Re: Arabic Spam

2010-05-29 Thread Karsten Bräckelmann
> > Not as far as ok_locales and the respective CHARSET_FARAWAY rules are > > concerned, IIRC. They have been written long ago to trigger on the > > char-sets used. They don't detect the char-set based on the actual > > payload. > > So where does that leave us? With the need for an update or addi

RE: Arabic Spam

2010-05-26 Thread Giampaolo Tomassoni
> From: Jason Bertoch [mailto:ja...@i6ix.com] > Sent: Wednesday, May 26, 2010 3:34 PM > On 2010/05/25 7:02 PM, Karsten Bräckelmann wrote: > > On Wed, 2010-05-26 at 10:35 +1200, Jason Haar wrote: > > > > Not as far as ok_locales and the respective CHARSET_FARAWAY rules are > > concerned, IIRC. They

Re: Arabic Spam

2010-05-26 Thread Jason Bertoch
On 2010/05/25 7:02 PM, Karsten Bräckelmann wrote: On Wed, 2010-05-26 at 10:35 +1200, Jason Haar wrote: Not as far as ok_locales and the respective CHARSET_FARAWAY rules are concerned, IIRC. They have been written long ago to trigger on the char-sets used. They don't detect the char-set based on

Re: Arabic Spam

2010-05-25 Thread Karsten Bräckelmann
On Wed, 2010-05-26 at 10:35 +1200, Jason Haar wrote: > On 05/26/2010 05:24 AM, Karsten Bräckelmann wrote: > > Unfortunately, in this case, the fact that it isn't a proper, raw > > message is not irrelevant. The ok_locales setting, which is part of your > > original question, depends on the char-set

Re: Arabic Spam

2010-05-25 Thread Jason Haar
On 05/26/2010 05:24 AM, Karsten Bräckelmann wrote: > > Unfortunately, in this case, the fact that it isn't a proper, raw > message is not irrelevant. The ok_locales setting, which is part of your > original question, depends on the char-set used. Which is missing from > the sample. We only can assu

Re: Arabic Spam

2010-05-25 Thread Karsten Bräckelmann
On Tue, 2010-05-25 at 12:51 -0400, Jason Bertoch wrote: > On 2010/05/25 10:48 AM, Karsten Bräckelmann wrote: > > It is not a FN. It isn't even a proper message. > > > > That's some headers, plus a screen-scraped, rendered version of the > > message, including the most common headers displayed to th

Re: Arabic Spam

2010-05-25 Thread Jason Bertoch
On 2010/05/25 10:48 AM, Karsten Bräckelmann wrote: On Mon, 2010-05-24 at 09:27 -0400, Jason Bertoch wrote: A user reported the following FN [...] It is not a FN. It isn't even a proper message. That's some headers, plus a screen-scraped, rendered version of the message, including the most com

RE: Arabic Spam

2010-05-25 Thread Giampaolo Tomassoni
> On Mon, 2010-05-24 at 09:27 -0400, Jason Bertoch wrote: > > A user reported the following FN [...] > > It is not a FN. It isn't even a proper message. > > That's some headers, plus a screen-scraped, rendered version of the > message, including the most common headers displayed to the user. > >

Re: Arabic Spam

2010-05-25 Thread Karsten Bräckelmann
On Mon, 2010-05-24 at 09:27 -0400, Jason Bertoch wrote: > A user reported the following FN [...] It is not a FN. It isn't even a proper message. That's some headers, plus a screen-scraped, rendered version of the message, including the most common headers displayed to the user. Without a RAW sam

Re: Arabic Spam

2010-05-25 Thread Jason Bertoch
On 2010/05/24 6:17 PM, Jason Haar wrote: On 05/25/2010 09:47 AM, RW wrote:. My guess is that none of of these is being hit because there's enough English mixed-in with the Arabic. I think the "FARAWAY" rules and other locale checks are dependent on email using the old, pre-Unicode "charset" fo

RE: Arabic Spam

2010-05-24 Thread Giampaolo Tomassoni
> On 05/25/2010 09:47 AM, RW wrote:. > > My guess is that none of of these is being hit because there's > > enough English mixed-in with the Arabic. > > > I think the "FARAWAY" rules and other locale checks are dependent on > email using the old, pre-Unicode "charset" formatting. > > Yesterday I h

Re: Arabic Spam

2010-05-24 Thread Jason Haar
On 05/25/2010 09:47 AM, RW wrote:. > My guess is that none of of these is being hit because there's > enough English mixed-in with the Arabic. > I think the "FARAWAY" rules and other locale checks are dependent on email using the old, pre-Unicode "charset" formatting. Yesterday I had some G

Re: Arabic Spam

2010-05-24 Thread RW
On Mon, 24 May 2010 16:21:15 -0400 Jason Bertoch wrote: > I was really more interested in the language aspect, though. I > expected to see more rules match because of my ok_locales setting. > To be honest, I really don't know which rules look at that setting. AFAIK the point of ok_locales is t

Re: Arabic Spam

2010-05-24 Thread Jason Bertoch
On 2010/05/24 1:50 PM, Giampaolo Tomassoni wrote: Jason was speaking about a FN, not an FP. Am I missing something? Yes, this was a FN. These are the findings with one of my setup (SA 3.3.1, all locales allowed): Content analysis details: (11.8 points, 5.0 required) pts rule name

RE: Arabic Spam

2010-05-24 Thread Giampaolo Tomassoni
> On Mon, 24 May 2010, Jason Bertoch wrote: > At a guess I would say the bulk of your score is attributed to the > URI in the body that has been flagged as being on the SURBL blocklist. > > Beyond that, the issue seems to be that they have used a body 'type' of > text/html without actually using H

Re: Arabic Spam

2010-05-24 Thread Charles Gregory
On Mon, 24 May 2010, Jason Bertoch wrote: A user reported the following FN to me which is written in an Arabic character set. I have "ok_locales en" set, but I don't see any rules hitting that appear language related. I also found the normalize_charset option, but don't know if it will help o