Re: why not doing a test that checks "name"-<email address> pairs

This message is in MIME format. The first part should be readable text,
while the remaining parts are likely unreadable without MIME-aware tools.

--151653122-700154689-1187384317=:18886
Content-Type: TEXT/PLAIN; charset=iso-8859-1; format=flowed
Content-Transfer-Encoding: 8BIT

On Fri, 17 Aug 2007, aag_uk wrote:
[color=blue]
> I´ve noticed that some spam messages not marked as spam by spamassassin (the
> score is lower than the limit I´ve set: 5.0. Those emails usually have some
> hints that suggest they are probably spam: score about 4.6). These message
> are addressed to many people in my domain but the names before the email
> address are random. To explain it more clearly, for example, the recipient
> in the TO field is something like this: "John" <user1@mydomain.com>. Very
> ofter the CC field includes other recipients like: "Peter"
> <user2@mydomain.com>; "Mike" <user3@mydomain.com>; etc... The think is that
> the email recepients (user1, user2, user3,...) are real, they exist in my
> domain, but the names "Peter, John, Mike" have nothing to do with "user1,
> user2, user3", they are picked randomly. Wouldn´t be interesting to have a
> test that checks the "user name-email address" pairs according to some
> settings?[/color]

That's an interesting idea, but it

a) is probably going to be quite resource-intensive;

b) requires LDAP, NIS, etc., so that SpamAssassin can have a clue
about your accounts;

c) requires competent fuzzy matching so that, when a user sends mail
to "Chris St. Pierre <stpierre@nebrwesleyan.edu>", it doesn't flag it
as spam because my "real name" is Christopher;

d) is prone to FPs, since its the clients who add that name, and it
could be literally _anything_ ("chris", "some guy", "", etc.) without
being spam; and

e) is fairly site-specific and would require a fair amount of
configuration.

It might be an interesting plugin, but I think that the kind of
scoring I'd be comfortable doing for a plugin like that -- very low --
wouldn't be worth the tradeoff in CPU time, network traffic, etc.

Chris St. Pierre
Unix Systems Administrator
Nebraska Wesleyan University
--151653122-700154689-1187384317=:18886--