On Tue, 6 Mar 2018, David Jones wrote:
On 03/05/2018 06:57 PM, John Hardin wrote:
On Mon, 5 Mar 2018, Alex wrote:
Hi,
On Mon, Mar 5, 2018 at 5:59 PM, John Hardin <jhar...@impsec.org> wrote:
On Mon, 5 Mar 2018, Alex wrote:
To: =?utf-8?Q?DermotO=27reilly?= <Sean.O'rei...@example.com>
* 2.6 APOSTROPHE_TOCC To or CC address contains an apostrophe
2.6 points for this is just unreasonable. This was a completely
legitimate email.
Is such an address even deliverable?
Yes, it's beyond me why anyone would want to use an apostrophe, but
it's valid.
OK.
That rule is 8 years stale. I've added a masscheck score limit of 1.000
I'm open to discussion of converting it to a subrule and/or adding some
extra conditions to it.
Here are some samples of what I found in my corpora which supplies the
majority of the nightly masscheck corpora.
https://pastebin.com/QchEu2BA
https://pastebin.com/pbYnvzU4
https://pastebin.com/EjnQSE7H
In this case these were really bad spam so the APOSTROPHE_TOCC is just riding
on the back of other rules, BLs, and high Bayes scores.
What I generally look at is the detailed rule performance in masscheck. If
it primarily hits on spams that score in total 1-3 points I generally
tend to set the score limit somewhat higher. Having a tail of
higher-scoring hits doesn't affect that analysis.
This looks like one of those rules.
In this case I'd probably set the score limit on this rule low and add
more generously-scored metas for the high-spam-low-ham rule overlaps from
the masscheck results.
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhar...@impsec.org FALaholic #11174 pgpk -a jhar...@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
Failure to plan ahead on someone else's part does not constitute
an emergency on my part. -- David W. Barts in a.s.r
-----------------------------------------------------------------------
5 days until Daylight Saving Time begins in U.S. - Spring Forward
