Mailing List Archive

What's worse now is this:

I copied the HOT_NASTY rule to my custom ruleset file, and modified it as
such:

body HOT_NASTY2
/\b(?=[dehklnswxy])(?:horny|nasty|hot|wild|young|horniest|nastiest|hottest|w
ildest|youngest|naughty|dirtiest|slutty|kinky|lusty|extreme|xxx+)\b.{0,9}\b(
?=[acfghilmpsvx])(?:virgin|asian|cheerleader|sex|selection|fuck|fucking|anal
\b|lesb(?:ian|o)|incest|chicks?|pics|movies|video|gay\b|porn|h[a\@]rdcore|sc
hoolgirls|amateur|slut|adult|cum|xxx|sites?|hotties|shit)/i
describe HOT_NASTY Possible porn - Hot, Nasty, Wild, Young

So it's an exact copy of the original, only with a new name. Now I resent an
email with the subject "hot sex cim viagra", and this is what I got in the
email's header:

Content analysis details: (6.1 points, 5.0 required)

pts rule name description
---- ----------------------
--------------------------------------------------
3.0 RM_bw_VIAGRA BODY: mentions viagra
1.0 HOT_NASTY2 BODY: Possible porn - Hot, Nasty, Wild, Young
0.0 HOT_NASTY BODY: Possible porn - Hot, Nasty, Wild, Young
0.0 Julian01 BODY: Test for 'Julian'
0.1 HTML_60_70 BODY: Message is 60% to 70% HTML
0.0 HTML_MESSAGE BODY: HTML included in message
2.0 LOCAL_DRUGS_MALEDYSFUNCTION LOCAL_DRUGS_MALEDYSFUNCTION

This is pretty much what I expected. Remember, I'm testing the functionality
of the rules here!

I then changed HOT_NASTY2 to look like this:

body HOT_NASTY2 Subject:
/\b(?=[dehklnswxy])(?:horny|nasty|hot|wild|young|horniest|nastiest|hottest|w
ildest|youngest|naughty|dirtiest|slutty|kinky|lusty|extreme|xxx+)\b.{0,9}\b(
?=[acfghilmpsvx])(?:virgin|asian|cheerleader|sex|selection|fuck|fucking|anal
\b|lesb(?:ian|o)|incest|chicks?|pics|movies|video|gay\b|porn|h[a\@]rdcore|sc
hoolgirls|amateur|slut|adult|cum|xxx|sites?|hotties|shit)/i
describe HOT_NASTY Possible porn - Hot, Nasty, Wild, Young

Now, I get the following headers in an exact copy of the previous email.

Subject: hot sex cum viagra
Date: Mon, 15 Mar 2004 15:44:15 +1100
....
X-Spam-Checker-Version: SpamAssassin 2.63 (2004-01-11) on
davmail.davenport-industries.com.au
X-Spam-Status: No, hits=0.1 required=5.0 tests=HTML_60_70,HTML_MESSAGE
autolearn=no version=2.63

For some reason, the new HOT_NASTY rule has killed ALL the rules in my
custom ruleset file!!!!! WHY??


Regards,
Julian Milano
IT Manager


Davenport Group
79-81 Coppin Street (PO Box 12) Richmond Victoria 3121
Ph : (613) 8416 6666

Limits of Liability and Disclaimer - Davenport Industries is not liable for
any loss, damages, claims, cost demand and expense whatsoever and howsoever
arising in connection with this email transmission. The receiver of this
transmission shall ascertain the accuracy and suitability of this data for
their purposes. Although computer virus scanning software is used by
Davenport Industries, the receiver shall be responsible for their own virus
protection and Davenport Industries shall not be held liable for and
subsequent loss, damage, cost or expense.

This email and any attachment is confidential and intended solely for the
use of the individual or entity to whom they are addressed. If you have
received this email in error you are prohibited from disclosing, copying or
using the information contained in it and please inform us by reply email
and delete.

-----Original Message-----
From: JulianM@davenport-industries.com.au
[mailto:JulianM@davenport-industries.com.au]
Sent: Monday, March 15, 2004 3:05 PM
To: spamassassin-users@incubator.apache.org
Subject: SA 4 Win 's gotta be bugged bad!


I've got the following rules:

body Met2 /single/i
score Met2 0.1

body Met222 /ADV/i
score Met222 0.1


body Julian01 /julian/i
describe Julian01 Test for 'Julian'
score Julian01 .01

I then Hotmailed a msg to my work account with the subject "single ADV SPAM
a b c d e f g" and got the following response:

X-Spam-Checker-Version: SpamAssassin 2.63 (2004-01-11) on
davmail.davenport-industries.com.au
X-Spam-Status: No, hits=0.8 required=5.0 tests=HTML_60_70,HTML_MESSAGE,
Julian01,LOC_DBLEXTONATTACH,Met2,Met222 autolearn=no version=2.63

Why are my BODY rules acting on the SUBJECT line??

I've spent the last 5 days writing and rewriting and testing the folloing
rule:

header Met33 Subject =~ /single/i
score Met33 0.1

And it hasn't triggered ONCE!!

I even sent a msg which contained "XXXXXX" and the HOTNASTY rule fired. I
then copied that rule, as-is, to my custom rules file, and it stopped
working!!!

This is BUGGING me!


Regards,

Julian Milano
IT Manager


Davenport Group
79-81 Coppin Street (PO Box 12) Richmond Victoria 3121
Ph : (613) 8416 6666

Limits of Liability and Disclaimer - Davenport Industries is not liable for
any loss, damages, claims, cost demand and expense whatsoever and howsoever
arising in connection with this email transmission. The receiver of this
transmission shall ascertain the accuracy and suitability of this data for
their purposes. Although computer virus scanning software is used by
Davenport Industries, the receiver shall be responsible for their own virus
protection and Davenport Industries shall not be held liable for and
subsequent loss, damage, cost or expense.

This email and any attachment is confidential and intended solely for the
use of the individual or entity to whom they are addressed. If you have
received this email in error you are prohibited from disclosing, copying or
using the information contained in it and please inform us by reply email
and delete.

At 03:05 PM 3/15/04 +1100, JulianM@davenport-industries.com.au wrote:
>Why are my BODY rules acting on the SUBJECT line??

Because there are supposed to.. read the docs in Mail::SpamAssassin::Conf
and they will plainly explain this is the designed behavior.

In general, every body rule would be likely to require duplication as a
subject-line rule. To avoid having large numbers of duplicate rules, the
body rules are also run against the subject line as a matter of course.

On Mon, 15 Mar 2004 JulianM@davenport-industries.com.au wrote:

> What's worse now is this:
>
[snip..]
> I then changed HOT_NASTY2 to look like this:
>
> body HOT_NASTY2 Subject:
> /\b(?=[dehklnswxy])(?:horny|nasty|hot|wild|young|horniest|nastiest|hottest|w
> ildest|youngest|naughty|dirtiest|slutty|kinky|lusty|extreme|xxx+)\b.{0,9}\b(
> ?=[acfghilmpsvx])(?:virgin|asian|cheerleader|sex|selection|fuck|fucking|anal
> \b|lesb(?:ian|o)|incest|chicks?|pics|movies|video|gay\b|porn|h[a\@]rdcore|sc
> hoolgirls|amateur|slut|adult|cum|xxx|sites?|hotties|shit)/i
> describe HOT_NASTY Possible porn - Hot, Nasty, Wild, Young
>
> Now, I get the following headers in an exact copy of the previous email.
>
> Subject: hot sex cum viagra
> Date: Mon, 15 Mar 2004 15:44:15 +1100
> ....
> X-Spam-Checker-Version: SpamAssassin 2.63 (2004-01-11) on
> davmail.davenport-industries.com.au
> X-Spam-Status: No, hits=0.1 required=5.0 tests=HTML_60_70,HTML_MESSAGE
> autolearn=no version=2.63
>
> For some reason, the new HOT_NASTY rule has killed ALL the rules in my
> custom ruleset file!!!!! WHY??

Stop, take a deep breath, repeat after me:
When I make a change to SpamAssassin, I WILL do a "spamassassin --lint" to
make sure that I haven't made a mistake somewhere.

Then go take a look at the SA config file documentation to find out
what you did wrong, and how you -should- go about writing a header
match rule.


--
Dave Funk University of Iowa
<dbfunk (at) engineering.uiowa.edu> College of Engineering
319/335-5751 FAX: 319/384-0549 1256 Seamans Center
Sys_admin/Postmaster/cell_admin Iowa City, IA 52242-1527
#include <std_disclaimer.h>
Better is not better, 'standard' is better. B{

MessageThe Subject, for reasons I don't understand, is included in the body for body checks. So that is why it is triggering your body checks.

I cna't see why the subject test would be failing. I suspect the problem is something other than what you showed. Have you run spamassassin --lint?

Loren

PPl.

I KNOW the rule is misconfigured. That's the whole excersice. I want to know
if it is "by design" that if a rule is not correctly written, it will affect
the checking of ALL other rules in the same ruleset file.

So is my theory correct?

And why when I hit reply do my replies to the list go to the name of the
person who's email is currently highlighted. Other lists I'm associated with
automatically reply to the list by default.

-Julian Milano

-----Original Message-----
From: Loren Wilton [mailto:lwilton@earthlink.net]
Sent: Monday, 15 March 2004 06:59 pm
To: spamassassin-users@incubator.apache.org
Subject: Re: SA 4 Win 's gotta be bugged bad!


The Subject, for reasons I don't understand, is included in the body for
body checks. So that is why it is triggering your body checks.

I cna't see why the subject test would be failing. I suspect the problem is
something other than what you showed. Have you run spamassassin --lint?

Loren

The comment "well duh" comes to mind. But we all gotta start somewhere
so it is not "by design" as if it was intended to annoy you. It was
likely as not "by design" that the parser's screwed up, better stop
now before it gets even more screwed up. The perl crowd has not quite
yet imported the PutriDOS (tm) DWIM (tm) module. So it's not very
good at guessing the user's intent.

The "Reply-to:" feature is an intentional (mis-)configuration of the
list software. Many Linuxoid people feel that this is the right way
to configure the list. I put in someone else's handy procmail rule to
rewrite that header to point towards the list. I suspect you are not
alone in figuring that is indeed a mis-configuration. He**, I KNOW you
are not. I think it is. My partner thinks it is. And the fellow from
whom I received the procmail tweak also must think so. It's a fact of
life we gotta live with, it seems. <sigh>

(And if I insulted with the lines above, please forgive. My sense of
humor turns vicious after being greeted within minutes of getting up
with a computer that decided to go down, and stay down. Computer rescue
was NOT on the day's agenda. My sense of humor turns nasty when that
happens, I've noticed.)

(PS: to be polite I am replying in your top posting style. Many members
of this list may be offended by it because they have become too machine
like and cannot handle format changes. They prefer comments mixed into
comments in a bottom posting style. Thought I'd warn you. {^_-} I still
seem to know how to adapt. Hope I never lose that ability.)

{o.o} Joanne Dow.
----- Original Message -----
From: <JulianM@davenport-industries.com.au>

> PPl.
>
> I KNOW the rule is misconfigured. That's the whole excersice. I want to
know
> if it is "by design" that if a rule is not correctly written, it will
affect
> the checking of ALL other rules in the same ruleset file.
>
> So is my theory correct?
>
> And why when I hit reply do my replies to the list go to the name of the
> person who's email is currently highlighted. Other lists I'm associated
with
> automatically reply to the list by default.
>
> -Julian Milano
>
> -----Original Message-----
> From: Loren Wilton [mailto:lwilton@earthlink.net]
>
> The Subject, for reasons I don't understand, is included in the body for
> body checks. So that is why it is triggering your body checks.
>
> I cna't see why the subject test would be failing. I suspect the problem
is
> something other than what you showed. Have you run spamassassin --lint?
>
> Loren

Thanks Joanne,

I'm only starting off in the world of SA, and the fact that most of you are
*NIX ppl is harder for us Win babies, but I'm sure we'll find a
common........pub?

Is there a fix for Outlook whereby I can set the list's address as the
reply-to address when I hit the REPLY button, or am I damned for ever?
(interestingly, hitting reply-all puts the sender's address PLUS the lists
address!)


Regards,

Julian Milano
IT Manager


Davenport Group
79-81 Coppin Street (PO Box 12) Richmond Victoria 3121
Ph : (613) 8416 6666

Limits of Liability and Disclaimer - Davenport Industries is not liable for
any loss, damages, claims, cost demand and expense whatsoever and howsoever
arising in connection with this email transmission. The receiver of this
transmission shall ascertain the accuracy and suitability of this data for
their purposes. Although computer virus scanning software is used by
Davenport Industries, the receiver shall be responsible for their own virus
protection and Davenport Industries shall not be held liable for and
subsequent loss, damage, cost or expense.

This email and any attachment is confidential and intended solely for the
use of the individual or entity to whom they are addressed. If you have
received this email in error you are prohibited from disclosing, copying or
using the information contained in it and please inform us by reply email
and delete.



-----Original Message-----
From: jdow [mailto:jdow@earthlink.net]
Sent: Monday, March 15, 2004 9:05 PM
To: spamassassin-users@incubator.apache.org
Subject: Re: SA 4 Win 's gotta be bugged bad!


The comment "well duh" comes to mind. But we all gotta start somewhere
so it is not "by design" as if it was intended to annoy you. It was
likely as not "by design" that the parser's screwed up, better stop
now before it gets even more screwed up. The perl crowd has not quite
yet imported the PutriDOS (tm) DWIM (tm) module. So it's not very
good at guessing the user's intent.

The "Reply-to:" feature is an intentional (mis-)configuration of the
list software. Many Linuxoid people feel that this is the right way
to configure the list. I put in someone else's handy procmail rule to
rewrite that header to point towards the list. I suspect you are not
alone in figuring that is indeed a mis-configuration. He**, I KNOW you
are not. I think it is. My partner thinks it is. And the fellow from
whom I received the procmail tweak also must think so. It's a fact of
life we gotta live with, it seems. <sigh>

(And if I insulted with the lines above, please forgive. My sense of
humor turns vicious after being greeted within minutes of getting up
with a computer that decided to go down, and stay down. Computer rescue
was NOT on the day's agenda. My sense of humor turns nasty when that
happens, I've noticed.)

(PS: to be polite I am replying in your top posting style. Many members
of this list may be offended by it because they have become too machine
like and cannot handle format changes. They prefer comments mixed into
comments in a bottom posting style. Thought I'd warn you. {^_-} I still
seem to know how to adapt. Hope I never lose that ability.)

{o.o} Joanne Dow.
----- Original Message -----
From: <JulianM@davenport-industries.com.au>

> PPl.
>
> I KNOW the rule is misconfigured. That's the whole excersice. I want to
know
> if it is "by design" that if a rule is not correctly written, it will
affect
> the checking of ALL other rules in the same ruleset file.
>
> So is my theory correct?
>
> And why when I hit reply do my replies to the list go to the name of the
> person who's email is currently highlighted. Other lists I'm associated
with
> automatically reply to the list by default.
>
> -Julian Milano
>
> -----Original Message-----
> From: Loren Wilton [mailto:lwilton@earthlink.net]
>
> The Subject, for reasons I don't understand, is included in the body for
> body checks. So that is why it is triggering your body checks.
>
> I cna't see why the subject test would be failing. I suspect the problem
is
> something other than what you showed. Have you run spamassassin --lint?
>
> Loren

I'm ambi-osial or something like that. I make my money hacking digital
video on Matrox DigiSuite cards under Windows XP. I manage the network
here under Linux. (And I've even perpetrated an emergency kernel hack
for Y2K on a machine that would divide by zero in the bios if the year
ended in 00. I offset the clock by several years and has the kernel
correct it.)

There is a Reply-To: fix for procmail that I know of. It's easy enough.
But, ya gotta be running procmail. What is your setup there? (Ours here
is Linux for the email and firewall. Windows for most of the machines
because both of us make $$$ with Windows. And for some reason I feel
happier when well fed and housed, which requires the $$$. So we process
email in Outlook Express. And I've even managed to automate the spam
learning process.

{^_-}
----- Original Message -----
From: <JulianM@davenport-industries.com.au>


> Thanks Joanne,
>
> I'm only starting off in the world of SA, and the fact that most of you
are
> *NIX ppl is harder for us Win babies, but I'm sure we'll find a
> common........pub?
>
> Is there a fix for Outlook whereby I can set the list's address as the
> reply-to address when I hit the REPLY button, or am I damned for ever?
> (interestingly, hitting reply-all puts the sender's address PLUS the lists
> address!)