Yeah, I had some reports that these rules would hit a few things. The only way I see to counter it, is with some negative rules. This was the best way I found to grab the random characters. For instance a negative Ezra rule :)
There is more tweaking I would like to do. Like letters by themselves that shouldn't be. ' j ' for example. The PGP thing is a pain. Best way, and a hassle, is to keep a negative rule of a few sections of PGP sigs you get from people. :( Also my rules are rawbody. Which has been conflicting in my mind. My OBFU rules hit strange http links. However they tend all to be from spammers! So I'm watching it closely. Chris Santerre System Admin and SA Custom Rules Emporium keeper http://www.merchantsoverseas.com/wwwroot/gorilla/sa_rules.htm "A little nonsense now and then, is relished by the wisest men." - Willy Wonka > -----Original Message----- > From: Robert Menschel [mailto:[EMAIL PROTECTED] > Sent: Friday, July 25, 2003 11:24 PM > To: Chris Santerre > Cc: 'Andrea Riela'; [EMAIL PROTECTED] > Subject: Re[2]: [SAtalk] spam funny > > > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > Hello Chris, > > Friday, July 25, 2003, 1:55:03 PM, you wrote: > > CS> # These next six are VERY INTERESTING. I'm very proud of these > CS> babies. > CS> # They help tag and find the random characters spammers > put in. Works > CS> GREAT!!!! > > CS> rawbody MY_OBFUZ /z(r|f|k|j|v|x)/i > CS> describe MY_OBFUZ Z with unusual chars > CS> score MY_OBFUZ .45 > > I see what you're doing, but I get too many FPs matching > these rules for > your scoring. The rule above matched Ezra, a cousin's name. Your rules > will also frequently match the checksum codes found in a PGP > signature. > > I'm testing them out to see how they might work for me, > perhaps with some > refinement, but I'm using extremely low scores (0.1) for now. > > The same PGP signature problem applies to the multiple-consonant rules > Daniel Carrera offered. I picked a signed email at random, and > found: ... 4cons ... 7cons ... 8cons ... 6cons ... > > I receive a lot of PGP-signed email ... I'm going to have to > be careful > with these. > > Bob Menschel > > -----BEGIN PGP SIGNATURE----- > Version: PGP 8.0 > > iQA/AwUBPyH0PpebK8E4qh1HEQLhKgCg9p+JBwEx3BdjPRktUHTYEXdTRfcAn1rc > GuulpCY1ereMqpWSY6quPuvi > =EEFh > -----END PGP SIGNATURE----- > > ------------------------------------------------------- This SF.Net email sponsored by: Free pre-built ASP.NET sites including Data Reports, E-commerce, Portals, and Forums are available now. Download today and enter to win an XBOX or Visual Studio .NET. http://aspnet.click-url.com/go/psa00100003ave/direct;at.aspnet_072303_01/01 _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
