On Tuesday, April 19, 2005, 2:35:37 AM, John Wilcock wrote:
John Wilcock wrote:
Logically the lower levels would have higher FP rates, but can be given lower SA scores (or equivalent weightings in other client apps)
For that matter, it occurs to me that it could actually be a *good* thing if an obscure but legitimate domain gets listed at the lower levels of a multi-level system due to being mentioned in a big spam run, as its presence would, albeit temporarily, be a sign of spamminess. This logic wouldn't apply for more commonly-mentioned legitimate domains, but those will be on the SURBL whitelist anyway.
I'm not favor of even intermittent listing of otherwise legitimate domains. Remember many of the FPs are innocent bystanders, like a stock spammer mentioning a legitimate investment site, a bank phish mentioning a legitimate bank, or a 419er mentioning some news story about their purported country, etc.
It's hard for me to think of a time when it would be a good idea to blacklist legitimate banks, etc. Most people don't want to miss ham from their banks, etc.
Obviously this only holds in the context of a weighted scoring system such as SpamAssassin, not one which excludes messages outright.
John.
Indeed.
Jeff C. -- "If it appears in hams, then don't list it."