Andy Dills wrote:
On Fri, 20 Jul 2007, Yet Another Ninja wrote:
Guys
These are NOT AV signatures to be updated every day/hour, whatever
Hammering the site won't make it any better and not help to keep it going.
Seems some ppl still haven't understood that hammer-leeching spoils it for
everyone and themselves.
People are still getting PDF spams?
I'm finding with a current version of SA and the sane security clamav
signatures, that none have gotten through for a few days now.
Do we really need a PDFinfo at this point?
Yes. Definitely.
I'm only using the signatures with the spamassassin plugin because I
found them to be too invasive. I dont allow anyone to block a mail at
SMTP level just because it contains ONE sentence. The sanesecurity
signatures also contain a LOT of single sentence rules which are too
risky for me... For example just becuase a mail contains '(ii) Email
ticket number' I dont want to block it.. but it will, according the the
current scam.ndb...
Thats why I only use these rules for scoring and I definitely also want
the pdfinfo scores in addition...
And.. It took them quite a while to score on the new encrypted pdfs
while they were already detected by the pdfinfo plugin
Matt
