You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Robert Menschel <Ro...@Menschel.net> on 2004/02/10 19:59:06 UTC
Re[2]: How can I catch this one
Hello Frank,
Tuesday, February 10, 2004, 3:03:50 AM, you wrote:
FTJ> Actually, I tried adding those LONGWORDS filters, and they didn't
FTJ> work really well...It actually blocks both the welcome and confirm
FTJ> message from when signing up to the spamassassin mailinglist (which
FTJ> I just did):
FTJ> pts rule name description
FTJ> --------------------------------------------------
FTJ> 0.2 NO_REAL_NAME From: does not include a real name
FTJ> 5.0 LONGWORDS_20 BODY: string of 20+ random letters
FTJ> 5.0 LONGWORDS_15 BODY: string of 15+ random letters
FTJ> -4.9 BAYES_00 BODY: Bayesian spam probability is 0 to 1%
FTJ> [score: 0.0000]
FTJ> 0.7 MSGID_FROM_MTA_HEADER Message-Id was added by a relay
FTJ> How was that filter supposed to work? Seems to me it doesn't care
FTJ> what the words are, as long as they are 4-12 characters long, and
FTJ> alot of em in a row.
Where did you get these longwords from? The descriptions you posted don't
match your discussion -- it seems like they would match loooong words,
15+ or 20+ letters, not multiple words of 4+ characters.
My longwords rules posted here late last month test for words 6 to 9+
characters long, and 6 to 9+ occurrences of them. They also score lower
than what you've posted.
Bob Menschel
Re[3]: How can I catch this one
Posted by Frank Tore Johansen <fr...@osc.no>.
On Tue, 10 Feb 2004, Robert Menschel wrote:
> FTJ> On Tue, 10 Feb 2004, Robert Menschel wrote:
> >> Where did you get these longwords from? The descriptions you posted don't
> >> match your discussion -- it seems like they would match loooong words,
> >> 15+ or 20+ letters, not multiple words of 4+ characters.
Oh, you mean what rules I used? I was just testing the ones just posted on
this list with this subject, by Bill Landry, February 6..
body LONGWORDS_15 /[a-zA-Z]{15}/
describe LONGWORDS_15 string of 15+ random letters
score LONGWORDS_15 5.0
body LONGWORDS_20 /[a-zA-Z]{20}/
describe LONGWORDS_20 string of 20+ random letters
score LONGWORDS_20 5.0
> If you're trying to flag emails that have long lists of random words,
> then use my longwords rules, as mentioned above, or Pierre's AR_* rules
> if you can find them.
OK, I'll search the archives for the rules you mentioned. Feel free to
email me them if you have them lying around.
-Frank.
Re[3]: How can I catch this one
Posted by Robert Menschel <Ro...@Menschel.net>.
Hello Frank,
Tuesday, February 10, 2004, 1:12:38 PM, you wrote:
FTJ> See attachments. Like I said, it was the normal mailing-list confirmation
FTJ> and welcome messages.
Yes, and again,
FTJ> On Tue, 10 Feb 2004, Robert Menschel wrote:
>> Where did you get these longwords from? The descriptions you posted don't
>> match your discussion -- it seems like they would match loooong words,
>> 15+ or 20+ letters, not multiple words of 4+ characters.
Looking at your attachments, there is no string of multiple words that
would kick off a "random string of words to confuse anti-spam software"
rule. What you do have are single, individual, long words, as in
> To confirm that you would like frankj@osc.no added to the
> spamassassin-users mailing list, please send an empty reply to this
> address:
> spamassassin-users-sc.1076410400.dpdnipjfjognepbjfhgh-frankj=osc.no@incubator.apache.org
where "dpdnipjfjognepbjfhgh" is probably the string that kicked off
whatever rule you are using.
It's because of this type of email URI, and also because of their random
appearance in PGP signatures and PGP-encrypted email, that I don't use
"single random word" rules.
>> My longwords rules posted here late last month test for words 6 to 9+
>> characters long, and 6 to 9+ occurrences of them. They also score lower
>> than what you've posted.
If you're trying to flag emails that have long lists of random words,
then use my longwords rules, as mentioned above, or Pierre's AR_* rules
if you can find them.
Bob Menschel
Re[2]: How can I catch this one
Posted by Frank Tore Johansen <fr...@osc.no>.
See attachments. Like I said, it was the normal mailing-list confirmation
and welcome messages.
-Frank.
On Tue, 10 Feb 2004, Robert Menschel wrote:
> Where did you get these longwords from? The descriptions you posted don't
> match your discussion -- it seems like they would match loooong words,
> 15+ or 20+ letters, not multiple words of 4+ characters.
>
> My longwords rules posted here late last month test for words 6 to 9+
> characters long, and 6 to 9+ occurrences of them. They also score lower
> than what you've posted.
>
> Bob Menschel
>
>
>