Re[2]: empty body

[Robert Menschel <Ro...@Menschel.net>]

Hello Stuart,

Friday, January 14, 2005, 9:17:56 AM, you wrote:

SJ> __MIME_ATTACHMENT, I believe, requires a new feature not in 3.0.2 so you
SJ> won't be able to simply drop in this rule.  The problem is that without
SJ> that rule, you'll match messages with an attachment but no other body text.

SJ> One option is to combine the empty message rule with a no To rule which
SJ> should give you a pretty low FP rate.  This is what the SARE rules do:
SJ> http://www.rulesemporium.com/rules/70_sare_html.cf - search for 
SJ> SARE_HTML_NO_BODY.  (Why are they under html?)

It's under HTML because in our testing we found that a rule which
tested for "this is an html message" with no body and no To header to
be a better Spam indicator than "this is an email" with no body and no
To header.

I don't remember the stats at that time, and it may be worth
revisiting...

Bob Menschel



SJ> Stuart Johnston


SJ> Ingo Reinhart wrote:
>> Hi!
>> 
>> Ok, the ideea is great but dont' work for me.
>> 
>> # __MIME_ATTACHMENT defined in 20_html_tests.cf
>> body __NONEMPTY_BODY    /\S/
>> meta EMPTY_MESSAGE      !__MIME_ATTACHMENT && !__NONEMPTY_BODY
>> describe EMPTY_MESSAGE  Message appears to be empty with no Subject: text
>> score EMPTY_MESSAGE 2
>> 
>> Any hint's?
>> 
>> Ingo
>> 
>> ----- Original Message ----- From: "Matt Kettler" <mk...@evi-inc.com>
>> To: "Ingo Reinhart" <i....@dung.de>; <us...@spamassassin.apache.org>
>> Sent: Thursday, January 13, 2005 6:30 PM
>> Subject: Re: empty body
>> 
>> 
>>> At 06:27 AM 1/13/2005, Ingo Reinhart wrote:
>>>
>>>> Hello!
>>>>
>>>> How can I test for an empty Mailbody?
>>>>
>>>> Any existing rule?
>>>>
>>>> Best Regards,
>>>
>>> Ingo
>>>
>>>
>>> Grab the latest SVN image from the downloads page and look at 
>>> EMPTY_MESSAGE.
>>>
>>>
>>>
>> 
>> 




-- 
Best regards,
 Robert                            mailto:Robert@Menschel.net