Re: HTTPS_HTTP_MISMATCH and explanation

2016-09-26 Thread RW
On Mon, 26 Sep 2016 09:16:43 -0400 Joe Quinn wrote: > On 9/26/2016 8:54 AM, RW wrote: > > Informational rules do that, but IIRC __RULES are simply a special > > case. > > > Hmm, you're probably right on that point. I can't find anything in > the source that behaves that way, but the documentatio

Re: HTTPS_HTTP_MISMATCH and explanation

2016-09-26 Thread Joe Quinn
On 9/26/2016 8:54 AM, RW wrote: Informational rules do that, but IIRC __RULES are simply a special case. Hmm, you're probably right on that point. I can't find anything in the source that behaves that way, but the documentation claims that's how it works and I also don't see anything to suppor

Re: HTTPS_HTTP_MISMATCH and explanation

2016-09-26 Thread RW
On Mon, 26 Sep 2016 08:26:27 -0400 Joe Quinn wrote: > On 9/25/2016 9:25 PM, Sean Greenslade wrote: > > On Sun, Sep 25, 2016 at 07:57:37PM -0400, Alex wrote: > >> I think the rule still has a use, perhaps in a meta or something. > > I believe (though don't quote me on this) that a zero-weight r

Re: HTTPS_HTTP_MISMATCH and explanation

2016-09-26 Thread Joe Quinn
On 9/25/2016 9:25 PM, Sean Greenslade wrote: On Sun, Sep 25, 2016 at 07:57:37PM -0400, Alex wrote: I think the rule still has a use, perhaps in a meta or something. I believe (though don't quote me on this) that a zero-weight rule will still be checked if it's used as part of a metarule. --Sea

Re: HTTPS_HTTP_MISMATCH and explanation

2016-09-25 Thread Sean Greenslade
On Sun, Sep 25, 2016 at 07:57:37PM -0400, Alex wrote: > I think the rule still has a use, perhaps in a meta or something. I believe (though don't quote me on this) that a zero-weight rule will still be checked if it's used as part of a metarule. --Sean

Re: HTTPS_HTTP_MISMATCH and explanation

2016-09-25 Thread Alex
Hi, > I had to add a rule weight for this rule to get it to trigger, so > evidently the latest ML rules weights have disabled this rule. > > Anyway, this is what triggered it: > >>https://www.google.com/url?q=3Dhttps%= >> 3A%2F%2Fglobal.gotomeetinA.com%2Fjoin%2F72626550

Re: HTTPS_HTTP_MISMATCH and explanation

2016-09-25 Thread Sean Greenslade
On Sun, Sep 25, 2016 at 04:51:20PM -0400, Alex wrote: > On Sun, Sep 25, 2016 at 4:41 PM, Sean Greenslade > wrote: > > On Sun, Sep 25, 2016 at 03:54:53PM -0400, Alex wrote: > >> > If you want to see what that rule's code looks like, here's a link: > >> > > >> > https://fossies.org/dox/Mail-SpamAssa

Re: HTTPS_HTTP_MISMATCH and explanation

2016-09-25 Thread RW
On Sun, 25 Sep 2016 12:52:57 -0700 jdow wrote: > These days even mixed links, some https and some simple http, is > suspicious. There's nothing in this for a spammer, it's just a sign of carelessness.

Re: HTTPS_HTTP_MISMATCH and explanation

2016-09-25 Thread Alex
On Sun, Sep 25, 2016 at 4:41 PM, Sean Greenslade wrote: > On Sun, Sep 25, 2016 at 03:54:53PM -0400, Alex wrote: >> > If you want to see what that rule's code looks like, here's a link: >> > >> > https://fossies.org/dox/Mail-SpamAssassin-3.4.1/classMail_1_1SpamAssassin_1_1Plugin_1_1HTTPSMismatch.ht

Re: HTTPS_HTTP_MISMATCH and explanation

2016-09-25 Thread Sean Greenslade
On Sun, Sep 25, 2016 at 03:54:53PM -0400, Alex wrote: > > If you want to see what that rule's code looks like, here's a link: > > > > https://fossies.org/dox/Mail-SpamAssassin-3.4.1/classMail_1_1SpamAssassin_1_1Plugin_1_1HTTPSMismatch.html > > > > It's possible there is a bug in that rule. If you s

Re: HTTPS_HTTP_MISMATCH and explanation

2016-09-25 Thread Alex
Hi, On Sun, Sep 25, 2016 at 3:46 PM, Sean Greenslade wrote: > On Sun, Sep 25, 2016 at 03:39:20PM -0400, Alex wrote: >> I think it must be something more than that. I've included the HTML >> component of an FP I received, and I don't see any occurrences of an >> https link where the text component

Re: HTTPS_HTTP_MISMATCH and explanation

2016-09-25 Thread jdow
On 2016-09-25 12:39, Alex wrote: Hi, On Sun, Sep 25, 2016 at 3:29 PM, Sean Greenslade wrote: On Sun, Sep 25, 2016 at 03:12:00PM -0400, Alex wrote: Hi, I'm seeing quite a few FPs with HTTPS_HTTP_MISMATCH and its score of 2.0. Isn't that kind of high for a rule that doesn't even have a descript

Re: HTTPS_HTTP_MISMATCH and explanation

2016-09-25 Thread jdow
Yeah, it should have a much higher score. {O.O} On 2016-09-25 12:12, Alex wrote: Hi, I'm seeing quite a few FPs with HTTPS_HTTP_MISMATCH and its score of 2.0. Isn't that kind of high for a rule that doesn't even have a description? Can someone explain what the rule does, and consider whether i

Re: HTTPS_HTTP_MISMATCH and explanation

2016-09-25 Thread Sean Greenslade
On Sun, Sep 25, 2016 at 03:39:20PM -0400, Alex wrote: > I think it must be something more than that. I've included the HTML > component of an FP I received, and I don't see any occurrences of an > https link where the text component is just http, or even vice-versa. > > http://pastebin.com/BNM9sLR

Re: HTTPS_HTTP_MISMATCH and explanation

2016-09-25 Thread Alex
Hi, On Sun, Sep 25, 2016 at 3:29 PM, Sean Greenslade wrote: > On Sun, Sep 25, 2016 at 03:12:00PM -0400, Alex wrote: >> Hi, I'm seeing quite a few FPs with HTTPS_HTTP_MISMATCH and its score >> of 2.0. Isn't that kind of high for a rule that doesn't even have a >> description? >> >> Can someone exp

Re: HTTPS_HTTP_MISMATCH and explanation

2016-09-25 Thread Sean Greenslade
On Sun, Sep 25, 2016 at 03:12:00PM -0400, Alex wrote: > Hi, I'm seeing quite a few FPs with HTTPS_HTTP_MISMATCH and its score > of 2.0. Isn't that kind of high for a rule that doesn't even have a > description? > > Can someone explain what the rule does, and consider whether its score > should be