Original Message-
> From: Chris Santerre [mailto:[EMAIL PROTECTED]
> Sent: Wednesday, October 15, 2003 3:47 PM
> To: 'Larry Rosenman'
> Cc: Spamassassin-Talk (E-mail)
> Subject: RE: [SAtalk] Popcorn, Backhair, and Weeds
>
>
> ARGH What should the enco
Hi Mike,
This is great! Thanks!
--Larry
> -Original Message-
> From: Mike Kuentz (2) [mailto:[EMAIL PROTECTED]
> Sent: Monday, October 20, 2003 3:14 PM
> To: Larry Gilson; Chris Santerre
> Cc: SA
> Subject: RE: [SAtalk] Popcorn, Backhair, and Weeds
>
>
>
Chris Santerre wrote:
> I'm hoping to get some feedback from the people who's system slowed to a
> crawl with the first update. Evilrules is basically cut in half now.
Chris, the new update kicks. When I added the last one it crashed my box,
256 MB was just not enough RAM on my 400 Mhz PII. This
--
> From: Larry Rosenman [mailto:[EMAIL PROTECTED]
> Sent: Wednesday, October 15, 2003 3:58 PM
> To: Chris Santerre
> Cc: Spamassassin-Talk (E-mail)
> Subject: RE: [SAtalk] Popcorn, Backhair, and Weeds
>
>
> the others were fine.
>
> should ascii, with unix line-ends.
the list users here rock? ;) Well except for the
Yankee fans!
--Chris Santerre
> -Original Message-
> From: Larry Gilson [mailto:[EMAIL PROTECTED]
> Sent: Wednesday, October 15, 2003 5:01 PM
> To: 'Chris Santerre'
> Cc: 'SA'
> Subject: RE: [SAtal
mailto:[EMAIL PROTECTED]
> Sent: Wednesday, October 15, 2003 3:47 PM
> To: 'Larry Rosenman'
> Cc: Spamassassin-Talk (E-mail)
> Subject: RE: [SAtalk] Popcorn, Backhair, and Weeds
>
>
> ARGH What should the encoding be: ANSI, DOS, or UTF-8?
>
> IT could be
ilto:[EMAIL PROTECTED]
> Sent: Wednesday, October 15, 2003 3:58 PM
> To: Chris Santerre
> Cc: Spamassassin-Talk (E-mail)
> Subject: RE: [SAtalk] Popcorn, Backhair, and Weeds
>
>
> the others were fine.
>
> should ascii, with unix line-ends.
>
> If you are do
nesday, October 15, 2003 1:58 PM
>> To: [EMAIL PROTECTED]
>> Subject: Re: [SAtalk] Popcorn, Backhair, and Weeds
>>
>>
>> Okay .. silly question then...
>>
>> Do you just copy the evilrules.cf to /etc/mail/spamassassin
>> and restart SA
>> and then SA
tober 15, 2003 3:22 PM
> To: Chris Santerre
> Subject: RE: [SAtalk] Popcorn, Backhair, and Weeds
>
>
> FYI, the popcorn.cf file on your site has DOS linends.
>
> LER
>
>
> --On Wednesday, October 15, 2003 14:43:28 -0400 Chris Santerre
> <[EMAIL P
/
I think that that this also reduces the complexity of the rule but leaves
the original pattern search the same. What do you think?
--Larry
> -Original Message-
> From: Jennifer Wheeler
> Sent: Wednesday, October 15, 2003 11:45 AM
> To: 'Larry Gilson'; [EMAIL PROTECTE
> -Original Message-
> From: Ray Dzek [mailto:[EMAIL PROTECTED]
> Sent: Wednesday, October 15, 2003 1:58 PM
> To: [EMAIL PROTECTED]
> Subject: Re: [SAtalk] Popcorn, Backhair, and Weeds
>
>
> Okay .. silly question then...
>
> Do you just copy the evilrule
I always use wget or curl for grabbing web "stuff".
- Original Message -
From: "Chris Santerre" <[EMAIL PROTECTED]>
To: "'Ray Dzek'" <[EMAIL PROTECTED]>;
<[EMAIL PROTECTED]>
Sent: Wednesday, October 15, 2003 1
Okay .. silly question then...
Do you just copy the evilrules.cf to /etc/mail/spamassassin and restart SA
and then SA will just process whatever .cf files are in the folder? Or do I
cat that to the local.cf file?
---
This SF.net email is spon
Hi Mike,
You can get them here: http://spamhammers.nxtek.net
--Larry
---
This SF.net email is sponsored by: SF.net Giveback Program.
SourceForge.net hosts over 70,000 Open Source Projects.
See the people who have HELPED US provide better se
there. :)
Jennifer
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Mike
Schrauder
Sent: Wednesday, October 15, 2003 11:24 AM
To: [EMAIL PROTECTED]
Subject: RE: [SAtalk] Popcorn, Backhair, and Weeds
where do I get the most up-to-date copy of PB&W?
where do I get the most up-to-date copy of PB&W?
Mike S
> -Original Message-
> From: Jennifer Wheeler [mailto:[EMAIL PROTECTED]
> Sent: Wednesday, October 15, 2003 11:45 AM
> To: 'Larry Gilson'; [EMAIL PROTECTED]
> Subject: RE: [SAtalk] Popcorn, Backhair, a
Ok, now I am in the light. I think we are looking at this test from
different perspectives.
This is what I'm replying to here...
>"My original goal was to shorten the tests into fewer tests but I think
I >found a way to shorten the tests into one test - bonus. :)"
I am not in favor of reducing
Hi Keith,
Thanks for following the thread.
> -Original Message-
> From: Keith C. Ivey
> Sent: Tuesday, October 14, 2003 11:39 PM
> To: [EMAIL PROTECTED]
> Subject: RE: [SAtalk] Popcorn, Backhair, and Weeds
>
>
> Larry Gilson <[EMAIL PROTECTED]> wrote:
>
Larry Gilson <[EMAIL PROTECTED]> wrote:
> / \w{1,7}<\/?[^<>]{0,150}>\w{1,7}/
>
> This one seems to be working well so far. It will catch any
> normal and funky stuff within the tags but makes sure it will
> not run over any subsequent tags.
Since '/' matches the character class '[^<>]', there
Hi Jennifer,
> -Original Message-
> From: Jennifer Wheeler
> Sent: Tuesday, October 14, 2003 12:27 PM
> To: 'Larry Gilson'
> Subject: RE: [SAtalk] Popcorn, Backhair, and Weeds
>
>
> Hi Larry!
>
> I read your message late yesterday, and had to
stvwxz\d]{3,}/i
Which will get the random stuff like:
zr bcllajzl-->ch (bcllajz - from your example)
yioqerf-->p to 3 From: jennifer
> Sent: Sunday, October 12, 2003 12:32 PM
> To: 'Larry Gilson'; [EMAIL PROTECTED]
> Subject: RE: [SAtalk] Popcorn, Backhair, and Weeds
&
ctober 12, 2003 12:18 AM
To: [EMAIL PROTECTED]
Subject: RE: [SAtalk] Popcorn, Backhair, and Weeds
Hi Keith,
Thanks for the your time and knowledge! The explanation of your rule
contraction is excellent and really helped me understand the process
much
better.
This exercise has been a very good
,
Larry
> -Original Message-
> From: Keith C. Ivey
> Sent: Saturday, October 11, 2003 6:02 PM
> To: [EMAIL PROTECTED]
> Subject: RE: [SAtalk] Popcorn, Backhair, and Weeds
>
>
> Larry Gilson <[EMAIL PROTECTED]> wrote:
>
> > I had the followi
atload of spam breezing
through.
The link above may shed more light if I didn't make this clear and you
would like to see the set.
Thanks again for the great explanation!! wow
Jennifer
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Keith
C. Iv
Larry Gilson <[EMAIL PROTECTED]> wrote:
> I had the following HTML tag OBFU rule (variant of yours):
> /(\>|\s)\w{1,5}?\<\/?\s?[\w\s]{6,150}\/?\s?\>\w{1,7}?(\s|\W|\<)/
There's a lot of clutter in that that makes it harder to
follow. Let's try paring it down. First, '<' and '>' are not
speci
Hi Jennifer,
Thanks for the reply. I think I am seeing the light now. With your help
and others from the list, I am really getting it now. The FPs I was getting
are gone after changing the limit from \w{0,7} to
\w{1,7}?. This really makes a huge difference. Thanks again!
Don't feel awkward a
ied!! Someone jump in if I'm on pluto!
I'm glad they're working out for you! Let me know if you come up with
some killer variation. I'm sure they'll need to be modified as spammers
vary their techniques.
Thanks for the input,
Jennifer
>>Regards,
>>
Stucki,
Your explanation makes perfect sense. Thanks for the correction and for
taking the time to explain this.
--Larry
> -Original Message-
> From: Chr. von Stuckrad
> Sent: Friday, October 10, 2003 5:31 PM
> To: 'Spamassassin-Talk (E-mail)'
> Subject: Re: [
ck it
out when you don't have a minute to spare. ;)
--Larry
> -Original Message-
> From: Chris Santerre [mailto:[EMAIL PROTECTED]
> Sent: Friday, October 10, 2003 5:15 PM
> To: 'Larry Gilson'; 'Spamassassin-Talk (E-mail)'
> Subje
On Fri, Oct 10, 2003 at 04:56:56PM -0400, Larry Gilson wrote:
> As an > example, an exact count would be matched if I omit the comma.
> /\w{5}/ will match exactly five word characters.
Definitely yes.
> Now if I modify that as /\w{5}?/, I believe that means zero or
> one occurance of five word cha
Yep, when those things hit you can see why she named them popcorn. ;)
Has anyone been as delighted as I am by doing tail -f /var/log/maillog |
grep MailScanner (or your appropriate scanner)? It brings a smile to my face
every time. :) We've tagged several thousands of messages and 0 (!) hams
with
riginal Message-
> From: Larry Gilson [mailto:[EMAIL PROTECTED]
> Sent: Friday, October 10, 2003 4:57 PM
> To: 'Chris Santerre'; 'Spamassassin-Talk (E-mail)'
> Subject: RE: [SAtalk] Popcorn, Backhair, and Weeds
>
>
> Hi Chris,
>
> > -----
Hi Chris,
> -Original Message-
> From: Chris Santerre
> Sent: Friday, October 10, 2003 3:26 PM
> To: 'Larry Gilson'; 'Spamassassin-Talk (E-mail)'
> Subject: RE: [SAtalk] Popcorn, Backhair, and Weeds
>
>
> LOL, I asked her the VERY same ques
ilto:[EMAIL PROTECTED]
> Sent: Friday, October 10, 2003 2:41 PM
> To: 'Spamassassin-Talk (E-mail)'
> Subject: RE: [SAtalk] Popcorn, Backhair, and Weeds
>
>
> Hi again Jennifer! I have another question. Both the
> BACKCHAIR and POPCORN
> rules have the following
Hi again Jennifer! I have another question. Both the BACKCHAIR and POPCORN
rules have the following format:
word - tag - word
/(\>|\s)\w{5}?\<\/?\s?[\w\s]{6,150}\/?\s?\>\w{5}?(\s|\W|\<)/
Each of the words use \w{#}? So if you have \w{5}? You would be saying
either 0 or 5 occurrences of [a-zA-Z0
Hi Jennifer,
I have rules to match character sets also but my format is a bit different
and thought I would share them.
Character set DEC: 61-126
# Obfuscate text by using ISO 8859-1 character set DEC encoding
rawbody MY_RBDY_OBFU_ISOD /&\#(6[5-9]|[7-9][0-9]|1[0-1][0-9]|12[0-6])\D/
describe MY
36 matches
Mail list logo
