Doc Schneider doc at maddoc.net
Sat Aug 12 03:30:33 IST 2006

Mark Nienberg wrote:
> Doc Schneider wrote:
>> I added a "tweak" to the rule set that should catch more of these dang 
>> image spams.
>> For those of you running "SARE_STOCK" please let me know if these are 
>> now being caught.
> After about a week of running the new rule set I realized that in 
> addition to catching more of those dang image spams, I was also getting 
> a lot of false positives.  We receive a lot of messages from persons who 
> write in html and attach a small gif image in their signature (usually a 
> company logo).  In fact, lots of my users do the same in their 
> signatures (don't get me started).  Consequently, I have had to disable 
> the gif rules in the rule set.
> Mark


You got more problems than the SARE_GIF_ATTACH if simple small images 
are being caught and FP mails. Since it only has a score of 0.75 which 
shouldn't be FP anything. But of course as with anything YMMV.

Lincoln, NE.

More information about the MailScanner mailing list