Hi Bill > -----Original Message----- > From: [EMAIL PROTECTED] [mailto:spamassassin- > [EMAIL PROTECTED] On Behalf Of Bill Landry > Sent: Saturday, December 13, 2003 7:04 AM > To: [EMAIL PROTECTED] > Subject: [SAtalk] chickenpox.cf > > Jennifer, I have been testing your chickenpox.cf rules, and I noticed that > there is plenty of other punctuation marks besides the period "." that are > also being used between the letters of works to obfuscate them. So I > modified you rules a bit from, for example: > > /\s[a-zA-Z]{9}\.[a-zA-Z]{1}[ ,'\?!]/i > > to: > > /\s[a-zA-Z]{9}[.,;:?%!&+^~`\$\*\=\#\|][a-zA-Z]{1}[ ,'\?!]/i > > So far it appears to be working well and catching lots of additional > obfuscated words. Just wondering what your thoughts were on this? Did > you > select only the period "." because that was the only punctuation make you > saw being used,
yes and no. the only spams that were getting through were the period obfus. So at the time I was only concerned with stopping those. I had a bit of a time figuring out how to keep them fenced in, but finally figured out a way to make them safe. In my thinking, I really only saw the period as being most problematic and a little dangerous. After working with them for so long, I decided to go ahead and release the set as I was comfortable with it, then add to it later when I felt like putting some honest work into it. Figuring the dot is probably the most problematic mark; I built the set around that, and it would be simple to add more punctuation as needed. or because you had problems when adding other punctuation > marks? Again, I didn't have problems, but in my mind I was coming up with what could be some potential problems with a few of the marks, and didn't want to prolong releasing the set while I tested them with the added marks. And actually, the only emails I saw that had consistent use of same punctuation obfu throughout one mail was the "." I figured I'd get around to extending them eventually, so what you added is most likely a good idea. Let me know how those go. I was a little leary about ":" "&" just off the top of my head, but I definitely would add "|" . I'll play some more too when I get some time. disclaimer: this reply was written under a heavy-duty-cold-&-flu-medication-induced/fever-induced fog *and* pre coca cola, the nectar of life. I think what I said is valid, but I'm sure it's a smidge spacey Thanks, Jennifer > > Bill > > > > ------------------------------------------------------- > This SF.net email is sponsored by: IBM Linux Tutorials. > Become an expert in LINUX or just sharpen your skills. Sign up for IBM's > Free Linux Tutorials. Learn everything from the bash shell to sys admin. > Click now! http://ads.osdn.com/?ad_id=1278&alloc_id=3371&op=click > _______________________________________________ > Spamassassin-talk mailing list > [EMAIL PROTECTED] > https://lists.sourceforge.net/lists/listinfo/spamassassin-talk ------------------------------------------------------- This SF.net email is sponsored by: IBM Linux Tutorials. Become an expert in LINUX or just sharpen your skills. Sign up for IBM's Free Linux Tutorials. Learn everything from the bash shell to sys admin. Click now! http://ads.osdn.com/?ad_id=1278&alloc_id=3371&op=click _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
