[spambayes-dev] saving attachments

Ryan Malayter rmalayter at bai.org
Mon Mar 8 15:18:53 EST 2004


[Tim Stone]
>I believe that's the case.  If you can remove the attachments 
>without altering the headers/multipart boundaries/etc., then 
>the resulting corpus should be functionally equivalent to the 
>original.

I just looked at the spam clues for several messages I have with
attachments, and SpamBayes 1.0a9 (Outlook Plug-in with default install
options) appears to ignore attachments completely. I get no Content-Type
or attachment name tokens at all. It seems these would be good spam
clues, or at least good for increasing the antivirus capabilities
inherent in SpamBayes filtering.

I've trained on several dozen Bagel-and NetSky infected messages, and
they all still score below 80%. If SpamBayes generated a token for the
attachment file name extension (.PIF, .EXE, whatever) it would certainly
help push these worm-generated messages over the top, and aid in the
quarantine of new worm variants, would it not?

Also, I noticed that I get only one 'Content-Type:text/plain' token for
each message, even though many of the messages are
'Content-Type:multipart/alternative' with both text and HTML body parts,
as well as Word or other attachment MIME parts. Is that a bug?

Regards,
	Ryan



More information about the spambayes-dev mailing list