You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Amir Caspi <ce...@3phase.com> on 2014/01/14 02:58:43 UTC
Re: Email address in subject line
On Dec 28, 2013, at 9:08 PM, John Hardin <jh...@impsec.org> wrote:
>> Yes, I definitely noticed that. As you can see from the spample (link
>> below), none of the above rules are hitting properly; the To: line is a
>> bare email, not properly angle-bracketed. Or, if any of the rules are
>> hitting, the meta rule that they are supposed to trigger still does not
>> trigger.
>>
>>> If you can post a spample or two somewhere I'll see what I can do.
>>
>> Spample:
>> http://pastebin.com/0jEMBA1X
>
> Thanks, I'll take a look.
Just to note that I saw a bunch of hits on TO_IN_SUBJ today, when the To: was a bare email... I guess you've been working on this and pushed an update out? If so, it seems to be working nicely so far.
> I'll have to check on that, I haven't looked in a while. My off-the-cuff answer is: look in my sandbox and in the masscheck results, I expect it isn't doing too well against the masscheck corpora.
Just checking to see if you had a chance to investigate your HTML_COMMENT_GIBBERISH rule and whether it was working OK or not...
Cheers.
--- Amir
Re: Email address in subject line
Posted by John Hardin <jh...@impsec.org>.
On Mon, 13 Jan 2014, Amir Caspi wrote:
> On Dec 28, 2013, at 9:08 PM, John Hardin <jh...@impsec.org> wrote:
>
>>> Yes, I definitely noticed that. As you can see from the spample (link
>>> below), none of the above rules are hitting properly; the To: line is a
>>> bare email, not properly angle-bracketed. Or, if any of the rules are
>>> hitting, the meta rule that they are supposed to trigger still does not
>>> trigger.
>>>
>>>> If you can post a spample or two somewhere I'll see what I can do.
>>>
>>> Spample:
>>> http://pastebin.com/0jEMBA1X
>>
>> Thanks, I'll take a look.
>
> Just to note that I saw a bunch of hits on TO_IN_SUBJ today, when the
> To: was a bare email... I guess you've been working on this and pushed
> an update out? If so, it seems to be working nicely so far.
>
>> I'll have to check on that, I haven't looked in a while. My off-the-cuff answer is: look in my sandbox and in the masscheck results, I expect it isn't doing too well against the masscheck corpora.
>
> Just checking to see if you had a chance to investigate your HTML_COMMENT_GIBBERISH rule and whether it was working OK or not...
>
> Cheers.
Sorry, $WORK is really busy now. Dunno when I'll get a chance.
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
My sidearm is a piece of emergency equipment. It absolutely must
be reliable, not "smart".
-----------------------------------------------------------------------
4 days until Benjamin Franklin's 308th Birthday