Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The funny rules of SpamAssassin in 2023

updown.io

Post reply on HN
Print view View original

21–30 of 92 posts

Re: The funny rules of SpamAssassin in 2023

#21

Post by dugite-code »

jeffbee wrote: post #3
lloydatkinson wrote: post #2

Some of those highlighted rules, such as using CC or having the string “can help” being used to decide if something is spam or not is so absurd I’ll make sure to never use SpamAssasin.

It is not and has never been a good classifier. If open AI fans want to contribute something of value to society, they would train a spam classifier on a large, manually-labeled corpus of mail, where the features include envelope data. That would get open source maybe 10% of the way to Gmail quality, or 100x better than SA.

Really any of the open source language models might work well enough for the job. If you could manage to get a classifier that runs with tensorflow to take advantage of a coral tpu it would certainly be a major step up with managable performance.

Re: The funny rules of SpamAssassin in 2023

#22

Post by throw0101d »

lloydatkinson wrote: post #2

Some of those highlighted rules, such as using CC or having the string “can help” being used to decide if something is spam or not is so absurd I’ll make sure to never use SpamAssasin.

> being used to decide if something is spam or not

Each rule has a score associated with it. By default a message needs to reach 5.0 to be marked as "spam":

* https://spamassassin.apache.org/full/3.0.x/dist/doc/Mail_Spa...

The threshold is configurable. An header is added post-processing, e.g.:

    X-Spam-Status: Yes, score=21.6 required=4.0 […]
* https://cwiki.apache.org/confluence/display/SPAMASSASSIN/X+S...

One can then choose what do to with this information (via procmail or Sieve). There is another header as well:

> X-Spam-Level: This displays your spam level with asterisks, with one asterisk displayed per point, rounded down. For example, if your overall SpamAssassin score is 4.3, it will display ****. If you score less than 1, for example, 0.5, it will display nothing.

* https://www.mailercheck.com/articles/spamassassin-score

Re: The funny rules of SpamAssassin in 2023

#23

Post by op00to »

srmarm wrote: post #9

I've been using SpamAssassin for at least 15 years and it's sadly gotten less useful as the spam arms race has moved on. We regularly see people on here post about deliverability issues with Gmail/Outlook but the truth is that sender reputation is by far the biggest indicator of whether a message will be spam - these type of rules are just counting deckchairs on the titanic in comparison. And this plays into the stre…

I switched from GMail to a personal Microsoft 365 domain when Google decided they didn't want to give me free email/domain services anymore. 365 was cheaper. I got about 10x the amount of spam to my 365 Junk folder than I did to the Junk folder in GMail. I would spend 10 minutes a day going through the junk folder to pick out false positives. I woud have inexplicable issues with missing email with 365, where the root cause was always SPF issues from a third party sender. The big issue was event tickets mailed from a third party ticket service provider using the venue's domain name rather than the ticket provider's domain.

I switched back to GMail a few months ago, and not only do I see less stuff in my Junk folder (indicating Google is blocking stuff rather than identifying it) but also I have not seen a single false positive. Hopefully that means Google is more effective, but there's no way to tell if I'm missing legitimate email. So far, no complaints.

Re: The funny rules of SpamAssassin in 2023

#24

Post by thesuitonym »

jeffbee wrote: post #3
lloydatkinson wrote: post #2

Some of those highlighted rules, such as using CC or having the string “can help” being used to decide if something is spam or not is so absurd I’ll make sure to never use SpamAssasin.

It is not and has never been a good classifier. If open AI fans want to contribute something of value to society, they would train a spam classifier on a large, manually-labeled corpus of mail, where the features include envelope data. That would get open source maybe 10% of the way to Gmail quality, or 100x better than SA.

I hope against hope that AI spam detection never becomes a thing. At least with today's methods, I can tell a person why their message was marked as spam. If AI detection becomes the norm, all I can do is shrug and say, "Sorry, it's the algorithm."

Re: The funny rules of SpamAssassin in 2023

#25

Post by arp242 »

acidburnNSA wrote: post #5
jeffbee wrote: post #3

Earlier quoted context omitted.

It is not and has never been a good classifier. If open AI fans want to contribute something of value to society, they would train a spam classifier on a large, manually-labeled corpus of mail, where the features include envelope data. That would get open source maybe 10% of the way to Gmail quality, or 100x better than SA.

FWIW I've been using SpamAssassin for over a decade personally (partly to avoid Google dependence), and it's been pretty darn good once I ran the Bayesian learning thing a few times many years ago. I get like 3-5 spams per week in my inbox. Do others really consider SA that bad?

FastMail uses SpamAssassin, and I get less than one spam emails in my inbox a month, with essentially zero false positives (which is the tricky bit where gmail seems to fail – I'd rather have the occasional spam in my email than false positives).

In short: you can probably do better than 3-5 spams per week with SA.

The big problem is the entire thing is a beast to configure with all the documentation of a Babylonian cuneiform stone tablet.

Re: The funny rules of SpamAssassin in 2023

#27

Post by uean »

I love the analysis. But I hate that the 'fixed' email ends up being wordier for no reason at all.

Brevity has value. Having to bloat content (an email to get past anti-spam; a cooking blog to rank better within Google SEO; ...) brings back memories of high-school english papers, or the modern equivalent ChatGPT.

Re: The funny rules of SpamAssassin in 2023

#28

Post by JohnFen »

srmarm wrote: post #9

I've been using SpamAssassin for at least 15 years and it's sadly gotten less useful as the spam arms race has moved on. We regularly see people on here post about deliverability issues with Gmail/Outlook but the truth is that sender reputation is by far the biggest indicator of whether a message will be spam - these type of rules are just counting deckchairs on the titanic in comparison. And this plays into the stre…

I've kinda given up on reputation scores to indicate spam/ham, personally, and rely more heavily on textual analysis rules. Going by "reputation" caused me far too many false positives.

Re: The funny rules of SpamAssassin in 2023

#29

Post by adrienjarthon »

londons_explore wrote: post #7

Having the rules public seems to take away most of the benefits... Any smart spammer will just tweak his spam to not hit these rules... And if he hasn't, it's because the vast majority of people don't use SpamAssassin

Hi, Adrien here author of this article (and of updown.io). That is true and I actually hesited to write the article for this reason, because it could make the spammer life easier. But after seing some of the legacy and nonsense in here I though it's still worth it so people at least understand what they are using.

Re: The funny rules of SpamAssassin in 2023

#30

Post by adrienjarthon »

uean wrote: post #27

I love the analysis. But I hate that the 'fixed' email ends up being wordier for no reason at all. Brevity has value. Having to bloat content (an email to get past anti-spam; a cooking blog to rank better within Google SEO; ...) brings back memories of high-school english papers, or the modern equivalent ChatGPT.

100% agree, I also hate that I had to do this.
Post reply on HN