One thing the anti-virus people got right is the ability to test
anti-virus engines by passing through a non-viral file that is by
de-facto detected as a virus by the vendors engines. This file is
called EICAR, and is a simple .COM executable that does nothing but
trigger AV engines.
In order to provide something similar for spam content filters, I
created something similar for spam. We put support for this into the
SpamAssassin project and notified some other creators of spam content
filters. Unfortunately they all ignored us.
I think this would be a good thing to support in content filters.
We called this thing "GTUBE" (Generic Test for UBE), and you can find
the email that should be stopped at
http://spamassassin.planetmirror.com/dist/t/data/spam/gtube.eml (note
the headers are abitrary - it is the long string in the body of the
message that should be detected).
The email is designed in such a way that it should not be munged by any
gateways.
I urge other vendors of anti-spam content filters to support this. It's
trivial, but it gives users the power to test that their filter is
working.
I also think this would be something worth standardising through the
IETF.
Matt.
_______________________________________________
Asrg mailing list
Asrg(_at_)ietf(_dot_)org
https://www1.ietf.org/mailman/listinfo/asrg