Re: Strategy for collecting spam to feed Bayes?

On 2025-01-13 at 01:51:17 UTC-0500 (Mon, 13 Jan 2025 08:51:17 +0200)
Anders Gustafsson <[email protected]>
is rumored to have said:

> Hi!
>
> When collecting spam I frequently see multiple copies of the same 
> message, but with different fake senders.
> In this case, should I feed just one or all to Bayes?

All.

> Also: Is there a point in feeding such spam that is already flagged by 
> other rules than Bayes

Yes. The header and body rules match known patterns. Bayes works to 
catch spam with more subtle commonalities that are unlikely to be 
noticed by a human. Those still exist with mail that also matches rules, 
so even if a spammer figures out how to evade explicit rules, they may 
well not be able to get past Bayes.

> and if so,
> should I remove the additions that SA adds to the message? Ie: XSPAM 
> etc?

SA knows to ignore its own additions, in part because anyone could have 
added them. X-Spam-* headers are ignored and we may also be ignoring 
Spam-* headers.

One issue that may exist with manually feeding caught spam to Bayes is 
if you use the "report_safe" feature which encapsulates identified spam 
in a wrapper message with a warning. You should feed Bayes the 
*original* message, not the encapsulation message. In principle SA 
should be able to unwrap its own reports, but there are gaps there.


-- 
  Bill Cole
  [email protected] or [email protected]
  (AKA @[email protected] and many *@billmail.scconsult.com 
addresses)
  Not Currently Available For Hire