Login | Register For Free | Help
Search for: (Advanced)

Mailing List Archive: SpamAssassin: users

T_FROM_MISSPACED score

 

 

SpamAssassin users RSS feed   Index | Next | Previous | View Threaded


rwmaillists at googlemail

Feb 22, 2010, 7:37 AM

Post #1 of 14 (2078 views)
Permalink
T_FROM_MISSPACED score

Why does T_FROM_MISSPACED score 0.0, when it's score isn't defined?



X-Spam-Report:
...
* 0.0 T_FROM_MISSPACED From: missing whitespace


$ grep -r T_FROM_MISSPACED /var/db/spamassassin/
/var/db/spamassassin/3.003000/updates_spamassassin_org/72_active.cf:meta MONEY_FROM_MISSP T_LOTS_OF_MONEY && T_FROM_MISSPACED
/var/db/spamassassin/3.003000/updates_spamassassin_org/72_active.cf:##{ T_FROM_MISSPACED
/var/db/spamassassin/3.003000/updates_spamassassin_org/72_active.cf:header T_FROM_MISSPACED From =~ /^\s*"[^"]*"</
/var/db/spamassassin/3.003000/updates_spamassassin_org/72_active.cf:describe T_FROM_MISSPACED From: missing whitespace
/var/db/spamassassin/3.003000/updates_spamassassin_org/72_active.cf:##} T_FROM_MISSPACED


jhardin at impsec

Feb 22, 2010, 8:05 AM

Post #2 of 14 (2010 views)
Permalink
Re: T_FROM_MISSPACED score [In reply to]

On Mon, 22 Feb 2010, RW wrote:

> Why does T_FROM_MISSPACED score 0.0, when it's score isn't defined?

Rounding. The actual defined score is 0.01, so it rounds down when
reported.

> X-Spam-Report:
> ...
> * 0.0 T_FROM_MISSPACED From: missing whitespace

--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin [at] impsec FALaholic #11174 pgpk -a jhardin [at] impsec
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
A superior gunman is one who uses his superior judgment to keep
himself out of situations that would require the use of his
superior skills.
-----------------------------------------------------------------------
Today: George Washington's 278th Birthday


guenther at rudersport

Feb 22, 2010, 8:48 AM

Post #3 of 14 (2001 views)
Permalink
Re: T_FROM_MISSPACED score [In reply to]

On Mon, 2010-02-22 at 15:37 +0000, RW wrote:
> Why does T_FROM_MISSPACED score 0.0, when it's score isn't defined?

It's a T_ testing rule. These don't score the default 1.0 with a missing
explicit score set.


--
char *t="\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1:
(c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}


rwmaillists at googlemail

Feb 22, 2010, 8:49 AM

Post #4 of 14 (2008 views)
Permalink
Re: T_FROM_MISSPACED score [In reply to]

On Mon, 22 Feb 2010 08:05:10 -0800 (PST)
John Hardin <jhardin [at] impsec> wrote:

> On Mon, 22 Feb 2010, RW wrote:
>
> > Why does T_FROM_MISSPACED score 0.0, when it's score isn't defined?
>
> Rounding. The actual defined score is 0.01, so it rounds down when
> reported.

but where is it defined? greping under /var/db/spamassassin for
T_FROM_MISSPACED doesn't find a score line.


Bowie_Bailey at BUC

Feb 22, 2010, 8:54 AM

Post #5 of 14 (2015 views)
Permalink
Re: T_FROM_MISSPACED score [In reply to]

RW wrote:
> On Mon, 22 Feb 2010 08:05:10 -0800 (PST)
> John Hardin <jhardin [at] impsec> wrote:
>
>
>> On Mon, 22 Feb 2010, RW wrote:
>>
>>
>>> Why does T_FROM_MISSPACED score 0.0, when it's score isn't defined?
>>>
>> Rounding. The actual defined score is 0.01, so it rounds down when
>> reported.
>>
>
> but where is it defined? greping under /var/db/spamassassin for
> T_FROM_MISSPACED doesn't find a score line.
>

It just gets the default score:

T_* gets 0.01 points
__* gets 0.0 points
everything else gets 1.0 points


--
Bowie


dbfunk at engineering

Feb 22, 2010, 9:11 AM

Post #6 of 14 (2011 views)
Permalink
Re: T_FROM_MISSPACED score [In reply to]

On Mon, 22 Feb 2010, RW wrote:

> On Mon, 22 Feb 2010 08:05:10 -0800 (PST)
> John Hardin <jhardin [at] impsec> wrote:
>
> > On Mon, 22 Feb 2010, RW wrote:
> >
> > > Why does T_FROM_MISSPACED score 0.0, when it's score isn't defined?
> >
> > Rounding. The actual defined score is 0.01, so it rounds down when
> > reported.
>
> but where is it defined? greping under /var/db/spamassassin for
> T_FROM_MISSPACED doesn't find a score line.

SA has some special rule naming conventions.

Rules that begin with the letters "T_" (EG T_FROM_MISSPACED) are so called
testing rules and automagically assigned a score of 0.01 (enough to show
up in the report but not enough to cause false positives in case they're
not right). The idea is that once the author is happy with the way the
rule works it's name will be changed (remove the 'T_') and a proper score
assigned.

The other special rule name is the hidden rule, one that starts with "__".
Those rules are assigned a score of 0 but do run regardless and aren't
reported in the scoring report. The intention there is that they're used
to form meta-rules when you need to combine a number of factors and only
want the final result to score/report.
When developing hidden rules it's easy to make them visable for debugging
purposes, mearly prepend a 'T' to the name which turns them into visible
testing rules.

--
Dave Funk University of Iowa
<dbfunk (at) engineering.uiowa.edu> College of Engineering
319/335-5751 FAX: 319/384-0549 1256 Seamans Center
Sys_admin/Postmaster/cell_admin Iowa City, IA 52242-1527
#include <std_disclaimer.h>
Better is not better, 'standard' is better. B{


guenther at rudersport

Feb 22, 2010, 9:40 AM

Post #7 of 14 (2008 views)
Permalink
Re: T_FROM_MISSPACED score [In reply to]

On Mon, 2010-02-22 at 11:11 -0600, David B Funk wrote:
> The other special rule name is the hidden rule, one that starts with "__".
> Those rules are assigned a score of 0 but do run regardless and aren't
> reported in the scoring report. The intention there is that they're used
> to form meta-rules when you need to combine a number of factors and only
> want the final result to score/report.
> When developing hidden rules it's easy to make them visable for debugging
> purposes, mearly prepend a 'T' to the name which turns them into visible
> testing rules.

This is the wrong approach. The non-scoring sub-rules with a double
underscore prefix are meant for meta rules.

Making them "visible" by transforming them into T_ testing rules sure
would make them visible in the *default* SA report headers, but comes
with an enormous downside: You have to rename *all* occurrences in all
meta rules using them. Moreover, it's pretty much a rule design decision
to not have them visible.

If -- for debugging purpose -- you want to have non-scoring sub-rules
visible, rather than renaming them, the best approach is (a) either to
have a look at the -D debug output, or (b) to add a header with the
_SUBTESTS(,)_ template tag. Depending on whether you just need some
ad-hoc checking, or on a broader basis.


--
char *t="\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1:
(c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}


rwmaillists at googlemail

Feb 22, 2010, 9:47 AM

Post #8 of 14 (2018 views)
Permalink
Re: T_FROM_MISSPACED score [In reply to]

On Mon, 22 Feb 2010 11:11:47 -0600 (CST)
David B Funk <dbfunk [at] engineering> wrote:

> On Mon, 22 Feb 2010, RW wrote:
>
> > On Mon, 22 Feb 2010 08:05:10 -0800 (PST)
> > John Hardin <jhardin [at] impsec> wrote:
> >
> > > On Mon, 22 Feb 2010, RW wrote:
> > >
> > > > Why does T_FROM_MISSPACED score 0.0, when it's score isn't
> > > > defined?
> > >
> > > Rounding. The actual defined score is 0.01, so it rounds down when
> > > reported.
> >
> > but where is it defined? greping under /var/db/spamassassin for
> > T_FROM_MISSPACED doesn't find a score line.
>
> SA has some special rule naming conventions.
>
> Rules that begin with the letters "T_" (EG T_FROM_MISSPACED) are so
> called testing rules and automagically assigned a score of 0.01
> (enough to show up in the report but not enough to cause false
> positives in case they're not right). The idea is that once the
> author is happy with the way the rule works it's name will be changed
> (remove the 'T_') and a proper score assigned.

I'm aware of __* rules, but I'd not noticed T_* rules before. And
looking back through my spam I don't see any hits until a couple of
weeks ago, so presumably something has changed.


guenther at rudersport

Feb 22, 2010, 9:53 AM

Post #9 of 14 (2003 views)
Permalink
Re: T_FROM_MISSPACED score [In reply to]

On Mon, 2010-02-22 at 17:47 +0000, RW wrote:
> I'm aware of __* rules, but I'd not noticed T_* rules before. And
> looking back through my spam I don't see any hits until a couple of
> weeks ago, so presumably something has changed.

Yup, the SA version you're running. And along with that change, some
changes for distributing updated rules...


--
char *t="\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1:
(c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}


jhardin at impsec

Feb 22, 2010, 11:44 AM

Post #10 of 14 (2016 views)
Permalink
Re: T_FROM_MISSPACED score [In reply to]

On Mon, 22 Feb 2010, RW wrote:

> On Mon, 22 Feb 2010 08:05:10 -0800 (PST)
> John Hardin <jhardin [at] impsec> wrote:
>
>> On Mon, 22 Feb 2010, RW wrote:
>>
>>> Why does T_FROM_MISSPACED score 0.0, when it's score isn't defined?
>>
>> Rounding. The actual defined score is 0.01, so it rounds down when
>> reported.
>
> but where is it defined? greping under /var/db/spamassassin for
> T_FROM_MISSPACED doesn't find a score line.

Sorry, I jumped to a wrong answer. Karsten's right, the T_ is fiddling
with the scoring.

In Real Life, if you see a 0.0 score in a Report, rounding is the cause.

--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin [at] impsec FALaholic #11174 pgpk -a jhardin [at] impsec
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
North Korea: the only country in the world where people would risk
execution to flee to communist China. -- Ride Fast
-----------------------------------------------------------------------
Today: George Washington's 278th Birthday


jhardin at impsec

Feb 22, 2010, 11:46 AM

Post #11 of 14 (2014 views)
Permalink
Re: T_FROM_MISSPACED score [In reply to]

On Mon, 22 Feb 2010, RW wrote:

> I'm aware of __* rules, but I'd not noticed T_* rules before. And
> looking back through my spam I don't see any hits until a couple of
> weeks ago, so presumably something has changed.

Wait, you're seeing this in a live SA install?

--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin [at] impsec FALaholic #11174 pgpk -a jhardin [at] impsec
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
North Korea: the only country in the world where people would risk
execution to flee to communist China. -- Ride Fast
-----------------------------------------------------------------------
Today: George Washington's 278th Birthday


artg at eclipse

Feb 22, 2010, 11:57 AM

Post #12 of 14 (2004 views)
Permalink
Re: T_FROM_MISSPACED score [In reply to]

On Mon, 22 Feb 2010, John Hardin wrote:

> On Mon, 22 Feb 2010, RW wrote:
>
>> I'm aware of __* rules, but I'd not noticed T_* rules before. And looking
>> back through my spam I don't see any hits until a couple of weeks ago, so
>> presumably something has changed.
>
> Wait, you're seeing this in a live SA install?

I am. SA 3.3.0 ruleset metadata version 903765

--
Art Greenberg
artg [at] eclipse


jhardin at impsec

Feb 22, 2010, 12:08 PM

Post #13 of 14 (2003 views)
Permalink
Re: T_FROM_MISSPACED score [In reply to]

On Mon, 22 Feb 2010, Art Greenberg wrote:

> On Mon, 22 Feb 2010, John Hardin wrote:
>
>> On Mon, 22 Feb 2010, RW wrote:
>>
>> > I'm aware of __* rules, but I'd not noticed T_* rules before. And
>> > looking back through my spam I don't see any hits until a couple of
>> > weeks ago, so presumably something has changed.
>>
>> Wait, you're seeing this in a live SA install?
>
> I am. SA 3.3.0 ruleset metadata version 903765

Ah, okay, it's being published even though the nightly masscheck thinks
it's not performing well because several meta rules that _do_ perform
well depend on it.

--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin [at] impsec FALaholic #11174 pgpk -a jhardin [at] impsec
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
Your mouse has moved. Your Windows Operating System must be
relicensed due to this hardware change. Please contact Microsoft
to obtain a new activation key. If this hardware change results in
added functionality you may be subject to additional license fees.
Your system will now shut down. Thank you for choosing Microsoft.
-----------------------------------------------------------------------
Today: George Washington's 278th Birthday


dfs at roaringpenguin

Feb 7, 2012, 11:33 AM

Post #14 of 14 (357 views)
Permalink
Re: T_FROM_MISSPACED score [In reply to]

On Tue, 7 Feb 2012 14:31:17 -0500
"David F. Skoll" <dfs [at] roaringpenguin> wrote:

> Is there a reason T_FROM_MISSPACED is still only a testing rule?

Never mind... I wasn't looking at an up-to-date ruleset.

Regards,

David.

SpamAssassin users RSS feed   Index | Next | Previous | View Threaded
 
 


Interested in having your list archived? Contact Gossamer Threads
 
  Web Applications & Managed Hosting Powered by Gossamer Threads Inc.