More on catching inlines

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

It appears that looking for src=cid: (and variants per Darxus more complete
regular expression) is amazingly effective at weeding out these inline image
spams.  I have been using a procmail rule to block these (combined with a
little white list rule to rescue messages from real correspondents) and it's
working perfectly.

Of course white lists are painful especially since I don't want my users on
my mail server to have to edit their own procmailrc files to update them.
So, I've been investigating how to allow SP to implement the white list.
What I've found is very interesting.

SP has an undocumented headers only mode (-t headers-only) and a document -X
mode (min 5 words for score but expanding to include all highly significant
terms).  Those two modes combined seem to work extremely well at picking out
the good from the bad among these types of messages.  For example looking in
my inbox there are 3 such ham emails and they all score less than 0.001
using

  spamprobe -t headers-only -X ~/Maildir/

There are 3 inline image spams in my "inlines" mailbox and they all score
0.83 or higher using

  spamprobe -t headers-only -X ~/Maildir/.inlines

Now I need to come up with a procmail recipe that looks for the inline image
regex and then scores either normally or using the above options depending
on whether or not inline images are present.  I'll experiment with procmail
for a while and then, if it works well, I can add the functionality as an
option to SP.

The reason this works so well is that generally the headers in these spams
are somewhat incriminating and headers from normal correspondents are
incredibly "good" so using just the headers and ignoring unknown terms (-X
is good at that) will generate very strong ham scores for good emails and
somewhat spammy scores for real spams. It might even be safe to lower the
spam threshold in that mode using the -l option.

I'll let you all know how this works out.

All the best!
++Brian

PS. Grey Listing still rocks.  It's blocking over 90% of the incoming spam
traffic.  In spite of it being a two year old idea with and easy technical
solutions most spammers don't seem to have adapted to it.



-----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 9.5.2 (Build 4075)
Charset: US-ASCII

wsBVAwUBRY/0wjxRyEoJfXIFAQgvTwgArsPWE3zha+5UepfsdalZZ/KsHpYfH0GS
7oXpdNvrhpJqogao8M+FhdxWQbn114faP/x4eCFhYj0raPlpwck93F5CqLBo79yz
GBHG07ro09xBEcXIM+aL6rjJ/Sf0uOR+jxi56EE5Ww3WmVjejLMzRnknIUrFhv1o
t2hHxJONERhuoNOyfkZk/3h6TfvXLVjBDZTwQvRDTzcqgVr7G6rBv+WHS+9/LPBz
7lkH108yWJkxRUFeCK417Y05RPxwZd5xWqHaM89wV1tPoVv4tWUs/E5Ot3ZoFlD6
EWt5kQ2ZYniHt79+w9alDmfceTgucGSd0Ewrs/dtpAX45ynA1lqMSw==
=z7MR
-----END PGP SIGNATURE-----

-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys - and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV