Re[2]: unwanted breakthrough

[Robert Menschel <Ro...@Menschel.net>]

Hello Herb,

Sunday, July 31, 2005, 4:00:58 PM, you wrote:

HM> 60_whitelist.cf
HM> 70_sare_adult.cf
HM> 70_sare_bayes_poison_nxm.cf
HM> 70_sare_evilnum0.cf
HM> 70_sare_evilnum1.cf
HM> 70_sare_genlsubj.cf
HM> 70_sare_genlsubj0.cf
HM> 70_sare_genlsubj1.cf
HM> 70_sare_genlsubj2.cf
HM> 70_sare_genlsubj3.cf

the 70_sare_genlsubj.cf includes all of the next four, so you can get
rid of them.

HM> 70_sare_genlsubj_arc.cf
HM> 70_sare_genlsubj_eng.cf
HM> 70_sare_header.cf
HM> 70_sare_header0.cf
HM> 70_sare_header1.cf
HM> 70_sare_header2.cf
HM> 70_sare_header3.cf

Ditto -- those last four above are duplicated within 70_sare_header.cf

HM> 70_sare_header_eng.cf
HM> 70_sare_highrisk.cf
HM> 70_sare_html.cf
HM> 70_sare_html0.cf
HM> 70_sare_html1.cf
HM> 70_sare_html2.cf
HM> 70_sare_html4.cf

You don't have 70_sare_html3.cf?  html3.cf is more effective than
70_sare_html4.cf

HM> 70_sare_html_eng.cf
HM> 70_sare_obfu.cf
HM> 70_sare_obfu2.cf
HM> 70_sare_oem.cf
HM> 70_sare_random.cf
HM> 70_sare_ratware.cf

70_sare_ratware.cf is empty. You can delete that.

HM> 70_sare_specific.cf
HM> 70_sare_spoof.cf
HM> 70_sare_unsub.cf
HM> 70_sare_uri0.cf
HM> 70_sare_uri1.cf
HM> 70_sare_uri3.cf
HM> 70_sare_uri_eng.cf
HM> 70_sare_whitelist.cf
HM> 70_sare_whitelist_pre30.cf

Drop 70_sare_whitelist_pre30.cf -- if 70_sare_whitelist.cf does not
error-out for you, then the pre30.cf version is not needed.

HM> 70_sc_top200.cf
HM> 72_sare_bml_post25x.cf
HM> 72_sare_redirect_post3.0.0.cf
HM> 88_FVGT_body.cf
HM> 88_FVGT_headers.cf
HM> 88_FVGT_rawbody.cf
HM> 88_FVGT_subject.cf
HM> 88_FVGT_uri.cf
HM> 999_antidrug.cf

antidrug.cf is included within 3.0.x, so there's no need for you to
have your own copy.

HM> 999_backhair.cf
HM> 999_chickenpox.cf
HM> 999_mangled.cf
HM> 999_weeds_2.cf
HM> 99_FVGT_Tripwire.cf
HM> 99_FVGT_meta.cf
HM> 99_sare_fraud_post25x.cf
HM> bogus-virus-warnings.cf
HM> random.cf
HM> tripwire.cf

99_FVGT_Tripwire.cf and tripwire.cf are the same rules, different
names.  Use whichever one is more recently updated, and not the other.

Bob Menschel