spamassassin-dev September 2011 archive
Main Archive Page > Month Archives  > spamassassin-dev archives
spamassassin-dev: Re: [SA-dev] [Bug 6660] __NSL_RCVD_FROM_41 sho

Re: [SA-dev] [Bug 6660] __NSL_RCVD_FROM_41 should include test for (41. in addition to [41.

From: Adam Katz <antispam_at_nospam>
Date: Tue Sep 27 2011 - 18:01:49 GMT
To: dev@spamassassin.apache.org

> https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6660

On 09/25/2011 10:43 AM, John Hardin wrote on bugzilla:
>> header __NSL_RCVD_FROM_41 X-Spam-Relays-External =~ / ip=41\./
>
> Hrm. I'm now wondering whether having __NSL_RCVD_FROM_41 as a subset of
> __RCVD_VIA_AFRINIC has any value...

On Sun, 25 Sep 2011, John Hardin amended privately:
> Actually, it's more a subset of __RCVD_VIA_AFRINIC_E since
> __RCVD_VIA_AFRINIC is anchored on the last external.
>
> Would you be willing to remove the "nopublish" from
> __RCVD_VIA_AFRINIC_E? That rule may be handy in metas.

I have only one issue with releasing the rest of the __RCVD_VIA_* rules,
which is a very stern reminder that using them is almost certainly a Bad
Idea, with its apparent merits tainted by the limitations of our ham
corpora.

I'll say that again: we do not have enough ham from Africa or Latin
America to understand how to properly use these rules.

If you block based (in part or wholly) on __RCVD_VIA_AFRINIC_E, you doom
South Africa to the same bucket as Nigeria. The 41/8 CIDR is restricted
to just Nigeria and surrounding areas, which (until they improve their
education and infrastructure) is pretty well correlated with advance-fee
fraudsters. AfriNIC's entire dedicated space is not a fair target.

Read these stats with a grain of salt:

http://ruleqa.spamassassin.org/?daterev=20110926&rule=%2FRCVD_VIA
   SPAM% HAM% S/O RANK NAME
  2.2063 0.0058 0.997 0.87 __RCVD_VIA_AFRINIC
  2.3564 0.1116 0.955 0.75 __RCVD_VIA_AFRINIC_E
  4.8714 0.7709 0.863 0.61 __RCVD_VIA_LACNIC
 34.8814 3.0100 0.921 0.57 __RCVD_VIA_APNIC
 35.6669 3.8372 0.903 0.56 __RCVD_VIA_APNIC_E
  4.9684 1.7034 0.745 0.54 __RCVD_VIA_LACNIC_E
 47.1530 14.6071 0.763 0.51 __RCVD_VIA_RIPE
  0.0158 0.0010 0.943 0.50 __RCVD_VIA_NON_RIR_E
 49.6605 21.5889 0.697 0.50 __RCVD_VIA_RIPE_E
       0 0.0010 0.000 0.48 __RCVD_VIA_NON_RIR
 10.6118 79.2411 0.118 0.41 __RCVD_VIA_ARIN_E
  4.8754 73.0384 0.063 0.39 __RCVD_VIA_ARIN
  0.0014 0.1577 0.009 0.32 __RCVD_VIA_IPV6
  0.0072 1.8275 0.004 0.11 __RCVD_VIA_IPV6_E