FORGED_YAHOO_RCVD

[Randy Ramsdell <rr...@livedatagroup.com>]

The "FORGED_YAHOO_RCVD" rule is triggering a KNOWN false positive since 
2005 and the only documentation I could find is from 2005. Anyone know 
how to fix this issue instead of having to modify the perl module for 
each change in Yahoo's servers? Is the best way to fix this using a 
custom rule for the standardized subject field? Although I would like to 
fix the cause not just mask it.

The Bayes rule has been updated for this since the below header.

Here is an example sanitized header:

Return-Path: <**...@yahoo.com>
X-Original-To: xxxxxxxxxxxxxxxxxxxx
Delivered-To: xxxxxxxxxxxxxxxxxxxxxx
Received: from localhost (localhost [127.0.0.1])
        by ********************** (Postfix) with ESMTP id 2DFD1B5435
        for <********************>; Fri, 10 Aug 2007 15:45:39 -0400 (EDT)
Received: from ***************** ([***************])
 by localhost (******************* [********]) (*****************)
 with ESMTP id 01315-01-3 for <*****************>;
 Fri, 10 Aug 2007 15:45:37 -0400 (EDT)
Received: from web51307.mail.re2.yahoo.com (web51307.mail.re2.yahoo.com 
[206.190.38.173])
        by mail1.livedatagroup.com (Postfix) with SMTP id C130FB54A0
        for <*********************>; Fri, 10 Aug 2007 15:45:36 -0400 (EDT)
Received: (qmail 97907 invoked by uid 0); 10 Aug 2007 19:45:31 -0000
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
  s=s1024; d=yahoo.com;
  h=Date:From:Subject:To:MIME-Version:Content-Type:Message-ID;
  
b=VMpeV0fzhlnDjBGOF6DfCbrz2+0DaPGtxLiH3qHzKBff+vrZQx7sJfJQNajLeBdiS3izTRdqkPT1M73oTvnF7Q0fV7hYANxgyfzgy6ECxvp36FYcTkheviJX8uKvd5qwXOx49t8GFFk36kEehY7x2AyPr4TfyAuf7KPE+746R40=;
Date: Fri, 10 Aug 2007 12:45:31 -0700 (PDT)
From: **************@yahoo.com
Subject: ***SPAM_LDG*** Yahoo! Auto Response
To: *********************
MIME-Version: 1.0
Message-ID: <19...@web51307.mail.re2.yahoo.com>
Content-Type: text/plain; charset=us-ascii
X-Virus-Scanned: ****************************
X-Spam-Status: Yes, score=5.266 tagged_above=-9999 required=5
 tests=[AWL=-0.900, BAYES_50=0.001, DNS_FROM_RFC_ABUSE=0.2,
 DNS_FROM_RFC_POST=1.708, DNS_FROM_RFC_WHOIS=1.447, FORGED_YAHOO_RCVD=1.849,
 NO_REAL_NAME=0.961]
X-Spam-Score: 5.266
X-Spam-Level: *****
X-Spam-Flag: YES

Re: FORGED_YAHOO_RCVD

[Randy Ramsdell <rr...@livedatagroup.com>]

Loren Wilton wrote:
>> Ok thanks turning it off works. I should edit the *.cf files or is 
>> there another way to turn it off instead of settings things up so 
>> updates kill off the setting? Anyway, I would think the rule is 
>> useful to some extent and if not, why is it included with spamassassin?
>
> Put it in local.cf.  That is where local adjustments to release rules 
> and such should go.
>
> Which version are you running?  I had vaguely thought that this rule 
> had been dropped a while ago for poor hitrate, but I may be confusing 
> it with some other rules.  There have been problems with both Yahoo 
> and AOL changing their configurations enough recently to end up 
> getting FPs on these sort of rules.
>
> As a general thing, rules are added and scored because *at the time 
> they are scored* they do well against spam on the test corpuses of 
> spam.  That is no guarantee that they will necessarily work for 
> someone else with a much different mail stream, although of course we 
> all hope that they will turn out fairly well in most cases.  Also, the 
> rules did well when they are scored.  Depending on how fast things 
> change, they may not do well at all years, months, or possibly even 
> weeks later.
>
> If you are not using it, you should look into turning on spamassassin 
> updates.  There are updated rule sets available for the more recent 
> releases that will change scores and add or subtract rules to match 
> the latest corpus characteristics.
>
>        Loren
>
>
We are using 3.1.1 ( distro patched ) until we upgrade our servers to a 
newer version.


Thanks,
Randy

Re: FORGED_YAHOO_RCVD

[Loren Wilton <lw...@earthlink.net>]

> Ok thanks turning it off works. I should edit the *.cf files or is there 
> another way to turn it off instead of settings things up so updates kill 
> off the setting? Anyway, I would think the rule is useful to some extent 
> and if not, why is it included with spamassassin?

Put it in local.cf.  That is where local adjustments to release rules and 
such should go.

Which version are you running?  I had vaguely thought that this rule had 
been dropped a while ago for poor hitrate, but I may be confusing it with 
some other rules.  There have been problems with both Yahoo and AOL changing 
their configurations enough recently to end up getting FPs on these sort of 
rules.

As a general thing, rules are added and scored because *at the time they are 
scored* they do well against spam on the test corpuses of spam.  That is no 
guarantee that they will necessarily work for someone else with a much 
different mail stream, although of course we all hope that they will turn 
out fairly well in most cases.  Also, the rules did well when they are 
scored.  Depending on how fast things change, they may not do well at all 
years, months, or possibly even weeks later.

If you are not using it, you should look into turning on spamassassin 
updates.  There are updated rule sets available for the more recent releases 
that will change scores and add or subtract rules to match the latest corpus 
characteristics.

        Loren

Re: FORGED_YAHOO_RCVD

[Randy Ramsdell <rr...@livedatagroup.com>]

Loren Wilton wrote:
> score FORGED_YAHOO_RCVD 0
>
>        Loren
>
>
Ok thanks turning it off works. I should edit the *.cf files or is there 
another way to turn it off instead of settings things up so updates kill 
off the setting? Anyway, I would think the rule is useful to some extent 
and if not, why is it included with spamassassin?

Re: FORGED_YAHOO_RCVD

[Loren Wilton <lw...@earthlink.net>]

score FORGED_YAHOO_RCVD 0

        Loren