Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The funny rules of SpamAssassin in 2023

updown.io

Post reply on HN
Print view View original

61–70 of 92 posts

Re: The funny rules of SpamAssassin in 2023

#61

Post by yabones »

op00to wrote: post #23
srmarm wrote: post #9

I've been using SpamAssassin for at least 15 years and it's sadly gotten less useful as the spam arms race has moved on. We regularly see people on here post about deliverability issues with Gmail/Outlook but the truth is that sender reputation is by far the biggest indicator of whether a message will be spam - these type of rules are just counting deckchairs on the titanic in comparison. And this plays into the stre…

I switched from GMail to a personal Microsoft 365 domain when Google decided they didn't want to give me free email/domain services anymore. 365 was cheaper. I got about 10x the amount of spam to my 365 Junk folder than I did to the Junk folder in GMail. I would spend 10 minutes a day going through the junk folder to pick out false positives. I woud have inexplicable issues with missing email with 365, where the root…

Microsoft's spam filter is fundamentally broken. It's been that way for decades. There's an entire cottage industry of snakeoil salesmen that want to sell in-line antispam gateways to bolt onto 365, and the worst part is that they have a very good reason to exist...

Re: The funny rules of SpamAssassin in 2023

#62

Post by jmyeet »

srmarm wrote: post #9

I've been using SpamAssassin for at least 15 years and it's sadly gotten less useful as the spam arms race has moved on. We regularly see people on here post about deliverability issues with Gmail/Outlook but the truth is that sender reputation is by far the biggest indicator of whether a message will be spam - these type of rules are just counting deckchairs on the titanic in comparison. And this plays into the stre…

> ... the truth is that sender reputation is by far the biggest indicator of whether a message will be spam

I couldn't agree with this more. I want people to remember this whenever the topic of decentralization or federation comes up. People see this as a technical problem. it's not. It's a political and organizational problem. Even with email, which is fully decentralized (other than the ICANN TLDs) running your own node still incredibly difficult. And those reasons aren't technical at all.

Re: The funny rules of SpamAssassin in 2023

#63

Post by creeble »

I tried using SpamAssassin (via Proxmox Mail Gateway, which makes it much easier to set up) to replace a Barracuda email appliance (it was destined to get a *6x* service price increase in 2024!), and after several months of trying to get the number of FPs down, I gave up.

The problem wasn't just the number of FPs (which were much higher than the 'Cuda) -- it was that they came from real people, who were often common senders. This is not corporate email, or anything that was even remotely spam (except as SA's crazy ruleset determined). These all required whitelisting, and it became a real chore for all my users to keep up with all the whitelisting.

So back to the Barracuda for another year. It lets a little more spam through, but virtually no FPs. I just couldn't make SA get the same performance, even with many tweaks to the weights and rulesets.

Re: The funny rules of SpamAssassin in 2023

#64

Post by JohnFen »

loloquwowndueo wrote: post #57
jwr wrote: post #36

I've been using SpamAssassin since, well, forever, in internet terms. My recent facepalm moment was when I noticed that E-mails from the Playdate developer forum (Playdate is a really cool tiny gaming console) land in my spam folder, because anything in the .date domain (and the forum uses play.date as the domain) is assumed to be "dating spam".

I have deny listed most of those new funny tld as it’s indeed a good indication of spam. Here the face palm should be playdate’s because they have realized their domain looks like a spam domain.

Yes, I do the same. It's very useful to me because there is no non-generic TLD that I would be getting legitimate email from, but it may not work well for people who do want to get emails from such TLDs.

Re: The funny rules of SpamAssassin in 2023

#65

Post by JohnFen »

acidburnNSA wrote: post #5
jeffbee wrote: post #3

Earlier quoted context omitted.

It is not and has never been a good classifier. If open AI fans want to contribute something of value to society, they would train a spam classifier on a large, manually-labeled corpus of mail, where the features include envelope data. That would get open source maybe 10% of the way to Gmail quality, or 100x better than SA.

FWIW I've been using SpamAssassin for over a decade personally (partly to avoid Google dependence), and it's been pretty darn good once I ran the Bayesian learning thing a few times many years ago. I get like 3-5 spams per week in my inbox. Do others really consider SA that bad?

I find SA works excellently, personally.

Re: The funny rules of SpamAssassin in 2023

#66

Post by jepler »

dugite-code wrote: post #15
CamperBob2 wrote: post #4

Earlier quoted context omitted.

Does SpamBayes still work?

The Python project that's clent side? Best of my knowledge it hasn't been updated in years, spamassasin's in built Bayesian classifier works just fine.

I still used spambayes up until I basically abandoned my self-hosted e-mail setup (in favor of an @gmail).

It occurred to me recently that LLM-style tokenization + bayesian classification would be a sweet upgrade for spambayes, which always struggled with ad-hoc tokenization rules.

(I don't think of it as "client side"; it was integrated with my system via procmail on what I'd call the "server side". You could use it in other ways, including as an Outlook plugin, way back in the day. Or it could connect to an IMAP mailbox and filter messages it found, etc. Really versatile tool for its time)

Re: The funny rules of SpamAssassin in 2023

#67

Post by JohnFen »

notatoad wrote: post #17
acidburnNSA wrote: post #5

Earlier quoted context omitted.

FWIW I've been using SpamAssassin for over a decade personally (partly to avoid Google dependence), and it's been pretty darn good once I ran the Bayesian learning thing a few times many years ago. I get like 3-5 spams per week in my inbox. Do others really consider SA that bad?

> I get like 3-5 spams per week in my inbox I'm more curious about the opposite metric: how many non-spam emails a week arent getting delivered to you? Because that seems to be the real flaw in spamassassin: the false positive rate. And the spamassassin users don't usually have much visibility into this, so when emails don't get to them they just blame the sender.

> how many non-spam emails a week arent getting delivered to you?

My false-positive rate is very low, maybe a couple per month. However, I can predict with a high degree of accuracy when a piece of email is likely to land in the spam folder. Things like confirmation emails, registration emails, etc. are guaranteed to land in the spam folder. It's pretty hard for any system to accommodate those without allowing spam to get by.

That's fine by me, though, because I know when to check my spam folder.

Re: The funny rules of SpamAssassin in 2023

#68

Post by andrewf »

layer8 wrote: post #53
thesuitonym wrote: post #24

Earlier quoted context omitted.

I hope against hope that AI spam detection never becomes a thing. At least with today's methods, I can tell a person why their message was marked as spam. If AI detection becomes the norm, all I can do is shrug and say, "Sorry, it's the algorithm."

SpamAssassin has a Bayes filter that you can train with ham and spam. This has basically been a thing since forever.

"A plan for Spam" (2002) - https://paulgraham.com/spam.html

Re: The funny rules of SpamAssassin in 2023

#69

Post by creeble »

jeffbee wrote: post #3
lloydatkinson wrote: post #2

Some of those highlighted rules, such as using CC or having the string “can help” being used to decide if something is spam or not is so absurd I’ll make sure to never use SpamAssasin.

It is not and has never been a good classifier. If open AI fans want to contribute something of value to society, they would train a spam classifier on a large, manually-labeled corpus of mail, where the features include envelope data. That would get open source maybe 10% of the way to Gmail quality, or 100x better than SA.

I find it far more likely that AI will be used (indeed, is used already) to generate spam, rather than filter it.

Re: The funny rules of SpamAssassin in 2023

#70

Post by 8organicbits »

Mailtemi wrote: post #56
ceejayoz wrote: post #48

Earlier quoted context omitted.

I get plenty of spam from Gmail accounts with SPF and DKIM passing.

I've got sometimes a legitimate Google or MS dev newsletter emails going into their own spam folders :) .

I've seen mail from my work Google Workspace that I sent to my own personal Gmail get flagged as spam. It's me sending to me. Google to Google. Logged into both account on the same computer.

If anything I'm nervous to recommend Google because they flag too many legitimate emails as spam. After years of not checking, I'm checking spam again.

Post reply on HN