[conspire] SpamAssassin and BAYES_99

[Don Marti]

On 01/14/2018 08:06 AM, Nick Moffitt wrote:
> I took the same rough theory and chucked BAYES_99 up to 9.0 at some
> point and never looked back. But I also have a sort of 
> communally-trained bayesian db shared across my users: 1. The act of 
> replying to or saving a message within mutt on frotz.zork.net trains 
> the message as non-spam. 2. Disused or deliberately spam-trappy 
> addresses go into an inbox that is automatically trained as spam.

All right, I'll bump it up to 4.5 and see how it goes. As I get these 
settings dialed in I will also bring down the reject threshold for 
spamass-milter.

I think I am doing something similar to your Bayesian plan.  The shared 
Bayes db gets updated by a cron job that

  * trains all mail that the user has moved to a folder (including 
Trash) as legit

  * trains all mail that the user has moved to Junk or Spam folders as spam

  * trains all the new mail to the spamtrap account as spam

  * removes old mail from the spamtrap account.

> It's kind of funny that I originally had to actually argue with users 
> never to reply to spam. It's been a while, but over a decade ago it 
> was still some people's instinct to try appealing to spammers to stop 
> sending them things.

My approach to the problem of user mail habits is to raise new users 
from the ground up; so far this is somewhat time-consuming but resulting 
in good basic mail decisions. Because the other experienced user here is 
familiar with Thunderbird, we're using that as a first MUA (so I'm 
practicing with it as well -- please excuse any weird formatting).

> The auto-training addresses only get better with time. Every time I 
> see a bunch of backscatter horror coming from an address on my mail 
> server, I make it an alias to the "train on this as spam" bucket. 
> Usually within a day or so I see my personal spam filtering improve 
> measurably. If you ever hosted mailman mailing lists on your domain, 
> you may find lots of -owner and -bounces addresses being abused by 
> spammers who found your archives and think they're the cleverest bits 
> of code on the net. Thank them silently for their contribution!

I have a bunch of dedicated spamtrap addresses that have been been on 
various web pages and getting real spam for years, so using those.