You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Alarig Le Lay <al...@swordarmor.fr> on 2016/01/06 11:43:28 UTC
Matches non RFC headers that not begin with X-
Hello,
I would like to mark as spam some mails with some non-RFC headers, like
deWBv5PD: offrespourlespros.net$
PFoRSKwhcmpngevb: 13716$
3D2rJMSW: 57$
WbCMJZG5: Gfo9K3iRJMJfbUms0jMjfpCWb+Q6Cp8F67lfYgxMoVw=$
(You can get the full mail here: https://paste.swordarmor.fr/raw/EEgF)
So, I’m looking for a test witch matches this kind of headers but I
didn’t find it. Does it exist? I could be interesting to have a regex
that matches all the headers not in https://tools.ietf.org/html/rfc4021.
--
Alarig Le Lay
Re: Matches non RFC headers that not begin with X-
Posted by Antony Stone <An...@spamassassin.open.source.it>.
On Wednesday 06 January 2016 at 11:48:12, Axb wrote:
> paste.swordarmor.fr uses an invalid security certificate. The
> certificate is not trusted because it was signed using a signature
> algorithm that was disabled because that algorithm is not secure.
My browser doesn't complain about the algorithm, but it does complain that the
site is paste.swordarmor.fr and the certificate is for bulbizarre.swordarmor.fr
Antony.
--
Late in 1972 President Richard Nixon announced that the rate of increase of
inflation was decreasing. This was the first time a sitting president used a
third derivative to advance his case for re-election.
- Hugo Rossi, Notices of the American Mathematical Society
Please reply to the list;
please *don't* CC me.
Re: Matches non RFC headers that not begin with X-
Posted by Reindl Harald <h....@thelounge.net>.
Am 06.01.2016 um 11:48 schrieb Axb:
> On 01/06/2016 11:43 AM, Alarig Le Lay wrote:
>> Hello,
>>
>> I would like to mark as spam some mails with some non-RFC headers, like
>> deWBv5PD: offrespourlespros.net$
>> PFoRSKwhcmpngevb: 13716$
>> 3D2rJMSW: 57$
>> WbCMJZG5: Gfo9K3iRJMJfbUms0jMjfpCWb+Q6Cp8F67lfYgxMoVw=$
>> (You can get the full mail here: https://paste.swordarmor.fr/raw/EEgF)
>>
>> So, I’m looking for a test witch matches this kind of headers but I
>> didn’t find it. Does it exist? I could be interesting to have a regex
>> that matches all the headers not in https://tools.ietf.org/html/rfc4021.
>>
>
> paste.swordarmor.fr uses an invalid security certificate. The
> certificate is not trusted because it was signed using a signature
> algorithm that was disabled because that algorithm is not secure. (Error
> code: sec_error_cert_signature_algorithm_disabled)
>
> sorry...
which browser does not support RSA 4096 / SHA512?
while it's untypical to not use SHA256 it's not wrong
CN: *.swordarmor.fr
valid: 19.02.2015 - 18.02.2017
firefox-43.0.3-2.fc23.x86_64
Re: Matches non RFC headers that not begin with X-
Posted by Alarig Le Lay <al...@swordarmor.fr>.
On Wed Jan 6 11:48:12 2016, Axb wrote:
> paste.swordarmor.fr uses an invalid security certificate. The certificate is
> not trusted because it was signed using a signature algorithm that was
> disabled because that algorithm is not secure. (Error code:
> sec_error_cert_signature_algorithm_disabled)
>
> sorry...
I use SHA-512/RSA for the signature and a 2048 bits RSA key, so it
should be secure. Which browser are you using?
On the other hand, I’m signed by CAcert, which is not included by
default on most distribution.
--
Alarig Le Lay
Re: Matches non RFC headers that not begin with X-
Posted by Axb <ax...@gmail.com>.
On 01/06/2016 11:43 AM, Alarig Le Lay wrote:
> Hello,
>
> I would like to mark as spam some mails with some non-RFC headers, like
> deWBv5PD: offrespourlespros.net$
> PFoRSKwhcmpngevb: 13716$
> 3D2rJMSW: 57$
> WbCMJZG5: Gfo9K3iRJMJfbUms0jMjfpCWb+Q6Cp8F67lfYgxMoVw=$
> (You can get the full mail here: https://paste.swordarmor.fr/raw/EEgF)
>
> So, I’m looking for a test witch matches this kind of headers but I
> didn’t find it. Does it exist? I could be interesting to have a regex
> that matches all the headers not in https://tools.ietf.org/html/rfc4021.
>
paste.swordarmor.fr uses an invalid security certificate. The
certificate is not trusted because it was signed using a signature
algorithm that was disabled because that algorithm is not secure. (Error
code: sec_error_cert_signature_algorithm_disabled)
sorry...
Re: Matches non RFC headers that not begin with X-
Posted by John Hardin <jh...@impsec.org>.
On Wed, 6 Jan 2016, Alarig Le Lay wrote:
> Hello,
>
> I would like to mark as spam some mails with some non-RFC headers, like
> deWBv5PD: offrespourlespros.net$
> PFoRSKwhcmpngevb: 13716$
> 3D2rJMSW: 57$
> WbCMJZG5: Gfo9K3iRJMJfbUms0jMjfpCWb+Q6Cp8F67lfYgxMoVw=$
> (You can get the full mail here: https://paste.swordarmor.fr/raw/EEgF)
>
> So, I’m looking for a test witch matches this kind of headers but I
> didn’t find it. Does it exist?
There's __RAND_HEADER and RAND_HEADER_MANY, but prior examples of random
garbage headers had some structure that was recognizable. This example
doesn't.
> I could be interesting to have a regex that matches all the headers not
> in https://tools.ietf.org/html/rfc4021.
I think that might be very FP-prone. There are a lot of legit non-standard
headers that don't start with X-
I'll see if I can do something with your sample...
...OK, lets see what masscheck thinks.
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
Je ne suis pas Charlie. Je suis armé.
-----------------------------------------------------------------------
Tomorrow: the 1st anniversary of the Charlie Hebdo massacre