Re: Spamcop missing a LOT of spam lately

In article <[email protected]>, [email protected] says...
> Kevin Hurni wrote:
> > Thanks, I figured I'd post here just to get a response.
> 
> This top post puts your remark out of context to whatever it is you are
> replying to.  You need to trim and contextualize your remarks.
> 
> > I referred to the subject lines and the content because that is how
> > most spam filters work (they analyze the subject, content, and
> > possibly IP address of sender).
> 
> Clearly you don't understand how your spamcop mail filter is supposed to
> work, so you are going to have to educate yourself on how to configure
> it for best effect.  SC mail filter uses blocklists, SA SpamAssassin,
> and whitelists.
> 
Is this more to your liking?

BTW, I AM using all three that you mentioned.  Blocklists and SA is 
checked.  I've had to whitelist probably less than 5 senders in the 3 
years or so that I've had the account.


> > But maybe spamcop ONLY blocks on IP address of the sender (which would
> > explain a lot)?
> 
> If you configure to only use blocklists, that would be true.  Most
> people use blocklists and SA.
> 
> > But it appears that you are suggesting to configure spamcop to block
> > everything and then whitelist individual senders.
> 
> Personally I configure my SpamPal tight and count on whitelisting to
> prevent any false positives.  Some people can't do that.
> 
> > Basially:  Compensate for the spamcop filtering that is missing stuff.
> 
> A filter filters the way the filter is configured to filter.  It isn't
> an emotional thing.
> 

Never said it was.  However, the analogy (listed below) is basically the 
same thing.

If you don't want any spam, simply rely only on a whitelist.  A lot of 
"anti-spam" vendors will use this similar configuration to claim a 100% 
spam catch rate and 0% false positive (why 0% because you can still 
technically go into the quarantine area and weed out the ones you want).

Same goes for an AV filter.  If you don't want any viruses in your 
system/email then block everything.  (HP sent out an email about 6 
months ago informing us of like 30+ attachments we can no longer send to 
them due to viruses).

> > Kinda like people who have to configure their AV filter to block ALL
> > incoming attachments for viruses to compensate for the time it takes
> > for a pattern file to update.  (Poor design, IMO).
> 
> That sounds like another different discussion.  I don't have a problem
> with false positives with my AV filter or with my spam filter.  You are
> having a problem with false negatives with your spam filter, probably
> because you don't understand it well enough.
> 

I'm pretty sure I do understand it.  (thanks for making the repeated 
assumptions).

> > Ironically we have an Ironport system at work using Brightmail that
> > catches far more than spamcop does (and I see spamcop is owned by
> > Ironport).
> 
> SpamCop is owned by Ironport, yes.
> 
> > So perhaps I'm better contacting Ironport directly and asking what's
> > going on.
>