On Tue, 6 Mar 2018, David Jones wrote:

On 03/05/2018 06:57 PM, John Hardin wrote:
On Mon, 5 Mar 2018, Alex wrote:


On Mon, Mar 5, 2018 at 5:59 PM, John Hardin <jhar...@impsec.org> wrote:
On Mon, 5 Mar 2018, Alex wrote:

To: =?utf-8?Q?DermotO=27reilly?= <Sean.O'rei...@example.com>
*  2.6 APOSTROPHE_TOCC To or CC address contains an apostrophe

2.6 points for this is just unreasonable. This was a completely
legitimate email.

Is such an address even deliverable?

Yes, it's beyond me why anyone would want to use an apostrophe, but
it's valid.


That rule is 8 years stale. I've added a masscheck score limit of 1.000

I'm open to discussion of converting it to a subrule and/or adding some extra conditions to it.

Here are some samples of what I found in my corpora which supplies the majority of the nightly masscheck corpora.


In this case these were really bad spam so the APOSTROPHE_TOCC is just riding on the back of other rules, BLs, and high Bayes scores.

What I generally look at is the detailed rule performance in masscheck. If it primarily hits on spams that score in total 1-3 points I generally tend to set the score limit somewhat higher. Having a tail of higher-scoring hits doesn't affect that analysis.

This looks like one of those rules.

In this case I'd probably set the score limit on this rule low and add more generously-scored metas for the high-spam-low-ham rule overlaps from the masscheck results.

 John Hardin KA7OHZ                    http://www.impsec.org/~jhardin/
 jhar...@impsec.org    FALaholic #11174     pgpk -a jhar...@impsec.org
 key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C  AF76 D822 E6E6 B873 2E79
  Failure to plan ahead on someone else's part does not constitute
  an emergency on my part.                 -- David W. Barts in a.s.r
 5 days until Daylight Saving Time begins in U.S. - Spring Forward

Reply via email to