> I always thought a blackRe hit was considered the same as a Bayesian hit
> - just forced.

Exactly, so you can't act on it separately from Bayesian.

> Perhaps the blackRe should register the same via the PB.

Exactly the opposite of what I would find useful.  I don't think the 
connection to Bayesian should be severed, but just another option added to 
score blackRe separately from Bayesian scoring.

> I understand what you are saying, but I can't think of a way this would be
> applicable in a general sense.
>
> Can you provide some example blackRe where your scenario would be
> worthwhile as apposed to using the bombRe?

My example is the regEx for catching image only spam.  My bombRe is set to 
"1" for activated.  The emails addresses that match it are supposed to be 
blocked very early on during the connection as a blacklist.  Those that pass 
the early test are then tested against the body of the email.  Any email 
that matches my bombRe gets blocked outright by design.  I continue to need 
this functionality and have no desire to change it.  It is working well, no 
false positives, _until_ I add the following regEx for image only spam.

#image only
<BODY[^>]*>(<[^>]+>|\n|\r)*<IMG[^>]+>(<[^>]+>|\n|\r)*</BODY>

Then I get image only email that is _not_ spam caught and blocked.  So sure 
I can change the bombRe functionality to not block email, but why throw out 
the baby with the bathwater?  So at my site, I can not use that string as a 
bombRe as email blocked due to false positives are not tolerated by my 
management.  So I add it to blackRe and mark it as spam and pass it to the 
user.  We don't PB score Bayesian due to its uncertainty but do mark it in 
the subject.  If there was a separate PB scoring for blackRe I could score 
it such that if any other penalty condition existed, missing ptr or MX etc. 
or I got more than one matching email from that IP, very common, then it 
would get that IP blocked.

I believe there is value to PB scoring email that hit the blackRe even 
though we don't want to PB score email that is strictly spam from Bayesian 
testing as is all newsletters and such until they get whitelisted.

It seems like an obvious extension to the blackRe/bombRe and I say again, I 
do not want to change the way bombRe is working.  It is working as desired.

Thanks,

Doug



-------------------------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
Assp-user mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/assp-user

Reply via email to