> -----Original Message----- > From: David Cary [mailto:[EMAIL PROTECTED] > Sent: Tuesday, July 29, 2003 3:00 PM > To: [EMAIL PROTECTED] > Subject: [SAtalk] [RD] rule discussion > > > Dear people annoyed at spam, > > I have an idea for a few rules, but I don't have any idea how > to implement > them. > > Here's the idea. Practically all the "ham" I receive has a > "signature" > section at the bottom. The signature repeats the name and > sometimes the > email address in the "From: " header. On the other hand, spam usually > doesn't have a signature, and when it does, it lists a > "return address" > completely different from the one in "From: " or "Reply-to: ". > Is there a way for SpamAssassin to match up the name in the > "From: " header > with a corresponding name in the signature block at the bottom ? > (the signature starts with a line that contains only "-- ", > pronounced > "return, dash, dash, space, return"). > > So I want rules like this: > > "If there is an email address in the body or signature, and > the last email > address matches the Reply-To: address (or, if there is none, > the From: > address), score -0.2" > "If there is an email address after the signature line, but > it matches > neither the Reply-To nor the From, score +0.2". > [I'm not sure how to handle the case of *multiple* email > addresses in the > signature] > "If there is no "-- " signature-start line, score +0.2" > "If the first 2 words after the signature-start line matches > the first 2 > words in the From: address, it looks like a real name -- score -0.2". > > How do I implement that ? > > > -- > David Cary
Well there are a couple of things here: 1) Good idea 2) Does have it's problems 3) Beyond rule writing. 1) In theory this would seem like a great idea. But not hard for the spammers to fake. But I do like it. 2) Simply using the "--" will just have spammers adding it. 3) This seems to be the topic recently. People would like to get a little better then simple rule writing. I haven't looked into writing eval tests at all. I think there is a good reason why there is little to no info on this. Devs don't need people messing with SA code ;) That said, is there a way to get local eval tests? Is there a good source of explanation (eval test for complete bumbling iditots.) on how to write these? This is pretty much a question for the devs. Before anyone gets crazy with the eval tests idea, I have seen many rules (meta) that will do exactly what you want. However in David's case, I can't think of a series of rules to do this. -Chris ------------------------------------------------------- This SF.Net email sponsored by: Free pre-built ASP.NET sites including Data Reports, E-commerce, Portals, and Forums are available now. Download today and enter to win an XBOX or Visual Studio .NET. http://aspnet.click-url.com/go/psa00100003ave/direct;at.aspnet_072303_01/01 _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
