procmail, was: speeding up bogofiltering

[Greg Louis]

On 20041201 (Wed) at 0720:35 -0500, David Relson wrote:
> On Wed, 1 Dec 2004 07:04:57 -0500
> Greg Louis wrote:
> 
> > But I must take a look at maildrop and see if it can do all I need yet
> > be simpler...
> 
> I attempted to replace procmail with maildrop on my mailserver.  Can't
> be done the way I want it.  I use procmail with a system wide set
> of rules.  Two of my spam related rules are "save copies in mbox
> spam-bogofilter" and then "put the message in the administrator's mbox,
> rather than the user's mbox".  Since procmail runs as root, the
> mailboxes are all accessible.  
> 
> AFAICT, maildrop can only run as a user and can only have rules for a
> single user.  That prevents changing mboxs for delivery.  I spent some
> time on the maildrop mailing list discussing this limitation, to little
> effect.  Sigh....

I took a look at the website and decided not to investigate further.
For something that important, I feel a need to be able to read and
understand the code, and maildrop is written in c++, at which I am
insufficiently expert.  Not that I've perused the procmail source all
that carefully :) but at least the possibility is there...

BTW, November was an ood month for us: zero fp in 22,541 nonspam but
almost 2.5% unsure spam, almost all of which had scores between 0.45
and our cutoff of 0.57.  Most were malware that somehow escaped our
malware filter (which sees them before bogofilter, so of course
bogofilter wasn't used to filtering that stuff).  After training, we
were back down to the usual 0.5%.  But the malware filter failing to
operate correctly is worrisome, even though it seems ok again with the
latest poison list (we update weekly, and I'm hypothesizing that one of
the updates got corrupted).  I'll have to watch that for a while. 
Maybe it should be policy to train bogofilter on malware, just as a
backup.

-- 
| G r e g  L o u i s         | gpg public key: 0x400B1AA86D9E3E64 |
|  http://www.bgl.nu/~glouis |   (on my website or any keyserver) |
|  http://wecanstopspam.org in signatures helps fight junk email. |