martinh@solidstatelogic.com ("Martin.Hepworth") writes:

> Greg
> Never found awl much good in a multi-user setup. Seems very variable - works For some, not for others.
>
> I get wayoo many false negatives with it as the spammers use the
> same 'from' quite a few times, so the address makes it io the awl
> db.

The AWL seems to be a rather frequent source of email.

There is only one wee little problem with AWL. The problem is the
score chosen for AWL. The score is computed in AWL.pm as

$delta = ($meanscore - $awlpoints) * $pms->{main}->{conf}->{auto_whitelist_factor};

This default score means that scores will be pushed toward the mean
of previous email messages from the same sender. I think this is
backwards. The goal is to use the information from previously
processed email messages to tell if the current message is spam or
ham. The goal should not be to make the current message be like
messages received in the past.

So, I think the AWL score should be computed as a percentage of the
previous score:

$delta = ($meanscore) * $pms->{main}->{conf}->{auto_whitelist_factor};

With this change AWL acts like a whitelist rather than a random number
generator. Known hammy senders will get negative awl scores. The
(very few) known spammy senders will get a positive awl score. Most
spam is used with random email addresses, so AWL rarely hits on spam.

Anyway, both behaviors could be accommodated by adding a 0/1 flag like
auto_whitelist_regress. Then the delta score could be computed as:

$delta = ($meanscore - $pms->{main}->{conf}->{auto_whitelist_regress}*$awlpoints) * $pms->{main}->{conf}->{auto_whitelist_factor};

Setting auto_whitelist_regress to 1 would get the current (wrong)
behavior, and setting auto_whitelist_regress to 0 would get the
behavior I think is correct.
-jeff



> Ymmv as they say.
> --
> martin
>
> -----Original Message-----
> From: Greg Troxel
> Sent: Friday, May 30, 2008 9:22 PM
> To: users@spamassassin.apache.org
> Subject: AWL aging?
>
> I have recently understood AWL better, and am wondering if there should
> be some minimum number of entries before AWL is applied. I often get
> spam that doesn't score that high due to being a fresh relay. If I
> rescore it with '|spamassassin -t' after a few days, often it's on
> blacklists and scores a lot higher, but is pulled down by AWL.
>
> So, I wonder if a rule that said 'AWL is only applied if there are >=5
> scores in the average' would avoid giving credit for spam that arrived
> when it wasn't classified as high as it should be now.