article on blocking by subnets

[David Relson]

At 07:23 PM 12/2/02, Barry Gould wrote:

>At 04:19 PM 12/2/2002, you wrote:
>>Isn't it much better to leave the handling of IP-adresses to those 
>>specialized
>>in handling IP-addresses ? Eg. www.ordb.org. Don't make bogofilter a 
>>universal
>>do everything tool. Let it do what it is good at, no more.
>>
>>How would an innocent IP-address get out of bogofilter, once the open relay
>>had been closed? It would sit in the spam-list forever unless the spam using
>>it is weeded out of the training set and retraining is done. Not very likely
>>to happen.
>
>It would be just like any other token.
>
>Bogofilter is ALREADY storing IP addresses... I was just putting out the 
>idea of using the subnet too.
>
>Barry

Barry,

A good question, but ...

The scoring algorithms used by bogofilter look at _all_ the tokens parsed 
from the message.  The algorithms give them all comparable 
importance.  Let's assume that a particular subnet came to be recognized as 
100% spam.  When that subnet was seen, the token would be a single max-spam 
factor in the overall calculation.  Every token contributes to the score, 
but no individual token contributes a lot.

Let me cast my vote in the "minimal effect" group.

Of course, you could design an experiment and test your idea.  I wouldn't 
mind being wrong :-)

David