You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@spamassassin.apache.org by John Hardin <jh...@impsec.org> on 2015/05/20 22:08:31 UTC
Something is wonky in masschecks
Check this out:
0 0 0 0.500 0.48 (n/a) __SPOOFED_FREEMAIL
0 3.7622 18.7236 0.167 0.40 0.01 T_SPOOFED_FREEMAIL
SPOOFED_FREEMAIL is just a scored meta of __SPOOFED_FREEMAIL. How can they
possibly have different hits?
http://ruleqa.spamassassin.org/?daterev=20150520-r1680490-n&rule=%2FSPOOFED_FREEMAIL
http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/khopesh/20_s25r.cf?r1=937743&r2=1678962&sortby=date&diff_format=h
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
Re: [SA-dev] Something is wonky in masschecks
Posted by Adam Katz <an...@khopis.com>.
On 05/21/2015 09:35 AM, John Hardin wrote:
> Adam, any objections to moving SPOOFED_FREEMAIL over to my sandbox?
Go ahead, you may take it. I think it has limited capacity as a
stand-alone rule and would advise against peppering it with too many
exclusions.
-Adam
Re: Something is wonky in masschecks
Posted by John Hardin <jh...@impsec.org>.
On Thu, 21 May 2015, Kevin A. McGrail wrote:
> On 5/20/2015 4:08 PM, John Hardin wrote:
>>
>> Check this out:
>>
>> 0 0 0 0.500 0.48 (n/a) __SPOOFED_FREEMAIL
>> 0 3.7622 18.7236 0.167 0.40 0.01 T_SPOOFED_FREEMAIL
>>
>> SPOOFED_FREEMAIL is just a scored meta of __SPOOFED_FREEMAIL. How can they
>> possibly have different hits?
>>
>> http://ruleqa.spamassassin.org/?daterev=20150520-r1680490-n&rule=%2FSPOOFED_FREEMAIL
>>
>> http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/khopesh/20_s25r.cf?r1=937743&r2=1678962&sortby=date&diff_format=h
>
> There is code to handle metas and auto promotion of sub rules but I don't
> know that it would handle the case where you have an identical rule as a sub
> rule and a full rule correctly. Why bother having both anyway?
When you want to use it as a component in other metas, and it might also
be a useful spam sign by itself, but if it isn't, you don't want the other
metas referring to a T_ rule...
So potentially changing the scored meta to be something like:
meta SPOOFED_FREEMAIL __SPOOFED_FREEMAIL && 1
...just so it's different, or adding some FP-avoidance stuff to the scored
rule, but I'm reluctant to do that to rules in somebody else's sandbox.
Adam, any objections to moving SPOOFED_FREEMAIL over to my sandbox?
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
W-w-w-w-w-where did he learn to n-n-negotiate like that?
-----------------------------------------------------------------------
4 days until Memorial Day - honor those who sacrificed for our liberty
Re: Something is wonky in masschecks
Posted by "Kevin A. McGrail" <KM...@PCCC.com>.
On 5/20/2015 4:08 PM, John Hardin wrote:
>
> Check this out:
>
> 0 0 0 0.500 0.48 (n/a) __SPOOFED_FREEMAIL
> 0 3.7622 18.7236 0.167 0.40 0.01 T_SPOOFED_FREEMAIL
>
> SPOOFED_FREEMAIL is just a scored meta of __SPOOFED_FREEMAIL. How can
> they possibly have different hits?
>
> http://ruleqa.spamassassin.org/?daterev=20150520-r1680490-n&rule=%2FSPOOFED_FREEMAIL
>
>
> http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/khopesh/20_s25r.cf?r1=937743&r2=1678962&sortby=date&diff_format=h
>
>
There is code to handle metas and auto promotion of sub rules but I
don't know that it would handle the case where you have an identical
rule as a sub rule and a full rule correctly. Why bother having both
anyway?
Regards,
KAM