Looking to get a rule checked against the SVN corpus

[Michael Cocke <mc...@guardiandigital.com>]

Can someone point me to a sa developer?  We've been doing some hacking 
on SA at work (guardiandigital.com) and have a rule that we'd like to 
get run against the corpus.  It's not worth getting all set up as real 
submitters, so maybe someone could just toss it in with their next 
run..?  The suspicion is that this might help against the current flood 
of image spam.  Eric noticed that most of it seems to be sent as 
multipart related instead of the common way, but we're a little 
concerned about false positives.

Thanks!

Mike-

header LOCAL_MULTIPART_RELATED Content-Type =~ /multipart\/related;/
score LOCAL_MULTIPART_RELATED 0.753
describe LOCAL_MULTIPART_RELATED Stock messages with images attachments

Re: Looking to get a rule checked against the SVN corpus

[Theo Van Dinter <fe...@apache.org>]

On Tue, Jan 23, 2007 at 01:54:27PM -0500, Michael Cocke wrote:
> Can someone point me to a sa developer?  We've been doing some hacking 

For things like rule suggestions, we generally like people to goto
http://issues.apache.org/SpamAssassin/ and open a ticket about it.
That way there's tracking and such.

> on SA at work (guardiandigital.com) and have a rule that we'd like to 
> get run against the corpus.  It's not worth getting all set up as real 

FWIW, there isn't "the corpus", it's a bunch of personal corpora.

> multipart related instead of the common way, but we're a little 
> concerned about false positives.

I'm not sure what you mean by "the common way".  If you want to send a text
part with an image, it's "multipart/related".

> header LOCAL_MULTIPART_RELATED Content-Type =~ /multipart\/related;/

Yeah, I did some work related to this when trying to clean up the
EXTRA_MPART_TYPE rule.  See
https://issues.apache.org/SpamAssassin/show_bug.cgi?id=5110 for that
discussion.

Someone else also suggested it in
https://issues.apache.org/SpamAssassin/show_bug.cgi?id=5224

There's also a number of tickets for FPs on image spams, since
they're essentially being sent with Outlook, so genuine Outlook mails get
flagged a lot, ie:
https://issues.apache.org/SpamAssassin/show_bug.cgi?id=5226


All that said, the rule may work well for you, it really depends on the type
of mails that you receive.  For example, if it wasn't for my hamtraps, I
wouldn't receive any legit mails that include pictures and could easily ignore
the whole image spam thing with a simple MTA rule.

-- 
Randomly Selected Tagline:
"Senator Helms went on to say that President Clinton would need a
 bodyguard if he ever went to North Carolina.  Helms later claimed that
 reporters misunderstood him through his hood."
         - Dennis Miller, Dennis Miller Live (1994, Jerry Seinfeld)