Re: [Sare] Rule for the SOFTWARE spam

[Daniel Watts <d...@nielwatts.com>]

Robert Menschel wrote:

>Hello Doc,
>
>Sunday, October 30, 2005, 10:36:39 AM, you wrote:
>DS> Daniel,
>
>DS> I got a whole lot of these... if you could make that into a 
>DS> 00_software_DW.cf file I can run it through the SARE masscheckers, if
>DS> you want.
>
>If they're good enough, they can be added to Fred's OEM file.
>
>Daniel, I didn't see any "score" lines in the extract Doc sent to the
>SARE list ... the default score on any "unscored" rule is 1.0, so you
>need to be aware that if any non-spam matches say 3 of your rules,
>it'll get a 3.0 score just from those rules.
>
>For testing you might want to set those rules to score 0.01 (leave the
>meta as it is), and then in production change those rules to
>__nonscore rules.
>
>Bob Menschel
>
>  
>
Very kind of you guys.
I must admit i'm not 100% sure what you mean by your
00_software_DW.cf file but i've attached my best guess to this email!
Daniel

Re: [Sare] Rule for the SOFTWARE spam

[Daniel Watts <d...@nielwatts.com>]

>
>
> Robert Menschel wrote:
>
>> Hello Doc,
>>
>> Sunday, October 30, 2005, 10:36:39 AM, you wrote:
>> DS> Daniel,
>>
>> DS> I got a whole lot of these... if you could make that into a DS> 
>> 00_software_DW.cf file I can run it through the SARE masscheckers, if
>> DS> you want.
>>
>> If they're good enough, they can be added to Fred's OEM file.
>>
>> Daniel, I didn't see any "score" lines in the extract Doc sent to the
>> SARE list ... the default score on any "unscored" rule is 1.0, so you
>> need to be aware that if any non-spam matches say 3 of your rules,
>> it'll get a 3.0 score just from those rules.
>>
>> For testing you might want to set those rules to score 0.01 (leave the
>> meta as it is), and then in production change those rules to
>> __nonscore rules.
>>
>> Bob Menschel
>>
>>  
>>
> Very kind of you guys.
> I must admit i'm not 100% sure what you mean by your
> 00_software_DW.cf file but i've attached my best guess to this email!
> Daniel
>
>------------------------------------------------------------------------
>
>#test cf file to run against software spam email
>#Tries to match several attributes within the email
>#Written by Daniel Watts Oct 2005 and submitted to the spamassassin list for public assesment and use.
>
># matches Software in the subject
>header SOFTWARE_SPAM_SUBJECT Subject =~ /^Software *$/       
>
>#matches "New software on our site:" on it's own line
>body SOFTWARE_SPAM_BODY1 /^New software on our site: *$/
>
>#matches $xx.xx at least 10 times
>body SOFTWARE_SPAM_BODY2 /(\$\d{1,3}\.\d{0,2}){10,}/s
>
>
>#matches at least 10 hyphens with spaces round them
>body SOFTWARE_SPAM_BODY3 /( \- ){10,}/s               
>
>
>#matches "Our site:" on it's own line
>body SOFTWARE_SPAM_BODY4 /^Our site: *$/
>
>
>#matches url with 4 parts
>body SOFTWARE_SPAM_BODY5
>/http:\/\/(([a-zA-Z0-9]+[a-zA-Z0-9_-]*)\.){3,}([a-zA-Z0-9]+[a-zA-Z0-9_-]*)/
>
>
>
>meta SOFTWARE_SPAM (SOFTWARE_SPAM_SUBJECT && SOFTWARE_SPAM_BODY1 && SOFTWARE_SPAM_BODY2 && SOFTWARE_SPAM_BODY3 && SOFTWARE_SPAM_BODY4 && SOFTWARE_SPAM_BODY5)
>
>description SOFTWARE_SPAM Unsolicited message selling software
>
>#None of these should singly mark a message as spam
>SOFTWARE_SPAM_SUBJECT 0.01
>SOFTWARE_SPAM_BODY1 0.01
>SOFTWARE_SPAM_BODY2 0.01
>SOFTWARE_SPAM_BODY3 0.01
>SOFTWARE_SPAM_BODY4 0.01
>SOFTWARE_SPAM_BODY5 0.01
>
>#The collection is almost certainly spam
>score SOFTWARE_SPAM 10 
>

Sorry  noticed 2 typos.
Ammended file attached again.

Re: [Sare] Rule for the SOFTWARE spam

[Daniel Watts <d...@nielwatts.com>]

Hi guys,

Wow this detail of feedback, recieved so fast, is great.
Evidently I didn't get it right the first time. Please bear with me - 
this is my first rule attempt.
I've spent another hour or so and I think I have it right this time.

Please if you would try the attached cf file against your mass checkers 
we should find a more positive result!
FILE: 01_software_DW.cf

Sincerely,
Daniel