[Mimedefang] Creating better idiots (spam blocking)

[Jeff Rife]

On 27 Jul 2004 at 0:30, Ashley M. Kirchner wrote:

> Every day you come up with a way to block charsets you don't want, and 
> someone makes a better idiot. So here's the next "problem". How do I 
> scan and properly block these? Notice the 'big5' charset
> 
> Subject: 
> =?big5?Q?=A7=D6=A8=D3=B3=F8=A6W->=A1u=A5x=B4=C1=AB=FC=C4=B9=AEa=AFZ=A1v=A7K=B6O=C1=BF=AEy?=

The "raw" scans of SpamAssassin (they don't interpret MIME and encodings) 
can catch this sort of thing.  I use a few extra rulesets, but I was 
catching this before I started using them.

Make sure you have the following in your SA config file, and you should 
at least get the e-mail marked as SPAM:

ok_locales      en
ok_languages    en

If you change the scoring for these rules, you can make the score high 
enough to meet a "drop" threshold.  Some of the rules that work with this 
(and their default scores in SA 2.63):

score BODY_8BITS             1.500
score CHARSET_FARAWAY        3.200
score CHARSET_FARAWAY_HEADER 3.200
score HTML_CHARSET_FARAWAY   0.500
score MIME_CHARSET_FARAWAY   2.450
score UNWANTED_LANGUAGE_BODY 2.800


--
Jeff Rife        | Coach: How's a beer sound, Norm? 
SPAM bait:       |  
AskDOJ at usdoj.gov |  Norm: I dunno.  I usually finish them before 
uce at ftc.gov      |        they get a word in.