[PLUG] Newsletter

Steve Bonds 1s7k8uhcd001 at sneakemail.com
Wed Nov 27 23:15:45 UTC 2002


On Wed, 27 Nov 2002, Russ Johnson russj-at-dimstar.net |PDX Linux| wrote:

> * Karl M. Hegbloom <karlheg at pdxlinux.org> [2002-11-27 11:43]:
> > On Wed, 2002-11-27 at 09:17, Russ Johnson wrote:
> > > AUGH! SPAM!
> > 
> > Yes, and not 24 hours have gone by since I opened the list, thinking
> > that spamassassin would catch them all.
> 
> Well, even spamassassin isn't 100%. :)
> 
> It catches most of the spam directed at me. About 95% or better of the
> spam that my system actually accepts, gets tagged as spam. Thankfully,
> I have some measures in place that tell my mail server not to allow
> connections from several thousand machines on the 'net.

My Spamassassin config caught it.  Admittedly, I have it cranked up a
bit more than the defaults...

Here's the content analysis on that "Newsletter" message:

>SPAM: Content analysis details:   (7 hits, 4 required)
>SPAM: FROM_HAS_MIXED_NUMS (-1.5 points) From: contains numbers mixed in
with letters

That rule is because of my sneakemail forwarding-- originally I
whitelisted anything from my sneakemail but thanks mostly to some of the
other mailing lists I'm on I had to stop this.  Believe me, PLUG is one of
the more well-behaved lists from a spam standpoint.

>SPAM: INVALID_DATE       (0.5 points)  Invalid Date: header (not RFC 822)
>SPAM: DOUBLE_CAPSWORD    (1.1 points)  BODY: A word in all caps repeated
on the line
>SPAM: HTTP_WITH_EMAIL_IN_URL (2.6 points)  URI: 'remove' URL contains an
email address
>SPAM: CTYPE_JUST_HTML    (4.3 points)  HTML-only mail, with no text
version

That last one is my "big gun" to slap down the HTML-only mailers.  Unless
the mail has other redeeming qualities it's going to get filtered.

Here's the line from my spamassassin user_prefs:

score CTYPE_JUST_HTML 4.3

  -- Steve

PS: My preference would be to keep the list closed.





More information about the PLUG mailing list