Chris,
Could you add a |MESSAGE to the PGP signature lines in tripwire so that
it does not trigger on PGP encrypted messages? I believe someone else
has suggested this earlier in the thread but it wasn't in version 1.13.
I made this change after receiving multiple false positives on PGP
encrypted messages and it stopped blocking them.
Example:
rawbody __PGP_BEGIN /^-----BEGIN PGP
SIGNATURE|MESSAGE-----$/
rawbody __PGP_MIDDLE /^[0-9A-Za-z+\/]{64}$/
rawbody __PGP_END /^-----END PGP
SIGNATURE|MESSAGE-----$/
Thank you and Frank for the great new ruleset!
Patrick Clary
Data Security Engineer, UMB Bank
-----Original Message-----
From: Chris Santerre [mailto:[EMAIL PROTECTED]
Sent: Wednesday, January 14, 2004 4:03 PM
To: 'Kurt Yoder'; Chris Santerre
Cc: 'Matthew Trent'; Spamassassin-Talk
Subject: RE: [SAtalk] RE: New Ruleset Available!!! TRIPWIRE! You don't
want to miss this o ne!
> -----Original Message-----
> From: Kurt Yoder [mailto:[EMAIL PROTECTED]
> Sent: Wednesday, January 14, 2004 4:54 PM
> To: Chris Santerre
> Cc: 'Matthew Trent'; Spamassassin-Talk
> Subject: RE: [SAtalk] RE: New Ruleset Available!!! TRIPWIRE! You don't
> want to miss this o ne!
>
>
>
> Chris Santerre said:
> > Popcorn, Weeds, Backhair, and Tripwire. One spam could hit 5 of
> > each. But I'm still curious. I've got to have more rules then anyone
> > else. I get VERY
> > long description headers. But I don't get any errors. What SA
> > version are
> > you running?
>
> Heh... sorry, it's not me having the problem with header length. I was
> just asking. I notice that one could theoretically get 878 matches,
> which would make for a very woolly message header.
>
LOL, sorry here as well, got my usernames messed up :) Here is a
typical header I get w/ no errors:
X-Spam-Status: Yes, hits=40.0 required=5.0
tests=CLICK_BELOW,CTYPE_JUST_HTML,FVGT_TRIPWIRE_HV,
FVGT_TRIPWIRE_KJ,FVGT_TRIPWIRE_MH,FVGT_TRIPWIRE_TB,
FVGT_TRIPWIRE_VM,FVGT_b_RANDOMTEXT,FVGT_s_SPACES_6,
HTML_50_70,HTML_COMMENT_UNIQUE_ID,HTML_FONT_COLOR_MAGENTA,
HTML_FONT_COLOR_RED,J_BACKHAIR_12,J_BACKHAIR_13,
J_BACKHAIR_14,J_BACKHAIR_21,J_BACKHAIR_22,J_BACKHAIR_23,
J_BACKHAIR_24,J_BACKHAIR_26,J_BACKHAIR_32,J_BACKHAIR_33,
J_BACKHAIR_34,J_BACKHAIR_35,J_BACKHAIR_42,J_BACKHAIR_43,
J_BACKHAIR_44,J_BACKHAIR_45,J_BACKHAIR_52,J_BACKHAIR_56,
L_s_MaskedWords4,MY_HTML_OBFU,MY_NO_QU,MY_OBFUJ,MY_OBFUT,
MY_OBFUX,MY_OBFUY,MY_OBFUZ,MY_OBFU_MISC,MY_S_URBOSS,
MY_TITLE,OBFUSCATING_COMMENT,REG_THANKS,RM_hc_HTML,
RM_rb_ANCHOR,RM_rb_BREAK,RM_rb_FONT,RM_rb_HTML,RM_rb_PARA,
RM_rb_TITLE,RND_WORD,SPAM_PHRASE_08_13,SUBJ_HAS_SPACES
Some of these rules are going the way of the dodo soon. But for this it
doesn't matter. I know I have larger then this as well.
--Chris
-------------------------------------------------------
This SF.net email is sponsored by: Perforce Software.
Perforce is the Fast Software Configuration Management System offering
advanced branching capabilities and atomic changes on 50+ platforms.
Free Eval! http://www.perforce.com/perforce/loadprog.html
_______________________________________________
Spamassassin-talk mailing list [EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
-------------------------------------------------------
This SF.net email is sponsored by: Perforce Software.
Perforce is the Fast Software Configuration Management System offering
advanced branching capabilities and atomic changes on 50+ platforms.
Free Eval! http://www.perforce.com/perforce/loadprog.html
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
