At work, we looked at this and decided the rule had no merit based on current mailstreams. Our guess was that the spam run it hit has ended. It is a deadweight rule.
On Wed, May 29, 2019, 18:05 John Hardin <jhar...@impsec.org> wrote: > On Thu, 16 May 2019, John Hardin wrote: > > > On Thu, 16 May 2019, Amir Caspi wrote: > > > >> On Apr 26, 2019, at 4:51 PM, RW <rwmailli...@googlemail.com> wrote: > >>> > >>> header BOGUS_MIME_VERSION MIME-Version =~ /^(?!\s*1\.0).+/ > >>> > >>> it may be better to change that to > >>> > >>> /^(?!.*\b1\.0\b).+/ > >>> > >>> to avoid punishing the form > >>> > >>> Mime-Version: (Nosuch Mail 2.0) 1.0 > >>> > >>> which is valid, though I don't think I've ever seen it (comments are > >>> usually on the right). > >> > >> John, so many of my spams are hitting BOGUS_MIME_VERSION that I would > >> imagine it's worth sandboxing and incorporating into the primary > ruleset. > > > > I've added both versions as unscored rules so we can see how they > perform. > > Masscheck doesn't think much of them: > > > https://ruleqa.spamassassin.org/20190529-r1860321-n/__BOGUS_MIME_VER_01/detail > > https://ruleqa.spamassassin.org/20190529-r1860321-n/__BOGUS_MIME_VER_02/detail > > The good news is their S/O is 1.00 (not that that means much given the > small hit rate), and the bulk of the spams they hit currently score zero. > > We could manually push them with score = 1.000, and let local admins > decide whether to adjust the score. > > Opinions solicited. > > -- > John Hardin KA7OHZ http://www.impsec.org/~jhardin/ > jhar...@impsec.org FALaholic #11174 pgpk -a jhar...@impsec.org > key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79 > ----------------------------------------------------------------------- > We have to realize that people who run the government can and do > change. Our society and laws must assume that bad people - > criminals even - will run the government, at least part of the > time. -- John Gilmore > ----------------------------------------------------------------------- > 8 days until the 75th anniversary of D-Day >