Ok this is an interesting followup. Since I *know* that the gr_domain.cf file is being read (I needed to change the '15' scores in there to 1.5 to have a shot at receiving mail from providers like Mailchimp and Constant Contact) I added the
score HTML_FONT_LOW_CONTRAST 10 To *that* file, recompiled rules, and restarted spamd and voila, it is now scored at 10 rather the 0.1 And per other comments here a number of senders do the low contrast thing so what I *really* want are the ones where it is practically *no* contrast, is COLORx / (COLORx+1) LSB in one of the colors. (looking at source pages i see background #ffffff and text #fffffe for example. That suggests that local.cf is either not being read, or something comes along and sets the parameters after it sets them? I note that gr_domain comes lexically *before* local.cf so that is kind of confusing to me. --Chuck On Mon, Oct 8, 2018 at 11:19 AM John Hardin <jhar...@impsec.org> wrote: > On Mon, 8 Oct 2018, Chuck McManis wrote: > > > Hi, > > > > I restart spamd everytime I change local.cf and unfortunately John > changing > > the value as you've suggested and as I mentioned I had already tried, > > doesn't actually change the score it assigns. Still trying to figure this > > out. > > ...whoops, I didn't catch that, sorry... > > SA supports multiple config files, they are parsed in > sorted-by-filename-order. Are there multiple .cf files in your local > config folder and is the score for that rule being set in one that sorts > after the one you're editing? > > Also: if the score was zero it would be suppressed entirely. The score is > probably 0.001 (advisory). > > The base scores are: > > score HTML_FONT_LOW_CONTRAST 0.713 0.001 0.786 0.001 > > ...so depending on your config that score may be coming from base, and > your local changes *should* be overriding it. > > And - silly question - are you *sure* you're editing the *correct* local > config file? > > > > --Chuck > > > > On Mon, Oct 8, 2018 at 8:33 AM Kevin A. McGrail <kmcgr...@apache.org> > wrote: > > > >> I think he might also need to restart spamd/amavisd/whatever to have the > >> local.cf change take place. > >> -- > >> Kevin A. McGrail > >> VP Fundraising, Apache Software Foundation > >> Chair Emeritus Apache SpamAssassin Project > >> https://www.linkedin.com/in/kmcgrail - 703.798.0171 > >> > >> > >> On Mon, Oct 8, 2018 at 11:18 AM John Hardin <jhar...@impsec.org> wrote: > >> > >>> On Mon, 8 Oct 2018, Chuck McManis wrote: > >>> > >>>> I have been trying to tune scores to achieve better matches with spam > >>> that > >>>> is getting through. And one test which shows up is > >>> HTML_FONT_LOW_CONTRAST > >>>> which is being scored for 0. Doing a scan of my incoming mail flow > this > >>> is > >>>> a huge signal, perhaps even a disqualifying one as I have yet to find > a > >>>> legitimate piece of email where this is true and it isn't spam. > >>>> > >>>> So in my local.cf file I added: > >>>> > >>>> score HTML_FONT_LOW_CONTRAST 10 > >>>> > >>>> To have it add 10 points to the spam score, recompiled rules and > >>> restarted > >>>> spamd. Yet it still gives it 0 points. > >>>> > >>>> 0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or identical > to > >>>> background > >>>> > >>>> How do I change this value? > >>> > >>> In your local config file: > >>> > >>> score HTML_FONT_LOW_CONTRAST 1.000 # or whatever score you > prefer > >>> > >>> > >>> The reason it scores so low in the base ruleset is the S/O is *very* > low > >>> in the masscheck corpora - 0.114 - 4% spam hits vs. 31% ham hits. > >>> > >>> You might want to be careful if you intend to treat that as a poison > pill > >>> by itself... > >>> > >>> I'll take a look at whether its performance can be improved. > >>> > >>> -- > >>> John Hardin KA7OHZ > http://www.impsec.org/~jhardin/ > >>> jhar...@impsec.org FALaholic #11174 pgpk -a > jhar...@impsec.org > >>> key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79 > >>> ----------------------------------------------------------------------- > >>> Politicians never accuse you of "greed" for wanting other people's > >>> money, only for wanting to keep your own money. -- Joseph Sobran > >>> ----------------------------------------------------------------------- > >>> 557 days since the first commercial re-flight of an orbital booster > >>> (SpaceX) > >>> > >> > > > > -- > John Hardin KA7OHZ http://www.impsec.org/~jhardin/ > jhar...@impsec.org FALaholic #11174 pgpk -a jhar...@impsec.org > key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79 > ----------------------------------------------------------------------- > The call to let 16-year-olds vote is a call to amplify the votes > of teachers' unions. If you think political indoctrination in the > schools is bad now, wait until it has the direct power to tip > election results. -- Robert Tracinski > ----------------------------------------------------------------------- > 557 days since the first commercial re-flight of an orbital booster > (SpaceX) >
