Closed xrat closed 6 months ago
Hi, this is a listing issue, not a plugin's one. I escalated internally but this is not the right place to raise issues about possible FPs.
Can we at least agree that schema URIs should not be checked?
No, because they could be ever changing and we do not mantain a list of them.
I don't mean a list but the extraction algorithm. The way the plugin operates it extracts and subsequently checks URIs of remote fonts (I get that though I see potential and actual problems) and schemas like those for XML etc. pointing at www.w3.org
. I've never heard of them being exploited or being any reasonable indicator for spam-iness.
Hi, this is a listing issue, not a plugin's one. I escalated internally but this is not the right place to raise issues about possible FPs.
Thanks for escalating this internally. However, I now came to the conclusion that I have to disagree with closing this issue as a "listing issue". Here's why:
does not work, @ricalfieri. SH_BODYURI_REVERSE_SBL
uses check_sh_bodyuri_a()
which aims to use a skip list via
which suggests to be filled using uridnsbl_skip_domains
, which however unfortunately has absolutely no effect (it's actually uridnsbl_skip_domain googleapis.com fonts.googleapis.com
in my SpamAssassin configuration). My expectation is quite simply: Please really skip the domain as the SH.pm
code makes admins believe.
Thanks robert-scheck, I was about to open a new issue about $skip_domains
next. I think it's a separate bug. Would you like to open a new issue for it?
I think it's a separate bug. Would you like to a new issue for it?
Thank you, done.
Just saw even more FPs for maps.googleapis.com
and notifications.googleapis.com
.
In the past,
SH_BODYURI_REVERSE_SBL
triggered due to IP addresses forfonts.googleapis.com
being listed. It's unclear why these IP addresses got listed in the first place, however, that's not the issue here. There should be means to avoid false positives due to URIs which are obviously generically used likefonts.googleapis.com
,fonts.gstatic.com
,schemas.microsoft.com
, orwww.w3.org
to name a few candidates.Note that the default threshold for spam in SpamAssassin is 5. The currently assigned score for
SH_BODYURI_REVERSE_SBL
by this project is 8: https://github.com/spamhaus/spamassassin-dqs/blob/666784cf94d8d17e3e2ffc09e95116aad5246af4/3.4.1%2B/sh_scores.cf#L7BTW, one such message recently affected was
It would seem to me like at least URIs of some known good and frequently used remote fonts hosters and schemas in general should be excluded. This would also save some resources of Spamhaus' DNS infrastructure.