We attempted implementing a test that counts the number of html comments and found that it was impractical as it consistently captured a large number of legitimate services. (Scott, you indicated that it might catch some - our experience has been that it captures so many we had to drop it.) I suspect that most systems will need to weight such a test very lightly. Hope this helps.
_M | -----Original Message----- | From: [EMAIL PROTECTED] | [mailto:[EMAIL PROTECTED]] On Behalf Of R. | Scott Perry | Sent: Tuesday, November 19, 2002 8:23 AM | To: [EMAIL PROTECTED] | Subject: Re: [Declude.JunkMail] Wordfilter bypassed | | | | >The sneaky buggers are at it again. I've been getting more and more | >emails | >that don't fail any tests at all, but should be caught as | spam due to | >multiple wordfilter hits. I had a look at the message (HTML) | source, and | >found this: | > | >Hum<!--nnbvmx-->an Gr<!--d-->owth Hor<!--fjkg-->mone | Th<!--sdkf-->erapy | > | >Scott, is it possible that the wordfilter, when looking at | HTML source | >messages, can be made to disregard HTML comments, as above? | | That likely isn't something that we will be doing, as it will | add a lot of | extra CPU time (or require writing our own specially designed string | matching functions). However, we are thinking of adding a | test that will | get triggered if a certain number of comments are found in an | E-mail. Although this would catch the occasionally bandwidth-wasting | legitimate bulk mailers (that have real comments), it would | also be very | useful in detecting spam. | -Scott | | --- | [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
