spamassassin-users August 2010 archive
Main Archive Page > Month Archives  > spamassassin-users archives
spamassassin-users: Re: JM_SOUGHT_FRAUD


From: Bowie Bailey <Bowie_Bailey_at_nospam>
Date: Wed Aug 11 2010 - 16:40:46 GMT

 On 8/11/2010 12:17 PM, Karsten Bräckelmann wrote:
> On Wed, 2010-08-11 at 11:57 -0400, Bowie Bailey wrote:
>> On 8/11/2010 11:46 AM, Karsten Bräckelmann wrote:
>>> On Wed, 2010-08-11 at 10:59 -0400, Bowie Bailey wrote:
>>>> I was looking through some of the spam rules, and I noticed that the
>>>> JM_SOUGHT_FRAUD rules are included in the main SA updates channel for SA
>>>> 3.3.1, but the scores are all 0. Is there a reason for this?
>>> Yes, an explicit request by Justin to zero them out, specifically aiming
>>> at the rescore runs to prevent biasing the scores too much, AFAIK.
>>> The Sought Fraud rules are expected to be enabled locally -- that is,
>>> assign them a proper score in the site config cf files.
>>> In other words: To my knowledge and experience, they are rather safe to
>>> use. They have *not* been zeroed out due to bad performance.
>> I thought I had enabled them by using the ""
>> sa-update channel, but apparently not, since that gets overridden by the
>> copy in the main updates channel.
> Uhm, yeah -- IIRC that's alphabetical order, and stock *u*pdates gets
> parsed after *s*ought channel.

I think you're right. In any case, I confirmed with a debug run that
updates is loaded after sought. Maybe I should run a script after the
sa-update that renames the file to z_sought... so it'll be loaded last.

>> Are the rules in the main updates channel being updated as often as the
>> ones in the sought channel? A quick comparison shows that the two sets
>> of rules on my system are different. I thought the sought rules were
>> highly dynamic, so I'm surprised to see one of them show up in the main
>> channel.
> I think they are updated frequently, also in 3.3 stock. Details escape
> me right now. Justin?
> Update frequency of the dedicated sought channel has been changing a few
> times in the past. Currently it's "more than once a day" for quite some
> time.

Right. And I'm checking for updates several times a day. If the
updates channel is not keeping up with sought, I need to make sure I am
running the rules from the dedicated channel and not the updates channel
so I have the latest.

-- Bowie