[Spambayes] Any ideas about this one?

[Tim Peters]

[Skip Montanaro]
> The message at
>
>     http://manatee.mojam.com/~skip/junk.msg
>
> scored squarely in the ham zone for me, mostly because the scoring was
> swamped by all those normally good address clues (aahz, aleax
> cosc.canterbury.ac.nz, etc).  I could obviously remove "to" from my
> address_headers option.  I tried doing that, which moved it up near 0.5,
> however I noticed no skip: tokens were generated:
>
> ...
>
> Is that related to the structure of the message (causing the
> attachment to be skipped altogether)?

I think so -- the MIME type was application/x-msdownload, and the tokenizer
doesn't even bother to decode non- text/* portions.

> ...
> P.S. I couldn't send the message itself to the list because the virus
> detector rejected it, hence the URL above.  Should we allow stuff
> like that to squeeze through to this list?

It would have been held for moderator approval regardless, due to sheer
size, and I would have rejected it (people on this list should be able to
find quarter-meg examples of viruses on their own <wink>).  The salient
points in this message were the headers, + a comment of the form "and the
body is a quarter megabyte of base64".