Negative scores (was Re: [Mimedefang] scores displayed in $tests)

[Nels Lindquist]

On 7 May 2003 at 10:34, David F. Skoll wrote:

> On Wed, 7 May 2003, alan premselaar wrote:
> 
> > i'm using MD 2.33 and SA 2.53 currently and recently
> > some SPAM has been getting thru the filter with low scores, but i'm not sure
> > if they're matching negative scores or not.
> 
> I recommend replacing almost all negative-score rules with zero weights.
> Widely-known negative-score rules are just an invitation for spammers to
> get around SpamAssassin.  I use a 90_local.cf file like the one appended.

This is a much-discussed issue on the sa-talk (probably the single 
most FAQ) and will be addressed in the imminent 2.54 release.  There 
have been a few spammers taking advantage of some of the negative 
rules by faking multiple MUA lines, for example.

Attached are two patches from the sa-talk list.  One of them reduces 
the magnitude of the negative rules in 50_scores.cf (though not to 
zero), and the other adds some meta rules which check for faked 
multiple MUA headers and the like.

----
Nels Lindquist <*>
Information Systems Manager
Morningstar Air Express Inc.

-------------- next part --------------
The following section of this message contains a file attachment
prepared for transmission using the Internet MIME message format.
If you are using Pegasus Mail, or any other MIME-compliant system,
you should be able to save it or view it from within your mailer.
If you cannot, please ask your system administrator for assistance.

   ---- File information -----------
     File:  rules_meta.diff
     Date:  7 May 2003, 9:20
     Size:  1623 bytes.
     Type:  Text
-------------- next part --------------
A non-text attachment was scrubbed...
Name: rules_meta.diff
Type: application/octet-stream
Size: 1623 bytes
Desc: not available
URL: <https://lists.mimedefang.org/pipermail/mimedefang_lists.mimedefang.org/attachments/20030507/ae69d77e/attachment.obj>
-------------- next part --------------
The following section of this message contains a file attachment
prepared for transmission using the Internet MIME message format.
If you are using Pegasus Mail, or any other MIME-compliant system,
you should be able to save it or view it from within your mailer.
If you cannot, please ask your system administrator for assistance.

   ---- File information -----------
     File:  rules_scores.diff
     Date:  7 May 2003, 9:20
     Size:  5321 bytes.
     Type:  Text
-------------- next part --------------
A non-text attachment was scrubbed...
Name: rules_scores.diff
Type: application/octet-stream
Size: 5321 bytes
Desc: not available
URL: <https://lists.mimedefang.org/pipermail/mimedefang_lists.mimedefang.org/attachments/20030507/ae69d77e/attachment-0001.obj>