EXTRA_MPART_TYPE redux.. - SpamAssassin

This is a discussion on EXTRA_MPART_TYPE redux.. - SpamAssassin ; http://markmail.org/message/w6scp6xq...scp6xqlkdgrh3b 263 google hits for EXTRA_MPART_TYPE. all someone needs to so is have an inline image, and pass it through a microsoft exchange server for this rule to hit. many (many, many) suggestions going way back to 2005: and sa3.15: ...

+ Reply to Thread
Results 1 to 3 of 3

Thread: EXTRA_MPART_TYPE redux..

  1. EXTRA_MPART_TYPE redux..

    http://markmail.org/message/w6scp6xq...scp6xqlkdgrh3b

    263 google hits for EXTRA_MPART_TYPE. all someone needs to so is have an
    inline image, and pass it through a microsoft exchange server for this
    rule to hit.

    many (many, many) suggestions going way back to 2005: and sa3.15:

    https://issues.apache.org/SpamAssass...ug.cgi?id=5110

    so, I for one will set score to 0 in local.cf.. waited and waited for
    the fix for 3 years
    (yes, I know, rfc compliant doesn't mean != spam), but a rule that will
    hit ANY exchange processed email with an inline image in the background
    is not helpful.



    --
    Michael Scheidell, CTO
    Main: 561-999-5000, Office: 561-939-7259
    > *| *SECNAP Network Security Corporation


    * Certified SNORT Integrator
    * Everything Channel Hot Product of 2008
    * Shaping Information Security Award 2008
    * CRN Magazine Top 40 Emerging Security Vendors

    __________________________________________________ _______________________
    This email has been scanned and certified safe by SpammerTrap(r).
    For Information please see http://www.spammertrap.com
    __________________________________________________ _______________________


  2. Re: EXTRA_MPART_TYPE redux..


    Michael Scheidell writes:
    > http://markmail.org/message/w6scp6xq...scp6xqlkdgrh3b
    >
    > 263 google hits for EXTRA_MPART_TYPE. all someone needs to so is have an
    > inline image, and pass it through a microsoft exchange server for this
    > rule to hit.
    >
    > many (many, many) suggestions going way back to 2005: and sa3.15:
    >
    > https://issues.apache.org/SpamAssass...ug.cgi?id=5110
    >
    > so, I for one will set score to 0 in local.cf.. waited and waited for
    > the fix for 3 years
    > (yes, I know, rfc compliant doesn't mean != spam), but a rule that will
    > hit ANY exchange processed email with an inline image in the background
    > is not helpful.


    it has a score of 1.0. that's about typical for a rule that has
    a 99.4% hitrate against spam, but still hits quite a lot of spam.

    FWIW, the more ham samples we have, the less likely FPs will be...

    --j.


  3. Re: EXTRA_MPART_TYPE redux..


    Justin Mason writes:
    >
    > Michael Scheidell writes:
    > > http://markmail.org/message/w6scp6xq...scp6xqlkdgrh3b
    > >
    > > 263 google hits for EXTRA_MPART_TYPE. all someone needs to so is have an
    > > inline image, and pass it through a microsoft exchange server for this
    > > rule to hit.
    > >
    > > many (many, many) suggestions going way back to 2005: and sa3.15:
    > >
    > > https://issues.apache.org/SpamAssass...ug.cgi?id=5110
    > >
    > > so, I for one will set score to 0 in local.cf.. waited and waited for
    > > the fix for 3 years
    > > (yes, I know, rfc compliant doesn't mean != spam), but a rule that will
    > > hit ANY exchange processed email with an inline image in the background
    > > is not helpful.

    >
    > it has a score of 1.0. that's about typical for a rule that has
    > a 99.4% hitrate against spam, but still hits quite a lot of spam.


    er, hits quite a lot of ham, rather.

    > FWIW, the more ham samples we have, the less likely FPs will be...
    >
    > --j.



+ Reply to Thread