documentation confusing?

On Fri, 27 Feb 2004, Chip Paswater wrote:

> I think my trap would still be of value to you.  I'm noticing that nearly
> half of the trapped messages don't get flagged by DCC (I use Spamassassin).
>
> If you really don't want my submissions, I won't send them.  But until we
> start seeing a 90% hitrate of spam on DCC servers, aren't the more spam
> submissions the merrier?

With 40,000,000 checksum submissions per day, I imagine that the DCC
servers are probably seeing nearly every spam sent on the entire 'net.

And by "seeing", I mean the human-readable content of the message. What I
suspect is happening, if 50% of your messages are not being flagged, is
that the personalizations in the email are eluding the fuzzy checksums.

For me, the fuzzy checksums stopped being effective months ago.  I was
waking up to 20 mortgage spams every morning, each having Fuz2=1.  Other
mailboxes that I also use DCC with also got the same spams, and again,
Fuz2=1.

Fortunately, I turned on greylisting, and it's been my biggest victory
against spam to date.  I've had three false negatives (out of 300/day or
so) in the past one to two months (combined with SpamAssassin and regular
DCC).  Two of those were nigerian spams from the same ISP (one of the more
notorious ones), and one was from a compromised formmail script.

So my advice to you is, don't bother reporting your checksums because it
won't help.

-Chris