Oh yeh one more thing.  None of this would explain why the signatures
for sample-spam.txt from spamassassin is registered on honor but not apt
Thanks that helps.  There's still so little info on TES and those of us
here since RazorV1 know how it works.  I did set my min_cf to "ac-100"
So the way you are suggesting that it works now is that everyone has a
trust level of 1 and have to work their way up.  Your trust level
increases when someone nominates the same message as spam. This must
have been the new changes made at the beginning of the week unless the
changes dumped everyone's trust level.  Now here come the questions...
What engine signature does TES look at?  Does it have to be the same e1
signature or does it use the e2 or e4 signatures.  How many people have
to nominate the message before everyones rating increases?  How many
revokes decreases someones rating?  Does a single revoke decrease the
rating of everyone that nominated the message?  If a newby reports a
message that has already been reported does their trust level
immediately go up?  In the case of revoking, does someone with a trust
level of 1 have the capability to revoke a message submitted by multiple
If you are not a trusted reporter, your reports will not have an
immediate effect. It takes a bunch of trusted reporters to bump up the
confidence of a signature to a point where it is considered to be spam.
This might be frustrating initially, but as the number of trusted users
grows the time delay between nominations and determination will become
shorter. Of course, it's a lot more frustating for people to have their
legit mail filtered out due to incorrect reporting.
Also, for the purpose of testing, I'd suggest making your min_cf (in
razor-agents.conf) to 0. min_cf defaults to the server recommended
average confidence, which at the moment is 1. Setting min_cf to 0 should
return true for whatever you submit (as long as it was not revoked by a
apt/fire sync with honor every 5 minutes, so you'd have to wait for a
_maximum_ of 5 minutes before signatures propagate.
On Wed, Aug 07, 2002 at 11:51:21PM -0400, Rose, Bobby wrote:
> This is still happening.  Nothing that I report is being registered at
> all.  I have confirmed that this also affects the Cloudmark Outlook
> plugin. If I block a message from Outlook using Spamnet then run it
> against the folder containing the message that was reported then
> On the unix side, I've tried different cloudmark servers, different
> identies, report from different systems, etc without an effect.  I did
> find that sample-spam.txt from Spamassassin is only registered on
> honor.cloudmark.net and comes back positive from it and it only so
> it's clearly not sync'd with apt or fire.
> Sent: Wednesday, August 07, 2002 1:32 PM
> Subject: RE: [Razor-users] What's wrong with the Razor servers now?
> I'm sure others have thought of that.  Probably the only way to
> prevent that is to include the host in the report/revoke
> Sent: Wednesday, August 07, 2002 12:33 PM
> On Wed, 7 Aug 2002, Rose, Bobby wrote:
> > Well at least it's been confirmed. I can say for cetain that it
> > started on Monday since that was when I noticed a huge drop in stats
> > that were tagged as being in razor.   And I know it was fine on
> > It may have something to do with the upgrades on the servers that
> > Vipul mentioned.  If TES is going to decide on what gets registered
> > and what doesn't then razor-report should provide some debug info
> > about the refusal.  You are correct about the need for more info on
> > TES, but it probably won't happen for fear of circumvention.
> <INSERT RANT REGARDING SECURITY THROUGH OBSCURITY>
> On the way into work I thought of some fairly easy ways to circumvent
> what I imagine the current trust model to be based on individual users
> blindly submitting reports and checking results.
> It's hard to imagine others haven't as well, as I'm not too bright.
>          Asking the wrong questions is the leading cause of wrong