Daniel Quinlan wrote:
DQ> MIME_SUSPECT_NAME MIME filename does not match MIME content type
Sounds like a nice rule. Is this an eval which reads mailcap? Or an
apache-style mime.types file? Or just a simple rule where you're encoding the
type<->extension rules? I think if the rule looked like:
full MIME_SUSPECT eval:mime_suspect('/path/to/mime.types')
then if filenotfound in the eval, it'd maybe default to some standard list.
That'd be really, really neat.
DQ> Incidentally, "rawbody" seems to be misnamed since you don't seem to
DQ> get the raw body (meaning, 100% uncooked). I had to use get_body() to
DQ> get the original unmodified body.
I think rawbody gives you the uncooked MIME part, not the full body. I haven't
actually looked at what it gives you for a little while. I'll probably need to
figure out what it should give as I do the MIME::Tools migration.
DQ> Another idea: what about a negative score for emails containing RFC
DQ> 934 encapsulated messages?
Sounds like a good pair of rules.
C
_______________________________________________________________
Hundreds of nodes, one monster rendering program.
Now that's a super model! Visit http://clustering.foundries.sf.net/
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
