Thank you for taking the time to write this detailed reply. >>>>> On Sat, 29 Mar 2003 16:01:10 -0600 (CST), Shane Williams <[EMAIL PROTECTED]> said:
>> On Sat, 29 Mar 2003, Chris Martin wrote: This spam (about a generic >> version of a medicine (?) with a name beginning with V) has been >> processed by SpamAssassin 2.50 and the original message is in a >> MIME part. Shane> This is due to a change in the default behavior of SA in 2.5x Shane> called safe report. Look in the SA documentation for Shane> report_safe (which can be turned off and may be what you want). Yes, this behaviour is due to the setup at the ISP, SA is used differently here on this machine. >> Passing the whole email through razor-check gives the result "not >> spam". Shane> This is because the "whole" mail you're referring to sounds Shane> like the email that SA now surrounds the original spam in (so Shane> that people don't even get an eyefull of anything offensive, Shane> web-bugged images don't display, etc. Yes again -- I hadn't thought carefully enough about it. >> Well, the surrounding text of the whole email as received must have >> changed the signature, but there have been emails which have not >> been processed by SpamAssassin (one offering diplomas) which are >> clearly spam but which are said _not_ to be spam. Shane> Not sure what this is about. Yes _again_: it seems so clear in my own head -- can heads be sent as MIME parts? Shane> If SA isn't processing it, then what is "saying" it's not spam? This was an email which had been tagged as spam on the local machine where SA is used just to return a status code which is then used by procmail to determine the folder the message is to be put in. Other spams like this (plain email unprocessed by SA) show up as "catalogued" when passed to razor-check but this particular one, which I reported on March 25, still shows up as "not catalogued". Since Razor relies on timely intervention, does it ignore reports which are sent more than x hours late (whatever "late" may be)? >> This one (the diploma one) has two extra headers due to POPing it >> from the ISP and delivering it locally but, otherwise, the text is >> much the same as everybody else gets -- the To: header has four >> addresses on it which presumably change during the spammer's run. >> >> Even removing these two local headers doesn't change the decision >> that it is not spam. Shane> I think this needs to be in big bold print somewhere because so Shane> many people aren't aware of it, but Razor pays no attention to Shane> headers at all. Razor doesn't care where it came from or what Shane> program sent it (SA cares about such things, but not Razor). Shane> It only hashes the email body itself. Thank you. I hadn't realized that. That must be what it means when it says (razor-check -d) Mar 29 10:23:29.229520 check[4067]: [ 6] preproc: mail 1.0 went from 3472 bytes to 762 >> Obviously, the SpamAssassin processed ones must be unprocessed >> before checking and, if necessary, reporting but should anything be >> done about the other ones before checking/reporting? Shane> Again, search for report_safe in SA documentation (or on the Shane> mailing list archive), since it sounds like you may want to Shane> turn it off. Also, note that SA is now at 2.52 to fix a few Shane> bugs, particularly in the bayesian learning code. I will check but I think the app I use to report spam to SpamCop and Razor only sends the "original" email to Razor (and, of course, SpamCop). >> P.S. Which exactly are the CF values in the output? Shane> Borrowing from someone else's recent post, here's a line where Shane> you can see the cf value (20, in this case, right before the >= Shane> min_cf): Shane> sig=6NGa2mSKjG-Bq7AMOBWKgd0vjEQA: Is spam: cf 20 >= min_cf 6 Yes, I saw this post immediately after I'd sent off the question... ------------------------------------------------------- This SF.net email is sponsored by: The Definitive IT and Networking Event. Be There! NetWorld+Interop Las Vegas 2003 -- Register today! http://ads.sourceforge.net/cgi-bin/redirect.pl?keyn0001en _______________________________________________ Razor-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/razor-users
