Re: Meta GENERATOR tag

[Justin Mason <jm...@jmason.org>]

Karl Auer writes:
> Hi there.
> 
> What is this:
> 
> <META content=3D"MSHTML 6.00.2900.2995" name=3DGENERATOR>
> 
> I have been putting a score of 10 on this, because it seemed never to be
> in non-spam. It catches a LOT of spam that otherwise would slip under
> the radar. However, I've seen a few non-spams now that have this. It
> seems to happen when people send a message with both plain text and HTML
> from Outlook. Is that particularly common? I don't have many
> correspondents that do that.

interesting -- I have no FPs for that. nice ;)

I've put it in for testing -- if anyone spots an FP, I'd like a copy
if possible...

--j.

Re: Meta GENERATOR tag

[Theo Van Dinter <fe...@apache.org>]

On Thu, Dec 14, 2006 at 04:56:09PM +0000, Justin Mason wrote:
> with the qp-encoded "=3D"?  without, it seems iffy, but in
> my corpus it's a different matter with.

I have both, from a quick glance it looks like the majority use qp,
but either way I think it's a bad rule.

-- 
Randomly Selected Tagline:
A goal, is a dream with a deadline!

Re: Meta GENERATOR tag

[Theo Van Dinter <fe...@apache.org>]

On Thu, Dec 14, 2006 at 12:44:48PM +0000, Justin Mason wrote:
> > What is this:
> > <META content=3D"MSHTML 6.00.2900.2995" name=3DGENERATOR>

It's a header put in by what creates the HTML.  In this case, some Microsoft
product, I'd guess FrontPage or something.  Searching around for a minute on
Google produces things like:

"MSHTML 5.50 is the DLL for HTML editing that comes with Internet Explorer 5.5
(the version number changes with the version of IE installed). This means that
the author created that page with either FrontPage, Visual InterDev, or some
other product (most likely made by Microsoft) that uses IE as its design
view."

> > I have been putting a score of 10 on this, because it seemed never to be

Ouch.  Not a good idea imo, but it really depends on what kind of mails you
receive.

> > the radar. However, I've seen a few non-spams now that have this. It

Yep.  It's the generator, not necessarily a spam sign.

> interesting -- I have no FPs for that. nice ;)

I have a ton, a majority of hamtraps.

> I've put it in for testing -- if anyone spots an FP, I'd like a copy
> if possible...

I can send you a bunch of them if you really want, but IMO it's just a bad rule.

-- 
Randomly Selected Tagline:
"I don't even have to get dressed up for Halloween.  I go as me." - Judge Judy