On Sun, 29 May 2016, Reindl Harald wrote:
Am 29.05.2016 um 23:38 schrieb John Hardin:
On Thu, 26 May 2016, RW wrote:
> I noticed that Bayes is picking-up on very strong tokens from "eval" and
> "code" in headers like this:
>
> X-PHP-Originating-Script: 1013:global.php(1938) : eval()'d code
>
> The "eval()'d code" part is in just over 2% of my spam, but it's
> never occurred in a single ham in my corpus.
It doesn't do too well in masscheck:
http://ruleqa.spamassassin.org/20160528-r1745852-n/__PHP_ORIG_SCRIPT_EVAL/detail
where is the rule?
https://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
if masscheck pretends that this hits a relevant amount of ham
It doesn't. 3 out of 139k.
while we see 250 sampls *at all* with a "X-PHP-Originating-Script"
Here is the basic "header exists" rule for that same masscheck run:
http://ruleqa.spamassassin.org/20160528-r1745852-n/__HAS_PHP_ORIG_SCRIPT/detail
It hits 1595 spam and 1972 ham. Where are you getting only 250 hits for
that header?
(with and without PHP eval()'d code" masscheck is *serious broken* not
only about all the FSL_ rules making nothing more than troubles the last
months
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhar...@impsec.org FALaholic #11174 pgpk -a jhar...@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
Where We Want You To Go Today 09/13/07: Microsoft patents in-OS
adware architecture that incorporates monitoring and analysis of
user actions and interrupting the user to display apparently
relevant advertisements (U.S. Patent #20070214042)
-----------------------------------------------------------------------
Tomorrow: Memorial Day - honor those who sacrificed for our liberty
