headers - example

[Tom Anderson]

On Mon, 2004-03-08 at 07:44, David Relson wrote:
> > 
> > "195.80.171.24"                     53  0.006570  0.000000  0.000074 +
> > "rcvd:mail.slovanet.sk"             52  0.006446  0.000000  0.000075 +
> > "212.55.234.133"                     1  0.000124  0.000000  0.003877 +
> > "rcvd:mtx1.www.ematrix.sk"           1  0.000124  0.000000  0.003877 +
> > "rcvd:proxy.ematrix.sk"              1  0.000124  0.000000  0.003877 +
> > "to:hotmail.com"                   266  0.029999  0.002026  0.063266 +
> > "head:UTC"                         661  0.061609  0.013842  0.183460 +

> Since you consider sources so important, create whitelists and
> blacklists.
> 
> If a message was "pure spam" that's how bogofilter would classify it.
> Your message included messages that you've used in ham training, else
> bogofilter wouldn't classify them as ham.  Sounds like additional
> training is needed.  Bogofilter needs sufficient information to to a
> good job, and that doesn't happen overnight.

David,

"hotmail.com" should not show up individually in the "to:" token.  It
should be a full email address.  This way bogofilter would automatically
maintain a white/black list (weighted) for you.  The domain alone should
not be a strong indicator, as you may receive a large majority of your
hams from domains such as hotmail and yahoo and aol, and only occasional
spams from these same sources.  The fact that it came from that same
email service as some of your friends use does not predict that it is
ham.  However, if you left the "@" out of the list of splitting
characters (include it in valid token characters), then a full email
address is fairly indicative of ham or spam (assuming the to: is not the
same as the from:).  "friend at hotmail.com" will be hammy while
"spammer at hotmail.com" will be spammy.  Meanwhile, "friend at yahoo.com" may
also be a spammer, so shouldn't receive special recognition just because
they use the same handle as "friend at hotmail.com".  Hotmail and yahoo
should remain neutral, as the domain should not be registered or
classified seperately.  Do you see the logic of this?

Tom

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
URL: <http://www.bogofilter.org/pipermail/bogofilter/attachments/20040308/3733124c/attachment.sig>