Re: IMF and UceArchive folder

I sounds like you are taking this a bit personal. Hope you don't.


> That you've never seen this doesn't mean it doesn't happen.

That I have never seen that makes me doubt on the validity of your
quotation.


> Yes, they would -- unless cost was the only driving factor. That zero
> price-point sways a lot of people. I use it here on my servers at
> home, but certainly not in production.

Do you have 11% false positives?


> The figures are there for you to disprove. They aren't mine. Go for
> it.

I followed the link. These guys are quoting MCP magazine. I tried to follow
the link to the review but couldn't find it (I am not saying that it is not
there.) Can you forward me the link to the review?


> BTW, spam varys a lot from company to company, and country to country.
> How well does IMF fare with Japanese spam? German? Dutch? And the spam
> we receive may be quite different to the spam you receive.

Agreed. This is exactly what I am saying. One cannot just say 11% false
positives without looking into the specific organization. In my previous
post I mentioned ways of getting a high rate of false positives as well.

I would like to see if the review you are quoting has indeed looked into
different setups.


> I doubt it. Well, maybe if he's never used anything else.

Well he answerred you saying that he is not getting that many false
positives. This has nothing to do on whether he used anything else. Do you
want to tell me that you know more than him?


> I was citing published data, not making a "blanket statement". You're
> stating an opinion. Now back it with some facts. You should also
> disclose that you're selling products that enhance the IMF.

True I am stating my opinion based on my experiece. This is backed on what
my clients say to me. You are free to take it or leave it

You have provided no facts either you simply pasted a link. Can you provide
some hard facts yourself??

You can easily find who I am by looking at my address of this post. My name
is in many places on the web and the links are public.

I have been developing Exchange applications for many years and I have no
problem arguing this issue in detail if necessary. Lets stick to the "11%
false positves" issue just to make sure that we get something useful out of
this discussion.



> BTW, you should understand the 11% is a measurement of how much of
> "known good" (i.e. ham) is determined to be spam, not 11% of all
> messages examined. There's quite a bit of difference there. But you
> knew that after you read the information, right?

Since you are quoting my links I think you should immagine that I know that.

What 11% means is that if you look at the Junk Email folder (lets assume
gateway blocking is disabled) out of every 10 emails filtered you will find
a bit more than one good (ham) email.



> Nothing like a little self aggrandizement, huh?

As I told you my links are public. I have no problem challenging your 11%
statement. Hope you will stick to the argument rather than truning this into
something personal.



cheers,

Alexander Zammit
Software Development Consultant
Check out, ExchangeInbox.com the MS Exchange Resource site at
http://www.exchangeinbox.com/



"Rich Matheisen [MVP]" <richnews@xxxxxxxxxxxxxxxxxxxxx> wrote in message
news:ref0e194sr18i1jhf8tue1dud8j2b3udts@xxxxxxxxxx
> "Alex Zammit" <alex@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote:
>
>>11% false positives!!!!
>>
>>Rich, let me tell you that I have seen quite a few large organizations
>>using
>>IMF and never saw 11% false positives.
>
> That you've never seen this doesn't mean it doesn't happen.
>
>>Any organization having those
>>results would be quite crazy to use IMF.
>
> Yes, they would -- unless cost was the only driving factor. That zero
> price-point sways a lot of people. I use it here on my servers at
> home, but certainly not in production.
>
>>You should know that IMF is based on the SCL configuration and this figure
>>means nothing unless you look at how they configured it. Of course if you
>>set your thresholds very low than true you get that type of result. But
>>can
>>you really blame it on IMF??
>
> The figures are there for you to disprove. They aren't mine. Go for
> it.
>
> BTW, spam varys a lot from company to company, and country to country.
> How well does IMF fare with Japanese spam? German? Dutch? And the spam
> we receive may be quite different to the spam you receive.
>
>>Alan, rest assured that if you are careful on how you configure IMF you
>>will
>>be happy with the results.
>
> I doubt it. Well, maybe if he's never used anything else.
>
>>Mind you there are a few cases where IMF is not for you. This is if you
>>are
>>in the business areas most targeted by spammers like pharmacy stuff. In
>>that
>>case yes I would say that you do risk a high level of false positives. I
>>am
>>just speculating here but I can imagine IMF can have problems because of
>>the
>>way the signature database is generated.
>>
>>Still make a blanket statement of "11% false positives" is incorrect in my
>>opinion.
>
> I was citing published data, not making a "blanket statement". You're
> stating an opinion. Now back it with some facts. You should also
> disclose that you're selling products that enhance the IMF.
>
> BTW, you should understand the 11% is a measurement of how much of
> "known good" (i.e. ham) is determined to be spam, not 11% of all
> messages examined. There's quite a bit of difference there. But you
> knew that after you read the information, right?
>
>>If you want to read more on IMF:
>>http://www.exchangeinbox.com/articles/001/imftune.htm
>
> Nothing like a little self aggrandizement, huh?
>
> --
> Rich Matheisen
> MCSE+I, Exchange MVP
> MS Exchange FAQ at http://www.swinc.com/resource/exch_faq.htm
> Don't send mail to this address mailto:h.pott@xxxxxxxxxxxxx


.

Relevant Pages

  • Re: IMF and UceArchive folder
    ... The IMF has been running over the weekend at a level of 5. ... checking through every piece of archived email, and have no false positives. ... Some of the spam has been given a rating of 1 or 2, ... These guys are quoting MCP magazine. ...
    (microsoft.public.exchange.admin)
  • Re: IMF and UceArchive folder
    ... could not get it to do what I needed, and decided to give the IMF a try. ... > 138 got a score of 1-3, making them almost certainly not spam. ... > potential false positives in the SCL range of 4-7." ... > It says you're a "Software Development Consultant" in your sig. ...
    (microsoft.public.exchange.admin)
  • Re: IMF Problem
    ... When that happens the likelihood of having "guilty" tokens ... the presense of a pair of words common to spam (or to the spam that MS ... >for you to track down all the people that might need to do this, but the IMF ... >is in use in quite a few smaller businesses that use Exchange. ...
    (microsoft.public.exchange.admin)
  • Re: Distribution Group
    ... Do you host your own exchange server or are ... I guess I can change the junk email to 6. ... expired we started receiving all of these spam emails. ... What are your SCL settings for IMF? ...
    (microsoft.public.windows.server.sbs)
  • Re: web email enquiry
    ... we are only using the spam filtering in exchange, ... If your exchange server ... Are you using IMF? ... messages or filing them as spam. ...
    (microsoft.public.windows.server.sbs)