--On Sunday, February 27, 2005 7:46 PM -0800 Loren Wilton
<[EMAIL PROTECTED]> wrote:
He has a point. A complicated regex is complicated, and that can mean
slow. It also by definition means "incomprehensible to humans", and so
has to be generated by a tool, and then not touched or looked at.
Than
Chris Santerre wrote:
> I remember that paper. I was impressed and sceptical at the same time. I
> could see it FPing a lot. One person in the crowd brought up Niagra vs. the
> V-drug word :)
>
> Cialis vs. Dial-Lisa
> ect..
That was MailFrontier, using the term lexigraphical distancing rat
>-Original Message-
>From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
>Sent: Monday, February 28, 2005 10:34 AM
>To: Loren Wilton
>Cc: users@spamassassin.apache.org
>Subject: Re: Obfuscation (was: Millions and Billions)
>
>
>-BEGIN PGP SIGNED MESSAGE-
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
Loren Wilton writes:
> Since a tool can generate the matching pattern and convert it to a re, it
> seems that a tool could in theory generate a matching pattern and convert it
> to something else that might be either more comprehensible or more
> effi
Hello Kenneth,
Sunday, February 27, 2005, 7:35:18 AM, you wrote:
KP> --On Thursday, February 24, 2005 6:07 PM -0500 Phil Barnett
KP> <[EMAIL PROTECTED]> wrote:
>> i or l = [|ííiil1]
>> a = [EMAIL PROTECTED]
>> e = [eé3]
>> o = [o0]
KP> It seems like this is getting overly-complicated. Are there
> > I just question whether regex's are the right "complicated solution".
> >
> > How does Google or one of the dictionary sites guess the correct
spelling
> > for a misspelled word?
>
> Great, why don't you go see if google can guess the correct spelling for
>
> c l @ L i @ s
He has a point. A c
On Sunday 27 February 2005 06:31 pm, Kenneth Porter wrote:
> --On Sunday, February 27, 2005 11:48 AM -0500 Phil Barnett <[EMAIL PROTECTED]>
>
> wrote:
> > All you have requested here is for someone else to do the complicated
> > stuff and make it easy for you. Someone has to get the code as comple
--On Sunday, February 27, 2005 11:48 AM -0500 Phil Barnett <[EMAIL PROTECTED]>
wrote:
All you have requested here is for someone else to do the complicated
stuff and make it easy for you. Someone has to get the code as complex
as it needs to be. If not you, then the guy that makes the library y
On Sunday 27 February 2005 10:35 am, Kenneth Porter wrote:
> --On Thursday, February 24, 2005 6:07 PM -0500 Phil Barnett
>
> <[EMAIL PROTECTED]> wrote:
> > i or l = [|ííiil1]
> >
> > a = [EMAIL PROTECTED]
> >
> > e = [eé3]
> >
> > o = [o0]
>
> It seems like this is getting overly-complicated. Are t
--On Thursday, February 24, 2005 6:07 PM -0500 Phil Barnett
<[EMAIL PROTECTED]> wrote:
i or l = [|ííiil1]
a = [EMAIL PROTECTED]
e = [eé3]
o = [o0]
It seems like this is getting overly-complicated. Are there any libraries
for doing fuzzy string matching and obfuscation detection that could be
us
On Thursday 24 February 2005 21:54, Stuart Johnston wrote:
> I've been seeing a ton of stock spam this week, no URLs - no SURBL :(
> Bayes and Razor, etc pick up on it eventually but to speed things up, I
> wrote a rule. One thing that is unique about these messages is that
> they replace l's with
On Thursday 24 February 2005 05:42 pm, [EMAIL PROTECTED] wrote:
> Stuart Johnston wrote:
> > [EMAIL PROTECTED] wrote:
> >> Stuart Johnston wrote:
> >>> body L_MILLBILL /[mb]i(?:\|l|l\||\|\|)ions?/i
> >>
> >> body L_MILLBILL /[mb]i[l|][l|]ions?/i
> >
> > I started with something similar to that but
Hi,
[EMAIL PROTECTED] wrote:
Stuart Johnston wrote:
[EMAIL PROTECTED] wrote:
Stuart Johnston wrote:
body L_MILLBILL /[mb]i(?:\|l|l\||\|\|)ions?/i
body L_MILLBILL /[mb]i[l|][l|]ions?/i
I started with something similar to that but it will also match
millions which we do
On Thu, 24 Feb 2005, Stuart Johnston wrote:
> [EMAIL PROTECTED] wrote:
[snip..]
> >
> > How about (slightly easier to read)
> > body L_MILLBILL /[mb]i[l|][l|]ions?/i
> > or even
> > body L_MILLBILL /[mb]i[l|]{2}ions?/i
>
> I started with something similar to that but it will also match millions
>
Stuart Johnston wrote:
> [EMAIL PROTECTED] wrote:
>> Stuart Johnston wrote:
>>
>>> body L_MILLBILL /[mb]i(?:\|l|l\||\|\|)ions?/i
>> body L_MILLBILL /[mb]i[l|][l|]ions?/i
> I started with something similar to that but it will also match
> millions which we don't want.
Touché!
OK, how about
body L
[EMAIL PROTECTED] wrote:
Stuart Johnston wrote:
body L_MILLBILL /[mb]i(?:\|l|l\||\|\|)ions?/i
Feel free to use it, make suggestions or point out that I wasted my
time writing a rule already available from SARE.
Stuart Johnston
How about (slightly easier to read)
body L_MILLBILL /[mb]i[l|][l|]ions?
Stuart Johnston wrote:
> body L_MILLBILL /[mb]i(?:\|l|l\||\|\|)ions?/i
>
> Feel free to use it, make suggestions or point out that I wasted my
> time writing a rule already available from SARE.
>
> Stuart Johnston
How about (slightly easier to read)
body L_MILLBILL /[mb]i[l|][l|]ions?/i
or even
I've been seeing a ton of stock spam this week, no URLs - no SURBL :(
Bayes and Razor, etc pick up on it eventually but to speed things up, I
wrote a rule. One thing that is unique about these messages is that
they replace l's with |'s. They usually will have some variation on
Mil|ions or Bi|
18 matches
Mail list logo
