On Mon, 17 Oct 2011, Christian Grunfeld wrote:
> Yeah, you catch my point !
>
> I think it's easier to find a non-alphanum character than trying to
> decode/desobfucate/guess the subject hidden word !
>
> Why do we have to waste resources in trying to guess "Sex Movie" out
> of "Se^x M-o ^v ~l e -". If it contains non-char in between chars you
> can directly trigger a rule !
>
However you need to be careful how you craft/use this kind of rule.
I regularly get legit messages with subjects like:
New ProTrav - Req Trav, Fac/Stf
Re: [Imap-protocol] FETCH (rfc822) response
SANS NewsBites Vol. 13 Num. 81 : Military Drone Cockpit Computers Infected
With Malware; AmEx Site Exposing Data; Calif. Governor Vetoes Bill Requiring
Warrant for Searching Mobile Phones
Cron <root@s-lib011> /exlibris/backup/scripts/exec_backup_main s2
FINAL DAYS: *Free to Choose* - Save 50% - All
[InCommon] IAM Online Weds., Oct. 12 - IAM Governance
Those kinds of rules may be good for making meta rules to
combine with other indications but be careful using them
by themselves.
--
Dave Funk University of Iowa
<dbfunk (at) engineering.uiowa.edu> College of Engineering
319/335-5751 FAX: 319/384-0549 1256 Seamans Center
Sys_admin/Postmaster/cell_admin Iowa City, IA 52242-1527
#include <std_disclaimer.h>
Better is not better, 'standard' is better. B{
