MISSING_FROM

[Richard Gilbert <R....@sheffield.ac.uk>]

What happened to the MISSING_FROM rule, which evidently used to exist?
It doesn't appear in either 2.63 or 2.64.  According to RFC2822 a From: is
required.  All my searches for a rule of this name related to older
versions of SA. I would add my own rule in the style of MISSING_DATE but I
am concerned that there is a good reason for its absence.

I do hope this isn't a stupid question.

TYIA

Richard
--
Richard Gilbert
Corporate Information and Computing Services
University of Sheffield, Sheffield, S10 2TN, UK
Phone: +44 114 222 3028   Fax: +44 114 222 3040

Re: MISSING_FROM

[Daniel Quinlan <qu...@pathname.com>]

Richard Gilbert <R....@sheffield.ac.uk> writes:

> What happened to the MISSING_FROM rule, which evidently used to exist?
> It doesn't appear in either 2.63 or 2.64.  According to RFC2822 a From: is
> required.  All my searches for a rule of this name related to older
> versions of SA. I would add my own rule in the style of MISSING_DATE but I
> am concerned that there is a good reason for its absence.

It's gone probably due to low spam hit rate combined with false
positives.  I don't recall exactly why.

RFC 2822 conformance is unfortunately not a good way to tell spam from
ham, although spam tends to be MUCH less conformant.

Daniel

-- 
Daniel Quinlan
http://www.pathname.com/~quinlan/

Re: MISSING_FROM

[Loren Wilton <lw...@earthlink.net>]

> >What happened to the MISSING_FROM rule, which evidently used to exist?
>
> Did it ever exist??
>
> I did a search of my rather comprehensive, but not all inclusive, library
> of SA versions and did not find it:

I know I never saw a hit like that on 2.63.  Which is why I wrote a version
of that.  It is part of a meta for "empty message" in one of the SARE
rulesets.

Just checking missing from by itself isn't all that good.  Its not too
uncommon to see that in automated replies from idiot webservers, and from
some mailing list mail.

Combine missing from with missing body check and you have a moderately good
spam detector.  Add missing subject and you've got a pretty guaranteed way
to dump malformed spams.

        Loren

Re: MISSING_FROM

[Matt Kettler <mk...@evi-inc.com>]

At 02:02 PM 8/25/2004, Richard Gilbert wrote:
>What happened to the MISSING_FROM rule, which evidently used to exist?

Did it ever exist??

I did a search of my rather comprehensive, but not all inclusive, library 
of SA versions and did not find it:

$ grep -r MISSING_FROM *
$

$ ls
Mail-SpamAssassin-2.0   Mail-SpamAssassin-2.42  Mail-SpamAssassin-2.60
Mail-SpamAssassin-2.01  Mail-SpamAssassin-2.43  Mail-SpamAssassin-2.61
Mail-SpamAssassin-2.1   Mail-SpamAssassin-2.44  Mail-SpamAssassin-2.62
Mail-SpamAssassin-2.11  Mail-SpamAssassin-2.50  Mail-SpamAssassin-2.63
Mail-SpamAssassin-2.20  Mail-SpamAssassin-2.51  Mail-SpamAssassin-2.64
Mail-SpamAssassin-2.30  Mail-SpamAssassin-2.52  SA3-pre1
Mail-SpamAssassin-2.31  Mail-SpamAssassin-2.53  SA3-pre2
Mail-SpamAssassin-2.40  Mail-SpamAssassin-2.54  SA3-pre3
Mail-SpamAssassin-2.41  Mail-SpamAssassin-2.55  SA3-pre4


Searching the bugzilla also turned up nothing

>  According to RFC2822 a From: is required.

Yes, and I suspect that most MTA/MDA's will insert one if not present, but 
I could be wrong here.