Negative scores (was Re: [Mimedefang] scores displayed in $tests)

[listuser at numbnuts.net]

On Wed, 7 May 2003, Nels Lindquist wrote:

> On 7 May 2003 at 11:43, David F. Skoll wrote:
> 
> > Also, a lot of the negative-weight scores are truly esoteric -- how
> > many people get genuine e-mail that triggers USER_AGENT_GNUS_UA or
> > DEBIAN_BTS_BUG that would be classified as spam without the
> > negative-weight rule? :-) 
> 
> One example: you're using one of those MUAs and your ISP has been 
> placed on multiple DNSBLs through no fault of your own.  And though 
> it's easy to say "then don't use DNSBLs!" they *do* help more than 
> they hinder, in my experience. :-)

I'm not yet using DNSBLs in SA so I'm not sure what they are scoring at
right now.  I'm making my DNSBL calls from Sendmail itself.  However I'd
have to say to this to NOT give a single DNSBL check the ability to put a
message over the spam threshold by itself.  For example if a DNSBLs check 
on the OPM adds a 5 to a spam score then that is way too much IMHO.  Add a 
one and move on to the rest of the checks.  I plan on doing foreign 
country checks one of these days and I'm only going to add .5 or 1 to the 
score.  Ditto for the RFC Ignorant DNSBLS.  Just because ebay.com is 
RFC-ignorant doesn't mean I want to neccessarily block their mail. :-)

> > The only way negative scores make sense is if you have a meta-rule
> > that says "if this e-mail triggers four or more negative-weighted
> > rules, then reset all negative weights to zero."
> 
> Indeed.  I'm pretty sure that's the general approach they're taking 
> with 2.54--especially with respect to rules which cannot possibly 
> occur together in a single legitimate message.  The meta rules will 
> add a large *positive* score in such cases.

This is a very good idea.  I've never been a fan of negative scores
because of their potential for abuse.  I'd rather see carefully chosen 
positive scores.

Justin