On Mon, 13 Jan 2014, Amir Caspi wrote:
On Dec 28, 2013, at 9:08 PM, John Hardin <jhar...@impsec.org> wrote:
Yes, I definitely noticed that. As you can see from the spample (link
below), none of the above rules are hitting properly; the To: line is a
bare email, not properly angle-bracketed. Or, if any of the rules are
hitting, the meta rule that they are supposed to trigger still does not
trigger.
If you can post a spample or two somewhere I'll see what I can do.
Spample:
http://pastebin.com/0jEMBA1X
Thanks, I'll take a look.
Just to note that I saw a bunch of hits on TO_IN_SUBJ today, when the
To: was a bare email... I guess you've been working on this and pushed
an update out? If so, it seems to be working nicely so far.
I'll have to check on that, I haven't looked in a while. My off-the-cuff answer
is: look in my sandbox and in the masscheck results, I expect it isn't doing
too well against the masscheck corpora.
Just checking to see if you had a chance to investigate your
HTML_COMMENT_GIBBERISH rule and whether it was working OK or not...
Cheers.
Sorry, $WORK is really busy now. Dunno when I'll get a chance.
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhar...@impsec.org FALaholic #11174 pgpk -a jhar...@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
My sidearm is a piece of emergency equipment. It absolutely must
be reliable, not "smart".
-----------------------------------------------------------------------
4 days until Benjamin Franklin's 308th Birthday
