i've found that the REGEX the way they have it in the SA code is actually quite useful. there was a slew of spam that was 'Group Mail(ing|er)' which this caught. i just filter out my lists first before i apply SA to my incoming maile. this allows me to control this with much more grainularity and keep SA in the mix unadulterated. when last we saw our hero (Wednesday, Jul 10, 2002), Matthew S. Hallacy was madly tapping out: > I already mailed the spamassassin list about this, it's because of > the List-ID header 'Twin Cities Linux Users Group Mailing List', > it's matching the |Group Mail| part of the RATWARE regex, my > suggested fix is to change it to |Group Mail\ | > > On Wed, Jul 10, 2002 at 07:35:25AM -0500, Jay Kline wrote: > > I just got SpamAssassin up and running, and noticed that some > > posts are getting taged as spam, because of RATWARE (Having bulk > > email fingerprints in the headers: 4.6 points) and some other > > small hit like double caps word. But I cant see how the headers > > look any different from other people's headers. Does anyone know > > what triggers that? Also, what is a good way to prevent these > > false positives (they happen consistantly with Jay Austad's > > emails) without having spamassissn ignore every email coming into > > the list? -- steve ulrich sulrich at botwerks.org PGP: 8D0B 0EE9 E700 A6CF ABA7 AE5F 4FD4 07C9 133B FAFC