Login | Register For Free | Help
Search for: (Advanced)

Mailing List Archive: SpamAssassin: devel

FROM_12LTRDOM high scored - remove?

 

 

SpamAssassin devel RSS feed   Index | Next | Previous | View Threaded


axb.lists at gmail

Jul 3, 2012, 7:00 AM

Post #1 of 7 (371 views)
Permalink
FROM_12LTRDOM high scored - remove?

score FROM_12LTRDOM 3.5

Even with lots of conditions, a 12 letter domain is nothing
extraordinary, especially in the eurozone.

Imo, this rule should be applied locally by the person who suggested as
per comment:

# 12-letter domain names, suggested by Len Conrad on the users list

Votes to see it go away? (even scoring low is asking for trouble)

Axb


KMcGrail at PCCC

Jul 3, 2012, 7:04 AM

Post #2 of 7 (344 views)
Permalink
Re: FROM_12LTRDOM high scored - remove? [In reply to]

On 7/3/2012 10:00 AM, Axb wrote:
> score FROM_12LTRDOM 3.5
>
> Even with lots of conditions, a 12 letter domain is nothing
> extraordinary, especially in the eurozone.
>
> Imo, this rule should be applied locally by the person who suggested
> as per comment:
>
> # 12-letter domain names, suggested by Len Conrad on the users list
>
> Votes to see it go away? (even scoring low is asking for trouble)
>
> Axb
Agreed. Sounds a bit silly to me. +1 to remove. Would have to be a
meta rule.


jhardin at impsec

Jul 3, 2012, 7:14 AM

Post #3 of 7 (343 views)
Permalink
Re: FROM_12LTRDOM high scored - remove? [In reply to]

On Tue, 3 Jul 2012, Kevin A. McGrail wrote:

> On 7/3/2012 10:00 AM, Axb wrote:
>> score FROM_12LTRDOM 3.5
>>
>> Even with lots of conditions, a 12 letter domain is nothing extraordinary,
>> especially in the eurozone.
>>
>> Imo, this rule should be applied locally by the person who suggested as
>> per comment:
>>
>> # 12-letter domain names, suggested by Len Conrad on the users list
>>
>> Votes to see it go away? (even scoring low is asking for trouble)
>>
>> Axb
>
> Agreed. Sounds a bit silly to me. +1 to remove. Would have to be a meta
> rule.

It _is_ a meta rule, with FP exclusions. Unfortunately that approach is
only as reliable as the masscheck corpus is reliable and broad.

I'd be willing to make it a subrule and investigate combinations with
other spammy rules, rather than trying to reduce its FPs through
exclusions.

--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin [at] impsec FALaholic #11174 pgpk -a jhardin [at] impsec
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
We have to realize that people who run the government can and do
change. Our society and laws must assume that bad people -
criminals even - will run the government, at least part of the
time. -- John Gilmore
-----------------------------------------------------------------------
Tomorrow: the 236th anniversary of the Declaration of Independence


axb.lists at gmail

Jul 3, 2012, 7:24 AM

Post #4 of 7 (343 views)
Permalink
Re: FROM_12LTRDOM high scored - remove? [In reply to]

On 07/03/2012 04:14 PM, John Hardin wrote:
> On Tue, 3 Jul 2012, Kevin A. McGrail wrote:
>
>> On 7/3/2012 10:00 AM, Axb wrote:
>>> score FROM_12LTRDOM 3.5
>>>
>>> Even with lots of conditions, a 12 letter domain is nothing
>>> extraordinary,
>>> especially in the eurozone.
>>>
>>> Imo, this rule should be applied locally by the person who suggested as
>>> per comment:
>>>
>>> # 12-letter domain names, suggested by Len Conrad on the users list
>>>
>>> Votes to see it go away? (even scoring low is asking for trouble)
>>>
>>> Axb
>>
>> Agreed. Sounds a bit silly to me. +1 to remove. Would have to be a
>> meta rule.
>
> It _is_ a meta rule, with FP exclusions. Unfortunately that approach is
> only as reliable as the masscheck corpus is reliable and broad.

not really - No way I could put my production ham mail in a corpus bin
to make it score "useless" but I can count >1.2 milllion hits where
that rule could have FPd, had I not lowered the score to 0.001, (to
watch it)

> I'd be willing to make it a subrule and investigate combinations with
> other spammy rules, rather than trying to reduce its FPs through
> exclusions.

reducing FPs is not possible, no matter how much you dance around it,
and not even worth it.

Sorry... I can't agree

Axb


dan.mcdonald at austinenergy

Jul 3, 2012, 8:13 AM

Post #5 of 7 (345 views)
Permalink
Re: FROM_12LTRDOM high scored - remove? [In reply to]

On 7/3/12 9:24 AM, "Axb" <axb.lists [at] gmail> wrote:

> On 07/03/2012 04:14 PM, John Hardin wrote:
>> On Tue, 3 Jul 2012, Kevin A. McGrail wrote:
>>
>>> On 7/3/2012 10:00 AM, Axb wrote:
>>>> score FROM_12LTRDOM 3.5
>>>>
>>>> Even with lots of conditions, a 12 letter domain is nothing
>>>> extraordinary,
>>>> especially in the eurozone.

Or elsewhere... However, it is much loved by spammers for some odd reason.

>>>>
>>>> Imo, this rule should be applied locally by the person who suggested as
>>>> per comment:
>>>>
>>>> # 12-letter domain names, suggested by Len Conrad on the users list
>>>>
>>>> Votes to see it go away? (even scoring low is asking for trouble)
>>>>
>>>> Axb
>>>
>>> Agreed. Sounds a bit silly to me. +1 to remove. Would have to be a
>>> meta rule.
>>
>> It _is_ a meta rule, with FP exclusions. Unfortunately that approach is
>> only as reliable as the masscheck corpus is reliable and broad.
>
> not really - No way I could put my production ham mail in a corpus bin
> to make it score "useless" but I can count >1.2 milllion hits where
> that rule could have FPd, had I not lowered the score to 0.001, (to
> watch it)

I see a huge overlap with URIBL_BLACK and URIBL_INVL (invaluement). Also
RAZOR2_CF_RANGE_E8_100

As a meta with URIBL_BLACK it would probably be fine for 3.5 points. The
other rules tend to be pretty clear kills anyway.

>
>> I'd be willing to make it a subrule and investigate combinations with
>> other spammy rules, rather than trying to reduce its FPs through
>> exclusions.
>
> reducing FPs is not possible, no matter how much you dance around it,
> and not even worth it.
>

As a user of a 12 letter domain, I'd prefer to have it as a meta with some
other strong rules than a standalone rule.

> Sorry... I can't agree
>
> Axb
>

--
Daniel J McDonald, CCIE # 2495, CISSP # 78281


jhardin at impsec

Jul 3, 2012, 8:41 AM

Post #6 of 7 (337 views)
Permalink
Re: FROM_12LTRDOM high scored - remove? [In reply to]

On Tue, 3 Jul 2012, Axb wrote:

> On 07/03/2012 04:14 PM, John Hardin wrote:
>> On Tue, 3 Jul 2012, Kevin A. McGrail wrote:
>>
>> > On 7/3/2012 10:00 AM, Axb wrote:
>> > > score FROM_12LTRDOM 3.5
>> > >
>> > > Even with lots of conditions, a 12 letter domain is nothing
>> > > extraordinary,
>> > > especially in the eurozone.
>> > >
>> > > Imo, this rule should be applied locally by the person who suggested
>> > > as
>> > > per comment:
>> > >
>> > > # 12-letter domain names, suggested by Len Conrad on the users list
>> > >
>> > > Votes to see it go away? (even scoring low is asking for trouble)
>> > >
>> > > Axb
>> >
>> > Agreed. Sounds a bit silly to me. +1 to remove. Would have to be a
>> > meta rule.
>>
>> It _is_ a meta rule, with FP exclusions. Unfortunately that approach is
>> only as reliable as the masscheck corpus is reliable and broad.
>
> not really - No way I could put my production ham mail in a corpus bin to
> make it score "useless" but I can count >1.2 milllion hits where that rule
> could have FPd, had I not lowered the score to 0.001, (to watch it)
>
>> I'd be willing to make it a subrule and investigate combinations with
>> other spammy rules, rather than trying to reduce its FPs through
>> exclusions.
>
> reducing FPs is not possible, no matter how much you dance around it, and not
> even worth it.
>
> Sorry... I can't agree

I accept that this rule may be too broad for the FP avoidance technique to
work given a limited masscheck corpus (and just about any corpus we could
use would be "limited" in this situation).

Just to clarify: you also don't believe that it may be useful as a subrule
to meta with other rules because you don't believe the masscheck corpus
can possibly give realistic results for this test? Is that what you're
saying above?

--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin [at] impsec FALaholic #11174 pgpk -a jhardin [at] impsec
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
A sword is never a killer, it is but a tool in the killer's hands.
-- Lucius Annaeus Seneca (Martial) 4BC-65AD
-----------------------------------------------------------------------
Tomorrow: the 236th anniversary of the Declaration of Independence


jhardin at impsec

Jul 3, 2012, 8:51 AM

Post #7 of 7 (341 views)
Permalink
Re: FROM_12LTRDOM high scored - remove? [In reply to]

On Tue, 3 Jul 2012, Daniel McDonald wrote:

> On 7/3/12 9:24 AM, "Axb" <axb.lists [at] gmail> wrote:
>
>> On 07/03/2012 04:14 PM, John Hardin wrote:
>>> On Tue, 3 Jul 2012, Kevin A. McGrail wrote:
>>>
>>>> On 7/3/2012 10:00 AM, Axb wrote:
>>>>> score FROM_12LTRDOM 3.5
>>>>>
>>>>> Even with lots of conditions, a 12 letter domain is nothing
>>>>> extraordinary, especially in the eurozone.
>
> Or elsewhere... However, it is much loved by spammers for some odd reason.

{snip}

> I see a huge overlap with URIBL_BLACK and URIBL_INVL (invaluement). Also
> RAZOR2_CF_RANGE_E8_100
>
> As a meta with URIBL_BLACK it would probably be fine for 3.5 points. The
> other rules tend to be pretty clear kills anyway.

meta'ing it with URIBL_* makes it a NET rule, which I'm trying somewhat to
avoid, and meta'ing it with another highly-effective rule moves the hit
spike out of the low-scoring-spams domain, which is reduces its utility.

>>> I'd be willing to make it a subrule and investigate combinations with
>>> other spammy rules, rather than trying to reduce its FPs through
>>> exclusions.
>>
>> reducing FPs is not possible, no matter how much you dance around it,
>> and not even worth it.
>
> As a user of a 12 letter domain, I'd prefer to have it as a meta with some
> other strong rules than a standalone rule.

I'll do some restructuring and then start analyzing spam overlap. In the
meantime I will set a low score limit.

--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin [at] impsec FALaholic #11174 pgpk -a jhardin [at] impsec
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
A sword is never a killer, it is but a tool in the killer's hands.
-- Lucius Annaeus Seneca (Martial) 4BC-65AD
-----------------------------------------------------------------------
Tomorrow: the 236th anniversary of the Declaration of Independence

SpamAssassin devel RSS feed   Index | Next | Previous | View Threaded
 
 


Interested in having your list archived? Contact Gossamer Threads
 
  Web Applications & Managed Hosting Powered by Gossamer Threads Inc.