Greg Troxel wrote: > Theo Van Dinter <[EMAIL PROTECTED]> writes: > > >> On Tue, Oct 14, 2008 at 06:55:27PM -0400, Greg Troxel wrote: >> >>>> 2.5 MPART_ALT_DIFF BODY: HTML and text parts are different >>>> well of course, because >>>> >>> This rule seems like it should not have fired. >>> >> Yes, it should have. If a multipart/alternate mail only has a text/html >> part, >> it should be a text/html mail. >> > > I see your point (the mail is malformed), but > > mail is multipart/alternative but only has text/html > > differs from > > mail is multipart/alternative and text/plain and text/html don't match > > are different conditions, and it might be useful to have different rules > that could have different scores. > Well, they're different, but are they different enough to be worth separate rules in a spam filtering context.
i.e.: would the scores generated be significantly different, or are both rules roughly the same strength of spam indicator, and end up with more-or-less the same score. I suppose it could be tested, but this isn't a terribly common false positive in the real world. If it were pervasive, I'd be jumping at getting it fixed, but I've not seen it FP very often. The set3 S/O for this rule was 0.969, which isn't perfect but it's really quite solid. In general it strikes me as a problem with email generated by some homebrew tool that isn't working properly. If it was generated by a common tool, we'd be seeing a lot of these, but a 3.1% false positive rate for the whole rule (not just this case) is pretty low. I know it's a bit harsh, but I'm not terribly inclined to jump to change SA to address rare-case false positives resulting from broken tools that aren't in mainstream use and don't have a significant impact on SA's global false positive rate. Unless someone knows of a mainstream FP case here, I'd be inclined to suggest either fixing the generator (best option, as some mail clients may barf on that output anyway), or locally zero the rule if you're the 1 in a million people who gets badly malformed email on a regular basis.
