Bayes Poisoning? Spam with negative BAYES Scores

[Randal, Phil]

Remember that spammers have access to SpamAssassin too...

We're seeing some obvious stuff slipping through here.

I think the solution is keeping one's eye on what's getting through and
writing custom rules to clobber it.

I've also found that the bigevil.cf list helps
(http://www.merchantsoverseas.com/wwwroot/gorilla/sa_rules.htm)

Cheers,

Phil

---------------------------------------------
Phil Randal
Network Engineer
Herefordshire Council
Hereford, UK

> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER at JISCMAIL.AC.UK]On
> Behalf Of Pete
> Sent: 19 December 2003 02:53
> To: MAILSCANNER at JISCMAIL.AC.UK
> Subject: Re: Bayes Poisoning? Spam with negative BAYES Scores
>
>
> Ken Anderson wrote:
>
> > Just .02..
> > For most of these, the bayes poisoning seems to be done in the
> > text/plain portion of the email, while the html part is spammy.
> > SA should be able to ignore the text/plain part completely
> if there is a
> > spammy html version. I'm not sure what/if anything has been
> done along
> > these lines.
> >
> > Ken A.
> > Pacific.Net
> >
> >
> > Nathan Johanson wrote:
> >
> >> Hello,
> >>
> >> A recent thread made brief reference to "bayes poisoning". We're
> >> currently using SpamAssassin 2.60 and will upgrade to version 2.61
> >> shortly, but we have seen an increasing amount of spam
> slipping through
> >> the filters with negative BAYES scores. Very annoying:
> >>
> >> X-tcpnetworks-MailScanner: Found to be clean
> >> X-tcpnetworks-MailScanner-SpamCheck: not spam, SpamAssassin
> >> (score=-3.361,
> >>  required 4, BAYES_00 -4.90, HTML_IMAGE_ONLY_06 1.44,
> >>  HTML_MESSAGE 0.10)
> >>
> >> Is anyone else seeing this sort of thing? Any recommendations for
> >> combating it? I noted the links to BigEvil custom rules (posted
> >> earlier), but I'm starting to wonder if Bayes usefulness
> is starting to
> >> dwindle. Is there some way to prevent this poisoning?
> >>
> >>
> >> help too.
> >>
> >> Nathan
> >>
> >>
> >
> >
> >
> I am starting to find that as the bayes DB is getting larger that more
> spam is starting to get through. I have only installed 6 weeks ago and
> in the last 2 weeks i have a steady increase in spam not
> being trapped -
> is there bayes maintenance i need to do? maybe its something
> completely
> unrelated, but it seemed logical to me.
>