John D. Hardin wrote: >On Sun, 25 Jun 2006, Philip Prindeville wrote: > > > >>John D. Hardin wrote: >> >> >> >>>On Sat, 24 Jun 2006, Philip Prindeville wrote: >>> >>> >>> >>>>The spammers send multipart/alternative >>>>because they want the text/plain section to confuse the Bayes >>>>filters, since they know it won't be rendered... >>>> >>>> >>>It seems to me that right there is the spam sign you should be looking >>>for, then, and save all the heavy-duty mathematical analysis of the >>>images themselves. >>> >>> >>A lot of mailers generate multipart/alternative legitimately, >> >> > >No, I was thinking of multipart/alternative where one of the >alternative streams is nothing but images. That doesn't strike me as >legitimate. Can anyone think of a scenario where images *are* a >legitimate alternative representation of text? > > >
Well, let's instrument it and see... run the spam v. ham numbers. -Philip
