October 01, 2002

SpamAssassin and Michael Moore's latest mailing

It looks like Michael Moore's latest message is another false-positive for spam by SpamAssassin. This might be a repeat of the situation discussed earlier, in SpamAssassin and Crypto-Gram . The mailing reads:

"Michael Moore's Mailing List" ... 10/01/02 1:57PM

October 1, 2002
"YOU ARE EITHER WITH US, OR YOU ARE FIRED!"

Dear Friends,

I was going to write you a letter about what a pathetic liar George W, Bush is -- but then I figured, hey, why waste your time telling you something you already know!

[body of message snipped]

---
If you wish to be be unsubscribed from this mailing list, please click the link below and follow the instructions.

http://www.michaelmoore.com/mailing/unsubscribe.php

Now, SpamAssassin (version 2.31) sees in part:

SPAM: DEAR_SOMEBODY (-0.7 points) BODY: Contains 'Dear Somebody'
SPAM: DEAR_FRIEND (3.1 points) BODY: How dear can you be if you don't know my name?
(net 3.1-0.7 = 2.4 points)
"Dear Friends," is the problem here.

SPAM: CLICK_BELOW (1.5 points) BODY: Asks you to click below
SPAM: UNSUB_PAGE (2.6 points) URI: URL of page called "unsubscribe"
Well, yes, it had unsubscribe instructions, that's generally considered good practice for a mailing list.

SPAM: DOUBLE_CAPSWORD (1.1 points) BODY: A word in all caps repeated on the line
"YOU ARE EITHER WITH US, OR YOU ARE FIRED!"

There may be a few other adjustments, my copy of the Michael Moore message is from a website, so it isn't pure with regard to "subject" line and mail headers. Still, the above is basically enough to have the message marked as spam with the default setting (5 points). Now if it gets automatically reported to the distributed spam-killing systems, it'll again get killed from those systems too.

Once more, I hate the spam-wars.

By Seth Finkelstein | posted in spam | on October 01, 2002 05:55 PM (Infothought permalink)

Seth Finkelstein's Infothought blog (Wikipedia, Google, censorware, and an inside view of net-politics) - Syndicate site (subscribe, RSS)

Subscribe with Bloglines      Subscribe in NewsGator Online  Google Reader or Homepage