Login | Register For Free | Help
Search for: (Advanced)

Mailing List Archive: SpamAssassin: users

Help eliminate false positive for Google Code notifications

 

 

SpamAssassin users RSS feed   Index | Next | Previous | View Threaded


mike at skew

Jul 11, 2013, 9:09 AM

Post #1 of 6 (109 views)
Permalink
Help eliminate false positive for Google Code notifications

Google Code sends out notifications from <project name>@googlecode.com. These
notifications have Message-ID headers that start with two digits and a dash,
triggering this rule:

SARE_MSGID_DDDASH Message-ID has ratware pattern (9-, 9$, 99-)

The rule was proposed in 2004:
https://mail-archives.apache.org/mod_mbox/spamassassin-users/200402.mbox/%3C20040204190450.9B96217007 [at] jmason%3E

A sample Message-ID (I have an issue starred in the Android project):
<46-15317412764558277774-7215198307142895543-android=googlecode.com [at] googlecode>

Complete mbox message at http://pastebin.com/W5cN4DFd

The false positive is not contributing much to the score (1.666), but I don't
like it, so I'd like to avoid triggering the rule altogether if I can. I want
to do it in the preferred way, if there is a preferred way. Any solution I
would come up with would be pretty kludgy. So, suggestions appreciated! Thanks.


axb.lists at gmail

Jul 11, 2013, 9:13 AM

Post #2 of 6 (101 views)
Permalink
Re: Help eliminate false positive for Google Code notifications [In reply to]

On 07/11/2013 06:09 PM, Mike Brown wrote:
> Google Code sends out notifications from <project name>@googlecode.com. These
> notifications have Message-ID headers that start with two digits and a dash,
> triggering this rule:
>
> SARE_MSGID_DDDASH Message-ID has ratware pattern (9-, 9$, 99-)
>
> The rule was proposed in 2004:
> https://mail-archives.apache.org/mod_mbox/spamassassin-users/200402.mbox/%3C20040204190450.9B96217007 [at] jmason%3E
>
> A sample Message-ID (I have an issue starred in the Android project):
> <46-15317412764558277774-7215198307142895543-android=googlecode.com [at] googlecode>
>
> Complete mbox message at http://pastebin.com/W5cN4DFd
>
> The false positive is not contributing much to the score (1.666), but I don't
> like it, so I'd like to avoid triggering the rule altogether if I can. I want
> to do it in the preferred way, if there is a preferred way. Any solution I
> would come up with would be pretty kludgy. So, suggestions appreciated! Thanks.
>

SARE rules are obsolete/unsupported/ancient/history/etc and shouldn't be
used.
Do yourself a favour and remove those files - will save you CPU cycles,
memory and lots of headaches.

your truly,
a retired SARE Ninja


mike at skew

Jul 11, 2013, 9:26 AM

Post #3 of 6 (101 views)
Permalink
Re: Help eliminate false positive for Google Code notifications [In reply to]

Axb wrote:
> SARE rules are obsolete/unsupported/ancient/history/etc and shouldn't be
> used.
> Do yourself a favour and remove those files - will save you CPU cycles,
> memory and lots of headaches.

Heh, even easier than I thought.

I think I had assumed that if I stopped fetching them, I wouldn't have them
anymore, especially after upgrading Spamassassin. But they stayed and got
copied over from upgrade to upgrade.

Thanks!


me at junc

Jul 14, 2013, 8:59 AM

Post #4 of 6 (90 views)
Permalink
Re: Help eliminate false positive for Google Code notifications [In reply to]

Mike Brown skrev den 2013-07-11 18:09:

> SARE_MSGID_DDDASH Message-ID has ratware pattern (9-, 9$, 99-)

sare rulesets is depricated, so you are on your own :=)


me at junc

Jul 14, 2013, 9:05 AM

Post #5 of 6 (90 views)
Permalink
Re: Help eliminate false positive for Google Code notifications [In reply to]

Axb skrev den 2013-07-11 18:13:

> a retired SARE Ninja

its was good since to many still use it :)


mike at skew

Jul 17, 2013, 11:19 AM

Post #6 of 6 (80 views)
Permalink
Re: Help eliminate false positive for Google Code notifications [In reply to]

Benny Pedersen wrote:
> its was good since to many still use it :)

In my case it was that the old rulesets were left behind long after the
updates stopped; they kept getting transferred over through upgrades of
SpamAssassin and Perl. Once I deleted them, all was well. Well, except that
more spam started getting through. :)

SpamAssassin users RSS feed   Index | Next | Previous | View Threaded
 
 


Interested in having your list archived? Contact Gossamer Threads
 
  Web Applications & Managed Hosting Powered by Gossamer Threads Inc.