Re: Short body rules

2011-11-25 Thread Karsten Bräckelmann
On Fri, 2011-11-25 at 20:42 +0100, Karsten Bräckelmann wrote: > On Fri, 2011-11-25 at 11:49 -0500, Kevin A. McGrail wrote: > > It was a brilliantly simple idea but this concept won't work if I am > > looking at things correctly. The loop for the pattern test appears to > > test line by line. S

Re: Short body rules

2011-11-25 Thread Karsten Bräckelmann
> And my suggested alternative should probably be adjusted in the same > manner. > > Any comment on what I suggested (the 1 LE + 0 GT approach)? Yup, it needs the same adjustment as I just explained, a minimum of at least 2 chars. On Fri, 2011-11-25 at 10:52 -0800, John Hardin wrote: >rawbo

Re: Short body rules

2011-11-25 Thread John Hardin
On Fri, 25 Nov 2011, Karsten Bräckelmann wrote: rawbody __KB_MIMEPART_200 /^.{2,200}$/s And my suggested alternative should probably be adjusted in the same manner. Any comment on what I suggested (the 1 LE + 0 GT approach)? -- John Hardin KA7OHZhttp://www.impsec.org

Re: Short body rules

2011-11-25 Thread Karsten Bräckelmann
On Fri, 2011-11-25 at 11:49 -0500, Kevin A. McGrail wrote: > > On 11/25/2011 12:23 AM, Alex wrote: > > > Some time ago we created the following rule on this list to identify > > > mail with less than 200 characters in the body: > > > rawbody __KB_RAWBODY_200/^.{0,200}$/s > > > I'm finding

Re: Short body rules

2011-11-25 Thread John Hardin
On Fri, 25 Nov 2011, Kevin A. McGrail wrote: On 11/25/2011 11:06 AM, Kevin A. McGrail wrote: On 11/25/2011 12:23 AM, Alex wrote: > Some time ago we created the following rule on this list to identify > mail with less than 200 characters in the body: > > rawbody __KB_RAWBODY_200/^.{

Re: Short body rules

2011-11-25 Thread Kevin A. McGrail
On 11/25/2011 11:06 AM, Kevin A. McGrail wrote: On 11/25/2011 12:23 AM, Alex wrote: Some time ago we created the following rule on this list to identify mail with less than 200 characters in the body: uri __HAS_HTTP_URI m~^https?://~ rawbody __KB_RAWBODY_200/^.{0,200}$/s me

Re: Short body rules

2011-11-25 Thread Kevin A. McGrail
On 11/25/2011 12:23 AM, Alex wrote: Some time ago we created the following rule on this list to identify mail with less than 200 characters in the body: uri __HAS_HTTP_URI m~^https?://~ rawbody __KB_RAWBODY_200/^.{0,200}$/s metaLOC_SHORT (__HAS_HTTP_URI&&

Short body rules

2011-11-24 Thread Alex
Hi, Some time ago we created the following rule on this list to identify mail with less than 200 characters in the body: uri __HAS_HTTP_URI m~^https?://~ rawbody __KB_RAWBODY_200/^.{0,200}$/s metaLOC_SHORT (__HAS_HTTP_URI && __KB_RAWBODY_200) score LOC