16.2 not as effective

[Andrew Norman]

>> I am still using bf build 0.13.6.2 and all of a sudden, 10 days or so
>> ago, I started getting far more spam not filtered. I went from one or
>> two spam messages incorrectly classified as ham a day to 20 or 30.
>> Most of these spams appear to be being generated by the same bit of
>> software (the resulting gibberish in the body and the format of the
>> names it uses are fairly obvious).
>>
>> Time for me to upgrade to the latest version of bf to see if that
>> catches them.
>
> I'm definitely seeing an increase in quantity of spam.  Each of the last
> 3 months I've received more spam than ever before (5386 in Oct, 7062 in
> Nov, and 9015 in Dec).  Bogofilter has already nailed 8112 this month,
> so I'm on the path of another record breaker.

It is not an sudden increase of spam that I have seen recently, but an
very sudden increase in the number of spams that bf is tagging with a
spamicity of zero and letting through to my inbox. The nature of these new
spams is somehow causing them all to slip past bf 0.13.6.2

> Switching from 0.13.6.2 to 0.15.13 (or, even better, 0.16.4 :-) you will
> likely see a temporary hit in accuracy.  With bogofilter having changed
> to case-sensitive tokens and tagging all header lines, there will be a
> lot of tokens seen by the new bogofilter that are not in your wordlists.
>  Training with a bunch of recent ham and spam will help you get past any
> changeover effects.

Thankfully I archive _all_ my spam and ham, so I have plenty of training
material...

I've been putting off upgrading to a recent version for a while now,
because I know it will take me half a day or more to implement it.

> P.S.  0.16.4 (current) is at least as good as 0.15.13 (stable).  There
> have been changes to the supporting programs, but nothing of
> significance to the bogofilter binary itself.  The newer version will
> also more closely match the code in the next release series (0.17.x).
> I'd recommend using 0.16.4 :-)

Great, whether or no I should jump to 0.16.x was a question I was just
about to ask ;-)

-- 
Andy Norman - andy at norman.cx
http://www.norman.cx/