On Fri, 2009-05-15 at 17:26 +0100, Jeremy Morton wrote:
> Karsten Bräckelmann wrote:
> > A: Because they are not defined. (See second half of this post.)
> > Where did you come across that rule at all? How did you get the
> > impression it should be in your stock install?
Would you mind contributing to this thread? Please do answer my
questions. They are not rhetorical, and I do ask them for a reason.
Thanks in advance for your cooperation.
> It seemed like quite an obvious one to me - an image only and no body?
> Anyway, OK so I can manually put this rule in. But is there a way to do
> things in a more automated fashion? I don't want to be manually
> entering new rules all the time. I tried sa-update but it seems to have
> made no difference and this rule still isn't getting matched.
Yes, because it IS NOT in sa-update. As I mentioned before, it is a rule
that has been written very recently, to catch a very specific, recent
spam run.
The rule hasn't even seen much mass-checks, most notably against ham
corpora. Thus it is not safe to shove it down the throat of all
sa-update users out there. Besides, updating rules is done manually by
the devs, and thus requires some spare time. Also, this typically will
be done for fixing issues or emergency rules only.
Spam is evolving, constantly changing and trying to sneak by using
different tricks and patterns all the time. Most of them are likely to
disappear soon-ish anyway. Image spam for example was last an issue
years ago. Using entirely different patterns, mind you.
It *is* your duty to keep an eye on things, and throw in a custom rule
occasionally. That's not anywhere near "manually entering new rules all
the time", as you put it.
While the update process indeed could, and IMHO should, be used more
frequently to distribute recent rules targeting recent patterns, this
currently involves quite a lot manual work. Unless that process becomes
more convenient and safe to use for the devs, don't expect us to write
0-day rules and hand 'em over to you.
Sorry, if I sound slightly annoyed.
guenther
--
char *t="\10pse\0r\0dtu...@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1:
(c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}
