Re: A spam fake From: example

[ned.freed@mrochek.com]

> I agree with you about the best being the enemy of the good; I think we
> also agree that any heuristic method for protecting IETF WG mailing lists
> should be backed up by a human review.
We do indeed agree.

> (I scanned my last 2 weeks of SpamAssassin-filtered mail today; 3
> misclassifications, one of which was deliberately taunting SpamAssassin,
> the two others were from the SpamAssassin mailing list.... I have tweaked
> some of the metrics, though..)
I keep tabs on this as well. Here are my tallies so far this year:

1/1/2003         20F-
1/2/2003          9F-
1/3/2003         19F-
1/4/2003         14F-
1/5/2003   1572+ 22F-
1/6/2003    214+ 15F-
1/7/2003         17F-
1/8/2003          5F-
1/9/2003    304+ 27F-
1/10/2003        14F-
1/11/2003   501+ 27F- 2F+ (tls)
1/12/2003   536+  4F- 3F+ (vpim, ttj, tls)

The notation should be obvious, but in case it isn't, + is correctly detected
spam, F- is a false negative -- spam that should have been caught but wasn't,
F+ is a false positive -- legit email caught as spam. I don't track legit email
not caught as spam.

I obviously don't check the spam folder every day and of course it always has a
backlog...

				Ned