We should forget SpamAddIn in this discussion. It certainly does not work, because the original message is in attachment (if it came from SAproxy), and SpamAddIn does not handle that attachment at all. If you use SpamAddIn's filtering, then the message is intact, and the spam status is in attachment. But let's forget SpamAddIn for now.
What I want to know: If I use Outlook Express and SAproxy, and get *SPAM*, then the original message is in attachment, and spam status is in headers, and also the message body has changed, it contains now "Content analysis details". What if I create a mbox of these messages with DbxConv, so that the original message is still in attachment, does sa-learn detect this and only process the attachment? ----- Original Message ----- From: "Dean Gallea" <[EMAIL PROTECTED]> To: "'Harri Pesonen'" <[EMAIL PROTECTED]>; <[EMAIL PROTECTED]>; <[EMAIL PROTECTED]> Cc: "'Dan Wing'" <[EMAIL PROTECTED]>; "'Theo Van Dinter'" <[EMAIL PROTECTED]>; "'Mike Burger'" <[EMAIL PROTECTED]> Sent: Sunday, August 10, 2003 5:42 PM Subject: RE: [SAtalk] Re: [Spamassassin-saproxy] Outlook Add-In for SpamAssassin is here Folks: This is from the SpamAssassin FAQ: " If you run sa-learn on a mail folder that includes messages with the SpamAssassin markup (X-Spam-Status headers, "real" message encapsulated as a message/rfc822 MIME part, Subject header tagged etc.), it'll automatically remove the markup on the fly. " So, the question breaks down to whether Harri's processing of the spam email being learned 1) keeps its X-Spam-Status flag and 2) has the original message "encapsulated as a message/rfc822 MIME part". I've looked at Harri's OutAddIn.cls code, but I can't easily determine if it creates a "genuine" mbox format that complies with what SA-learn needs to do its "remove the markup" magic, or just recreates the original headers and leaves the message encapsulated in whatever format Outlook uses. Harri, can you provide a definitive answer, because before you said the encapsulated spam should not be learned with your Add-In. -- Dean Confucius say: Early worm have death wish. -----Original Message----- From: Harri Pesonen [mailto:[EMAIL PROTECTED] Sent: Sunday, August 10, 2003 8:02 AM To: Mike Burger Cc: Dan Wing; Theo Van Dinter; Dean Gallea; [EMAIL PROTECTED]; [EMAIL PROTECTED] Subject: Re: [SAtalk] Re: [Spamassassin-saproxy] Outlook Add-In for SpamAssassin is here I still don't get it. The report is not in attachment, the original message is. The report is in message body. ----- Original Message ----- From: "Mike Burger" <[EMAIL PROTECTED]> To: "Harri Pesonen" <[EMAIL PROTECTED]> Cc: "Dan Wing" <[EMAIL PROTECTED]>; "Theo Van Dinter" <[EMAIL PROTECTED]>; "Dean Gallea" <[EMAIL PROTECTED]>; <[EMAIL PROTECTED]>; <[EMAIL PROTECTED]> Sent: Sunday, August 10, 2003 12:02 PM Subject: Re: [SAtalk] Re: [Spamassassin-saproxy] Outlook Add-In for SpamAssassin is here > If you edit your /etc/mail/spamassassin/local.cf and insert the > following > lines: > > report_safe 0 > use_terse_report 0 > > You'll find that the report is put into the message headers, instead > of as a MIME attachment. > > On Sun, 10 Aug 2003, Harri Pesonen wrote: > > > Are you saying, that if SA inserts the original e-mail as an > > attachment, then it is OK to feed this message to sa-learn, even if > > it has a new body > > text: > > > > "This mail is probably spam. The original message has been attached > > along with this report, so you can recognize or block similar > > unwanted mail in future. See http://spamassassin.org/tag/ for more > > details. > > > > Content preview: Loading image ... URI:http://www32.com/gh/ > > URI:http://www32.com/gh/ghad.jpg URI:http://www32.com/gh/rm.htm > > URI:http://www32.com/gh/rm.gif [...] > > > > Content analysis details: (19.70 points, 5 required) > > X_MSMAIL_PRIORITY_HIGH (0.0 points) Sent with 'X-Msmail-Priority' > > set to > > high > > X_PRIORITY_HIGH (1.9 points) Sent with 'X-Priority' set to high > > FROM_ENDS_IN_NUMS (0.6 points) From: ends in numbers > > MSGID_OE_SPAM_4ZERO (4.3 points) Message-Id generated by spam tool > > (4-zeroes variant) > > INVALID_DATE (0.6 points) Invalid Date: header (not RFC 2822) > > MSGID_SPAMSIGN_ZEROES (4.3 points) Message-Id generated by spam > > tool (zeroes variant) > > HTML_80_90 (0.5 points) BODY: Message is 80% to 90% HTML > > BAYES_60 (1.1 points) BODY: Bayesian classifier says spam > > probability is 60 to 70% > > [score: 0.6024] > > HTML_MESSAGE (0.0 points) BODY: HTML included in message > > HTML_IMAGE_ONLY_02 (1.4 points) BODY: HTML has images with 0-200 > > bytes of > > words > > MSGID_OUTLOOK_TIME (4.4 points) Message-Id is fake (in Outlook > > Express > > format) > > DATE_IN_PAST_06_12 (0.1 points) Date: is 6 to 12 hours before Received: > > date > > MIME_HTML_ONLY (0.1 points) Message only has text/html MIME parts > > PRIORITY_NO_NAME (0.4 points) Message has priority setting, but no > > X-Mailer > > > > The original message did not contain plain text, and may be unsafe > > to open with some email clients; in particular, it may contain a > > virus, or confirm that your address can receive spam. If you wish > > to view it, it may be safer to save it to a file and open it with an > > editor." > > > > I want to be 100% sure about this! :-) > > > > ----- Original Message ----- > > From: "Dan Wing" <[EMAIL PROTECTED]> > > To: "Theo Van Dinter" <[EMAIL PROTECTED]> > > Cc: "Harri Pesonen" <[EMAIL PROTECTED]>; "Dean Gallea" <[EMAIL PROTECTED]>; > > <[EMAIL PROTECTED]>; > > <[EMAIL PROTECTED]> > > Sent: Saturday, August 09, 2003 10:32 PM > > Subject: Re: [SAtalk] Re: [Spamassassin-saproxy] Outlook Add-In for > > SpamAssassin is here > > > > > > > On Sat, 9 Aug 2003, Theo Van Dinter wrote: > > > > > > > The bayes system won't learn already learned messages (as per > > > > the Message-ID header). That's that whole bayes_seen db. > > > > > > > > There was a bug where messages w/out the Message-ID header could > > > > be learned/forgotten multiple times. That's fixed in 2.60. > > > > > > > > sa-learn looks for the X-Spam-Status header, and if it exists, > > > > it'll remove the markup from the message, so report_safe mails > > > > are fine. > > > > > > Ah. I had thought it didn't work based on some testing I did, but > > > obviously my testing was flawed. > > > > > > Thanks. > > > -d ------------------------------------------------------- This SF.Net email sponsored by: Free pre-built ASP.NET sites including Data Reports, E-commerce, Portals, and Forums are available now. Download today and enter to win an XBOX or Visual Studio .NET. http://aspnet.click-url.com/go/psa00100003ave/direct;at.aspnet_072303_01/01 _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
