Wednesday, November 30, 2005, 11:59:23 AM, Matt wrote: MK> I'm not well versed in picking the "minimalist" set for a low-resource site, but MK> I can at least tell you what I know you should avoid.
MK> In general, the bigger the .cf file, the more resource intensive it will likely MK> be. Admittedly this is a wildly inaccurate measure because of non-rule content, MK> but it's better than nothing. I tend to be wary of .cf files over 128k, and I'd MK> keep the total under 256k. MK> FWIW, I personally like these SARE rulesets: MK> 70_sare_adult.cf (SARE_ADULT) MK> 70_sare_evilnum0.cf (SARE_EVILNUMBERS0) MK> 70_sare_evilnum1.cf (SARE_EVILNUMBERS1) MK> 70_sare_genlsubj0.cf (SARE_GENLSUBJ0) MK> 70_sare_obfu0.cf (SARE_OBFU0) MK> 70_sare_random.cf (SARE_RANDOM) MK> 70_sare_specific.cf (SARE_SPECIFIC) MK> 70_sare_uri0.cf (SARE_URI0) MK> 99_sare_fraud_post25x.cf (SARE_FRAUD) In addition, I suggest 70_sare_html0.cf -- all the 70_sare_*0.cf rules files that I maintain are the ones which during SARE mass-checks hit no ham, and hit significant (by our classification) spam. Read the documentation in those *0.cf files, and you'll be able to determine for yourself whether to also use the *1.cf files. If you're tight on resources, stay away from 70_sare_obfu1.cf, though it is a very powerful file and useful to many systems. Bob Menschel
