Apologies. I didn't post a complete ruleset, merely some useful examples. The basic motivation is that I have a rule that matches on various references to size, a rule (below) that matches on references to genitalia, and a rule that matches on mammary references (trying to beat our internal profanity filter here too ;) )
So, if you make a reference to size, and also to genitalia or mammaries, then a rule will fire. While I can imagine an email that would trigger a false positive for this rule, our systems handle almost entirely business mail, and the rule is scored quite low. Please just ignore it if you don't trust it, I had no intention of publishing a complete ruleset (I will if people really want me to) so cut, paste, shred as much as you would like. R -----Original Message----- From: Bowie Bailey [mailto:[EMAIL PROTECTED] Sent: 22 February 2005 20:46 To: [EMAIL PROTECTED] Subject: RE: ENC: Wet 30 to 40 girls hrony and wants you From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] > > Joe Kletch wrote: > >> header __PORN_WORD12 Subject =~/(?:d(?:ic|ci)k|c(?:|oc|co)k/i > >> > >> Unfortunately I don't understand regexp, any suggestions for fixing > >> this? If I remove the lint test report is good. > >> > > > > Through trial and error I found that removing the third '(' > > made lint happy. I hope I didn't change the intent of the rule: > > This works: > > header __PORN_WORD12 Subject =~/(?:d(?:ic|ci)k|c?:|oc|co)k/i > > You did change the intent of the rule > > I'm having trouble reconstructing the original intent, though... > header __PORN_WORD12 Subject =~/(?:d(?:ic|ci)k)|c(?:|oc|co)k/i > or > header __PORN_WORD12 Subject =~/(?:d(?:ic|ci)k|c(?:|oc|co)k)/i > I think it is more likely to be this: > header __PORN_WORD12 Subject =~/d(?:ic|ci)k|c(?:oc|co)k/i --------------------------------------------------- This email from dns has been validated by dnsMSS Managed Email Security and is free from all known viruses. For further information contact [EMAIL PROTECTED]
