On 01/12/17 10:54, Axb wrote:
On 12/01/2017 11:17 AM, Sebastian Arcus wrote:
On 30/11/17 12:45, Matus UHLAR - fantomas wrote:
On 28.11.17 19:39, Sebastian Arcus wrote:
I'm having more and more problems with the HTML_IMAGE_ONLY_* set of
rules recently generating false positives.
Plenty of business emails will include a logo at the bottom - and
not everybody is a graphics expert to make their logo a tiny
optimised gif or png - so some of these are slightly bigger than
they should be.
However, this seems to be sufficiently wide spread. Also, many
business emails can be just a few words reply - so the ratio of
words to images triggers the filter in SA. Could the scores on
HTML_IMAGE_ONLY_* set of rules be lowered a bit - or is there
anything else to be done - aside from educating all the internet on
optimising logos in the email signatures? :-)
those have lower scorew with BAYES and network rules enabled.
configure BAYES and enable netowrk rules...
Hi. I have BAYES enabled and DNSBL's enabled (I assume that's what you
mean by network rules?). I still think that a score of 1.6 is quite a
lot, considering that so many emails nowadays contain either an
embedded logo in the signature, with just a few words (in a quick
email reply, for example), or even images inserted, instead of
attached to the email. Please see below an example of a SA report:
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[212.227.126.131 listed in wl.mailspike.net]
0.4 MIME_HTML_MOSTLY BODY: Multipart message mostly text/html MIME
1.6 HTML_IMAGE_ONLY_24 BODY: HTML: images with 2000-2400 bytes of
words
2.0 BAYES_50 BODY: Bayes spam probability is 40 to 60%
[score: 0.4808]
0.8 MPART_ALT_DIFF BODY: HTML and text parts are different
0.0 HTML_MESSAGE BODY: HTML included in message
2.5 PYZOR_CHECK Listed in Pyzor (http://pyzor.sf.net/)
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at
http://www.dnswl.org/, no
trust
[212.227.126.131 listed in list.dnswl.org]
you've changed SA default scores and now complain about one which hasn't
been touched as cause for FPs?
compare the defaults with yours...
score PYZOR_CHECK 0 1.985 0 1.392 # n=0 n=2
score BAYES_50 0 0 2.0 0.8
hmmmm.... maybe you should rethink those changes.
Indeed, I did amend some of the default SA scores, to catch more spam
for the type of email received at this particular site. That doesn't
change the fact that 1.6 seems to me a pretty high score for a rule
which would be triggered on such a large number of ham emails. Just saying.
