On Wed, 12 Nov 2014, David B Funk wrote:
In my first message I included an example URL from an Amtrak ticket
notification that it fired on.
...
That same message also fired on URI_HEX, URIBL_RHS_DOB, STYLE_GIBBERISH, and
MPART_ALT_DIFF which were enough to overcome the BAYES_00 and cause an FP.
Another potential change is to have URI_HEX exclude purely-numeric
strings:
before:
uri URI_HEX m%^https?://[^/?]*\b(?![0-9a-f]{0,12}[a-f]{3})[0-9a-f]{6,}\b%i
after (perhaps):
uri URI_HEX
m%^https?://[^/?]*\b(?![0-9a-f]{0,12}[a-f]{3}|[0-9]{6,}\b)[0-9a-f]{6,}\b%i
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhar...@impsec.org FALaholic #11174 pgpk -a jhar...@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
The ["assault weapons"] ban is the moral equivalent of banning red
cars because they look too fast. -- Steve Chapman, Chicago Tribune
-----------------------------------------------------------------------
895 days since the first successful private support mission to ISS (SpaceX)
