Stefan Jakobs wrote:
> Hello list,
>
> one of my users received this message:
> http://pastebin.com/m2d3ad435
>
> and it scored like that:
> X-Spam-Status: Yes, score=12.501 tagged_above=-999 required=5
> tests=[BAYES_00=-2.599, DATE_IN_PAST_12_24=0.992, EXTRA_MPART_TYPE=1,
> HTML_MESSAGE=0.001, INVALID_DATE=1.245, MIME_QP_LONG_LINE=1.396,
> MY_CID_AND_ARIAL2=1.46, MY_CID_AND_CLOSING=1.6, MY_CID_AND_STYLE=1.54,
> MY_CID_ARIAL2_CLOSING=1.63, MY_CID_ARIAL_STYLE=1.58,
> PART_CID_STOCK=1.635, SA2DNSBLC=0.001, T_TVD_FW_GRAPHIC_ID1=0.01,
> URI_SPACE=1.01]
>
> 12.5 points is a lot. And again the message was from VDE and 70_sare_stocks
> hit at it. Is 70_sare_stocks still useful?
>
> My rankings from today:
> %4.38 MY_CID_AND_STYLE=1.54
> %2.89 MY_CID_AND_ARIAL2=1.46
> %2.89 MY_CID_ARIAL_STYLE=1.58
> <%1.0 MY_CID_AND_CLOSING=1.6
> <%1.0 MY_CID_ARIAL2_CLOSING=1.63
>
> I suppose the problem is that MY_CID_ARIAL_STYLE is a subset of
> MY_CID_AND_STYLE. Also is MY_CID_ARIAL_STYLE a subset of MY_CID_AND_ARIAL2.
> And MY_CID_AND_CLOSING is a subset of MY_CID_ARIAL2_CLOSING which is a subset
> of MY_CID_ARIAL_STYLE.
>
> That seams complicated. I try to present it in some kind of a tree:
> MY_CID_AND_STYLE MY_CID_AND_ARIAL2 MY_CID_AND_CLOSING
> | | |
> +---MY_CID_ARIAL_STYLE---+---MY_CID_ARIAL2_CLOSING---+
>
>
> So, if one of the rules in the second level fire, then at least two other
> rules will also fire and the message get approx. 4.5 points. Isn't that too
> much?


Yeah, you might want to take that up wit the SARE guys. That rule is
from 70_sare_stocks.cf, not an official SA ruleset.