On 07/30/2014 05:05 PM, Kevin A. McGrail wrote:
On 7/30/2014 10:58 AM, Axb wrote:
On 07/30/2014 04:52 PM, Kevin A. McGrail wrote:
On 7/30/2014 10:50 AM, Axb wrote:
The concept of this rule just tells me that it's wrong..
meta __TO_NO_BRKTS_MSFT __TO_NO_ARROWS_R &&
!__TO_UNDISCLOSED && (__ANY_OUTLOOK_MUA || __MIMEOLE_MS)
welcome to 2014
"X-Mailer: Microsoft Windows Live Mail"
where is the exception for that? .-)
and if you add it so what? even more bloat...
But the real-world S/O shows it is a spammy indicator. When we can, we
need to pastebin a sample to discuss this effectively.
with a LIMIT of 3.5 ????
header RCVD_HOTMAIL Received =~ /\.hotmail\.com/
also a sign of spamminess in our corpus
may I submit and limit 3.5?
You'd nuke instantly and call me all sorta names...
scr :)
Perhaps but my general rule is I look for a rule to have a hit of 1 to 1.5.
A meta rule combines other rules and can therefore be combined to have a
higher ceiling score.
Additionally, I am not anti-poison pills because I don't block email
using RBLs or Spam Scores so I have promoted some very high scoring
rules. KAM.cf is evidence of that.
In the end, you are asking us to change the score of a rule without a
spample and with no evidence in ruleqa that it's warranted.
To synopsize: This appears to be an effective rule at blocking spam with
at least one theoretical FP and tweaking it is my recommended course of
action.
I love poison pill rules.. but this rule doesn't qualify. It's suicidal :)
Obviously our ham corpus is not good enough and I can hardly ask my
client to supply 2 msgs which will make zero difference if the score is
forced limit of 3.5
