Re: yahoo X-YMail-OSG

2010-06-03 Thread Ned Slider
On 06/03/2010 05:29 PM, LuKreme wrote: On 3-Jun-2010, at 03:27, Ned Slider wrote: Can we re-evaluate how useful this is, or maybe exclude To: and CC: headers? After several years I have trained all my users to use the Bcc header for any email going to more than 4 or 5 users and to address th

Re: yahoo X-YMail-OSG

2010-06-03 Thread LuKreme
On 3-Jun-2010, at 03:27, Ned Slider wrote: > > Can we re-evaluate how useful this is, or maybe exclude To: and CC: headers? After several years I have trained all my users to use the Bcc header for any email going to more than 4 or 5 users and to address those emails to themselves. To me, this

Re: yahoo X-YMail-OSG

2010-06-03 Thread Ned Slider
On 05/25/2010 12:14 AM, Adam Katz wrote: My original rule: header SINGLE_HEADER_2K ALL:raw =~ /^(?=.{2048,3071}$)/m Karsten Bräckelmann noted: It does not match a single header, let alone a *specific* header as the one mentioned, but ALL headers. It effectively checks the entire headers' s

Re: yahoo X-YMail-OSG

2010-05-24 Thread Adam Katz
My original rule: header SINGLE_HEADER_2K ALL:raw =~ /^(?=.{2048,3071}$)/m Karsten Bräckelmann noted: >>> It does not match a single header, let alone a *specific* >>> header as the one mentioned, but ALL headers. It effectively >>> checks the entire headers' size. Karsten then corrected

Re: yahoo X-YMail-OSG

2010-05-21 Thread Michael Scheidell
On 5/21/10 7:35 PM, Karsten Bräckelmann wrote: On Sat, 2010-05-22 at 00:13 +0200, Karsten Bräckelmann wrote: On Fri, 2010-05-21 at 17:43 -0400, Adam Katz wrote: header SINGLE_HEADER_2K ALL:raw =~ /^(?=.{2048,3071}$)/m It does not match a single header, let alone a *specifi

Re: yahoo X-YMail-OSG

2010-05-21 Thread Karsten Bräckelmann
On Sat, 2010-05-22 at 00:13 +0200, Karsten Bräckelmann wrote: > On Fri, 2010-05-21 at 17:43 -0400, Adam Katz wrote: > > header SINGLE_HEADER_2K ALL:raw =~ /^(?=.{2048,3071}$)/m > > It does not match a single header, let alone a *specific* header as the > one mentioned, but ALL headers. It effec

Re: yahoo X-YMail-OSG

2010-05-21 Thread Karsten Bräckelmann
On Fri, 2010-05-21 at 17:43 -0400, Adam Katz wrote: > header SINGLE_HEADER_2K ALL:raw =~ /^(?=.{2048,3071}$)/m It does not match a single header, let alone a *specific* header as the one mentioned, but ALL headers. It effectively checks the entire headers' size. As I understood it, the desired

Re: yahoo X-YMail-OSG

2010-05-21 Thread Adam Katz
your headers and in the body's content analysis details. Also, it doesn't add additional 1KB_HEADER hits for additional big headers. Instead, I've added the following to my sandbox: # Idea from Michael Scheidell of SECNAP on SA Users List 2010-05-08 # http://old.nabble.com/yahoo-X-YMai

Re: yahoo X-YMail-OSG

2010-05-10 Thread J.D. Falk
On May 8, 2010, at 8:18 AM, Michael Scheidell wrote: > Yahoo's own DKIM implementation? header signing? Neither. It's related to their anti-spam system, but not intended for end-user parsing. > would adding 1 point for each 1K of header length help? Interesting idea! I don't know the precise

yahoo X-YMail-OSG

2010-05-08 Thread Michael Scheidell
Yahoo's own DKIM implementation? header signing? I usually see very small < 100 chars in this header, but sometimes, I see HUGE, 8000 char X-YMail-OSG headers (always in spam) Rumor has it, that this gets bigger the more recipients are in the email, including Bcc recipients. Anyone run a ch