You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Andy Dorman <ad...@ironicdesign.com> on 2009/06/16 00:23:44 UTC
Suggested Change For FS_TEEN_BAD
We had someone complain today about a forwarded email with the following subject:
"Shock!! Tiny young girls getting fucked by different items!!!"
The email (less the Received headers to protect the guilty) is at the end of
this email. It DID trigger several tests for poor formatting. And in later
tests it was caught by SURBL.
However, I was a little surprised that SpamAssassin did not have a test for a
phrase in the subject that seemed to clearly indicate potential child porn like
"girls getting f**ked".
I DID find the standard FS_TEEN_BAD test which would have been triggered if it
was expanded to check for a phrase starting with 'boy' OR 'girl' in addition to
'teen'.
I am currently running the following test on our development server.
header GIRLBOY_BAD Subject =~
/(?:girl|boy).{1,15}(?:pussy|sex|slut|ass|fuck|rape)/i
score GIRLBOY_BAD 3.00
describe GIRLBOY_BAD Subject says something bad about girls or boys
As yet we have seen no FPs. Although my Chief Architect has pointed out that
this will trigger on a RSS news headline like 'Local Girl Is Raped". I expect
that most people will already have "white listed" their news feeds to handle any
number of other issues.
I would like to suggest expanding the FS_TEEN_BAD test to handle this new case:
##{ FS_TEEN_BAD
header FS_TEEN_BAD Subject =~
/(?:teen|girl|boy).{1,15}(?:pussy|sex|slut|ass|fuck|rape)/i
describe FS_TEEN_BAD Subject says something bad about teens
##} FS_TEEN_BAD
Anyone see anything stupid I might be doing with this suggested change? (would
not be the first time)
Regards,
--
Andy Dorman
Ironic Design, Inc.
AnteSpam.com, HomeFreeMail.com, ComeHome.net
Message-ID: <00...@lord5d4fc94d98>
From: Megan Kadi <yk...@crosslandrealestate.com>
To: Info-master <in...@dbtsvr1.dbtech.net>
Subject: Shock!! Tiny young girls getting fucked by different items!!!
Date: Sat, 1 Jan 2005 19:13:08 +0200
MIME-Version: 1.0
Content-Type: text/plain;
format=flowed;
charset="UTF-8";
reply-type=original
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.3790.4682
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.4682
Ah, we see you are interested, so get a look at http://mootube.ru, look this 13
year old cutie stuck coke can into her virgin pussy. We can bring best children
porn to you, just register, pay and order it, http://carlobucks.ru will bring
the best not only from Russia, but whole world! We have 15-18 years old girls
fucked by animals(horses, goats, dogs, etc.), masturbating less 12 years babies
and mega cool teen gay porn at gaykiss.ru, enjoy it all!
If you want to join, register at http://carlobucks.ru and you can pay for
unlimited account and get some bonuses. Webmasters, if you have any weird
children porn, we will buy it for good price, don't miss your chance to get
extra money.
Re: Suggested Change For FS_TEEN_BAD
Posted by Andy Dorman <ad...@ironicdesign.com>.
RW wrote:
>
>> ##{ FS_TEEN_BAD
>> header FS_TEEN_BAD Subject =~
>> /\b(?:teens?|girls?|boys?).{1,15}\b(?:pussy|sex(?:xy|ual)?|slut(?:s|ty)?|ass(?:es|fuck(?:ing|ed)?|whip(?:ing|ped)?|spank(?:ing|ed)?)?|fuck(?:ing|ed)?|rap(?:e|ed|ing)+)\b/i
>> describe FS_TEEN_BAD Subject says something bad about teens,
>> girls, boys ##} FS_TEEN_BAD
>
> You aren't checking the boundary after the first word. Since it's a
> subject test I think the .{1,15} could probably be a .+
>
> You might also throw in jailbait and lolita. Also it's very common for
> porn spam to use z in plurals e.g. girlz, boyz.
Thank you. Just like the warez crowd. Yeah.
You also mmake a good point about the boundary after the first word. However,
it seems to me that if there is no text in between the first and second words
then we end up with two consecutive word boundaries and no match. Leaving off
the first boundary and using .* allows us to catch anything without an
intervening term and still ensures grape does not get tagged for rape. :-)
##{ FS_TEEN_BAD
header FS_TEEN_BAD Subject =~
/\b(?:teen(?:s|z)?|girl(?:s|z)?|boy(?:s|z)?|jailbait|lolita(?:s|z)?).*\b(?:pussy|sex(?:xy|ual)?|slut(?:s|ty)?|ass(?:es|fuck(?:ing|ed)?|whip(?:ing|ped)?|spank(?:ing|ed)?)?|fuck(?:ing|ed)?|rap(?:e|ed|ing)+)\b/i
describe FS_TEEN_BAD Subject says something bad about teens, girls, boys, others
##} FS_TEEN_BAD
Thank you again.
--
Andy Dorman
Ironic Design, Inc.
AnteSpam.com, HomeFreeMail.com, ComeHome.net
Re: Suggested Change For FS_TEEN_BAD
Posted by Charles Gregory <cg...@hwcn.org>.
On Tue, 16 Jun 2009, McDonald, Dan wrote:
>> Two 'p's in 'whipping'. One 'x' in 'sexy'.... :)
> I've seen sexxxy as well....
(BIG LOUD LAUGH)
(clutches head in pain) No! Not obfuscation checking code! No! Please make
it stop! Make it stop! The pain! I can't take it!
You are, of course, correct. :)
- Charles
Re: [sa] Re: Suggested Change For FS_TEEN_BAD
Posted by Charles Gregory <cg...@hwcn.org>.
On Tue, 16 Jun 2009, Andy Dorman wrote:
> ##{ FS_TEEN_BAD
>
> header FS_TEEN_BAD Subject =~
> /\b(?:teen(?:s|z)?|girl(?:s|z)?|boy(?:s|z)?|jailbait|lolita(?:s|z)?)
> .*\b(?:pussy|sex(?:x{0,3}y|ual)?|slut(?:s|ty)?|
> ass(?:es|fuck(?:ing|ed)?|whip(?:ping|ped)?|
> spank(?:ing|ed)?)?|fuck(?:ing|ed)?|rap(?:e|ed|ing)+)\b/i
> describe FS_TEEN_BAD Subject says something bad about girls or boys
>
> ##} FS_TEEN_BAD
It's a good looking rule, but I would suggest splitting it into TWO.
One low-score version for combinations that could reasonably FP on
expressions like 'teenage sexual health', and a high-score version for
more distinctly spammy phrases like "teenz getting whipped"....
- Charles
Re: Suggested Change For FS_TEEN_BAD
Posted by Theo Van Dinter <fe...@apache.org>.
On Thu, Jun 18, 2009 at 7:26 AM, Michael
Monnerie<mi...@is.it-management.at> wrote:
> On Mittwoch 17 Juni 2009 Theo Van Dinter wrote:
>> Yes, it matters (one path is tried then the other has to be tried, as
>> opposed to having a single path)
>
> So which is better performance wise? I guess [sz]? but I'm not sure now.
[sz] is better than (s|z), I want to say always (true from the
theoretical POV), but it depends on the RE compiler which can optimize
(convert) one to the other (the reality POV). IMO, it's good habit to
just do the right thing yourself, since different RE compilers are
well, different.
In short:
if you want to match one of several specific single characters, use a
character class "[]". only use "(...|...)" if you need to catch more
complicated/non-single character things.
If you want to know more gory details, search around for "finite automata". :)
Re: Suggested Change For FS_TEEN_BAD
Posted by Henrik K <he...@hege.li>.
On Thu, Jun 18, 2009 at 07:26:58AM +0200, Michael Monnerie wrote:
> On Mittwoch 17 Juni 2009 Theo Van Dinter wrote:
> > Yes, it matters (one path is tried then the other has to be tried, as
> > opposed to having a single path)
>
> So which is better performance wise? I guess [sz]? but I'm not sure now.
It's very simple to test, here's a very unscientific one:
#!/usr/bin/perl
use Benchmark qw(cmpthese);
cmpthese(1000000, {
'group_nomatch' => sub { 'abc' =~ /b[xy]?/; },
'group_match' => sub { 'abc' =~ /b[xc]?/; },
'alt_nomatch' => sub { 'abc' =~ /b(?:x|y)?/; },
'alt_match' => sub { 'abc' =~ /b(?:x|c)?/; },
});
Rate alt_match group_nomatch group_match alt_nomatch
alt_match 534759/s -- -75% -75% -77%
group_nomatch 2127660/s 298% -- -2% -9%
group_match 2173913/s 307% 2% -- -7%
alt_nomatch 2325581/s 335% 9% 7% --
Not much difference, but alternation having a match ends up very slow.
Grouping would logically thinking be better and it seems so. Though it
always ends up slightly slower as a not matching alternation?
I'm sure there would be other test cases. Where are the perl über-geeks now? ;)
Cheers,
Henrik
Re: Suggested Change For FS_TEEN_BAD
Posted by Michael Monnerie <mi...@is.it-management.at>.
On Mittwoch 17 Juni 2009 Theo Van Dinter wrote:
> Yes, it matters (one path is tried then the other has to be tried, as
> opposed to having a single path)
So which is better performance wise? I guess [sz]? but I'm not sure now.
mfg zmi
--
// Michael Monnerie, Ing.BSc ----- http://it-management.at
// Tel: 0660 / 415 65 31 .network.your.ideas.
// PGP Key: "curl -s http://zmi.at/zmi.asc | gpg --import"
// Fingerprint: AC19 F9D5 36ED CD8A EF38 500E CE14 91F7 1C12 09B4
// Keyserver: wwwkeys.eu.pgp.net Key-ID: 1C1209B4
Re: Suggested Change For FS_TEEN_BAD
Posted by Justin Mason <jm...@jmason.org>.
I'm pretty sure it still matters.
On Wed, Jun 17, 2009 at 19:16, Theo Van Dinter<fe...@apache.org> wrote:
> Yes, it matters (one path is tried then the other has to be tried, as
> opposed to having a single path), though the overall amount is
> probably negligible. Perl's RE compiler could well optimize this away
> anyway.
>
>
> On Wed, Jun 17, 2009 at 7:45 PM, Kelson<ke...@speed.net> wrote:
>> Wouldn't it be more efficient to write all the single-letter matches like
>> "(?:s|z)?" as "[sz]?" or does it end up not making a difference when the
>> regex is actually processed?
>
>
Re: Suggested Change For FS_TEEN_BAD
Posted by Theo Van Dinter <fe...@apache.org>.
Yes, it matters (one path is tried then the other has to be tried, as
opposed to having a single path), though the overall amount is
probably negligible. Perl's RE compiler could well optimize this away
anyway.
On Wed, Jun 17, 2009 at 7:45 PM, Kelson<ke...@speed.net> wrote:
> Wouldn't it be more efficient to write all the single-letter matches like
> "(?:s|z)?" as "[sz]?" or does it end up not making a difference when the
> regex is actually processed?
Re: Suggested Change For FS_TEEN_BAD
Posted by Kelson <ke...@speed.net>.
Wouldn't it be more efficient to write all the single-letter matches
like "(?:s|z)?" as "[sz]?" or does it end up not making a difference
when the regex is actually processed?
--
Kelson Vibber
SpeedGate Communications <www.speed.net>
Re: Suggested Change For FS_TEEN_BAD
Posted by Andy Dorman <ad...@ironicdesign.com>.
OK, I think/hope this is the final pass. Thanks for all the good thoughts &
ideas (and spelling corrections) from everyone.
##{ FS_TEEN_BAD
header FS_TEEN_BAD Subject =~
/\b(?:teen(?:s|z)?|girl(?:s|z)?|boy(?:s|z)?|jailbait|lolita(?:s|z)?).*\b(?:pussy|sex(?:x{0,3}y|ual)?|slut(?:s|ty)?|ass(?:es|fuck(?:ing|ed)?|whip(?:ping|ped)?|spank(?:ing|ed)?)?|fuck(?:ing|ed)?|rap(?:e|ed|ing)+)\b/i
describe FS_TEEN_BAD Subject says something bad about girls or boys
##} FS_TEEN_BAD
--
Andy Dorman
Ironic Design, Inc.
AnteSpam.com, HomeFreeMail.com, ComeHome.net
Re: Suggested Change For FS_TEEN_BAD
Posted by John Hardin <jh...@impsec.org>.
On Tue, 16 Jun 2009, McDonald, Dan wrote:
>>>> /\b(?:teens?|girls?|boys?...
>
> doesn't the first ?: negate that whole part of the test?
No, that means "don't capture the match", not "this is optional".
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
...people who insist that religion is required for morality remind
me of hoplophobes who insist that I be disarmed because _they're_
unsafe with a gun. -- MarkHB at munchkinwrangler's
-----------------------------------------------------------------------
2 days until SWMBO's Birthday
Re: Suggested Change For FS_TEEN_BAD
Posted by "McDonald, Dan" <Da...@austinenergy.com>.
On Tue, 2009-06-16 at 13:52 -0400, Charles Gregory wrote:
> On Tue, 16 Jun 2009, RW wrote:
> > On Tue, 16 Jun 2009 12:03:43 -0500
> > Andy Dorman <ad...@ironicdesign.com> wrote:
> >> ##{ FS_TEEN_BAD
> >> header FS_TEEN_BAD Subject =~
> >> /\b(?:teens?|girls?|boys?...
> >> describe FS_TEEN_BAD Subject says something bad about teens,
> >> girls, boys ##} FS_TEEN_BAD
> > You aren't checking the boundary after the first word. Since it's a
> > subject test I think the .{1,15} could probably be a .+
> > You might also throw in jailbait and lolita. Also it's very common for
> > porn spam to use z in plurals e.g. girlz, boyz.
doesn't the first ?: negate that whole part of the test?
Seems like it should start out as
/\b(teen|girl|boy|jailbait|lolita)[sz]?.{0,15}\b
>
> Two 'p's in 'whipping'. One 'x' in 'sexy'.... :)
I've seen sexxxy as well, maybe:
sex(?:x{0,3}y|ual)
>
> - Charles
--
Daniel J McDonald, CCIE # 2495, CISSP # 78281, CNX
www.austinenergy.com
Re: [sa] Re: Suggested Change For FS_TEEN_BAD
Posted by Charles Gregory <cg...@hwcn.org>.
On Tue, 16 Jun 2009, RW wrote:
> On Tue, 16 Jun 2009 12:03:43 -0500
> Andy Dorman <ad...@ironicdesign.com> wrote:
>> ##{ FS_TEEN_BAD
>> header FS_TEEN_BAD Subject =~
>> /\b(?:teens?|girls?|boys?).{1,15}\b(?:pussy|sex(?:xy|ual)?|slut(?:s|ty)?|ass(?:es|fuck(?:ing|ed)?|whip(?:ing|ped)?|spank(?:ing|ed)?)?|fuck(?:ing|ed)?|rap(?:e|ed|ing)+)\b/i
>> describe FS_TEEN_BAD Subject says something bad about teens,
>> girls, boys ##} FS_TEEN_BAD
> You aren't checking the boundary after the first word. Since it's a
> subject test I think the .{1,15} could probably be a .+
> You might also throw in jailbait and lolita. Also it's very common for
> porn spam to use z in plurals e.g. girlz, boyz.
Two 'p's in 'whipping'. One 'x' in 'sexy'.... :)
- Charles
Re: Suggested Change For FS_TEEN_BAD
Posted by RW <rw...@googlemail.com>.
On Tue, 16 Jun 2009 12:03:43 -0500
Andy Dorman <ad...@ironicdesign.com> wrote:
> ##{ FS_TEEN_BAD
> header FS_TEEN_BAD Subject =~
> /\b(?:teens?|girls?|boys?).{1,15}\b(?:pussy|sex(?:xy|ual)?|slut(?:s|ty)?|ass(?:es|fuck(?:ing|ed)?|whip(?:ing|ped)?|spank(?:ing|ed)?)?|fuck(?:ing|ed)?|rap(?:e|ed|ing)+)\b/i
> describe FS_TEEN_BAD Subject says something bad about teens,
> girls, boys ##} FS_TEEN_BAD
>
You aren't checking the boundary after the first word. Since it's a
subject test I think the .{1,15} could probably be a .+
You might also throw in jailbait and lolita. Also it's very common for
porn spam to use z in plurals e.g. girlz, boyz.
Re: Suggested Change For FS_TEEN_BAD
Posted by Andy Dorman <ad...@ironicdesign.com>.
David B Funk wrote:
>> I would like to suggest expanding the FS_TEEN_BAD test to handle this new case:
>>
>> ##{ FS_TEEN_BAD
>> header FS_TEEN_BAD Subject =~
>> /(?:teen|girl|boy).{1,15}(?:pussy|sex|slut|ass|fuck|rape)/i
>> describe FS_TEEN_BAD Subject says something bad about teens
>> ##} FS_TEEN_BAD
>
> Unbounded matches are FP fodder,
>
> Use '\b' (word boundary) metasymbols to bound matches.
>
> EG:
>
> /\b(?:teen|girl|boy)\b.{1,15}\b(?:pussy|sex|slut|ass|fuck|rape)\b/i
>
> Of course then you get into the plural(s) and other variation match
> chase. (EG, "teen" vs "teens" etc).
>
David, excellent point. Let me see if I can adjust what you added and catch
some of the many variations.
##{ FS_TEEN_BAD
header FS_TEEN_BAD Subject =~
/\b(?:teens?|girls?|boys?).{1,15}\b(?:pussy|sex(?:xy|ual)?|slut(?:s|ty)?|ass(?:es|fuck(?:ing|ed)?|whip(?:ing|ped)?|spank(?:ing|ed)?)?|fuck(?:ing|ed)?|rap(?:e|ed|ing)+)\b/i
describe FS_TEEN_BAD Subject says something bad about teens, girls, boys
##} FS_TEEN_BAD
I considered leaving off the final end word boundary because there are so many
possibilities. But I decided to try getting in touch with my "dark side" and
cover as many variations as I could think of. :-)
As written above, this still triggers on the original email that set off this
quest. And I think with the most recent changes it will be very unlikely to FPs.
But those could always be "famous last words".
Did I miss anything?
--
Andy Dorman
Ironic Design, Inc.
AnteSpam.com, HomeFreeMail.com, ComeHome.net
Re: Suggested Change For FS_TEEN_BAD
Posted by David B Funk <db...@engineering.uiowa.edu>.
On Mon, 15 Jun 2009, Andy Dorman wrote:
> I am currently running the following test on our development server.
>
> header GIRLBOY_BAD Subject =~
> /(?:girl|boy).{1,15}(?:pussy|sex|slut|ass|fuck|rape)/i
> score GIRLBOY_BAD 3.00
> describe GIRLBOY_BAD Subject says something bad about girls or boys
>
> As yet we have seen no FPs. Although my Chief Architect has pointed out that
> this will trigger on a RSS news headline like 'Local Girl Is Raped". I expect
> that most people will already have "white listed" their news feeds to handle any
> number of other issues.
>
> I would like to suggest expanding the FS_TEEN_BAD test to handle this new case:
>
> ##{ FS_TEEN_BAD
> header FS_TEEN_BAD Subject =~
> /(?:teen|girl|boy).{1,15}(?:pussy|sex|slut|ass|fuck|rape)/i
> describe FS_TEEN_BAD Subject says something bad about teens
> ##} FS_TEEN_BAD
Unbounded matches are FP fodder,
Try:
Subject: girl takes pussycat to local vet
Subject: boys join Middlesex militia
Subject: teen dance class registration now open
Use '\b' (word boundary) metasymbols to bound matches.
EG:
/\b(?:teen|girl|boy)\b.{1,15}\b(?:pussy|sex|slut|ass|fuck|rape)\b/i
Of course then you get into the plural(s) and other variation match
chase. (EG, "teen" vs "teens" etc).
--
Dave Funk University of Iowa
<dbfunk (at) engineering.uiowa.edu> College of Engineering
319/335-5751 FAX: 319/384-0549 1256 Seamans Center
Sys_admin/Postmaster/cell_admin Iowa City, IA 52242-1527
#include <std_disclaimer.h>
Better is not better, 'standard' is better. B{
Re: Suggested Change For FS_TEEN_BAD
Posted by Andy Dorman <ad...@ironicdesign.com>.
Jason Haar wrote:
> John Rudd wrote:
>> I believe Theo's point is that: Just because it's porn doesn't mean
>> it's unsolicited. The deciding factor is not "it's porn? therefore SA
>> should detect it"
>>
> Well as my second sentence said - there is ALREADY a rule in
> 72_active.cf that detects this. That's all Andy was talking about.
> There's an existing rule and he proposed an update that would make it
> more effective to do *what it is already designed to do*
>
Exactly. I should have started with that point. I apologize for starting off
on a tangent with the porn issue.
I am just suggesting an update to help FS_TEEN_BAD catch more of what it
appeared to be already intended to catch.
I honestly do NOT want to get into a debate on porn. That is why SA let's us
adjust the rule scores. If we want to run it as a porn filter, then we can
increase selected scores. Or not if we so choose.
And in fact, the original complaint was for the "bad" word, not the phrase, in
the subject. We have already passed back to the user that we have a special
"Block list" filter that anyone can apply to their emails if they do not want to
see ANY emails with selected words in the subject. But that is an individual
choice and not something we are going to apply system-wide.
Hooray for SpamAssassin, Open Source and being able to run our own filters as we
choose to!
--
Andy Dorman
Ironic Design, Inc.
AnteSpam.com, HomeFreeMail.com, ComeHome.net
Re: Suggested Change For FS_TEEN_BAD
Posted by Jason Haar <Ja...@trimble.co.nz>.
John Rudd wrote:
> I believe Theo's point is that: Just because it's porn doesn't mean
> it's unsolicited. The deciding factor is not "it's porn? therefore SA
> should detect it"
>
Well as my second sentence said - there is ALREADY a rule in
72_active.cf that detects this. That's all Andy was talking about.
There's an existing rule and he proposed an update that would make it
more effective to do *what it is already designed to do*
--
Cheers
Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone: +64 3 9635 377 Fax: +64 3 9635 417
PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1
Re: Suggested Change For FS_TEEN_BAD
Posted by John Rudd <jr...@ucsc.edu>.
On Mon, Jun 15, 2009 at 15:43, Jason Haar<Ja...@trimble.co.nz> wrote:
> Theo Van Dinter wrote:
>> SpamAssassin is not a porn filter, whatever the variety.
>>
> Yes it is. If it's unsolicited - then it's spam.
I believe Theo's point is that: Just because it's porn doesn't mean
it's unsolicited. The deciding factor is not "it's porn? therefore SA
should detect it" (which would imply that either all porn is spam, or
SA is a porn detecting filter -- the latter is definitely false, and
the former is unproven and probably false). The deciding factor is
"is it spam? therefore SA should detect it".
(plus, on an axe-grinding tangent, I personally hate the "unsolicited"
qualification on spam ... there's plenty of crap headed toward my
inbox that the vendor can claim was solicited due to missing some tiny
checkbox on a signup form, or some other loophole; of "UCE" and "UBE",
the only part that holds true for me is the E, for "it's a subset of
Email"; not all spam is commercial, not all spam is bulk, not all spam
is "unsolicited" from everyone's point of view (including the law's),
the only thing all spam has in common with those two acronyms is: it's
email; "Junk Email" is a better description, but it's just as
vague/ambiguous as "Spam")
Re: Suggested Change For FS_TEEN_BAD
Posted by Jason Haar <Ja...@trimble.co.nz>.
Theo Van Dinter wrote:
> SpamAssassin is not a porn filter, whatever the variety.
>
Yes it is. If it's unsolicited - then it's spam. By that logic, there
should be no textual regex rules - SA should only use RBLs and Bayes.
BTW, the originator was referring to changing an existing official rule:
FS_TEEN_BAD
(/var/lib/spamassassin/3.002005/updates_spamassassin_org/72_active.cf)
I would add 'f\*\*k' to the rule too...
--
Cheers
Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone: +64 3 9635 377 Fax: +64 3 9635 417
PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1
Re: Suggested Change For FS_TEEN_BAD
Posted by Theo Van Dinter <fe...@apache.org>.
On Tue, Jun 16, 2009 at 12:23 AM, Andy Dorman<ad...@ironicdesign.com> wrote:
> However, I was a little surprised that SpamAssassin did not have a test for
> a phrase in the subject that seemed to clearly indicate potential child porn
> like "girls getting f**ked".
SpamAssassin is not a porn filter, whatever the variety.