On Wed, 19 Nov 2014, Reindl Harald wrote:
i thought about a by default 0 scored rule enabled and scored only via "local.cf" by the admin or very low scored (0.001) which might make the difference FN/caught and should not hurt a legit message anything with else OK
It's more useful to do that as a subrule so that any cases where it + another rule are a good sign can be scored as a meta.
If the admin wanted to score on that alone, then they'd add a meta where the only member rule was the subrule, and score that.
-- John Hardin KA7OHZ http://www.impsec.org/~jhardin/ jhar...@impsec.org FALaholic #11174 pgpk -a jhar...@impsec.org key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79 ----------------------------------------------------------------------- Vista is at best mildly annoying and at worst makes you want to rush to Redmond, Wash. and rip somebody's liver out. -- Forbes ----------------------------------------------------------------------- 902 days since the first successful private support mission to ISS (SpaceX)
