On Fri, 2011-11-25 at 20:42 +0100, Karsten Bräckelmann wrote:
> On Fri, 2011-11-25 at 11:49 -0500, Kevin A. McGrail wrote:
> > It was a brilliantly simple idea but this concept won't work if I am
> > looking at things correctly. The loop for the pattern test appears to
> > test line by line. S
> And my suggested alternative should probably be adjusted in the same
> manner.
>
> Any comment on what I suggested (the 1 LE + 0 GT approach)?
Yup, it needs the same adjustment as I just explained, a minimum of at
least 2 chars.
On Fri, 2011-11-25 at 10:52 -0800, John Hardin wrote:
>rawbo
On Fri, 25 Nov 2011, Karsten Bräckelmann wrote:
rawbody __KB_MIMEPART_200 /^.{2,200}$/s
And my suggested alternative should probably be adjusted in the same
manner.
Any comment on what I suggested (the 1 LE + 0 GT approach)?
--
John Hardin KA7OHZhttp://www.impsec.org
On Fri, 2011-11-25 at 11:49 -0500, Kevin A. McGrail wrote:
> > On 11/25/2011 12:23 AM, Alex wrote:
> > > Some time ago we created the following rule on this list to identify
> > > mail with less than 200 characters in the body:
> > > rawbody __KB_RAWBODY_200/^.{0,200}$/s
> > > I'm finding
On Fri, 25 Nov 2011, Kevin A. McGrail wrote:
On 11/25/2011 11:06 AM, Kevin A. McGrail wrote:
On 11/25/2011 12:23 AM, Alex wrote:
> Some time ago we created the following rule on this list to identify
> mail with less than 200 characters in the body:
>
> rawbody __KB_RAWBODY_200/^.{
On 11/25/2011 11:06 AM, Kevin A. McGrail wrote:
On 11/25/2011 12:23 AM, Alex wrote:
Some time ago we created the following rule on this list to identify
mail with less than 200 characters in the body:
uri __HAS_HTTP_URI m~^https?://~
rawbody __KB_RAWBODY_200/^.{0,200}$/s
me
On 11/25/2011 12:23 AM, Alex wrote:
Some time ago we created the following rule on this list to identify
mail with less than 200 characters in the body:
uri __HAS_HTTP_URI m~^https?://~
rawbody __KB_RAWBODY_200/^.{0,200}$/s
metaLOC_SHORT (__HAS_HTTP_URI&&
Hi,
Some time ago we created the following rule on this list to identify
mail with less than 200 characters in the body:
uri __HAS_HTTP_URI m~^https?://~
rawbody __KB_RAWBODY_200/^.{0,200}$/s
metaLOC_SHORT (__HAS_HTTP_URI && __KB_RAWBODY_200)
score LOC