[Bug 7944] New: FONT_INVIS_MSGID false positive

[bu...@spamassassin.apache.org]

https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7944

            Bug ID: 7944
           Summary: FONT_INVIS_MSGID false positive
           Product: Spamassassin
           Version: unspecified
          Hardware: PC
                OS: Windows NT
            Status: NEW
          Severity: normal
          Priority: P2
         Component: Rules
          Assignee: dev@spamassassin.apache.org
          Reporter: stephansfourie@gmail.com
  Target Milestone: Undefined

Hi SpamAssassin,

The meta rule FONT_INVIS_MSGID is currently set to check for both
__FONT_INVIS_MSGID and __MSGID_OK_HOST. 

This matches on good message IDs which is contrary to the description of
"suspicious message ID", eg.
<si...@email.freshdesk.com>

I think the __MSGID_OK_HOST in that meta is perhaps missing an exclamation mark
before it.

Thanks!
Stephan

-- 
You are receiving this mail because:
You are the assignee for the bug.

[Bug 7944] FONT_INVIS_MSGID false positive

[bu...@spamassassin.apache.org]

https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7944

John Hardin <jh...@impsec.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
                 CC|                            |jhardin@impsec.org
         Resolution|---                         |WONTFIX

--- Comment #1 from John Hardin <jh...@impsec.org> ---
(In reply to stephansfourie from comment #0)
> I think the __MSGID_OK_HOST in that meta is perhaps missing an exclamation
> mark before it.

No, that was intentional based on a combination that was fairly spammy at the
time. The scored version has exclusions for ham hits and is doing fairly well
in masscheck:

https://ruleqa.spamassassin.org/20211114-r1895009-n/FONT_INVIS_MSGID/detail

I've added another current ham exclusion to reduce the FPs further.

> This matches on good message IDs

It also matches on spam having good message IDs:

https://ruleqa.spamassassin.org/20211114-r1895009-n/__MSGID_OK_HOST/detail

If __MSGID_OK_HOST + other rules hit well on spam and poorly on ham then that
combination is a useful spam sign even though the single rule isn't useful by
itself.

The fact that a rule hits ham is not, by itself, a problem. Has this rule been
contributing to hams being scored spammy?

Rule discussions should take place on the Users mailing list, please follow up
there.

-- 
You are receiving this mail because:
You are the assignee for the bug.