Author: Alan J. Flavell Date: To: Exim users list Subject: Re: [exim] Continuing Exim 4.60 & SpamAssassin 3.1.0 Problems
On Sat, 14 Jan 2006, John Hall wrote:
> On 13/01/06, Alan J. Flavell <a.flavell@???> wrote:
>
> > > There's no need to check whether a 1 MB message is spam.
> >
> > I can't really confirm that diagnosis. Practically all messages
> > >=1MB which get to *me*, I would categorise as spam[1], but,
> > across our user population, there are both spam and non-spam mail
> > items of quite remarkable size.
>
> But that's not really spam in the sense that SpamAssassin defines
> spam.
I would have to disagree with you there. Even reviewing the items
which I bothered to retain in my abuse archive (i.e not counting the
ones which I discarded out of hand at the time), I can assure you that
all except one of the items, ranging from 1.6MB to over 3.5MB in size,
are most certainly rateable as spam in the usual sense in which we use
that term. Only the one was a misguided attempt by one of our users
to inform the whole Department of some minor issue by distributing
hundreds of copies of a huge PDF attachment.
And, as I already said in relation to the spams: generally speaking,
the covering HTML-only text was of a size and nature which could have
been rated by SA, and would have been rated as spam, whereas the
attachments (in most cases they consisted of numerous images - in a
few cases they consisted of a large PDF attachment) would clearly not
have done SA any good at all.
> Large attachments may be unwanted and even unsolicited, but are
> usually from people you have an existing relationship with
This was not the case in relation to the items which I rated as spam
in the preceding discussion, Some of the senders had already spammed
me on an earlier occasion, but had changed their sender address, thus
bypassing the previous sender blacklisting which I'd set for them.
But I wouldn't describe an earlier successful spamming as an
"existing" business relationship!
> (I would imagine).
I've already described the situation to the best of my ability.
You're of course free to disbelieve me, but I'm not sure what we gain
from you making that disbelief public.
> I would doubt that there is much benefit in feeding large
> e-mails into SpamAssassin.
I already make it clear, I think, that feeding the attachments to SA
would not be useful. I've also indicated that I hadn't tried
selectively feeding the covering HTML to SA, but, based on what I have
seen, I *do* believe it might have possibilities.
