I can't believe this mail got 0.4 from SA!

[Michal Szymanski <ms...@astrouw.edu.pl>]

Hi,

Can somebody try to explain to me how the below included message could
possibly go through SA getting the score of 0.4? And even that not
for the content but some date-in-the-past.

Is it really so that vulgar words are NOT included in any of standard
rules?

I'm really confused and embarassed.

regards, Michal.

----- Forwarded message from Vica Hotway <ot...@altavista.net> -----

Date: Thu, 12 Feb 2004 10:58:45 -0500
From: Vica Hotway <ot...@altavista.net>
To: <ms...@albireo.astrouw.edu.pl>
Subject: They fuck my cunt when I was chaste
X-Scanned-By: MIMEDefang 2.39
X-Spam-Level: 
X-Spam-Checker-Version: SpamAssassin 2.63 (2004-01-11) on 
	sirius.astrouw.edu.pl
X-Spam-Report: 
	*  0.4 DATE_IN_PAST_12_24 Date: is 12 to 24 hours before Received: date
X-Spam-Status: No, hits=0.4 required=5.0 tests=DATE_IN_PAST_12_24 
	autolearn=no version=2.63

---a----bbbaba

http://www.myfirstpain.com

aba---a----bbb

----- End forwarded message -----

Re: I can't believe this mail got 0.4 from SA!

[Evan Platt <ev...@espphotography.com>]

-----Original Message-----
From: Michal Szymanski <ms...@astrouw.edu.pl>
To: spamassassin-users@incubator.apache.org
Date: Fri, 13 Feb 2004 21:16:09 +0100
Subject: I can't believe this mail got 0.4 from SA!

> Hi,
> 
> Can somebody try to explain to me how the below included message could
> possibly go through SA getting the score of 0.4? And even that not
> for the content but some date-in-the-past.
> 
> Is it really so that vulgar words are NOT included in any of standard
> rules?
> 
> I'm really confused and embarassed.

That's about the sum of it. Vulgar rules aren't included in any of the
standard scores. I think the reasoning is SA is a SPAM filter, not a
content filter. You can obviously write your own rules, but I've seen too
many ways at obfuscating obscenitied to do any good (People saw me
f.u.ck..ing..) to do any good.

There was a discussion here about how to do this, and someone mentioned a
subject with "See young girls getting raped." in the subject. I made the
incorrect comment of "How often do you get a legit e-mail with rape in the
subject?" Well.. quite a few women told me quite often.

Evan

Re: I can't believe this mail got 0.4 from SA!

[Steve Thomas <li...@sthomas.net>]

On Fri, Feb 13, 2004 at 09:16:09PM +0100, Michal Szymanski is rumored to have said:
> 
> Can somebody try to explain to me how the below included message could
> possibly go through SA getting the score of 0.4? And even that not
> for the content but some date-in-the-past.

Hit BAYES_99 on my system, bumping it to 5.9. :)


-- 
"The right to swing my fist ends where the other man's nose begins." 
- Oliver Wendell Holmes (1841-1935) 

Re: I can't believe this mail got 0.4 from SA!

[Kelson Vibber <ke...@speed.net>]

At 12:16 PM 2/13/2004, Michal Szymanski wrote:
>Is it really so that vulgar words are NOT included in any of standard
>rules?

I imagine those vulgar words show up too frequently in personal mail - and 
on mailing lists where flamewars are common - to be a good 
indicator.  (Yes, there are people who are vulgar in personal mail.  Just 
as there really are people who talk like Tony Soprano.)  Even 
SpamAssassin's porn-detection rules have to look for phrases and 
combinations, because context is key.  Some random 14-year-old saying "Hey, 
this is f'***ing awesome!" isn't in the same class as x-rated spam.


Kelson Vibber
SpeedGate Communications <www.speed.net> 

Re: I can't believe this mail got 0.4 from SA!

[Nix <ni...@esperi.org.uk>]

On Fri, 13 Feb 2004, Lucas Albers moaned:
> 
> Michal Szymanski said:
>> X-Spam-Report:
>> 	*  0.4 DATE_IN_PAST_12_24 Date: is 12 to 24 hours before Received: date
>> X-Spam-Status: No, hits=0.4 required=5.0 tests=DATE_IN_PAST_12_24
> 
> Under what possible reasonable situation would the the date in the past be
> 12 to 24 hours?

People on dialup links sending mail out in batches when they sign on.

(I often get mail a week in the past from my rarely-connected parents.)

> Would upping this score for this rule block this sort of spam?

Yeah, and normal mail from intermittently-connected sites too.

-- 
`note to the crown prosecution service: Machine guns dont have a
 'stun' setting.' --- mjw

Re: I can't believe this mail got 0.4 from SA!

[Lucas Albers <ad...@cs.montana.edu>]

Michal Szymanski said:
> X-Spam-Report:
> 	*  0.4 DATE_IN_PAST_12_24 Date: is 12 to 24 hours before Received: date
> X-Spam-Status: No, hits=0.4 required=5.0 tests=DATE_IN_PAST_12_24

Under what possible reasonable situation would the the date in the past be
12 to 24 hours?
Why would spam have this set?
What normal mail would have this set?
This only occurs because the client clock is off?
Would upping this score for this rule block this sort of spam?

-- 
Luke Computer Science System Administrator