[Mimedefang] Sober virus highlights problem

[Paul Murphy]

Jonathan,

See http://wiki.apache.org/spamassassin/CustomRulesets - the chickenpox rules
are reported to be seriously broken for non-English mail, since they treated
extended characters as non-alpha.  I would expect this to show up most in HTML
e-mail, where e.g. naïve would show as "naïve", which would trigger the
chickenpox rules.

Basically, be very careful using the Chickenpox rule set - if you're messages
are all English, then they're fine.

Best Wishes,

Paul.
__________________________________________________
Paul Murphy
Head of Informatics
Ionix Pharmaceuticals Ltd
418 Science Park, Cambridge, CB4 0PA

Tel. 01223 433741
Fax. 01223 433788


> -----Original Message-----
> From: mimedefang-bounces at lists.roaringpenguin.com 
> [mailto:mimedefang-bounces at lists.roaringpenguin.com] On 
> Behalf Of Jonathan Maliepaard
> Sent: 19 May 2005 14:47
> To: mimedefang at lists.roaringpenguin.com
> Subject: RE: [Mimedefang] Sober virus highlights problem
> 
> 
> Hi
> 
> The reason that we embarked on whitelisting many domains was 
> because of
> all the false positives. We would come in to the office in the moring
> and have to sort through 1000 messages in the spam trap. (right now it
> is mainly SPAM and 300-400)
> 
> As happy as our customers are with this arrangement, (we are 
> an ISP) it
> was putting an over-head on us. It actually was working very 
> well until
> this virus came along and I noticed the flaw in my plan.
> 
> I have installed the custom rules and thousands of mails have been
> blocked, but if a whitelisted domain is spoofed then it comes through.
> 
> One of the problems that we have seen has been indigenous 
> languages. The
> get caught by the chickpox rules quite often, I have been feeding the
> messages to bayes, but so hopefully things will get better soon as out
> bayesian filter copes with our 11 official languages! Also 
> people use a
> lot of foul language and sexual references, they get nabbed 
> every time.
> 
> Thanks for all the feed-back I am going to have to rethink a lot, and
> try to work out why we get so many false positives, and as Joseph so
> rightly said fix my filters ;-)
> 
> Regards Jon.
> 
> 
> 
> 
> _______________________________________________
> Visit http://www.mimedefang.org and http://www.canit.ca
> MIMEDefang mailing list
> MIMEDefang at lists.roaringpenguin.com
> http://lists.roaringpenguin.com/mailman/listinfo/mimedefang
> 

_______________________________________________________________________
DISCLAIMER:
This email and any files transmitted with it are confidential and 
intended solely for the use of the individual or entity to which they
are addressed.  If you have received this email in error please contact
the sender or the Ionix IT Helpdesk on +44 (0) 1223 433741
_______________________________________________________________________