checking for BCC

[Franklin Currah <fr...@cafes.net>]

I have been looking for a plugin or rule or some method of 
marking/scoring a message if it is a BCC.

My little mind was thinking of a rule that compares headers To: and 
Delivered To: and marks/scores if one isn't inside the other, but I'm 
not sure of how to do variables in regex.

Point me in the right direction please :)

Re: checking for BCC

[Matt Kettler <mk...@verizon.net>]

Franklin Currah wrote:
> I have been looking for a plugin or rule or some method of
> marking/scoring a message if it is a BCC.
>
> My little mind was thinking of a rule that compares headers To: and
> Delivered To: and marks/scores if one isn't inside the other, but I'm
> not sure of how to do variables in regex.
>
> Point me in the right direction please :)
>
The closest thing to "variables" in a regex. is a backreference using ()
and \1..
ie  /([0-9])[a-z]\1/


Will match 1b1 but not 1b2. The backreference \1 forces a match of the
same text that was matched by the first ().

However some points:

1) You'll have to do this as a single regex applied across the entire
header block, and using backreferences at all is kinda inefficient. The
result will likely be very slow. You can't do two separate SA rules and
"compare notes" between them.

2) You'll have to check both the To: and the Cc: header. Normally in SA
you don't have to worry about this, but since you'll have to use the
"ALL" pseudo-header to get the entire header block, you'll have to worry
about it.

3) Because of the complexity of 1 and 2, this would be much better done
with a perl plugin than a regular regex based rules. That can store the
results of two separate regexes and compare them, without having to
scan/store all the text between.

All that said, are you *SURE* this is something that would be useful?

Remember, normal posts to a mailing list, even this list, will arrive to
you as a BCC, not a To. Do some checking around, you probably get a lot
more mail that's BCC'ed to you than you think..

Be sure to consider these common matches:
newsletters (spam or nonspam)
mailing list posts
spam
viruses
the occasional email from a friend who is emailing everyone they know
and is using BCC so they're not telling members of different friend
groups the address of everyone they know. (I did this when I sent an
email announcing my daughter's birth. I sent it "To:" myself, and bcc'ed
it to multiple groups of friends and family at once, many of whom don't
know each other. ie: my college buddies from Iowa don't know my high
school friends from Maryland. It also makes for a less cluttered email
header.)

Re: checking for BCC

[Evan Platt <ev...@espphotography.com>]

At 06:14 PM 2/7/2007, Franklin Currah wrote:
>I have been looking for a plugin or rule or some method of 
>marking/scoring a message if it is a BCC.
>
>My little mind was thinking of a rule that compares headers To: and 
>Delivered To: and marks/scores if one isn't inside the other, but 
>I'm not sure of how to do variables in regex.
>
>Point me in the right direction please :)

I can't help you with the rule, but what are you trying to accomplish / check?

If I e-mail you and BCC 100 people, you'd never know. :-D