Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The funny rules of SpamAssassin in 2023

updown.io

Post reply on HN
Print view View original

11–20 of 92 posts

Re: The funny rules of SpamAssassin in 2023

#11

Post by acidburnNSA »

brokensegue wrote: post #8
acidburnNSA wrote: post #5

Earlier quoted context omitted.

FWIW I've been using SpamAssassin for over a decade personally (partly to avoid Google dependence), and it's been pretty darn good once I ran the Bayesian learning thing a few times many years ago. I get like 3-5 spams per week in my inbox. Do others really consider SA that bad?

On Gmail I get maybe 1 spam a month max in my inbox (and it blocks many per day)

That's pretty good. I have no doubt that Gmail spam protection is better than my self-hosted SA protection. For me, independence from a somewhat suspicious large company for something as important as e-mail is worth it.

Re: The funny rules of SpamAssassin in 2023

#12

Post by andrewfromx »

srmarm wrote: post #9

I've been using SpamAssassin for at least 15 years and it's sadly gotten less useful as the spam arms race has moved on. We regularly see people on here post about deliverability issues with Gmail/Outlook but the truth is that sender reputation is by far the biggest indicator of whether a message will be spam - these type of rules are just counting deckchairs on the titanic in comparison. And this plays into the stre…

there needs to be like a mozillia vs chrome thing here no? What's the best try so far for something like letsencrypt or mozilla foundation for not owned by big tech email so "will consider a move to office365 or Google Workspace for their mail" the sender has this other awesome option?

Re: The funny rules of SpamAssassin in 2023

#13

Post by jeffbee »

jerf wrote: post #6
jeffbee wrote: post #3

Earlier quoted context omitted.

It is not and has never been a good classifier. If open AI fans want to contribute something of value to society, they would train a spam classifier on a large, manually-labeled corpus of mail, where the features include envelope data. That would get open source maybe 10% of the way to Gmail quality, or 100x better than SA.

We'll get there eventually, but it will be a bit. Spam classification at scale is already a compute-bound, or at least compute-starved, operation. Spam classification systems already do what they can to avoid so much as invoking a virus scanner if they can avoid it, because at scale it's so expensive. LLM-based spam classification is another order of magnitude more expensive and would require hardware that current sp…

It doesn't need to be computationally costly because, as you seem to imply, there are tiers of cost tradeoffs. You can invoke a very cheap classifier at SMTP time, that is biased to have few false positives, that will temporarily reject all that which is highly likely to be spam. You can do this without even glancing at the body. Of course, having signals about peer reputation is the strong suit of Gmail or Microsoft, and the distributed, open community would need to solve the problem of promptly updating and distributing such reputation signals. And by "promptly" I mean within seconds of the leading edge of an attack.

Then there are increasing tiers of cost that you would only run after it becomes likely that the message is acceptable. As you say, you would only run an antivirus on a message on the verge of delivery, because decoding the attachment and running the AV (in an expensive sandbox) is so costly.

Re: The funny rules of SpamAssassin in 2023

#14

Post by dugite-code »

acidburnNSA wrote: post #11
brokensegue wrote: post #8

Earlier quoted context omitted.

On Gmail I get maybe 1 spam a month max in my inbox (and it blocks many per day)

That's pretty good. I have no doubt that Gmail spam protection is better than my self-hosted SA protection. For me, independence from a somewhat suspicious large company for something as important as e-mail is worth it.

I have a gmail honeypot where I fetchmail junk email straight to my junk folder and have a scheduled sa-learn cronjob. Ever since I started this I essentially stopped getting junk email in my selfhosted inbox.

I also have dovecot set to learn Ham every time I file an email from the inbox to a folder for good measure.

Re: The funny rules of SpamAssassin in 2023

#15

Post by dugite-code »

CamperBob2 wrote: post #4
jeffbee wrote: post #3

Earlier quoted context omitted.

It is not and has never been a good classifier. If open AI fans want to contribute something of value to society, they would train a spam classifier on a large, manually-labeled corpus of mail, where the features include envelope data. That would get open source maybe 10% of the way to Gmail quality, or 100x better than SA.

Does SpamBayes still work?

The Python project that's clent side? Best of my knowledge it hasn't been updated in years, spamassasin's in built Bayesian classifier works just fine.

Re: The funny rules of SpamAssassin in 2023

#16

Post by BSDobelix »

srmarm wrote: post #9

I've been using SpamAssassin for at least 15 years and it's sadly gotten less useful as the spam arms race has moved on. We regularly see people on here post about deliverability issues with Gmail/Outlook but the truth is that sender reputation is by far the biggest indicator of whether a message will be spam - these type of rules are just counting deckchairs on the titanic in comparison. And this plays into the stre…

I like rspamd much more (performance and redis) than SpamAssassin, and as you mentioned:

-https://www.mail-tester.com

-https://www.learndmarc.com

-https://mecsa.jrc.ec.europa.eu/en/

Are exellent tool's to check your "deliverability".

Re: The funny rules of SpamAssassin in 2023

#17

Post by notatoad »

acidburnNSA wrote: post #5
jeffbee wrote: post #3

Earlier quoted context omitted.

It is not and has never been a good classifier. If open AI fans want to contribute something of value to society, they would train a spam classifier on a large, manually-labeled corpus of mail, where the features include envelope data. That would get open source maybe 10% of the way to Gmail quality, or 100x better than SA.

FWIW I've been using SpamAssassin for over a decade personally (partly to avoid Google dependence), and it's been pretty darn good once I ran the Bayesian learning thing a few times many years ago. I get like 3-5 spams per week in my inbox. Do others really consider SA that bad?

> I get like 3-5 spams per week in my inbox

I'm more curious about the opposite metric: how many non-spam emails a week arent getting delivered to you? Because that seems to be the real flaw in spamassassin: the false positive rate.

And the spamassassin users don't usually have much visibility into this, so when emails don't get to them they just blame the sender.

Re: The funny rules of SpamAssassin in 2023

#18

Post by Retric »

srmarm wrote: post #9

I've been using SpamAssassin for at least 15 years and it's sadly gotten less useful as the spam arms race has moved on. We regularly see people on here post about deliverability issues with Gmail/Outlook but the truth is that sender reputation is by far the biggest indicator of whether a message will be spam - these type of rules are just counting deckchairs on the titanic in comparison. And this plays into the stre…

Reputation works well because of those other rules. If every office365/gmail email got through and everything lose was blocked spammers would just move to those platforms. Thus email inspection is a critical component enabling reputation based filtering.

Re: The funny rules of SpamAssassin in 2023

#19

Post by jeffbee »

andrewfromx wrote: post #12
srmarm wrote: post #9

I've been using SpamAssassin for at least 15 years and it's sadly gotten less useful as the spam arms race has moved on. We regularly see people on here post about deliverability issues with Gmail/Outlook but the truth is that sender reputation is by far the biggest indicator of whether a message will be spam - these type of rules are just counting deckchairs on the titanic in comparison. And this plays into the stre…

there needs to be like a mozillia vs chrome thing here no? What's the best try so far for something like letsencrypt or mozilla foundation for not owned by big tech email so "will consider a move to office365 or Google Workspace for their mail" the sender has this other awesome option?

If you wanted to operate a haven for independent email hosting, where you want to assure deliverability in the face of Gmail's sender reputation system, you would need to classify your outbound traffic, and have a death penalty for spammers. If you tolerate any activity that peers classify as spam, that would tank your reputation.

Re: The funny rules of SpamAssassin in 2023

#20

Post by rlpb »

srmarm wrote: post #9

I've been using SpamAssassin for at least 15 years and it's sadly gotten less useful as the spam arms race has moved on. We regularly see people on here post about deliverability issues with Gmail/Outlook but the truth is that sender reputation is by far the biggest indicator of whether a message will be spam - these type of rules are just counting deckchairs on the titanic in comparison. And this plays into the stre…

> It's a bonus to them that every time they block a smaller host there is a good chance that sender will consider a move to office365 or Google Workspace for their mail.

The irony is that a substantial amount of the spam I receive comes from those platforms.

Post reply on HN