Live data from Hacker News

The funny rules of SpamAssassin in 2023

updown.io

31–40 of 92 posts

Re: The funny rules of SpamAssassin in 2023

#31
post #9

I've been using SpamAssassin for at least 15 years and it's sadly gotten less useful as the spam arms race has moved on. We regularly see people on here post about deliverability issues with Gmail/Outlook but the truth is that sender reputation is by far the biggest indicator of whether a message will be spam - these type of rules are just counting deckchairs on the titanic in comparison. And this plays into the stre…

I like rspamd much more (performance and redis) than SpamAssassin, and as you mentioned: - https://www.mail-tester.com - https://www.learndmarc.com - https://mecsa.jrc.ec.europa.eu/en/ Are exellent tool's to check your "deliverability".

Suprised to not see https://mxtoolbox.com in this list too

Re: The funny rules of SpamAssassin in 2023

#32
post #25

Earlier quoted context omitted.

FWIW I've been using SpamAssassin for over a decade personally (partly to avoid Google dependence), and it's been pretty darn good once I ran the Bayesian learning thing a few times many years ago. I get like 3-5 spams per week in my inbox. Do others really consider SA that bad?

FastMail uses SpamAssassin, and I get less than one spam emails in my inbox a month, with essentially zero false positives (which is the tricky bit where gmail seems to fail – I'd rather have the occasional spam in my email than false positives). In short: you can probably do better than 3-5 spams per week with SA. The big problem is the entire thing is a beast to configure with all the documentation of a Babylonian…

I hate to agree here, but configuring SpamAssassin is pretty rough. That being said, once its done, its pretty bulletproof and doesnt usually require messing with it all the time.

Re: The funny rules of SpamAssassin in 2023

#33
post #3

Some of those highlighted rules, such as using CC or having the string “can help” being used to decide if something is spam or not is so absurd I’ll make sure to never use SpamAssasin.

It is not and has never been a good classifier. If open AI fans want to contribute something of value to society, they would train a spam classifier on a large, manually-labeled corpus of mail, where the features include envelope data. That would get open source maybe 10% of the way to Gmail quality, or 100x better than SA.

Correct, Spamassassin will not classify emails be default. But it does include a Bayesian classifier and tooling that can be used to train it with curated ham and spam emails. It does require extra steps to set this up and feed it selected maildirs (for example, exclude inbox, spam and trash for training ham).

https://spamassassin.apache.org/full/3.0.x/dist/doc/sa-learn... https://cwiki.apache.org/confluence/display/spamassassin/Bay...

Re: The funny rules of SpamAssassin in 2023

#34
post #9

I've been using SpamAssassin for at least 15 years and it's sadly gotten less useful as the spam arms race has moved on. We regularly see people on here post about deliverability issues with Gmail/Outlook but the truth is that sender reputation is by far the biggest indicator of whether a message will be spam - these type of rules are just counting deckchairs on the titanic in comparison. And this plays into the stre…

> As an aside, not sure if OP is related to them but updown.io is a nice service and I appreciate the simple PAYG pricing! For what it's worth their mails seem to get through successfully to me too.

Not related in any way except as an happy customer. They added a blog recently and this article caught my eye because of the nightmare that is mail delivery issue for everyone.

I found it particularly ironic that you now have to think like a spammer (i.e. look at spam detection engine source code to find a way to circumvent their heuristics) in order to get your totally valid email delivered (^_^).

edit: typo

Re: The funny rules of SpamAssassin in 2023

#35
post #3

Earlier quoted context omitted.

It is not and has never been a good classifier. If open AI fans want to contribute something of value to society, they would train a spam classifier on a large, manually-labeled corpus of mail, where the features include envelope data. That would get open source maybe 10% of the way to Gmail quality, or 100x better than SA.

I hope against hope that AI spam detection never becomes a thing. At least with today's methods, I can tell a person why their message was marked as spam. If AI detection becomes the norm, all I can do is shrug and say, "Sorry, it's the algorithm."

How do you think SpamAssassin/gmail/outlook created their spam rules?

Re: The funny rules of SpamAssassin in 2023

#36
I've been using SpamAssassin since, well, forever, in internet terms. My recent facepalm moment was when I noticed that E-mails from the Playdate developer forum (Playdate is a really cool tiny gaming console) land in my spam folder, because anything in the .date domain (and the forum uses play.date as the domain) is assumed to be "dating spam".

Re: The funny rules of SpamAssassin in 2023

#37

Earlier quoted context omitted.

FWIW I've been using SpamAssassin for over a decade personally (partly to avoid Google dependence), and it's been pretty darn good once I ran the Bayesian learning thing a few times many years ago. I get like 3-5 spams per week in my inbox. Do others really consider SA that bad?

On Gmail I get maybe 1 spam a month max in my inbox (and it blocks many per day)

So...statistically insignificant difference from SA for most mail users.

Re: The funny rules of SpamAssassin in 2023

#38

Having the rules public seems to take away most of the benefits... Any smart spammer will just tweak his spam to not hit these rules... And if he hasn't, it's because the vast majority of people don't use SpamAssassin

> Any smart spammer will just...

Spam is all about high-volume/~no-cost delivery of crap. Time spent tweaking the spam - to evade $Defense_1, $Defense_2, etc. - is added cost. Especially if $Defense_n is only used by a few of the prospective victims (folks too savvy or paranoid to be suckered do not count), then tweaking to get around $Defense_n is a losing strategy for the spammer.

Re: The funny rules of SpamAssassin in 2023

#39
post #20
post #9

I've been using SpamAssassin for at least 15 years and it's sadly gotten less useful as the spam arms race has moved on. We regularly see people on here post about deliverability issues with Gmail/Outlook but the truth is that sender reputation is by far the biggest indicator of whether a message will be spam - these type of rules are just counting deckchairs on the titanic in comparison. And this plays into the stre…

> It's a bonus to them that every time they block a smaller host there is a good chance that sender will consider a move to office365 or Google Workspace for their mail. The irony is that a substantial amount of the spam I receive comes from those platforms.

Are you certain the spam is actually coming from IP addresses controlled by those platforms? It's common for spammers to fake the SMTP headers.

Re: The funny rules of SpamAssassin in 2023

#40
post #39
post #20

Earlier quoted context omitted.

> It's a bonus to them that every time they block a smaller host there is a good chance that sender will consider a move to office365 or Google Workspace for their mail. The irony is that a substantial amount of the spam I receive comes from those platforms.

Are you certain the spam is actually coming from IP addresses controlled by those platforms? It's common for spammers to fake the SMTP headers.

Quite a bit is "genuine", at least with Gmail, because infinite monkeys can sign up for infinite accounts.
Post reply on HN