chickenpox.cf ham

[Robert Fitzpatrick <li...@webtent.net>]

I have chickenpox.cf consistently hitting ham. I did some digging, looks
like when Microsoft Word or similar is involved in the body, this
hits...

<snip>
<meta name=3DGenerator content=3D"Microsoft Word 12 (filtered medium)">
<!--[if !mso]>
<style>
v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style>
<![endif]-->
<style>
<!--
 /* Font Definitions */
 @font-face
        {font-family:Calibri;
        panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
        {font-family:Tahoma;
        panose-1:2 11 6 4 3 5 4 4 2 4;}
 /* Style Definitions */
<snip>

I know I can make a meta rule to combine with another, but not sure how
to combine with all chickenpox rules. Do I have to include all of them
or will a wildcard work in the meta? Also, I see where Word is mentioned
here, does anyone have an idea of a meta rule that would catch all kinds
of garbage like this, Word or anything similar?

I am new at making my own rules and not sure if combining to reduce the
score is the right thing to do?

-- 
Robert

Re: chickenpox.cf ham

[Matthew Newton <mc...@leicester.ac.uk>]

Hi,

On Tue, Aug 28, 2007 at 11:23:45AM -0700, Loren Wilton wrote:
> >I have chickenpox.cf consistently hitting ham. I did some digging, looks
> 
> They are known to do this, which was why the set was depreciated.  Unless 
> they are still hitting on some of those mangled stock spams for you, the 
> simplest solution might be to just remove the set until they come back 
> again.

I've altered the ruleset to use meta rules so that they don't
score so high. Seems to work fine here (I did this maybe a couple
of years ago, and haven't hit problems):

  http://www.le.ac.uk/its/mcn4/mcnchickenpox.cf

Maximum chickenpox score with this is 3.5, if over 9 rules hit.

HTH,

Matthew


-- 
Matthew Newton <mc...@le.ac.uk>

Network Support and UNIX Systems Administrator, Network Services,
I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom

For IT help contact helpdesk extn. 2253, <cc...@le.ac.uk>

Re: chickenpox.cf ham

[Loren Wilton <lw...@earthlink.net>]

>I have chickenpox.cf consistently hitting ham. I did some digging, looks

They are known to do this, which was why the set was depreciated.  Unless 
they are still hitting on some of those mangled stock spams for you, the 
simplest solution might be to just remove the set until they come back 
again.


> I know I can make a meta rule to combine with another, but not sure how
> to combine with all chickenpox rules. Do I have to include all of them
> or will a wildcard work in the meta? Also, I see where Word is mentioned
> here, does anyone have an idea of a meta rule that would catch all kinds
> of garbage like this, Word or anything similar?

Hum.  Quite recently there was something about adding wild-card syntax to 
meta terms.  I don't recall if it was implemented or not.  If it was, then 
in probably 3.2 you could do a wild-card meta.  In any earlier version (or 
if this wasn't implemented) then you would have to list all of the rules 
with an 'or'.


> I am new at making my own rules and not sure if combining to reduce the
> score is the right thing to do?

The old way might be simpler.  Detect the nasty pattern and simply make a 
rule that adds a negative half point for Word garbage, and just assume that 
chickenpox is going to hit.  Let SA add up the scores and don't bother with 
the meta.

        Loren