On Tue, 2010-06-29 at 04:39 -0400, Dan Mahoney, System Admin wrote:
> On Mon, 28 Jun 2010, Yet Another Ninja wrote:
> > > Perhaps this is by design, but rt replies are, strictly speaking, not
> > > bounce messages.
> > from what I see it looks normal if someone really makes an effort to
> > "tune" SA scores.
> >
> > score ANY_BOUNCE_MESSAGE 0.1
> > score SHORTCIRCUIT 0
>
> Even so, why is it matching, when it's not a bounce. It's either
> something inaccurate in spamassassin, or something RT is doing that it
> shouldn't be. It it's the latter, I'll attempt to fix rt. If the former,
> perhaps SA should.
You didn't provide the necessary information to determine, why the
vbounce rules fire. A full, raw message would be good, and of course
your whitelist_bounce_relays setting. Ideally you would further provide
the relevant sub-tests hit.
Moreover, you didn't mention your SA version, though from another post
of yours we know it to be 3.2.3. There have been quite some changes to
the vbounce rule-set since -- does 3.3.x also hit?
Lastly, as Alex hinted, stock SA would *not* have classified the mail as
spam. That is due to your incredibly high custom score.
The vbounce rule-set is meant to identify backscatter, and action is
supposed to be taken on the rules hit. It is not meant and better not be
used to classify these spam. See the vbounce rule-set cf file for proper
usage.
--
char *t="\10pse\0r\0dtu...@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1:
(c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}
