So you want 50 points for any file with
Content-Type: application/x-msexcel;
^^^
???
Looking through a mailbox full of mime-encoded attachments (and only
attachments) I found several occurrences of "sex" in the encoded data.
That can't possibly be what you're after. There's a real danger in
getting overzealous going after "bad" words. Your HR department is
bound to get communications involving "sex"ual harassment, "sex"
discrimination, etc.
I think you really need to take a breath and think rationally about
these rules before you implement them. You're taking an extremely smart
content filtering system and turning it into a really dumb one.
Chris
On Tue, 2003-08-12 at 14:30, Robin Witkop-Staub wrote:
> But what is improper about it? The coding looks correct to me? Its a
> filter running and looking for any instance or combination of the word
> "sex". And we do want to assign it 50 points so it definitely gets
> rejected.
>
> -----Original Message-----
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] Behalf Of Fred
> I-IS.COM
> Sent: Tuesday, August 12, 2003 3:30 PM
> To: [EMAIL PROTECTED]; Spamassassin List
> Subject: Re: [SAtalk] filter catching excel files
>
>
> The person who marks their rules named RAVEN have coded an improper rule to
> match the word SEX.
> Take a look in the log file you posted, it gave a score of +50, that rule
> should be removed.
>
> Frederic Tarasevicius
> Internet Information Services, Inc.
>
>
> ----- Original Message -----
> From: "Robin Witkop-Staub" <[EMAIL PROTECTED]>
> To: "Spamassassin List" <[EMAIL PROTECTED]>
> Sent: Tuesday, August 12, 2003 3:23 PM
> Subject: [SAtalk] filter catching excel files
>
>
> > For some reason my filter is tagging excel .xls attachments. I had a user
> > leave the message line and the body blank and only attach the excel and it
> > still got tagged. Not sure why?
> >
> > Here is my filter:
> > #body RAVEN_SEX /sex/i
> > #describe RAVEN_SEX contains advertising sex by any name
> > #score RAVEN_SEX 50.0
> >
> >
> > Here is what was in the header:
> > Subject: *****SPAM***** file
> > Date: Mon, 11 Aug 2003 08:07:05 -0700
> > MIME-Version: 1.0
> > Content-Type: multipart/mixed;
> > boundary="----=_NextPart_000_0005_01C35FDF.8DE75680"
> > X-Priority: 3
> > X-MSMail-Priority: Normal
> > X-Mailer: Microsoft Outlook Express 6.00.2600.0000
> > X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
> > X-Spam-Status: Yes, hits=34.4 required=5.0
> > tests=AWL,MAY_BE_FORGED,RAVEN_SEX,SPAM_PHRASE_00_01,USER_AGENT_OE
> > version=2.43-cvs
> > X-Spam-Flag: YES
> > X-Spam-Level: **********************************
> > X-Spam-Checker-Version: SpamAssassin 2.43-cvs (1.115.2.19-2002-10-15-exp)
> > Status:
> >
> > Then we tried to send the files from her desk internally and this is what
> we
> > got back:
> > SPAM: -------------------- Start SpamAssassin
> results ----------------------
> > SPAM: This mail is probably spam. The original message has been altered
> > SPAM: so you can recognise or block similar unwanted mail in future.
> > SPAM: See http://spamassassin.org/tag/ for more details.
> > SPAM:
> > SPAM: Content analysis details: (28.30 hits, 5 required)
> > SPAM: X_AUTH_WARNING (-0.2 points) Found a X-Authentication-Warning
> > header
> > SPAM: RAVEN_SEX (50.0 points) BODY: contains advertising sex by
> any
> > name
> > SPAM: SPAM_PHRASE_00_01 (0.8 points) BODY: Spam phrases score is 00 to
> 01
> > (low)
> > SPAM: FROM_AND_TO_SAME_5 (1.3 points) From and To are same (5)
> > SPAM: MSG_ID_ADDED_BY_MTA_3 (0.9 points) 'Message-Id' was added by a
> relay
> > (3)
> > SPAM: MISSING_MIMEOLE (0.5 points) Message has X-MSMail-Priority, but
> no
> > X-MimeOLE
> > SPAM: MISSING_OUTLOOK_NAME (1.1 points) Message looks like Outlook, but
> > isn't
> > SPAM: AWL (-26.1 points)AWL: Auto-whitelist adjustment
> > SPAM:
> > SPAM: -------------------- End of SpamAssassin
> results ---------------------
> >
> >
> >
> > Robin Witkop-Staub
> > Raven Industries
> > Network Administrator
> >
> >
> >
> > -------------------------------------------------------
> > This SF.Net email sponsored by: Free pre-built ASP.NET sites including
> > Data Reports, E-commerce, Portals, and Forums are available now.
> > Download today and enter to win an XBOX or Visual Studio .NET.
> >
> http://aspnet.click-url.com/go/psa00100003ave/direct;at.aspnet_072303_01/01
> > _______________________________________________
> > Spamassassin-talk mailing list
> > [EMAIL PROTECTED]
> > https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
>
>
>
> -------------------------------------------------------
> This SF.Net email sponsored by: Free pre-built ASP.NET sites including
> Data Reports, E-commerce, Portals, and Forums are available now.
> Download today and enter to win an XBOX or Visual Studio .NET.
> http://aspnet.click-url.com/go/psa00100003ave/direct;at.aspnet_072303_01/01
> _______________________________________________
> Spamassassin-talk mailing list
> [EMAIL PROTECTED]
> https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
>
>
>
> -------------------------------------------------------
> This SF.Net email sponsored by: Free pre-built ASP.NET sites including
> Data Reports, E-commerce, Portals, and Forums are available now.
> Download today and enter to win an XBOX or Visual Studio .NET.
> http://aspnet.click-url.com/go/psa00100003ave/direct;at.aspnet_072303_01/01
> _______________________________________________
> Spamassassin-talk mailing list
> [EMAIL PROTECTED]
> https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
-------------------------------------------------------
This SF.Net email sponsored by: Free pre-built ASP.NET sites including
Data Reports, E-commerce, Portals, and Forums are available now.
Download today and enter to win an XBOX or Visual Studio .NET.
http://aspnet.click-url.com/go/psa00100003ave/direct;at.aspnet_072303_01/01
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
