You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by "Peter H. Lemieux" <ph...@cyways.com> on 2006/11/14 15:58:46 UTC
Where to submit SARE rule patches?
Is this a good place for this? If so, I'd like to propose the following
fix to 70_sare_adult.cf:
329d328
< body __HAS_PENETRATION /\bpenetration\b/i
331c330
< meta FP_MIXED_PORN3 ((__HAS_COLLECTION +
__HAS_HARDCORE + __HAS_YOUNGGIRL + __HAS_PENETRATION + __HAS_ADOLESCENT +
__HAS_CHICKS) > 2)
---
> meta FP_MIXED_PORN3 ((__HAS_COLLECTION +
__HAS_HARDCORE + __HAS_YOUNGGIRL + FPS_PENETRAT + __HAS_ADOLESCENT +
__HAS_CHICKS) > 2)
There is no rule called simply "FPS_PENETRAT" in the file. There is a
header rule called __FPS_PENETRAT which might be what's intended, but the
rest of the checks in the FP_MIXED_PORN3 meta are body rules. So I
decided from the logic that you wanted to tag the word "penetration" in
the body as well and created the __HAS_PENETRATION rule along the same
lines as __HAS_HARDCORE.
Peter
Re: Where to submit SARE rule patches?
Posted by Kelson <ke...@speed.net>.
Matthias Haegele wrote:
> iirc: local.cf would be a good place since it overwrites other rules
> (which might get updated and your changes overwritten) ...
I think he meant where to submit it as a suggested change to the actual
ruleset...
--
Kelson Vibber
SpeedGate Communications <www.speed.net>
Re: Where to submit SARE rule patches?
Posted by Matthias Haegele <mh...@linuxrocks.dyndns.org>.
Peter H. Lemieux schrieb:
> Is this a good place for this? If so, I'd like to propose the following
> fix to 70_sare_adult.cf:
>
> 329d328
> < body __HAS_PENETRATION /\bpenetration\b/i
> 331c330
> < meta FP_MIXED_PORN3 ((__HAS_COLLECTION +
> __HAS_HARDCORE + __HAS_YOUNGGIRL + __HAS_PENETRATION + __HAS_ADOLESCENT
> + __HAS_CHICKS) > 2)
> ---
> > meta FP_MIXED_PORN3 ((__HAS_COLLECTION +
> __HAS_HARDCORE + __HAS_YOUNGGIRL + FPS_PENETRAT + __HAS_ADOLESCENT +
> __HAS_CHICKS) > 2)
>
> There is no rule called simply "FPS_PENETRAT" in the file. There is a
> header rule called __FPS_PENETRAT which might be what's intended, but
> the rest of the checks in the FP_MIXED_PORN3 meta are body rules. So I
> decided from the logic that you wanted to tag the word "penetration" in
> the body as well and created the __HAS_PENETRATION rule along the same
> lines as __HAS_HARDCORE.
iirc: local.cf would be a good place since it overwrites other rules
(which might get updated and your changes overwritten) ...
> Peter
hth
MH
Re: Where to submit SARE rule patches?
Posted by "Peter H. Lemieux" <ph...@cyways.com>.
Karl Auer wrote:
> On Tue, 2006-11-14 at 09:58 -0500, Peter H. Lemieux wrote:
>> < body __HAS_PENETRATION /\bpenetration\b/i
>
> I think a lot of rules would be better for losing the word boundaries.
> Very few of the worst "four letter words", are ever legitimate
> substrings, either.
I generally agree, Karl. In this particular instance I was suggesting a
patch to the 70_sare_adult ruleset and was following the patterns the
maintainer used for similar rules.
OTOH, I've had FP problems with simple word searches that don't include
word boundaries. A word like "sex" can match "sextuplets" or
"Middlesex". (The latter case brought this quickly to my attention some
years ago when I first starting writing my own SA rules. Middlesex is a
county here in Massachusetts.) It's often hard to imagine all the
possible false positives that might arise from a particular string, so I
can understand why the publicly-distributed rulesets like those from SARE
are so careful about word boundaries.
Peter
Re: Where to submit SARE rule patches?
Posted by Karl Auer <ka...@biplane.com.au>.
On Tue, 2006-11-14 at 09:58 -0500, Peter H. Lemieux wrote:
> < body __HAS_PENETRATION /\bpenetration\b/i
A lot of rules use "\b" to mark spammy words (i.e., they stipulate a
word boundary). I see a LOT of spam, however, that runs words together -
presumably to avoid exactly such checks: "hotchicks looking forsex" and
suchlike.
Short words probably should be sought on word boundaries, because of the
risk that they may legitimately form substrings of other words. The
longer a word is though, the less likely it is to be a legitimate
substring.
Sooo - I think you can and should just look for "penetration" without
the word boundaries. And I think a lot of rules would be better for
losing the word boundaries. Very few of the worst "four letter words",
are ever legitimate substrings, either.
Regards, K.
--
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Karl Auer (kauer@biplane.com.au) +61-2-64957160 (h)
http://www.biplane.com.au/~kauer/ +61-428-957160 (mob)
Re: Where to submit SARE rule patches?
Posted by Chris Thielen <cm...@someone.dhs.org>.
Peter H. Lemieux wrote:
> Is this a good place for this?
I caught it, but a better place would be sare-users list
http://lists.maddoc.net/mailman/listinfo/sare-users
> If so, I'd like to propose the following fix to 70_sare_adult.cf:
I'm not the maintainer of that ruleset, but I will run the proposed
change through the masscheckers.
Thanks for the patch!
Chris Thielen