New SARE Rule Set: General Subject Headers

[Robert Menschel <Ro...@Menschel.net>]

Hello spamassassin-users,

Now available through http://www.rulesemporium.com/rules.htm are the
SARE General Subject rules (named SARE_SUB_*).

The structure of this ruleset is a new experiment for SARE -- we've split
the ruleset into four parts:

70_sare_genlsubj0.cf contains those SARE_SUB_* rules which in all SARE
mass-check testing hit ONLY spam. This is the safest of the four
SARE_SUB_* rulesets for use. However, systems with specific
characteristics (such as those that deliver mail to physicians' offices)
should pay attention to the topics included and adjust if needed.

Unlike 70_sare_genlsubj0.cf, the 70_sare_genlsubj1.cf ruleset contains
rules which do (or in the past have) hit ham during SARE mass-check
tests. The S/O calculated by SA's hit-frequencies scripts are all at or
above 0.900. Systems which are excessively sensitive to false positives
may want to exclude this ruleset, pick and choose among its rules, or
lower their scores.     

70_sare_genlsub2.cf contains only rules which test for obfuscation within
subject headers. This subset of SARE_SUB_*_OB* rules do not hit any
emails during SARE mass-check testing against current corpi. Therefore,
systems which are very sensitive to SpamAssassin overhead may want to
exclude this ruleset to avoid its regex overhead.

(Those SARE_SUB_*_OB* obfuscation rules that did hit spam and only spam
are in genlsubj0, and those that hit ham also are in genlsubj1 or
genlsubj2.) 

Finally, 70_sare_genlsub3.cf contains a subset of SARE_SUB_* rules which
hit a significant amount of ham during SARE mass-check tests. Systems
which are very sensitive to false positives should probably NOT install
this ruleset.

Hit-Frequency results against my mass-check are included in the
documentation at the top of each of the four files. Each rule also shows
its own hits, including any/all mass-check runs that hit ham.

We're interested in knowing whether this is an approach people would like
us to use more often, or whether it's more trouble than it's worth.

Bob Menschel