Re: False positives due to __BITCOIN_ID

2019-12-03 Thread RW
On Tue, 3 Dec 2019 11:27:11 -0800 (PST) John Hardin wrote: > On Tue, 3 Dec 2019, Mark London wrote: > > > It seems to me that the rule for detecting a BITCOIN in an email, > > is incorrect. See below: > > > > body __BITCOIN_ID /\b(? > > > Why is there a \s in this rule?I didn't think that a

Re: False positives due to __BITCOIN_ID

2019-12-03 Thread John Hardin
On Tue, 3 Dec 2019, Mark London wrote: It seems to me that the rule for detecting a BITCOIN in an email, is incorrect. See below: body __BITCOIN_ID /\b(?Why is there a \s in this rule?I didn't think that a BITCOIN id has a space. Recent obfuscation seen in RL extortion spams. This ru

Re: False positives due to __BITCOIN_ID

2019-12-03 Thread RW
On Tue, 3 Dec 2019 14:05:10 -0500 Mark London wrote: > It seems to me that the rule for detecting a BITCOIN in an email, is > incorrect. See below: > > body __BITCOIN_ID /\b(? > Why is there a \s in this rule?I didn't think that a BITCOIN id > has a space. It doesn't, but spammers have s

False positives due to __BITCOIN_ID

2019-12-03 Thread Mark London
It seems to me that the rule for detecting a BITCOIN in an email, is incorrect. See below: body __BITCOIN_ID /\b(?Why is there a \s in this rule?I didn't think that a BITCOIN id has a space. This rule is triggered, on a simple line like this, because of the fact that the line has a "1"

Re: spamassassin dkim says invalid

2019-12-03 Thread Henrik K
On Tue, Dec 03, 2019 at 11:42:21AM +0100, Benny Pedersen wrote: > On 2019-12-03 10:26, Henrik K wrote: > > >Tried with 3.4.2, 3.4.3, trunk, all result in DKIM_VALID > >$ spamassassin -t -D dkim < benny.eml > > good > > >$ perl -MMail::DKIM::Verifier -e 'print $Mail::DKIM::Verifier::VERSION' > >0

Re: spamassassin dkim says invalid

2019-12-03 Thread Benny Pedersen
On 2019-12-03 10:26, Henrik K wrote: Tried with 3.4.2, 3.4.3, trunk, all result in DKIM_VALID $ spamassassin -t -D dkim < benny.eml good $ perl -MMail::DKIM::Verifier -e 'print $Mail::DKIM::Verifier::VERSION' 0.53 maked gentoo ebuild for 0.58 solved it for me :=) in 3.4.3 set minimal vers

Re: spamassassin dkim says invalid

2019-12-03 Thread Henrik K
On Tue, Dec 03, 2019 at 10:17:23AM +0100, Benny Pedersen wrote: > On 2019-12-03 10:10, Henrik K wrote: > > >Anyway, that code is not identical to SA, which goes like this in 3.4: > > > >my $msg = do { local $/; }; # Slurp > >$msg =~ s/\012/\015\012/gs; > >$dkim->PRINT($msg); > > > >Your code woul

Re: spamassassin dkim says invalid

2019-12-03 Thread Benny Pedersen
On 2019-12-03 10:10, Henrik K wrote: Anyway, that code is not identical to SA, which goes like this in 3.4: my $msg = do { local $/; }; # Slurp $msg =~ s/\012/\015\012/gs; $dkim->PRINT($msg); Your code would break with missing line terminator at message end I think. https://metacpan.org/po

Re: spamassassin dkim says invalid

2019-12-03 Thread Henrik K
On Tue, Dec 03, 2019 at 09:56:58AM +0100, Benny Pedersen wrote: > > # read an email from stdin, pass it into the verifier > while () > { > # remove local line terminators > chomp; > s/\015$//; > > # use SMTP line terminators > $dkim->PRINT("$_\015\012"); > } Anyway, that code

Re: spamassassin dkim says invalid

2019-12-03 Thread Henrik K
On Tue, Dec 03, 2019 at 09:56:58AM +0100, Benny Pedersen wrote: > > while this simple perl gives pass > > # how to use > cat email | above.pl > > known problem ? Impossible to know without SA version and sample message?

spamassassin dkim says invalid

2019-12-03 Thread Benny Pedersen
while this simple perl gives pass # verify a message use Mail::DKIM::Verifier; # create a verifier object my $dkim = Mail::DKIM::Verifier->new(); # read an email from stdin, pass it into the verifier while () { # remove local line terminators chomp; s/\015$//; # use SMTP line