from localhost (jalapeno [127.0.0.1])
	by jmason.org (Postfix) with ESMTP id B160F16F1E
	for <jm@localhost>; Thu,  5 Sep 2002 12:50:52 +0100 (IST)
from jalapeno [127.0.0.1]
	by localhost with IMAP (fetchmail-5.9.0)
	for jm@localhost (single-drop); Thu, 05 Sep 2002 12:50:52 +0100 (IST)
from usw-sf-list2.sourceforge.net (usw-sf-fw2.sourceforge.net
    [216.136.171.252]) by dogma.slashnull.org (8.11.6/8.11.6) with ESMTP id
    g85BdTZ17218 for <jm-sa@jmason.org>; Thu, 5 Sep 2002 12:39:30 +0100
from usw-sf-list1-b.sourceforge.net ([10.3.1.13]
    helo=usw-sf-list1.sourceforge.net) by usw-sf-list2.sourceforge.net with
    esmtp (Exim 3.31-VA-mm2 #1 (Debian)) id 17muyY-0002sW-00; Thu,
    05 Sep 2002 04:39:06 -0700
from relay05.indigo.ie ([194.125.133.229]) by
    usw-sf-list1.sourceforge.net with smtp (Exim 3.31-VA-mm2 #1 (Debian)) id
    17muxV-0001OC-00 for <spamassassin-talk@lists.sourceforge.net>;
    Thu, 05 Sep 2002 04:38:02 -0700
from ts12-167.dublin.indigo.ie (HELO spamassassin.taint.org)
    (194.125.172.167) by relay05.indigo.ie (qp 67309) with SMTP;
    5 Sep 2002 11:37:56 -0000
by spamassassin.taint.org (Postfix, from userid 500) id 0C81E16F21;
    Thu,  5 Sep 2002 12:22:05 +0100 (IST)
from spamassassin.taint.org (localhost [127.0.0.1]) by spamassassin.taint.org (Postfix)
    with ESMTP id 09402F7B1; Thu,  5 Sep 2002 12:22:05 +0100 (IST)
Re: [SAtalk] Trend: Spam disguised as newsletters
Message from
    "Kerry Nice"
    <kerry_nice@hotmail.com> of
    "Wed, 04 Sep 2002 18:25:44 EDT."
    <OE70qw5lPwexlPCo66S0000e176@hotmail.com>
From spamassassin-talk-admin@lists.sourceforge.net  Thu Sep  5 12:50:54 2002

"Kerry Nice" said:
> What about some reality check rules.  Yeah, you can pack in lots of things
> into the header to try and get some negative points, but do they all make
> sense in combination.  Can you have a Pine message id in the same header
> with an Outlook Express one or a Mutt User-Agent?
Yes, this is a big bonus of meta rules (new in 2.40); we can now
e.g. check for an Outlook-style forwarded message, and not give
it negative points unless it contains other signs of being from
Outlook.
> I think the headers should be paid special attention to.  The message
> content of something from the NY Times or Lockergnome might look spammy, but
> usually they don't forge or fake anything in the header.  Tone down the
> negative scores and ding them extra for any obvious forgeries.
When we get more (good) "nice" tests, the GA will assign lower
scores to them.  I think the current problem is that there are
very few really good nice tests in the current rulebase, and lots
of +ve tests that those newsletters hit, giving the GA a big
problem to solve.
--j.
-------------------------------------------------------
This sf.net email is sponsored by: OSDN - Tired of that same old
cell phone?  Get a new here for FREE!
https://www.inphonic.com/r.asp?r=sourceforge1&refcode1=vs3390
_______________________________________________
Spamassassin-talk mailing list
Spamassassin-talk@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk