Case sensitivity

[Ron McKeating <R....@lboro.ac.uk>]

Hi all, we just got hit with about 50 copies of the spam I have put here
http://www.sprocket.lboro.ac.uk/~ron/bademail.txt

Interestingly if you look at the uri it gives, the fact that each word
starts with an upper case letter gets it past the porn rule. If I edit
the email and change those letters to lower case it gets cought. I
thought the rules were case insensitive if the rule was written in lower
case. As the spammers now seem to know this they are driving a coach and
horses through the rules just by changing case. 

Am I misunderstanding how this should work, if so please advise.

/Ron

-- 
Ron McKeating
Senior IT Services Specialist
Internet Services and Software Solutions
Loughborough University
01509 222329

Re: Case sensitivity

[Ron McKeating <R....@lboro.ac.uk>]

On Wed, 2004-05-19 at 11:08, Loren Wilton wrote:
> A rule is case-insensitive if it ends with an 'i' character after the end of
> the regexp, like:
> 
>         header    SOME_THING    From =~ /myname/i
> 
> It is not case-insensitive otherwise, as in:
> 
>         header    SOME_THING    From =~ /myname/
> 
> I would guess in this case that we just plain forgot the /i on the end of
> the rule, although there are some rules we deliberately make case sensitive
> when you might think they should be otherwise.  Usually that happens when
> making it case insensitive will end up hitting a lot of ham we don't want
> the rule to hit.
> 
>         Loren

Thanks for that, do we need to go through our rule sets and decide for
ourselves which should be sensitive or not. Or are you going to release
updated versions of the rules.

Ron
-- 
Ron McKeating
Senior IT Services Specialist
Internet Services and Software Solutions
Loughborough University
01509 222329

Re: Case sensitivity

[Loren Wilton <lw...@earthlink.net>]

A rule is case-insensitive if it ends with an 'i' character after the end of
the regexp, like:

        header    SOME_THING    From =~ /myname/i

It is not case-insensitive otherwise, as in:

        header    SOME_THING    From =~ /myname/

I would guess in this case that we just plain forgot the /i on the end of
the rule, although there are some rules we deliberately make case sensitive
when you might think they should be otherwise.  Usually that happens when
making it case insensitive will end up hitting a lot of ham we don't want
the rule to hit.

        Loren