On Sat, 2009-03-28 at 17:20 -0700, jdpnh wrote:
> For a long time I have been reviewing the header/source of spam that I
> received in my inbox. The version/release of SpamAssassin was old - at
> least 10 releases. I pointed this out to the customer service people and
> tech support folks at my ISP - NO RESPONSE. I followed thru with a letter
> to the prez of the company.
>
> All of a sudden the header/source reflected the current release of
> SpamAssassin.
>
> The service people said that they have always been up to date with the
> current release/version - but they had forgotten to do something that it
> would be reflected in the header/source. I'm a tech and really question
> this response.
While it does sound strange and questionable -- there's pretty much no
way to confirm it's legitimacy or your suspicion. Even less so, without
the actual headers, which at least give some hint about how SA is
integrated in the mail flow.
No matter how dumb, of course a later hop can rewrite the SA version
header, if inserted (by SA rather than a glue) in the first place at
all. Also, the headers could at least give a hint about the legitimacy
of the claim of a second hop.
> Below is the actual response - I would like someone to verify the
> information:
>
> "Our anti-spam system has two components. The first component scans emails
> at its point of entry and uses the most current anit-spam engine, 3.2.5.
> The second component popluates the email header with its current engine
> version then moves the email to your inbox. Since it is not a scan point it
> had not been updated. This has been corrected to reflect the version used
> by the component that scans the message, 3.2.5"
--
char *t="\10pse\0r\0dtu...@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1:
(c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}
