On Thursday 29 January 2009 18:21, Michael Monnerie wrote: > At least on our generally german e-mails, the following rules very often > cause false positives: > > 1.6 MY_CID_AND_CLOSING SARE cid and closing > 1.5 MY_CID_AND_STYLE SARE cid and style > 1.6 MY_CID_ARIAL2_CLOSING SARE cid arial2 closing > 1.6 MY_CID_ARIAL_STYLE SARE cid arial2 style > 1.5 MY_CID_AND_ARIAL2 SARE CID and Arial2 > > They are part of 70_sare_stocks and I'd like to know if others do not > have this problem or if it's a speciality of german e-mails?
I brought up that problem a while ago on this list. As the sare rules aren't
maintained any more I created this rule:
meta MY_CID_BUG MY_CID_AND_STYLE && MY_CID_AND_ARIAL2 &&
MY_CID_ARIAL_STYLE && MY_CID_AND_CLOSING && MY_CID_ARIAL2_CLOSING
describe MY_CID_BUG when 6 MY_CID_* rules hit, correct the score
score MY_CID_BUG -3
After activating the rule I haven't seen any more FP. But that doesn't mean
much. Here are my stats from yesterday:
Rank Hits % Msgs % Spam % Ham Score Rule
---- ---- ------ ------ ----- ----- ----
347 2 0.01% 0.06% 0.22% 1.46 MY_CID_AND_ARIAL2
371 1 0.01% 0.03% 0.02% 1.54 MY_CID_AND_STYLE
0 0.01% 0.00% 0.02% 1.58 MY_CID_ARIAL_STYLE
> I looked into the ruleset and found that all of the MY_CID rules refer
> to spam from 2006. Maybe those rules can be dismissed by now?
Yes, looks like that.
> mfg zmi
Greetings
Stefan
pgpAl7yvZr98E.pgp
Description: PGP signature
