Sa-learn tricks

[James R. Stevens]

This is something I have also strugled with. There are two scripts out
on the web designed to remove the forwarded headers before sa-lear scans
them, although I was not happy with the results.

If anyone has a clean way of doing this I would also be very interested.
A small log STDOUT of the headers removes before sa-learn ran would
proove its use. It would also give us a tool in troubleshooting Bayes
false positives. 

-----Original Message-----
From: Quentin Campbell [mailto:Q.G.Campbell at NEWCASTLE.AC.UK] 
Sent: Tuesday, October 19, 2004 3:11 AM
To: MAILSCANNER at JISCMAIL.AC.UK
Subject: Re: Sa-learn tricks

>-----Original Message-----
>From: MailScanner mailing list 
>[mailto:MAILSCANNER at JISCMAIL.AC.UK] On Behalf Of Sanjay K. Patel
>Sent: 18 October 2004 15:05
>To: MAILSCANNER at JISCMAIL.AC.UK
>Subject: Sa-learn tricks
>
>Although this is a bit of topic I was hoping someone here might have a
>answer. I want to send spam not caught by mailscanner back to 
>the server for
>sa-learn to learn the spam. The question is "does sa-learn 
>learn the content
>of the spam or the headers also?". My concern is that all the 
>headers will
>have my info since I am forwarding it and I don't want 
>sa-learn to think I
>am a spammer.

Sanjay

Since sa-learn _does_ use the message headers you have to be careful.

However if you are forwarding roughly equal amounts of spam & ham it
should not matter since the added headers appear in both so their
overall effect is nill.

Although I have stopped using the Bayes stuff in SpamAssassin, when I
was forwarding spam & ham for sa-learn to use I ran it through a script
at the recipient end to remove the headers, mostly "Received:" but
including ReSent:, etc, that were added locally.

Quentin  

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

-- 
This message has been scanned for viruses and
dangerous content by Athens Hyperion Scanner, and is
believed to be clean.




-- 
This message has been scanned for viruses and
dangerous content by Athens Hyperion Scanner, and is
believed to be clean.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).