Re: Arabic Spam

2010-05-29 Thread Karsten Bräckelmann
Not as far as ok_locales and the respective CHARSET_FARAWAY rules are concerned, IIRC. They have been written long ago to trigger on the char-sets used. They don't detect the char-set based on the actual payload. So where does that leave us? With the need for an update or addition to

Re: Arabic Spam

2010-05-26 Thread Jason Bertoch
On 2010/05/25 7:02 PM, Karsten Bräckelmann wrote: On Wed, 2010-05-26 at 10:35 +1200, Jason Haar wrote: Not as far as ok_locales and the respective CHARSET_FARAWAY rules are concerned, IIRC. They have been written long ago to trigger on the char-sets used. They don't detect the char-set based on

RE: Arabic Spam

2010-05-26 Thread Giampaolo Tomassoni
From: Jason Bertoch [mailto:ja...@i6ix.com] Sent: Wednesday, May 26, 2010 3:34 PM On 2010/05/25 7:02 PM, Karsten Bräckelmann wrote: On Wed, 2010-05-26 at 10:35 +1200, Jason Haar wrote: Not as far as ok_locales and the respective CHARSET_FARAWAY rules are concerned, IIRC. They have been

RE: Arabic Spam

2010-05-25 Thread Giampaolo Tomassoni
On 05/25/2010 09:47 AM, RW wrote:. My guess is that none of of these is being hit because there's enough English mixed-in with the Arabic. I think the FARAWAY rules and other locale checks are dependent on email using the old, pre-Unicode charset formatting. Yesterday I had some Greek

Re: Arabic Spam

2010-05-25 Thread Jason Bertoch
On 2010/05/24 6:17 PM, Jason Haar wrote: On 05/25/2010 09:47 AM, RW wrote:. My guess is that none of of these is being hit because there's enough English mixed-in with the Arabic. I think the FARAWAY rules and other locale checks are dependent on email using the old, pre-Unicode charset

Re: Arabic Spam

2010-05-25 Thread Karsten Bräckelmann
On Mon, 2010-05-24 at 09:27 -0400, Jason Bertoch wrote: A user reported the following FN [...] It is not a FN. It isn't even a proper message. That's some headers, plus a screen-scraped, rendered version of the message, including the most common headers displayed to the user. Without a RAW

RE: Arabic Spam

2010-05-25 Thread Giampaolo Tomassoni
On Mon, 2010-05-24 at 09:27 -0400, Jason Bertoch wrote: A user reported the following FN [...] It is not a FN. It isn't even a proper message. That's some headers, plus a screen-scraped, rendered version of the message, including the most common headers displayed to the user. Without

Re: Arabic Spam

2010-05-25 Thread Jason Bertoch
On 2010/05/25 10:48 AM, Karsten Bräckelmann wrote: On Mon, 2010-05-24 at 09:27 -0400, Jason Bertoch wrote: A user reported the following FN [...] It is not a FN. It isn't even a proper message. That's some headers, plus a screen-scraped, rendered version of the message, including the most

Re: Arabic Spam

2010-05-25 Thread Karsten Bräckelmann
On Tue, 2010-05-25 at 12:51 -0400, Jason Bertoch wrote: On 2010/05/25 10:48 AM, Karsten Bräckelmann wrote: It is not a FN. It isn't even a proper message. That's some headers, plus a screen-scraped, rendered version of the message, including the most common headers displayed to the user.

Re: Arabic Spam

2010-05-25 Thread Jason Haar
On 05/26/2010 05:24 AM, Karsten Bräckelmann wrote: Unfortunately, in this case, the fact that it isn't a proper, raw message is not irrelevant. The ok_locales setting, which is part of your original question, depends on the char-set used. Which is missing from the sample. We only can assume

Re: Arabic Spam

2010-05-25 Thread Karsten Bräckelmann
On Wed, 2010-05-26 at 10:35 +1200, Jason Haar wrote: On 05/26/2010 05:24 AM, Karsten Bräckelmann wrote: Unfortunately, in this case, the fact that it isn't a proper, raw message is not irrelevant. The ok_locales setting, which is part of your original question, depends on the char-set used.

Arabic Spam

2010-05-24 Thread Jason Bertoch
A user reported the following FN to me which is written in an Arabic character set. I have ok_locales en set, but I don't see any rules hitting that appear language related. I also found the normalize_charset option, but don't know if it will help or hurt my ability to detect these

Re: Arabic Spam

2010-05-24 Thread Charles Gregory
On Mon, 24 May 2010, Jason Bertoch wrote: A user reported the following FN to me which is written in an Arabic character set. I have ok_locales en set, but I don't see any rules hitting that appear language related. I also found the normalize_charset option, but don't know if it will help or

RE: Arabic Spam

2010-05-24 Thread Giampaolo Tomassoni
On Mon, 24 May 2010, Jason Bertoch wrote: At a guess I would say the bulk of your score is attributed to the URI in the body that has been flagged as being on the SURBL blocklist. Beyond that, the issue seems to be that they have used a body 'type' of text/html without actually using HTML.

Re: Arabic Spam

2010-05-24 Thread Jason Bertoch
On 2010/05/24 1:50 PM, Giampaolo Tomassoni wrote: Jason was speaking about a FN, not an FP. Am I missing something? Yes, this was a FN. These are the findings with one of my setup (SA 3.3.1, all locales allowed): Content analysis details: (11.8 points, 5.0 required) pts rule name

Re: Arabic Spam

2010-05-24 Thread RW
On Mon, 24 May 2010 16:21:15 -0400 Jason Bertoch ja...@i6ix.com wrote: I was really more interested in the language aspect, though. I expected to see more rules match because of my ok_locales setting. To be honest, I really don't know which rules look at that setting. AFAIK the point of

Re: Arabic Spam

2010-05-24 Thread Jason Haar
On 05/25/2010 09:47 AM, RW wrote:. My guess is that none of of these is being hit because there's enough English mixed-in with the Arabic. I think the FARAWAY rules and other locale checks are dependent on email using the old, pre-Unicode charset formatting. Yesterday I had some Greek