox dns tests lower the score based on the spamminess of the dns
entry for the server.

-- 
Luke Computer Science System Administrator
Security Administrator,College of Engineering
Montana State University-Bozeman,Montana