Re: Pyzor server

[Tony M. <to...@sp...>]

> You mean that it's impossible to get an account on the public server? 
> And without it the submits are ignored? That seems odd. How do the 
> fingerprints of spams end up in the public "database" then?

No.  public.pyzor.org is using the default ACL for the anonymous user, which means that an anonymous user can use "check", "report", "ping", and "info".  IOW, the only command that requires an account is "whitelist" - anyone can submit a spam report, but only trusted sources may whitelist a report.

The reason behind this lies with how pyzor treats (at least by default) a "whitelist" command - if a digest is whitelisted, that doesn't just decrease the count (i.e. it's not an "unreport"), it means that the digest never gets considered spam (i.e. it really is whitelisting).  This isn't practical as an anonymous function.

Note that since the anonymous user can submit reports, these might be wrong.  I think the SA plug-in will believe Pyzor if there is any number of reports, but more judicious decisions can be made if the report count is taken into consideration (however, since Pyzor's just another rule inside of SA, that perhaps isn't necessary in that context).

I have plans (but no idea when there will be time) to add another public database (e.g. trusted.pyzor.org) that restricts the anonymous user to "check", "ping", and "info", and give out accounts (allowing "report" and "whitelist") to anyone that appears to be legitimate.  It would be interesting to compare the results of these.

A reputation system for reporters could be added (other fingerprinting systems have them), but that is a significant change, and not likely to happen any time soon (unless someone submits a patch for it…).

Apologies for the slow reply - I wasn't really doing much with email over the Christmas period.

Cheers,
Tony