LOL, I asked her the VERY same question when I first looked at them!!! But I
didn't realise that {#}? meant "exactly that many". So 2 things:
1) You won't get a 0 word - tag - 0 word situation
2) Great minds think alike! ;)
The upper limits are arguably not needed. But I think it is good to have
them bound for now.
I actually asked myself why she broke them up. Doh!!! I had written this as
a tip in my own page!!! These borken up rules will hit multiple times in a
single spam message. That is perfect for rules like this. One hit might not
make it a true spam. But get 3 and your on to something. 5+ and you got a
real party! :)
I'm answering for her, because she already left for the weekend. I also
totally agree that these rules are great! She had tried to combine popcorn
and backhair, but I urged against it. I mean, who wants someone's backhair
in their popcorn? :p
HTH
Chris Santerre
System Admin and SA Custom Rules Emporium keeper
http://www.merchantsoverseas.com/wwwroot/gorilla/sa_rules.htm
"A little nonsense now and then, is relished by the wisest men." - Willy
Wonka
> -----Original Message-----
> From: Larry Gilson [mailto:[EMAIL PROTECTED]
> Sent: Friday, October 10, 2003 2:41 PM
> To: 'Spamassassin-Talk (E-mail)'
> Subject: RE: [SAtalk] Popcorn, Backhair, and Weeds
>
>
> Hi again Jennifer! I have another question. Both the
> BACKCHAIR and POPCORN
> rules have the following format:
>
> word - tag - word
> /(\>|\s)\w{5}?\<\/?\s?[\w\s]{6,150}\/?\s?\>\w{5}?(\s|\W|\<)/
>
> Each of the words use \w{#}? So if you have \w{5}? You would be saying
> either 0 or 5 occurrences of [a-zA-Z0-9_]. So is it possible
> that you would
> encounter a situation in which you would find:
>
> 0 word - tag - 0 word
>
> If so, each rule could hit for only one occurrence. I think
> the following
> could produce this affect:
>
> <html><body bgcolor="#FFFFFF"><center>
> The match would be on <center>:
> /\>\<\w{6}\>\s/
> Or would [\n\r] be stripped?
>
> or
>
> <P><CENTER><SMALL>
> The match would be on <center> also:
> /\>\<\w{6}\>\</
>
>
> My thinking may be incorrect so please correct me if I am wrong. I
> encountered a false positive (on a variant of your rules) as
> I tried to
> reduce the number of tests down to one. The result was as follows:
>
> /(\>|\s)\w{0,7}\<\/?\s?[\w\s]{6,75}\/?\s?\>\w{0,7}(\s|\W|\<)/
>
> I think I need to change from \w{0,7} to \w{1,7}; or [\w\s]{6,75} to
> [\w\s]{7,75}.
>
> Am I trying to do to much? Why did you break up the rules into small
> pieces?
>
>
> One last question. Are any of the upper limits necessary?
> Spammers may
> just want to keep uping the limit. Would it be beneficial to modify
> [\w\s]{6,150} to [\w\s]{6,}; etc.?
>
>
> Overall, the rules are a great addition and have been helping a
> tremendously. I hope you do not find me overbearing by picking at the
> rules. I think they are great and that is why I am spending
> some time with
> them. Thanks again!
>
>
> Regards,
> Larry
>
>
>
> > -----Original Message-----
> > From: Jennifer Wheeler
>
> > You're welcome!
> >
> > Thanks for the tip. I'll modify them. (Popcorn has the same
> > redundancy.)
> >
> > Jennifer
> >
> > -----Original Message-----
> > From: Larry Gilson
>
> > Hey Jennifer,
> >
> > In your BACKCHAIR rules, your regex contains [\w\s\n\r]. I don't
> > believe you need the \n\r as \s is equivalent to [\f\t\n\r].
> >
> > Great rules . . . thanks for sharing!
> >
> > --Larry
> >
> >
> > > -----Original Message-----
> > > From: Jennifer Wheeler [mailto:[EMAIL PROTECTED]
> > > Sent: Thursday, October 09, 2003 6:15 PM
> > > To: 'Spamassassin-Talk (E-mail)'
> > > Subject: [SAtalk] Popcorn, Backhair, and Weeds
> > >
> > >
> > > Chris S. is going to be posting these on his site when he
> > > gets time, and I believe he was also waiting on my tweaks. I
> > > have tweaked to the best of my ability, which is scarce. :)
> > > I will post these now since there was some discussion on
> > > catching tidal waves of hidden tags obscuring known spam
> > > words and phrases. If you can improve on these, please let
> > > me know. I've been using these for about 3 weeks and they
> > > are kicking boo-tay.
> > >
> > > Thanks Chris for your input!
> > >
> > > Sit back, tail your mail log, and watch the show. :) It's
> > > rather humorous.
> > >
> > > (wow I probably just bought a bucket load of spam. Good
> > > material for more rules!)
> > >
> > http://spamhammers.nxtek.net
> >
> > Jennifer
>
>
>
> -------------------------------------------------------
> This SF.net email is sponsored by: SF.net Giveback Program.
> SourceForge.net hosts over 70,000 Open Source Projects.
> See the people who have HELPED US provide better services:
> Click here: http://sourceforge.net/supporters.php
> _______________________________________________
> Spamassassin-talk mailing list
> [EMAIL PROTECTED]
> https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
>
-------------------------------------------------------
This SF.net email is sponsored by: SF.net Giveback Program.
SourceForge.net hosts over 70,000 Open Source Projects.
See the people who have HELPED US provide better services:
Click here: http://sourceforge.net/supporters.php
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
