You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Mynabbler <my...@live.com> on 2011/05/10 13:59:12 UTC
Re: Interword capitalization - solved
Mynabbler wrote:
>
> Does someone have a rule for interword capitalization?
>
Unfortunately no takers for the question. I came up with this:
# Gibberish subjects like: Cap su lesOr de rsMad eFo rRar ePro du cts
header __MN_IWCAP Subject =~ /[a-z][A-Z][a-z]/
tflags __MN_IWCAP multiple
meta MN_IWCAP __MN_IWCAP >= 3
score MN_IWCAP 0.1
meta MN_FMIWCAP (MN_IWCAP && FREEMAIL_FROM)
score MN_FMIWCAP 3
describe MN_FMIWCAP Found thRee intErword caPitalizations from a free
mail address
It searches for three or more occurrences in the subject and scores it when
coming
from a freemail address (just hotmail would have been enough... sigh).
--
View this message in context: http://old.nabble.com/Interword-capitalization-tp31521819p31584892.html
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
Re: Interword capitalization - solved and improved
Posted by jdow <jd...@earthlink.net>.
Add "on YouTube" and Bob's your uncle.
But it is a tad contrived.
{^_-}
On 2011/05/11 03:58, Mynabbler wrote:
>
>
> jdow wrote:
>>
>>>> header __MN_IWCAP Subject =~ /[a-z][A-Z][a-z]/
>> Help! My iPad does not work on FaceBook.
>> Bet that hits it as a subject.
>>
>
> Nope. Matches only two times..., on the P from iPad and the B from FaceBook.
> It does not match the F.
>
> Getting back to the matter at hand: is someone able to put that ruleset in a
> sandbox for the daily run?
>
> A 'yahoo groups' would be:
>
> header __MN_YHGRP Return-path =~ /returns\.groups\.yahoo\.com/
>
> and the better meta with ruleset and not yahoogroups could be:
>
> # Gibberish subjects like: Cap su lesOr de rsMad eFo rRar ePro du cts
> header __MN_IWCAP Subject =~ /[a-z][A-Z][a-z]/
> tflags __MN_IWCAP multiple
> meta MN_IWCAP __MN_IWCAP>= 3&& !__MN_YHGRP
> score MN_IWCAP 0.01
>
> meta MN_FMIWCAP MN_IWCAP&& FREEMAIL_FROM
> score MN_FMIWCAP 3
>
Re: Interword capitalization - solved and improved
Posted by Mynabbler <my...@live.com>.
jdow wrote:
>
>>> header __MN_IWCAP Subject =~ /[a-z][A-Z][a-z]/
> Help! My iPad does not work on FaceBook.
> Bet that hits it as a subject.
>
Nope. Matches only two times..., on the P from iPad and the B from FaceBook.
It does not match the F.
Getting back to the matter at hand: is someone able to put that ruleset in a
sandbox for the daily run?
A 'yahoo groups' would be:
header __MN_YHGRP Return-path =~ /returns\.groups\.yahoo\.com/
and the better meta with ruleset and not yahoogroups could be:
# Gibberish subjects like: Cap su lesOr de rsMad eFo rRar ePro du cts
header __MN_IWCAP Subject =~ /[a-z][A-Z][a-z]/
tflags __MN_IWCAP multiple
meta MN_IWCAP __MN_IWCAP >= 3 && !__MN_YHGRP
score MN_IWCAP 0.01
meta MN_FMIWCAP MN_IWCAP && FREEMAIL_FROM
score MN_FMIWCAP 3
--
View this message in context: http://old.nabble.com/Interword-capitalization-tp31521819p31593215.html
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
Re: Interword capitalization - solved
Posted by jdow <jd...@earthlink.net>.
Help! My iPad does not work on FaceBook.
Bet that hits it as a subject.
{^_-}
On 2011/05/10 06:01, Bowie Bailey wrote:
> On 5/10/2011 7:59 AM, Mynabbler wrote:
>>
>> Mynabbler wrote:
>>> Does someone have a rule for interword capitalization?
>>>
>> Unfortunately no takers for the question. I came up with this:
>>
>> # Gibberish subjects like: Cap su lesOr de rsMad eFo rRar ePro du cts
>> header __MN_IWCAP Subject =~ /[a-z][A-Z][a-z]/
>> tflags __MN_IWCAP multiple
>> meta MN_IWCAP __MN_IWCAP>= 3
>> score MN_IWCAP 0.1
>> meta MN_FMIWCAP (MN_IWCAP&& FREEMAIL_FROM)
>> score MN_FMIWCAP 3
>> describe MN_FMIWCAP Found thRee intErword caPitalizations from a free
>> mail address
>>
>> It searches for three or more occurrences in the subject and scores it when
>> coming
>> from a freemail address (just hotmail would have been enough... sigh).
>
> So hopefully you aren't expecting any emails from a Hotmail user
> discussing iPods or iPads....or McDonalds.... :)
>
Re: Interword capitalization - solved
Posted by Mynabbler <my...@live.com>.
Bowie Bailey wrote:
>
> Ah. I missed the meta limiting it to 3 or more hits. If it works well,
> maybe we can add it to the stock ruleset.
>
Step 1 would be a check in someone's sandbox. And maybe a better meta than
freemail, since I do see some false positives in yahoo groups:
Spamassassin found from <XX...@returns.groups.yahoo.com> at
n73c.bullet.mail.sp1.yahoo.com [98.136.45.72] HELO
n73c.bullet.mail.sp1.yahoo.com to <XXX>
...snip,DKIM_SIGNED,DKIM_VALID,FREEMAIL_FROM,CAPSNOSPACE,MN_FMIWCAP,snip...
Subject: Re: [RebornDollsArtistCircle] Hello
so... a freemail post to a yahoo group that has three interword capitals in
the groupname is a false positive (in this case, by the way, the group
message _was_ spam).
A not 'CAPSNOSPACE' or a not yahoogroups would be in order to solve that.
CAPSNOSPACE is:
# Junk with CapsCrapMessageSubjects
header MN_CAPSNOSPACE Subject =~ /(?:[A-Z][a-z]+){4}/
describe MN_CAPSNOSPACE Subject ContainsFourWordsLikeThis
score MN_CAPSNOSPACE 1
--
View this message in context: http://old.nabble.com/Interword-capitalization-tp31521819p31586088.html
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
Re: Interword capitalization - solved
Posted by Bowie Bailey <Bo...@BUC.com>.
On 5/10/2011 9:22 AM, Mynabbler wrote:
> Bowie Bailey wrote:
>>> header __MN_IWCAP Subject =~ /[a-z][A-Z][a-z]/
>>> tflags __MN_IWCAP multiple
>>> meta MN_IWCAP __MN_IWCAP >= 3
>> So hopefully you aren't expecting any emails from a Hotmail user
>> discussing iPods or iPads....or McDonalds.... :)
> It searches for three occurrences or more. So, they would ought to compose a
> subject like "Shall I bring my iPod or my iPad to McDonalds", and daft
> enough to be using a free mail provider. Yes. In the meantime I only see the
> rule hitting spam:
>
> Subject: Typ eOfCap sule sSa tis fac tor yForVerySt ric tBuy er s
> Subject: SeeLate stPill sAma zingAdv ant ages
> Subject: TakeAdv an tag eOfToda y' sNe wTabl ets
> Subject: No velPillOff erAHoli sti cPro ce ssToHe al th
>
> ... and it is interesting to see how long it takes for the ruLese tTob ecoMe
> oBso letE because of changed tactics after publicly publishing a specific
> rule.
Ah. I missed the meta limiting it to 3 or more hits. If it works well,
maybe we can add it to the stock ruleset.
--
Bowie
Re: Interword capitalization - solved
Posted by Mynabbler <my...@live.com>.
Bowie Bailey wrote:
>
>> header __MN_IWCAP Subject =~ /[a-z][A-Z][a-z]/
>> tflags __MN_IWCAP multiple
>> meta MN_IWCAP __MN_IWCAP >= 3
>
> So hopefully you aren't expecting any emails from a Hotmail user
> discussing iPods or iPads....or McDonalds.... :)
>
It searches for three occurrences or more. So, they would ought to compose a
subject like "Shall I bring my iPod or my iPad to McDonalds", and daft
enough to be using a free mail provider. Yes. In the meantime I only see the
rule hitting spam:
Subject: Typ eOfCap sule sSa tis fac tor yForVerySt ric tBuy er s
Subject: SeeLate stPill sAma zingAdv ant ages
Subject: TakeAdv an tag eOfToda y' sNe wTabl ets
Subject: No velPillOff erAHoli sti cPro ce ssToHe al th
... and it is interesting to see how long it takes for the ruLese tTob ecoMe
oBso letE because of changed tactics after publicly publishing a specific
rule.
--
View this message in context: http://old.nabble.com/Interword-capitalization-tp31521819p31585518.html
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
Re: Interword capitalization - solved
Posted by Bowie Bailey <Bo...@BUC.com>.
On 5/10/2011 7:59 AM, Mynabbler wrote:
>
> Mynabbler wrote:
>> Does someone have a rule for interword capitalization?
>>
> Unfortunately no takers for the question. I came up with this:
>
> # Gibberish subjects like: Cap su lesOr de rsMad eFo rRar ePro du cts
> header __MN_IWCAP Subject =~ /[a-z][A-Z][a-z]/
> tflags __MN_IWCAP multiple
> meta MN_IWCAP __MN_IWCAP >= 3
> score MN_IWCAP 0.1
> meta MN_FMIWCAP (MN_IWCAP && FREEMAIL_FROM)
> score MN_FMIWCAP 3
> describe MN_FMIWCAP Found thRee intErword caPitalizations from a free
> mail address
>
> It searches for three or more occurrences in the subject and scores it when
> coming
> from a freemail address (just hotmail would have been enough... sigh).
So hopefully you aren't expecting any emails from a Hotmail user
discussing iPods or iPads....or McDonalds.... :)
--
Bowie