On Sun, 2008-08-31 at 19:50 +0200, mouss wrote:
> John Hardin wrote:
> >
> > How about these rules? (watch the line wrap)
> >
> > describe TO_HARVESTED To: obviously harvested
> > header TO_HARVESTED To =~ /\@(?:(?:(?:example|your|
> > some)\.domain)|(?:(?:example|your\.domain)\.com)|your\.favou?rite
> > \.machine)\b/
> >
> > describe TO_TOO_MANY To: too many recipients
> > header TO_TOO_MANY To =~ /(?:,[^,]{1,80}){20}/
> >
> > describe TO_WAY_TOO_MANY To: way too many recipients
> > header TO_WAY_TOO_MANY To =~ /(?:,[^,]{1,80}){50}/
>
> The {20} variant will cause "normal" FPs. I don't think the {50} would
> really cause FPs. but then
>
> header TO_WAY_TOO_MANY To =~ /(?:,[^,]{1,80}){100}/
>
> should more than conservative.
Of course. The threshold for "too many" is naturally something that will
vary for different people and situations.
> Anyway, this is worth an MTA reject
Good point - I added some tests to my milter-regex.
However, not everyone can do MTA rejects on this, so SA rules do have
utility.
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
[EMAIL PROTECTED] FALaholic #11174 pgpk -a [EMAIL PROTECTED]
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
Those in the media have donated to Obama at a 100:1 ratio compared
to McCain. Are we to believe that this bias does not in any way
taint their coverage of the campaign?
-----------------------------------------------------------------------
65 days until the Presidential Election
