On 14/3/2022 10:42 π.μ., Matus UHLAR - fantomas wrote:
looks perfectly valid. Note that L_OLEMACRO_ZIP_PW and
L_FROM_2_EMAILS each score 1 point by default.
If this is not what you want, start name with __
... I use L_ as prefix for local rules, __ prefixes test rules (no
score by default) and T_ prefixes test rules (score 0.01 by default).
rules with score 0 are not evaluated unless they are prefixed with __
Also, what should I do to catch (and score) ALL mails with 2
different mail addresses in the From header (regardless whether there
is an encrypted zip attachment or not)?
the __PDS_FROM_2_EMAILS should catch excatly this, but since the rule
name starts with __, it has no points by default.
Thank you Matus,
I appreciate your help.
I am studying your notes; I also found supplementary documentation to
help me gain some better insight
(https://cwiki.apache.org/confluence/display/SPAMASSASSIN/writingrules).
In case I need more of your valuable clarifications, I will have to
disturb you a bit again.
One of those is: Why use parentheses in some cases, like:
(__PDS_FROM_2_EMAILS) ? Do parentheses have particular significance by
modifying operation/evaluation?
Thanks again,
Nick
