Trainable spam filter ready for beta testing

[carverrn]

Originally posted by jbonet
Before DSPAM, I used an extensive blacklist and a number of filters which would delete messages which satisfied certain tests. That got rid of about half of my SPAM, which I never got to see, not even in my SPAM folder. Right now, while DSPAM is in training, my blacklist is empty (I saved a backup with Carver's Edit Blacklist bookmarklet), and my anti-SPAM filters are deactivated. After I feel that DSPAM has been trained sufficiently, I will restore my blacklist. As for the filters, I will have to reactivate them and give them a higher priority (more negative than -2) so they will catch the SPAM before DSPAM puts it into the SPAM folder.

Blacklists typically won't do much good for blocking spam because most spam won't have valid "From" addresses. It can even cause problems if you block by domain instead of by specific addresses because you might find out later its blocking mail you really want.

Originally posted by jbonet
Examples of anti-SPAM filters:
Subject contains Paris Hilton
Subject contains singles
Subject contains mortgage
From contains offer
From contains saver
Subject contains deep in debt
From contains bargains
From contains Great Deals
etc.

Messages satisfying any of these conditions can be deleted, so they won't show up, not even in the SPAM or Trash folders. That's what I mean by automatic deletion.

I see.

So it might make things easier if you had a link like "Make Filter" that creates a filter template based on the contents of the message?


Regards,
Rich

[50ftQueenie]

Glad to take part in this testing, thanks!

So I begin to start off with a question. I had one false-positive that was initially directed to my Trash folder (that I use as my SPAM folder) because of the SA SPAM score, but moved it from there to another folder.

Then I turned on DSpam and went to the folder the false-positive was in to report it as 'Not Spam'. After doing so the false-postive was mysteriously gone, but I found out that it appeared to be in my Inbox. Just wondering if this is always the case once you correct a false-positive in a folder other than the SPAM folder.

50ftQ.

[jbonet]

Originally posted by carverrn
Blacklists typically won't do much good for blocking spam because most spam won't have valid "From" addresses. It can even cause problems if you block by domain instead of by specific addresses because you might find out later its blocking mail you really want.

I'm well aware of that, and I'm very careful about adding to my blacklist.

So it might make things easier if you had a link like "Make Filter" that creates a filter template based on the contents of the message?

Yes, that would be very useful.

[carverrn]

Yes.

In the "spam folder" (the one you specified) you have a link that says "Not Spam". If you click on that it tells DSPAM that the message was incorrectly identified as spam and it also moves the message to your Inbox.

In every other folder you will have a link that says "Report Spam". If you click on this it tells DSPAM that the message was incorrectly identified as not being spam and it also moves the message to your "spam folder" (the one you specified).

Rich

[jbonet]

I understand that SpamAssassin operates at a priority of -2, and that DSPAM operates at a priority of -1 (please correct me if I'm wrong).

If I create a filter with priority -2, will it run before or after SA adds its headers (and puts the message in the SPAM folder if the score is 5 or more)?

If I create a filter with priority -1, will it run before or after DSPAM adds its headers and decides whether to put the message in the SPAM folder?

For example, suppose I decide that I want to delete messages witth a SA score of 8 or more, without ever seeing them, not even in my SPAM or Trash folder. What priority should the filter have?

[jbonet]

I would love to have a button that would show me my statistics for the last week.

What difference does it make whether I mark "Reject if possible"?

[trond]

Originally posted by jbonet
I understand that SpamAssassin operates at a priority of -2, and that DSPAM operates at a priority of -1 (please correct me if I'm wrong).

First of all "priority" is a confusing term here. You expect something with the higest priority to be taken care of first, but the filter with the lowest number is checked first. We call it "order" on the filter page.

Both DSpam and SpamAssassin has the order "-1".

If I create a filter with priority -2, will it run before or after SA adds its headers (and puts the message in the SPAM folder if the score is 5 or more)?

Well, this is actually two operations.

SpamAssassin (and Dspam) is run by the mailserver, so if you have turned on spamchecking, it will always be sent through SA and possibly Dspam. This is where the headers are added.

Then, when it's time to deliver the mail in your mailbox, the mailserver looks at your filter file, and processes each rule in turn. Every rule is basically of the form "if header X contains string then do something"

"something" is usually to save the mail in a folder, but it can be pretty much any action the the mail server supports.

If I create a filter with priority -1, will it run before or after DSPAM adds its headers and decides whether to put the message in the SPAM folder?

That's a bit unpredictable. When two filters have the same order, the filter with the lowest ID in the database will be listed first. IDs are autogenerated, so normally the filter that was added last has the higher ID. Occationally, that seems to not be the case - at least in the messages tables, so it's possible that the database decides to recycle IDs every now and then. Then there's the issue that if you turn off spam filtering, that filter is removed from the database. It'll obviously be reinserted when you turn it back on, but now it'll have a new ID. And that effectivly changes the order of your filters.

It's better to choose different order-levels for filters you want to be executed in a certain order

For example, suppose I decide that I want to delete messages witth a SA score of 8 or more, without ever seeing them, not even in my SPAM or Trash folder. What priority should the filter have?

-2 or less

[trond]

[quote]Originally posted by jbonet
I would love to have a button that would show me my statistics for the last week.
[quote]

I'm searching for a place to put it

What difference does it make whether I mark "Reject if possible"?

It will mean that mails that SpamAssassin thinks is spam will be rejected by the mailserver (as long as all the runbox-recipents of that particular mail has turned on "reject if possible"), so it never reaches your inbox or spamfolder - or even Dspam.

The effect for Dspam is that it sees fewer of your spams, so it'll take it longer to learn properly. But, after you feel it's sufficiently effective, it's definately better to turn on "reject if possible" again.

[jbs]

Originally posted by trond
...Both DSpam and SpamAssassin has the order "-1".


...
jbonet: For example, suppose I decide that I want to delete messages witth a SA score of 8 or more, without ever seeing them, not even in my SPAM or Trash folder. What priority should the filter have?

trond:
-2 or less

Just to make sure I understand this process . . . (correct me if I'm wrong here, Trond). The headers themselves are added as soon as the mail arrives at the mail server (before even a filter with order -99 (the earliest possible filter placement). When you say DSpam and SA both have the order -1, you mean taking ACTION on the headers, not placement of the headers, right?

Otherwise there would be no tags to act on in filter position -2 if the first SA saw of a message was at -1.

--Jason

[carverrn]

Correct Jason. The headers are added when the mails are checked on arrival at the server. They are "filtered" to the "spam" folders later when the filters are processed.

Rich

[imants]

Ok, so I've been trying this DSPAM for about close to a week now, and I have two things

1) This only happened once, and I don't know if it was an isolated incident, but since it's in beta, it doesn't hurt to share. I flagged a few messages as spam, and waited a few moments and nothing was happening (I have broadband connection). For whatever reason, I decided to close my browser that I was using (Mozilla), and reopened it and logged back into runbox. In my Inbox were the messages that I had flagged as spam, complete with the "*SPAM*" text that gets automatically added to the subject line. So, somehow, the messages were flagged as spam, but they weren't moved to my Spam folder. Like I said, it only happened once and didn't really bother me or anything, but I figured I'd share.

2) I recieve about 100 spam messages (give or take) in any given 24 hour period. So I have had the opportunity to flag quite a number of messages as spam. So far, I haven't had any false positives, but I still get a number of false negatives (maybe about 2 per hour). Is this normal? I know that if I don't correct false positives, dspam's accuracy goes down, but if I haven't had any, are there any measures that I can take to increase dspam's accuracy?

thanks

Imants

[JeffK]

Most of the spam I get (in a known spam magnet alias enabled by Liz at my request) does not appear to be marked by DSPAM in spite of reporting several (at least seventy) of these emails as spam. I am wondering why this is so.

Jeff

[jbonet]

I haven't received any false positives during the last week. That's great.

I wish Trond would give us a link to see our SPAM statistics for the past week. He might put it in the Filters page, or just list it there. It could be something like the report Trond posted here.

This would fit in the blank space at the right of the "Unwanted email protection" section at the top of the Filters page.

[jbonet]

Trond, how about an explanation as to what the DSPAM headers mean?

[JeffK]

Originally posted by JeffK
Most of the spam I get (in a known spam magnet alias enabled by Liz at my request) does not appear to be marked by DSPAM in spite of reporting several (at least seventy) of these emails as spam. I am wondering why this is so.

Jeff

I'm wondering if trond or Liz see this they might be able to explain what is happening, please.

Jeff