DCC -- how do I effectively use it?

On Sun, Sep 02, 2001 at 04:38:47PM -0700, Mediratta, Bharat wrote:
> 
> Howdy.  I'm working on a personal anti-spam project that I'd like
> to eventually distribute freely (probably under GPL).  It is a 
> thin IMAP client that can monitor a mailbox, detect any new
> spam and move it to a separate spam mailbox.

Interesting.

> It currently uses
> DCC as the arbiter for spamminess.  The code is operational and
> probably worthy of being shipped as a beta.  However, it's not as 
> effective as I would have hoped.

Probably is as effective as it is going to be for the time being.

> My problem is that I'm not getting very many positive hits from 
> DCC.  I know that I'm connected to DCC properly because it does
> identify certain spam messages correctly, but unfortunately it
> misses a large percentage of them.

The database/userbase is just not large enough yet.

> I ran it against a folder 
> containing spam detected with spambouncer and other tools and
> in some (admittedly) small trials it had about a 25% hit rate.

That would seem about right right now.

> Perhaps I'm using DCC incorrectly?

Well, if you are getting some >1 counts then you are most likely using
it correctly.

> Since I'm in development, I've 
> been using dcc.rhyolite.com in anonymous mode.  I hope that I'm not 
> imposing too much of a load there.  My script calls dccproc, passes 
> in the message and parses the results.

Will you also support a mode of operation where the MTA has already
"dcc"ed the message and put it's (DCC's) header in the message?  i.e.
simply parse the IMAP INBOX for messages with existing DCC headers
with values of n>1 where n is some configurable values (rather than
using dccproc on the messages)?

> Most of my results indicate
> that DCC has never seen the message before (ie, I get counts of
> 1 for all of the metrics).

Critical mass is not there yet.  Be patient.  Spread the word.  The
more users DCC has the more effective it's going to be.

b.

-- 
Brian J. Murrell