subject line anomaly

Fri Nov 26 00:13:02 CET 2004

Happy Thanksgiving to ye all!

When I got back from turkey dinner with the relatives, I was surprised
to find 2 identical, obvious spam in my bogofilter directory.  According
to my mail client, the headers were:

(69-171-160-38.atlsfl.adelphia.net [69.171.160.38])
	by mail.example.com (Postfix) with SMTP id D72F02FD97;
	Thu, 25 Nov 2004 13:06:12 -0500 (EST)
Received: from placater.77.88.3.154 (HELO
whelp.fgepudoztevi.153.121.20.212) (137.225.69.184)
  by abk532.ruth.69.171.160.38 with SMTP; Thu, 25 Nov 2004 20:00:12
+0200
Message-ID: <RYCRAHOENJQC at 69.171.160.38> 
From: "Jame Mckinnon" <mwiqlkpgcvl at firemail.de>
To: linda at example.com
Cc: mark at example.com
Subject: Antidote found in Crocodiles

Date: Fri, 26 Nov 2004 00:02:12 +0600
MIME-Version: 1.0 (appeasableallen kessler cove.3) 
Content-Type: multipart/alternative;
	boundary="--=_fzEmtAW1cFkeL"
X-Bogosity: Spam, tests=bogofilter, spamicity=1.000000, version=0.93.1

This looks a lot like the X-Bogosity line is in the wrong place, doesn't
it?  Checking on my mail server, I found that the subject line is
actually:

Subject: Antidote found in Crocodiles^M^M 

(with the last 3 characters being CR, CR, SP).

Conclusion, bogofilter correctly placed the X-Bogosity line using the
prescribed CRLF, CRLF sequence at the end of the message header, but my
mail client muffed the CR CR sequence of the Subject line.

A few days ago, there was a report of bogofilter's occasionally not
adding the X-Bogosity line to a message.  I wonder if the line might be
present, but the MUA didn't think it in the header.

Anyhow, I thought y'all might be interested in this unexpected event.

Regards,

David

-- 
David Relson                   Osage Software Systems, Inc.
relson at osagesoftware.com       Ann Arbor, MI 48103
www.osagesoftware.com          tel:  734.821.8800