[spambayes-dev] 1070 spam, 1 false positive

[Greg Ward]

Gee, I don't think I told the spambayes-dev crowd that I switched
mail.python.org over to Spambayes last weekend.  Anyways, so far it has
rejected 1070 spam messages, and we just got our first false positive
today:

"""
Return-Path: <*CENSORED*@aol.com>
Envelope-To: Tutor at python.org
Received: from imo-d04.mx.aol.com ([205.188.157.36])
        by mail.python.org with esmtp (Exim 4.05)
        id 19Sp8l-000636-00
        for Tutor at python.org; Wed, 18 Jun 2003 22:27:07 -0400
Received: from *CENSORED*@aol.com
        by imo-d04.mx.aol.com (mail_out_v36.3.) id 8.bd.3377bddd (4402)
         for <Tutor at python.org>; Wed, 18 Jun 2003 22:27:01 -0400 (EDT)
From: *CENSORED*@aol.com
Message-ID: <bd.3377bddd.2c227975 at aol.com>
Date: Wed, 18 Jun 2003 22:27:01 EDT
Subject: tutor
To: Tutor at python.org
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="part1_bd.3377bddd.2c227975_bounda
ry"
X-Mailer: 8.0 for Windows sub 6011
X-Spam-Status: SPAM (default 0.994)

Content-Type: text/plain; charset="US-ASCII"
Content-Transfer-Encoding: 7bit

UNSUBSCRIBE PLEASE


*CENSORED*@aol.com
"""

Oh wait, it was *really* a multipart/alternative message with text/plain
and text/html; the above is just how mutt renders it for me.  But never
mind that; there's some interesting stuff going on here.

Background: I grouped the 300+ recipient addresses on mail.python.org
into 18 clusters of similar addresses; tutor at python.org falls into the
grab-bag "default" cluster (which is what "default 0.994" means in the
X-Spam-Status header: in the context of the "default" training DB, this
message scored 0.994).

But note that this message was sent to the wrong address: admin requests
should never be sent to the list post address!  So, while this is
certainly not spam in the UBE sense, it *is* undesired mail for
tutor at python.org.  If I score this message under the "list-misc" or
"list-owner" training -- which are for *-request and *-owner addresses,
ie. the *right* place to send this sort of message -- it scores 0.02 and
0.05 respectively.

So if this guy had sent his message to the right address, it would have
been accepted without problems; Spambayes successfully blocked him from
bothering the whole list with his off-topic request.  Cool!

I guess I should go unsubscribe the poor slob now...

        Greg
-- 
Greg Ward <gward at python.net>                         http://www.gerg.ca/
Always look on the bright side of life.