Re: IMF and UceArchive folder

"Alex Zammit" <alex@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote:

>11% false positives!!!!
>
>Rich, let me tell you that I have seen quite a few large organizations using
>IMF and never saw 11% false positives.

That you've never seen this doesn't mean it doesn't happen.

>Any organization having those
>results would be quite crazy to use IMF.

Yes, they would -- unless cost was the only driving factor. That zero
price-point sways a lot of people. I use it here on my servers at
home, but certainly not in production.

>You should know that IMF is based on the SCL configuration and this figure
>means nothing unless you look at how they configured it. Of course if you
>set your thresholds very low than true you get that type of result. But can
>you really blame it on IMF??

The figures are there for you to disprove. They aren't mine. Go for
it.

BTW, spam varys a lot from company to company, and country to country.
How well does IMF fare with Japanese spam? German? Dutch? And the spam
we receive may be quite different to the spam you receive.

>Alan, rest assured that if you are careful on how you configure IMF you will
>be happy with the results.

I doubt it. Well, maybe if he's never used anything else.

>Mind you there are a few cases where IMF is not for you. This is if you are
>in the business areas most targeted by spammers like pharmacy stuff. In that
>case yes I would say that you do risk a high level of false positives. I am
>just speculating here but I can imagine IMF can have problems because of the
>way the signature database is generated.
>
>Still make a blanket statement of "11% false positives" is incorrect in my
>opinion.

I was citing published data, not making a "blanket statement". You're
stating an opinion. Now back it with some facts. You should also
disclose that you're selling products that enhance the IMF.

BTW, you should understand the 11% is a measurement of how much of
"known good" (i.e. ham) is determined to be spam, not 11% of all
messages examined. There's quite a bit of difference there. But you
knew that after you read the information, right?

>If you want to read more on IMF:
>http://www.exchangeinbox.com/articles/001/imftune.htm

Nothing like a little self aggrandizement, huh?

--
Rich Matheisen
MCSE+I, Exchange MVP
MS Exchange FAQ at http://www.swinc.com/resource/exch_faq.htm
Don't send mail to this address mailto:h.pott@xxxxxxxxxxxxx
.

Relevant Pages

  • Re: IMF and UceArchive folder
    ... a lot of the stuff that waltzes right through IMF). ... 138 got a score of 1-3, making them almost certainly not spam. ... potential false positives in the SCL range of 4-7." ... MCSE+I, Exchange MVP ...
    (microsoft.public.exchange.admin)
  • Re: IMF and UceArchive folder
    ... The IMF has been running over the weekend at a level of 5. ... checking through every piece of archived email, and have no false positives. ... Some of the spam has been given a rating of 1 or 2, ... These guys are quoting MCP magazine. ...
    (microsoft.public.exchange.admin)
  • Re: IMF and UceArchive folder
    ... > BTW, spam varys a lot from company to company, and country to country. ... post I mentioned ways of getting a high rate of false positives as well. ... > disclose that you're selling products that enhance the IMF. ... I have been developing Exchange applications for many years and I have no ...
    (microsoft.public.exchange.admin)
  • Re: IMF and UceArchive folder
    ... could not get it to do what I needed, and decided to give the IMF a try. ... > 138 got a score of 1-3, making them almost certainly not spam. ... > potential false positives in the SCL range of 4-7." ... > It says you're a "Software Development Consultant" in your sig. ...
    (microsoft.public.exchange.admin)
  • Re: IMF and UceArchive folder
    ... Rich, let me tell you that I have seen quite a few large organizations using ... IMF and never saw 11% false positives. ... case yes I would say that you do risk a high level of false positives. ... >>Is there a way to make the archive folder a public folder within Exchange? ...
    (microsoft.public.exchange.admin)
Loading