Mods to Fuz2 seem to make it less effective

Vernon Schryver vjs@calcite.rhyolite.com
Fri Mar 7 17:56:25 UTC 2003


> From: Tim Wicinski <tim@meer.net>

> Your informants are, as usual, correct. However, lowering the bulk 
> numbers have been something we tried and were unsuccessful in, due to 
> the number of legitimate bounces.
>
> Also, when we process the spam we do receive, I always check via 
> 'dccproc -H' the bulk numbers before tagging as 'many'.  They usually do 
> not have a high enough number to warrant lowering the value.
> ...

I think one must not assume that a message with DCC counts of "many"
is more "bulky" than a message with counts of 10.  "Many" only means
"definitely 'bulk' according to one or more reporters."   

To put it another way, you did not get false positives from the DCC
when you lowered the thresholds, because a message with a count of 50
or 100 is no less "bulk" mail than a message with a count of "many."
Instead, you got false positives from the system that determines
"unsolicited," your whitelists.

I realize that building whitelists is hard for organizations with many
users.  Perhaps dccm and dccifd need two sets of thresholds, one for
users without per-user whitelists and other set of much lower thesholds
for users with individual whitelists.  What do you (plural) think?


Vernon Schryver    vjs@rhyolite.com



More information about the DCC mailing list

Contact vjs@rhyolite.com by mail or use the form.