Re: Bigevil and SARE update! If you read only one post this year, it should be this one

[Al Danks <ad...@calvin.edu>]

Chris Santerre <csanterre <at> MerchantsOverseas.com> writes:

> And a HUGE thank you to all the SARE members who secretly work away at this
> stuff in their spare time! You guys rock, and I grow more intelligent every
> day from working with you. Thank you! And we would all be WAY behind if it
> wasn't for the work of Robert M. and his corpus of doom! You rock Bob!
 
Ditto on the HUGE thank you to all.

When I tried loading the new rules I came up with a couple of error/warnings 
showing in my maillog after restarting SA - spamd.

biz_market_learn.cf

Illegal hexadecimal digit ! rule RM_bwo_Auction line 1

drugs_diet.cf

Illegal hexadecimal digit ! rule RM_bwo_VIAGRA line 1

It said it would ignore the illegal hex digit. Should I wait for updated files, 
or is this not a problem?

Al

Re: Re[2]: Bigevil and SARE update! If you read only one post this year, it should be this one

[jdow <jd...@earthlink.net>]

From: "Al Danks" <ad...@calvin.edu>

> First attempt downloaded to Windows PC and copied to Unix.
>
> Second attempt, just now,
>
> wget http://www.merchantsoverseas.com/wwwroot/gorilla/biz_market_learn.cf
>
> directly from Unix machine. Still get the same illegal hexadecimal ! line
1
> when I restart SA 2.63.
>
> At this point, since Chris says it's not ready yet I'm waiting until he
says it
> is.

Push comes to shove, Al, you can double click on it then "save as" or
clip and paste the whole thing. I've used both tricks from time to time.
{^_^}

Re: Re[2]: Bigevil and SARE update! If you read only one post this year, it should be this one

[Matt Yackley <sa...@yackley.org>]

Al Danks said:
> Robert Menschel <Robert <at> Menschel.net> writes:
>
>>
>> Hello Al,
>>
>> How did you download the file, and then how did you save it to your
>> system? If you used any editor or word processor that might wrap text,
>> that could be the cause.
>>
>> Another possibility:  If you saved the file on a Windows/DOS machine,
>> and
>> then copied it to a Unix machine without translating for the O/S
>> difference, that could also cause similar symptoms.
>
> First attempt downloaded to Windows PC and copied to Unix.
>
> Second attempt, just now,
>
> wget http://www.merchantsoverseas.com/wwwroot/gorilla/biz_market_learn.cf
>
> directly from Unix machine. Still get the same illegal hexadecimal ! line
> 1
> when I restart SA 2.63.
>
> At this point, since Chris says it's not ready yet I'm waiting until he
> says it
> is.
>
> Al
>

Hi Al, Bob,
I think I ran into this as well during the initial testing & cleanup
before the first test run.  I believe the regex that is causing the
problem is "|\xCE\xB!9|", if I remember correctly, removing the "!" from
"xB!9" fixed the error.

The updated, cleaned, tweaked, etc. biz_market_learn file should be ready
within a week.

Cheers,
matt

Re: Re[2]: Bigevil and SARE update! If you read only one post this year, it should be this one

[Al Danks <ad...@calvin.edu>]

Robert Menschel <Robert <at> Menschel.net> writes:

> 
> Hello Al,
> 
> How did you download the file, and then how did you save it to your
> system? If you used any editor or word processor that might wrap text,
> that could be the cause.
> 
> Another possibility:  If you saved the file on a Windows/DOS machine, and
> then copied it to a Unix machine without translating for the O/S
> difference, that could also cause similar symptoms.

First attempt downloaded to Windows PC and copied to Unix.

Second attempt, just now, 

wget http://www.merchantsoverseas.com/wwwroot/gorilla/biz_market_learn.cf

directly from Unix machine. Still get the same illegal hexadecimal ! line 1 
when I restart SA 2.63.

At this point, since Chris says it's not ready yet I'm waiting until he says it 
is.

Al

Re[2]: Bigevil and SARE update! If you read only one post this year, it should be this one

[Robert Menschel <Ro...@Menschel.net>]

Hello Al,

Tuesday, March 16, 2004, 12:11:15 PM, you wrote:

AD> When I tried loading the new rules I came up with a couple of error/warnings
AD> showing in my maillog after restarting SA - spamd.

AD> biz_market_learn.cf
AD> Illegal hexadecimal digit ! rule RM_bwo_Auction line 1
AD> drugs_diet.cf
AD> Illegal hexadecimal digit ! rule RM_bwo_VIAGRA line 1

AD> It said it would ignore the illegal hex digit. Should I wait for
AD> updated files, or is this not a problem?

These are very loooong rules (because of the obfuscation tests), and I
suspect the problem was caused by line wrapping somewhere along the way.
I don't see that problem in the original biz_market_learn.cf file on the
web site, so I fear I must ask:

How did you download the file, and then how did you save it to your
system? If you used any editor or word processor that might wrap text,
that could be the cause.

Another possibility:  If you saved the file on a Windows/DOS machine, and
then copied it to a Unix machine without translating for the O/S
difference, that could also cause similar symptoms.

Bob Menschel