70_sare_stocks.cf

[Mark Nienberg]

Doc Schneider wrote:
> Mark Nienberg wrote:
>> Doc Schneider wrote:
>>> I added a "tweak" to the rule set that should catch more of these 
>>> dang image spams.
>>>
>>> For those of you running "SARE_STOCK" please let me know if these are 
>>> now being caught.
>>
>>
>> After about a week of running the new rule set I realized that in 
>> addition to catching more of those dang image spams, I was also 
>> getting a lot of false positives.  We receive a lot of messages from 
>> persons who write in html and attach a small gif image in their 
>> signature (usually a company logo).  In fact, lots of my users do the 
>> same in their signatures (don't get me started).  Consequently, I have 
>> had to disable the gif rules in the rule set.

> Mark,
> 
> You got more problems than the SARE_GIF_ATTACH if simple small images 
> are being caught and FP mails. Since it only has a score of 0.75 which 
> shouldn't be FP anything. But of course as with anything YMMV.

It often triggers in combination with the meta rule SARE_GIF_STOX for a 
total of (0.75 + 1.66= 2.41).  I'm not saying that many messages are 
pushed from non-spam to spam by the additional points, but in our mix of 
mail the points are added to many messages that are not spam, so the 
rule is not a very good indication of spaminess (again, in our mix of 
mail).  I'm still using the rest of the ruleset though, with some success.

Mark