Theo Van Dinter wrote:
On Thu, Oct 26, 2006 at 09:46:28AM -0400, Peter H. Lemieux wrote:
Does SA convert the blob into text before scanning? It contains a number
of drug-related words and a URI that points to "pharmconnect.org".
Yes.
I was pretty sure this was the case but wanted to confirm it.
Also is there an SA rule that scores messages that contain only a single
base64 part (as opposed to a base64-encoded attachment)? I doubt many
legitimate messages arrive with only a single base64 part.
No, because there are going to be a lot of mails that would hit that.
Really? Maybe it's because I live in the US, but I can't think of a
legitimate message I've ever received consisting only of a base64 blob.
Our of curiosity, how frequently does this appear in the SA ham corpus?
Rather than making anyone else do the work for me, is there something I
can read about how to determine the frequency of different message
features appearing in the corpus?
Thanks, Theo.
Peter
