Correcting poisoned Auto-Whitelist (AWL)

[mmorse]

someone's notes and modifications: http://mail-archives.apache.org/mod_mbox/spamassassin-dev/200501.mbox/<200501112307.j0BN7JhZ104226@opal.eng.sun.com>
yes with the <> on the url

Though it's from '05 so some stuff might already be incorporated in a newer script:

I found the check_whitelist tool very convenient for examining who had sent me mail and what scores they had earned. But I often found myself wanting
to study certain individuals and/or domains, and sometimes to use the same as --clean fodder. So I extended the script to understand the new options --addr and --domain.

I also found the output format a little too rigid for my taste, as I like to pipe the output to sort with k1n, k3n or k5n as an argument, but the '(' / ')' were sometimes interfering, and typing a long sed entry every time was a pain. So I altered the white-space a bit accordingly.

[rfoster]

I could use this functionality (see below) to correct one spammer's AWL scores (which are very negative and completely counter-acting all the good done by spamassassin). Unfortunately, the spamassassin executable doesn't seem to be available in the Zimbra installation. I probably am just missing something silly.

Originally Posted by mmorse

While you did say you had a bunch, if you ever wanted to do it for one address it's like:
spamassassin --remove-addr-from-whitelist user@domain.com
(Remove the named email address from the automatic whitelist)

[mmorse]

Ya I never got that particular syntax to do anything usefull, but did you see:
http://spamassassin.apache.org/full/...heck_whitelist & http://mail-archives.apache.org/mod_mbox/spamassassin-dev/200501.mbox/<200501112307.j0BN7JhZ104226@opal.eng.sun.com>

Dan did you ever try it?

It'll probably be really long time before it's investigated; but I suppose someone might as well start the RFE for 'including a method for AWL corrections' that doesn't involve a whole wipe (rm -f /opt/zimbra/amavisd/.spamassassin/auto-whitelist*)

[dwmtractor]

Originally Posted by mmorse

Ya I never got that particular syntax to do anything usefull, but did you see:
http://spamassassin.apache.org/full/...heck_whitelist & http://mail-archives.apache.org/mod_mbox/spamassassin-dev/200501.mbox/<200501112307.j0BN7JhZ104226@opal.eng.sun.com>

Dan did you ever try it?

It'll probably be really long time before it's investigated; but I suppose someone might as well start the RFE for 'including a method for AWL corrections' that doesn't involve a whole wipe (rm -f /opt/zimbra/amavisd/.spamassassin/auto-whitelist*)

No Mike, I got overtaken by fiscal-year-end and haven't paid much attention. I did not download those tools though I may try at some point if I get a moment to breathe. . .

I was actually hoping I had misunderstood something and when rfoster asked the question I hadn't gotten around to asking I was looking forward to your simple response!

[mmorse]

Darn, same here -lol

Side thought on my factor recommendations thing:
Wouldn't it be cool if it auto-changed on time since install?

Originally Posted by mmorse

So maybe like:
-use_auto_whitelist 0 for one week so that you work out SA rules as desired (also called sa_auto_whitelist=0)
-followed by a week of use_auto_whitelist 1 & auto_whitelist_factor 0 (to train the database)
-then increase the factor to 0.3 for another week (to start using the database)
-and factor of 0.5 from then on

[dwmtractor]

Originally Posted by mmorse

Darn, same here -lol

Side thought on my factor recommendations thing:
Wouldn't it be cool if it auto-changed on time since install?

Sure, but it'd be even cooler if we could maintain that list from inside the gui!

Having watched a bunch of email headers (cf. my other posting today on more spam tweaks), I'm increasingly convinced that AWL is only tilting one way for me, which is to allow stuff it shouldn't, not to hurt stuff that would otherwise be desired. So I think I'm gonna change it to maybe 0.1 or something like that so it doesn't disappear completely from the header (and consequently from my memory), and let it be next-to-irrelevant in my spam world.