http://bugzilla.spamassassin.org/show_bug.cgi?id=3131





------- Additional Comments From [EMAIL PROTECTED]  2004-03-06 07:53 -------
This rule was not intended to be used standalone, but as part of a meta to 
catch the particular spams.  These spams have about 4 identifying 
characteristics that between them are quite unique.  Loosing any of the parts 
of the meta increases the likelyhood of a FP considerably.

As of last night, the combined meta has been catching my spams with no FPs on a 
100K corpus.  The particular case that I had to code with a full body search 
does indeed produce many FPs by itself.

The new strain of spams we are starting to see have very small bodies, often in 
plain text, and do NOT contain all of the usual obfuscation tricks that are so 
easy to detect and filter out.  Filtering them can be quite tricky, and the 
possibility of FPs higher than on more traditional spam, so the rules have to 
be watched carefully and tweaked as necessary rather than thrown in a box and 
forgotten.

Note I am NOT proposing this rule as part of the SA main tests; it would not be 
approprate.  It IS however appropriate for this current particular spam when 
used with other tests.




------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.

Reply via email to