Re: charset=utf-16 tricks out SA

2015-10-08 Thread John Wilcock
Le 08/10/2015 17:34, Reindl Harald a écrit : Content-Type: text/plain; charset=utf-16 Content-Transfer-Encoding: base64 no custom body rules hit like they do for ISO/UTF8 :-( What is your normalize_charsets setting? -- John

Re: Help with RegEx Rule

2015-10-08 Thread AK
On 09/10/15 15:10, Kevin A. McGrail wrote: Perhaps you'll have more luck looking at the debug output from SA itself? Something like spamassassin -t -D < email.mbox 2>&1 | grep -i RULE Nope, no luck there either; did not see mention of my rule (though it's located inside /etc/spamassassin/

Re: Help with RegEx Rule

2015-10-08 Thread Kevin A. McGrail
On 10/9/2015 12:07 AM, AK wrote: On 20/09/15 03:07, Dave Funk wrote: Notes: 1) Due to SA pre-processing collapsing body into one long line, cannot match on '^' repeatedly, need to look for '\n' as line break indicator. Find start of a line and then following repeats of ".\n" Dave, I've bee

Re: Help with RegEx Rule

2015-10-08 Thread AK
On 20/09/15 03:07, Dave Funk wrote: Notes: 1) Due to SA pre-processing collapsing body into one long line, cannot match on '^' repeatedly, need to look for '\n' as line break indicator. Find start of a line and then following repeats of ".\n" Dave, I've been creating my own regular expressi

Re: charset=utf-16 tricks out SA

2015-10-08 Thread Kevin A. McGrail
Please open a bug especially if this is seen in the wild! On 10/8/2015 11:34 AM, Reindl Harald wrote: Content-Type: text/plain; charset=utf-16 Content-Transfer-Encoding: base64 no custom body rules hit like they do for ISO/UTF8 :-(

charset=utf-16 tricks out SA

2015-10-08 Thread Reindl Harald
Content-Type: text/plain; charset=utf-16 Content-Transfer-Encoding: base64 no custom body rules hit like they do for ISO/UTF8 :-( signature.asc Description: OpenPGP digital signature

Re: Investigating facebook spam

2015-10-08 Thread RW
On Thu, 8 Oct 2015 13:59:31 +0100 RW wrote: > On Thu, 8 Oct 2015 13:13:57 +0100 > RW wrote: > > > On Tue, 6 Oct 2015 17:05:48 -0400 > > Kevin A. McGrail wrote: > > > > > On 10/6/2015 5:01 PM, Jered Floyd wrote: > > > > Ah; good eyes! > > > > > > > > That KAM_FACEBOOK rule is dangerous. > > > The

Re: Investigating facebook spam

2015-10-08 Thread RW
On Thu, 8 Oct 2015 13:13:57 +0100 RW wrote: > On Tue, 6 Oct 2015 17:05:48 -0400 > Kevin A. McGrail wrote: > > > On 10/6/2015 5:01 PM, Jered Floyd wrote: > > > Ah; good eyes! > > > > > > That KAM_FACEBOOK rule is dangerous. > > The behavior of forwarding content which effectively is the same as >

Re: Investigating facebook spam

2015-10-08 Thread RW
On Tue, 6 Oct 2015 17:05:48 -0400 Kevin A. McGrail wrote: > On 10/6/2015 5:01 PM, Jered Floyd wrote: > > Ah; good eyes! > > > > That KAM_FACEBOOK rule is dangerous. > The behavior of forwarding content which effectively is the same as a > forgery is where the danger lies... If this is behavior th

Re: Help with RegEx Rule

2015-10-08 Thread Anthony Kamau
On 20/09/15 03:07, Dave Funk wrote: Notes: 1) Due to SA pre-processing collapsing body into one long line, cannot match on '^' repeatedly, need to look for '\n' as line break indicator. Find start of a line and then following repeats of ".\n" Dave, I need to see the mail message as spamassas