Re: again a false positive
Stefan Jakobs wrote:[color=blue]
> Hello list,
> one of my users received this message:
> and it scored like that:
> X-Spam-Status: Yes, score=12.501 tagged_above=-999 required=5
> tests=[BAYES_00=-2.599, DATE_IN_PAST_12_24=0.992, EXTRA_MPART_TYPE=1,
> HTML_MESSAGE=0.001, INVALID_DATE=1.245, MIME_QP_LONG_LINE=1.396,
> MY_CID_AND_ARIAL2=1.46, MY_CID_AND_CLOSING=1.6, MY_CID_AND_STYLE=1.54,
> MY_CID_ARIAL2_CLOSING=1.63, MY_CID_ARIAL_STYLE=1.58,
> PART_CID_STOCK=1.635, SA2DNSBLC=0.001, T_TVD_FW_GRAPHIC_ID1=0.01,
> 12.5 points is a lot. And again the message was from VDE and 70_sare_stocks
> hit at it. Is 70_sare_stocks still useful?
> My rankings from today:
> %4.38 MY_CID_AND_STYLE=1.54
> %2.89 MY_CID_AND_ARIAL2=1.46
> %2.89 MY_CID_ARIAL_STYLE=1.58
> <%1.0 MY_CID_AND_CLOSING=1.6
> <%1.0 MY_CID_ARIAL2_CLOSING=1.63
> I suppose the problem is that MY_CID_ARIAL_STYLE is a subset of
> MY_CID_AND_STYLE. Also is MY_CID_ARIAL_STYLE a subset of MY_CID_AND_ARIAL2.
> And MY_CID_AND_CLOSING is a subset of MY_CID_ARIAL2_CLOSING which is a subset
> of MY_CID_ARIAL_STYLE.
> That seams complicated. I try to present it in some kind of a tree:
> MY_CID_AND_STYLE MY_CID_AND_ARIAL2 MY_CID_AND_CLOSING
> | | |
> So, if one of the rules in the second level fire, then at least two other
> rules will also fire and the message get approx. 4.5 points. Isn't that too
Yeah, you might want to take that up wit the SARE guys. That rule is
from 70_sare_stocks.cf, not an official SA ruleset.