Re: Romance spam

2013-03-09 Thread Kenneth Porter
--On Thursday, March 07, 2013 11:26 PM +0100 Benny Pedersen m...@junc.eu wrote: only bayes hitting ?, and it autolearns ham ? Presumably the autolearn=ham applies to anything that doesn't get marked as spam. Once I move it to my Uncaught folder, it gets retrained that night as spam. But

Re: Checking for email attachment name for containing Javscript code that could get potentially executed when displayed on a webpage.

2013-03-09 Thread Martin Gregorie
On Sat, 2013-03-09 at 09:23 -0800, John Hardin wrote: Regarding that analogy, SA is not an antivirus tool, and any attempt to make it one would be met with resistance. SA is also not an email *security* tool. Agreed. If I thought I needed an antivirus tool I's run Clamav. An email

Re: Understanding spamhaus FP

2013-03-09 Thread Alex
Hi, I received an email that was tagged with KHOP_SPAMHAUS_DROP, which means it was listed in the Spamhaus Don't Route Or Peer List. However, I've checked every IP and domain in the email, and none are listed on any spamhaus list, even as of a minute ago. What is it in this message that is

Re: Romance spam

2013-03-09 Thread Benny Pedersen
Kenneth Porter skrev den 2013-03-09 14:44: Presumably the autolearn=ham applies to anything that doesn't get marked as spam. nope, it still need to score below -0.1 to learn as ham, so i would check whitelist scores, or scores that hits on negatives Once I move it to my Uncaught folder,

Re: Checking for email attachment name for containing Javscript code that could get potentially executed when displayed on a webpage.

2013-03-09 Thread Martin Gregorie
On Sat, 2013-03-09 at 09:23 -0800, John Hardin wrote: On Sat, 9 Mar 2013, Martin Gregorie wrote: Presumably the, ahem, misguided js interpretation is being triggered by the script/script tags, so wouldn't the regex I've used here mimeheader JS_TRAP_RULE name =~ /script/ be a more

Re: Checking for email attachment name for containing Javscript code that could get potentially executed when displayed on a webpage.

2013-03-09 Thread Martin Gregorie
On Sat, 2013-03-09 at 20:56 +, Martin Gregorie wrote: Correction: describe SCRIPTED_NAME Attachment name or filename is a script mimeheader __SCRIPTN1Content-Type =~ /name.*\=.*script/ mimeheader __SCRIPTN2Content-Disposition =~ /filename.*\=.*script/ meta SCRIPTED_NAME