@bobfrankston/rmfmail 1.2.282 → 1.2.283

package/.commitmsg

@@ -1,62 +1,17 @@
-Catch the spam that scores under the threshold
-
-A sextortion mail arrived that none of yesterday's checks caught ("yet this
-spam got through"). SpamAssassin scored it 2.7 against a 4.5 threshold and
-delivered it, so server-spam-verdict correctly stayed silent — the server said
-no. Three independent proofs of forgery were sitting in the message anyway.
-
-spf=none now counts as "not authenticated" for self-claimed mail, not just
-fail. bobf.frankston.com publishes no SPF record, so nothing sent as that
-domain can ever FAIL — only come back none. Treating none as neutral left the
-least-protected domain the least defended, which is backwards. Checked against
-the real store before changing it, 50,000 messages scanned:
-
-  From at one of Bob's domains          10,338
-    no Authentication-Results           10,034   <- his own mail, still ignored
-    spf=pass                               243   <- still ignored
-    spf=fail / softfail                     33
-    spf=none                                18   <- nearly all spam
-
-The 18 were "Settle your debt", "AAA Final notice", "McAfee Protection Plan
-Ended" and similar. Legitimate self-mail sits in the no-header group: it never
-crossed a trust boundary, so there is no Authentication-Results to read, and
-that case is untouched. An explicit spf/dkim/dmarc=pass still silences the
-check.
-
-relay-auth-mismatch — Bob's own catch: "note that the origin is different than
-the from domain in antiabuse and in source-auth".
-
-  From:          universe@bobf.frankston.com
-  X-Source-Auth: admin@calebjross.com
-  X-Source-Cap:  (base64) calebjro;calebjro;box2202.bluehost.com
-  Message-ID:    <...@calebjross.com>
-
-A Bluehost cPanel account belonging to an unrelated domain authenticated and
-sent mail wearing his address. That stamp is written by the RELAY, downstream
-of whoever submitted the message, so a forger cannot remove or edit it — which
-makes the disagreement about as close to proof as mail headers get. Compared at
-the registrable-domain level, since a host legitimately sending for a domain
-authenticates as some account AT that domain and the local part varies for
-ordinary reasons. Covers the cPanel/Exim, Postfix and Communigate spellings.
-
-zero-width-obfuscation — the body had ~1380 zero-width characters stuffed
-between letters, so "i regret to inform you" reached every word-matching filter
-as gibberish while rendering as clean prose. SpamAssassin saw it
-(UNICODE_OBFU_ZW_MANY) and still totalled only 2.7. Counted only BETWEEN TWO
-LATIN LETTERS, which is what obfuscation looks like and what the legitimate
-uses are not: an emoji ZWJ joins pictographs, Arabic and Indic ZWNJ sit between
-their own scripts' letters. The occurrence count guards against a stray
-character surviving a copy-paste; it is a sanity bound, not a sensitivity dial.
-
-The score itself is now always visible — a chip above the body reading "spam
-score 2.7 of 4.5" ("should we have a flag ... with the spam assassin number and
-a color code?"). Separate from the findings on purpose: a finding is an
-accusation and fires only on evidence, this is a measurement. Colour is a
-PROPORTION of the server's own threshold — red once flagged, amber past halfway
-to its line, quiet below — so it follows if the server's threshold changes
-rather than hardcoding a number. Viewer only for now; the message-list row
-would need the score stored at sync time.
-
-tests/trust.test.ts covers all three, and the negative cases with them: spf=pass
-and no-header both silent, a relay identity at the same organisation, an emoji
-ZWJ family sequence, and a stray zero-width character from a paste.
+Show the spam score only when it means something
+
+"Only show the spam score if it is high and likely." The first cut put a chip on
+every message that carried a score, which is nearly all of them — a badge that
+is always there carries no information and turns into furniture the eye stops
+reading, which is the same failure mode the findings themselves are built to
+avoid.
+
+The chip now renders only at or above halfway to the server's own threshold.
+That floor is a proportion, not a constant, so it follows if the threshold
+changes. Halfway is where "did not quite trip the wire" stops meaning the same
+thing as "clean": the sextortion mail scored 2.7 against 4.5 and was delivered
+unflagged, so showing only what the server flagged would miss precisely the
+case worth showing. Two levels remain — flagged, and past halfway — because
+anything quieter no longer renders.
+
+Findings are unaffected: they never depended on the score.

package/client/app.bundle.js

@@ -3108,11 +3108,11 @@ async function showMessage(accountId, uid, folderId, specialUse, isRetry = false
     }
     bodyEl.innerHTML = "";
     const spam = msg.spamScore;
-    if (spam && Number.isFinite(spam.score)) {
-      const level = spam.flagged ? "high" : spam.score >= spam.threshold / 2 ? "mid" : "low";
+    if (spam && Number.isFinite(spam.score) && (spam.flagged || spam.score >= spam.threshold / 2)) {
+      const level = spam.flagged ? "high" : "mid";
       const chip = document.createElement("div");
       chip.className = `mv-spamscore mv-spamscore-${level}`;
-      chip.title = level === "high" ? "Your mail server scored this at or above its spam threshold and flagged it." : level === "mid" ? "Below your server's spam threshold, but more than halfway to it." : "Well below your mail server's spam threshold.";
+      chip.title = level === "high" ? "Your mail server scored this at or above its spam threshold and flagged it." : "Below your server's spam threshold, but more than halfway to it.";
       chip.textContent = `spam score ${spam.score} of ${spam.threshold}`;
       bodyEl.appendChild(chip);
     }