Re: BUG with reproducer: pyzor silently fails to check certain e-mails.

[tlhackque <tlh...@ya...>]

>>There's a minimum amount of data required.  This is by design -
hash-based systems are risky when there is little data to hash,
because the risk of collisions significantly increases.

 
I understand - but nonetheless am surprised that there is no response - even
-d doesn't say "too small, not processed".

>>The best way to combat spam is with a combination of techniques.  For
the messages you are describing, a tool like SURBL would probably be
ideal.

Well, these folks seem to be clever (or lucky).  Despite my best efforts so far, 
a lot of
this is finding its way through. As you can see below, they're slipping by just
under the radar; I had hoped that pyzor would help..

X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on localhost
X-Spam-Level: ****
X-Spam-Status: No, score=4.9 required=5.0 tests=BAYES_99,
    RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_DNSWL_LOW,RCVD_IN_SORBS_WEB,T_RP_MATCHES_RCVD
    autolearn=no version=3.3.1
X-Spam-Date-Scanned: Tue, 14 Sep 2010 00:59:55 -0400
X-Spam-Bayes: score=1.0000 summary=Tokens: new, 31; hammy, 1; neutral, 91;
    spammy, 12.
X-Spam-Pyzor: 
Subject: Hot Discounts on Boner Pills

---------------------------------------------------------
This communication may not represent my employer's views,
if any, on the matters discussed.



Message: 4
Date: Mon, 13 Sep 2010 09:04:00 +1200
From: Tony Meyer <to...@sp...>
Subject: Re: BUG with reproducer: pyzor silently fails to check
    certain    e-mails.
To: pyz...@li...
Message-ID:
    <AAN...@ma...>
Content-Type: text/plain; charset=ISO-8859-1

> What seems to be happening is that the message text consists of a single data
> line - a url.

There's a minimum amount of data required.  This is by design -
hash-based systems are risky when there is little data to hash,
because the risk of collisions significantly increases.

> I'm actually seeing quite a bit of spam like this, where the subject is some
> illicit offer, and the text is just a url.

The best way to combat spam is with a combination of techniques.  For
the messages you are describing, a tool like SURBL would probably be
ideal.

Cheers,
Tony