Page History

...

A common question regarding SpamAssassin's rules is, why aren't they kept secret? Doesn't publishing the rules alert the 'bad guys', causing them to change their spam patterns to evade the rule?

Wiki MarkupThis is true, but only to a degree. In a way, this is an example of the \[http://en.wikipedia.org/wiki/Security_through_obscurity 'Security through obscurity'\] fallacy.

Spammers aren't all that smart

...

For example, the 'JODY' rule (matching the text 'My Wife, Jody') was been part of SpamAssassin for many years, spam hitting that text has been observed in mail going back into the 1990s, and modern spam mail still hits that pattern. Many chain-letter scams rely on word-for-word reproduction of a piece of text like this.

...

In other words, even though they had no access to the source code or published details of AOL's system, they could reverse-engineer enough details to get around it.

A Test Case

Here's an analysis of the change in effectiveness of the MIME_BOUND_DD_DIGITS rule over time, during 2004 and 2005.CategoryFaq