Nigel Metheringham wrote:
NM> Melissa (if I had 1% of the money saved by some ISPs by that filter
NM> during the Melissa and its successors storms I would be writing this
NM> from my state-of-the-art wireless networked laptop whilst sipping a cold
NM> drink on a carribean beach :-) ).
I'll be th
On Fri, May 24, 2002 at 09:06:43AM -0700, Marc MERLIN wrote:
> > Its lame, I no longer use it much myself (theres a couple of places its
> > not been removed from) even though I wrote the thing, but its cheap
> > (money and MTA resources) and suprisingly effective against things like
>
> Yeah, I
On Fri, May 24, 2002 at 10:01:15AM +0100, Nigel Metheringham wrote:
> > You'd have thought the least a header regexp would do is bind to the
> > start of the line!
>
> The problem with the exim filter stuff is it was never designed to be
> able to do this and it *can't* bind to start of line (th
Nigel Metheringham wrote:
> The problem with the exim filter stuff is it was never designed to be
> able to do this and it *can't* bind to start of line (the string its
> matching against is a concaternated set of lines from the message -
> without newlines).
>
> Its lame, I no longer use it much
On Fri, 2002-05-24 at 09:40, Matt Sergeant wrote:
> Marc MERLIN wrote:
> > On Mon, May 20, 2002 at 09:59:55AM +0100, Matt Sergeant wrote:
> >
> >>Ugh, looks like SourceForge installed a lame text filter that attempts
> >>to do virus protection (incorrectly, brokenly)... So my email didn't get
>
Marc MERLIN wrote:
> On Mon, May 20, 2002 at 09:59:55AM +0100, Matt Sergeant wrote:
>
>>Ugh, looks like SourceForge installed a lame text filter that attempts
>>to do virus protection (incorrectly, brokenly)... So my email didn't get
>>through.
>
>
> Just in case you are curious, it's the "s
On Mon, May 20, 2002 at 09:59:55AM +0100, Matt Sergeant wrote:
> Ugh, looks like SourceForge installed a lame text filter that attempts
> to do virus protection (incorrectly, brokenly)... So my email didn't get
> through.
Just in case you are curious, it's the "standard" exim mime filter, and
Daniel Quinlan wrote:
DQ> Craig R Hughes writes:
DQ>
DQ> > full MIME_SUSPECT eval:mime_suspect('/path/to/mime.types')
DQ>
DQ> I looked at those MIME types that tended to be connected to unsolicited
DQ> email (spam and viruses) or generally frequent and hard-coded those
DQ> types. I also
Daniel Quinlan wrote:
> Matt Sergeant writes:
>
>
>>Every single one of these is a virus, not spam.
>
>
> I think it's a worm, actually
Call it what you like. It's still malicious code designed purely to
propogate (and perhaps do something evil while it does so). In no way is
it unsolicited
Matt Sergeant writes:
> Every single one of these is a virus, not spam.
I think it's a worm, actually, but the headers are forged so I don't
know who's sending them, so unlike a trojan being sent from a
co-worker, it's basically unsolicited email that should be filtered.
I think trying to not f
;
Date: Mon, 20 May 2002 09:30:34 +0100
From: Matt Sergeant <[EMAIL PROTECTED]>
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.0rc1)
Gecko/20020426
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: [EMAIL PROTECTED]
CC: [EMAIL PROTECTED], Vivek Khera <[EMAIL PROTECTED]>,
[
Craig R Hughes wrote:
> Matt Sergeant wrote:
>
> MS> My MIME parser (posted to the dev list) croaks on invalid MIME. In
> MS> testing about 30,000 emails it only croaks on spams, so far.
> MS>
> MS> I just wish I had time to implement it inside SA (it's a big job as
> MS> currently SA's mail pars
Craig R Hughes writes:
> Sounds like a nice rule. Is this an eval which reads mailcap? Or
> an apache-style mime.types file? Or just a simple rule where you're
> encoding the type<->extension rules? I think if the rule looked
> like:
>
> full MIME_SUSPECT eval:mime_suspect('/path/to
Matt Sergeant wrote:
MS> My MIME parser (posted to the dev list) croaks on invalid MIME. In
MS> testing about 30,000 emails it only croaks on spams, so far.
MS>
MS> I just wish I had time to implement it inside SA (it's a big job as
MS> currently SA's mail parsing is a bit all over the shop).
No
Daniel Quinlan wrote:
DQ> MIME_SUSPECT_NAME MIME filename does not match MIME content type
Sounds like a nice rule. Is this an eval which reads mailcap? Or an
apache-style mime.types file? Or just a simple rule where you're encoding the
type<->extension rules? I think if the rule look
Vivek Khera wrote:
> I read email with VM in XEmacs, and every once in a while it complains
> about bothced MIME like this:
>
> From: <[EMAIL PROTECTED]>
> To: <[EMAIL PROTECTED]>
> Subject: Learn How To Grow Your Portfolio
>9806Dl5
> Date: Wed, 15 May 2002
On Wed, May 15, 2002 at 07:56:40PM -0700, Daniel Quinlan wrote:
...
| Another idea: what about a negative score for emails containing RFC
| 934 encapsulated messages?
|
| $ egrep -hi '^--* end.* -*-$' *[0-9] | count
| 7 --- End of forwarded message ---
| 8 --- end
Dan> The NO_REAL_NAME is not too meaningful since it matches 423
Dan> messages with only 244 being spam...
This is one for which I suspect different people running the masses stuff
would get substantially different values, depending on their Internet
"circle of friends". I run a website
Vivek Khera <[EMAIL PROTECTED]> writes:
> I've had exactly 1 message in three years for which this missing
> boundary was not a SPAM (which seems to be some mailing list software
> that did that botching on an attachment). There doesn't seem to be a
> correlation with X-Mailer header, Does.
>
>
I read email with VM in XEmacs, and every once in a while it complains
about bothced MIME like this:
From: <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Subject: Learn How To Grow Your Portfolio
9806Dl5
Date: Wed, 15 May 2002 11:40:15 -0700
final =_NextP
20 matches
Mail list logo
