Tag: spam

Posted on

Sorting in Mutt

A couple of days ago I discovered the following mutt config option.

set sort = threads
set sort_aux = last-date-received

This means you get the usual threading but that a thread is sorted by the date the last message in the thread was received. This keeps a thread which receives new mail at the bottom of your mailbox rather than up at the top.

Another idea I found useful is to sort my spam mailbox by subject. Since a lot of SPAM has exactly the same subject it makes it really easily to quickly scan the mailbox for HAM.

You can easily do this with the following additions to your muttrc

folder-hook . set sort=threads
folder-hook spam set sort=subject

You need to set the default as mutt will change the sort order when you change to the spam folder but won’t change it back when you jump out of it.

Posted on

DSPAM case sensitivity

I use DSPAM to handle my spam checking and have been quite happy with it as it normally delivers >99.9% hit rate.

In the last few weeks the amount of spam in my INBOX had been getting progressively worse to the point where I noticed no spam whatsoever was making its way into my spam folder.

Looking through my logs I eventually found the following

May 10 10:03:03 fozzie dspam[30287]: Unable to find a valid signature. Aborting.
May 10 10:03:03 fozzie dspam[30287]: process_message returned error -5.  dropping message.

I process my spam by using a mutt macro which bounces emails to johnf-spam at inodes dot org. This then passes the email to DSPAM which reclassifies it. It does this by looking at a header it added to the email.

X-DSPAM-Signature: 464400d0223642194712985

However these were appearing in my INBOX as

X-Dspam-Signature: 464400d0223642194712985

I use procmail and a perl script to pre-process some of my email and it uses Mail::Internet which in turn uses Mail::Header. It bestows this piece of wisdom upon the world.

# attempt to change the case of a tag to that required by RFC822. That
# being all characters are lowercase except the first of each word. Also
# if the word is an `acronym' then all characters are uppercase. We decide
# a word is an acronym if it does not contain a vowel.

sub _tag_case
{

Now I can’t see where in RFC822 it specifies this but in section B.2 it does specify

Upper and lower case are not dis-tinguished when comparing field-names.

So on that basis I choose to blame DSPAM and applied the following diff

diff -ur dspam-3.8.0.orig/src/dspam.c dspam-3.8.0/src/dspam.c
--- dspam-3.8.0.orig/src/dspam.c        2006-12-13 02:33:45.000000000 +1100
+++ dspam-3.8.0/src/dspam.c     2007-05-11 16:25:11.000000000 +1000
@@ -2165,7 +2165,7 @@
           while(node_header != NULL) {
             head = (ds_header_t) node_header->ptr;
             if (head->heading && 
-                !strcmp(head->heading, "X-DSPAM-Signature")) {
+                !strcasecmp(head->heading, "X-DSPAM-Signature")) {
               if (!strncmp(head->data, SIGNATURE_BEGIN, 
                            strlen(SIGNATURE_BEGIN))) 
               {

Now to work out the best way to push that upstream.