On Thu, 21 May 2015, Kevin A. McGrail wrote:
On 5/20/2015 4:08 PM, John Hardin wrote:
Check this out:
0 0 0 0.500 0.48 (n/a) __SPOOFED_FREEMAIL
0 3.7622 18.7236 0.167 0.40 0.01 T_SPOOFED_FREEMAIL
SPOOFED_FREEMAIL is just a scored meta of __SPOOFED_FREEMAIL. How can they
possibly have different hits?
http://ruleqa.spamassassin.org/?daterev=20150520-r1680490-n&rule=%2FSPOOFED_FREEMAIL
http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/khopesh/20_s25r.cf?r1=937743&r2=1678962&sortby=date&diff_format=h
There is code to handle metas and auto promotion of sub rules but I don't
know that it would handle the case where you have an identical rule as a sub
rule and a full rule correctly. Why bother having both anyway?
When you want to use it as a component in other metas, and it might also
be a useful spam sign by itself, but if it isn't, you don't want the other
metas referring to a T_ rule...
So potentially changing the scored meta to be something like:
meta SPOOFED_FREEMAIL __SPOOFED_FREEMAIL && 1
...just so it's different, or adding some FP-avoidance stuff to the scored
rule, but I'm reluctant to do that to rules in somebody else's sandbox.
Adam, any objections to moving SPOOFED_FREEMAIL over to my sandbox?
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
[email protected] FALaholic #11174 pgpk -a [email protected]
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
W-w-w-w-w-where did he learn to n-n-negotiate like that?
-----------------------------------------------------------------------
4 days until Memorial Day - honor those who sacrificed for our liberty
