Re: [exim] Message size checks on spam ACLs

Nigel wrote:

| This raises the following issues:-
|       * Is SA on a part message sensible?  A partial message could, in
|         theory, banjax a load of SA rules, so getting lots of extra hits
|         for (say) maleformed MIME

Hmm - hadn't thought of that.

As Marc says, it seems more efficient for exim to truncate what gets shown
to spamd, rather than passing the lot and having spamd bin it.

But if we're risking false positives, more care may be needed.

As Michael says, there ought to be scope to implement something more
intelligent (and, I guess, more complicated) within spamd itself.

When time allows, I'll bring this up on the SA list.

For (mild) amusement, a recent 419 spam that sneaked in unscanned over the
size limit contained a load of crud and an attached image, which I've put
on the web at:

http://www.skipnote.org/box.jpg


--
Chris Edwards, Glasgow University Computing Service