Loren Wilton wrote: >> in 70_sare_spoof.cf some scores are set to 104. >> What is the reason to set such high scores? (I know how to lower >> them) > > The spoof rules are to catch forgeries for things like Paypal and > Ebay and various banks. These are things that people might have > whitelisted with a simple whitelist command. Whitelisting by default > gives a score of -100. > > These phish checks have not, so far as we know, hit any FPs recently. > If you have some examples, we would dearly like to see them. > > Since these aren't known to FP, and since many phish look somewhat > convincing to a nieve user, we felt it was best to override any > possible simple whitelist on the name of the sender. > > Loren
Thanks Loren, That would reinforce my comments inside the rule file: # Comments: Some scores are high enough to counter whitelist entries, adjust as needed. #--------------------------------------------------------------------------- -----------------------# ## THESE RULES HAVE VERY LARGE SCORES, PLEASE ADJUST TO YOUR NEEDS, I NEED TO OVERRIDE WHITELIST. ## #--------------------------------------------------------------------------- -----------------------# I do hope people read the comments at the top of the rulefile before added them to their systems! Fred
