I run regexp for header check on my Postfix gateways, but not for body checks because of the CPU usage it takes to scan message bodies. I like the fact the Declude JunkMail is fast and efficient and would be opposed to adding code that would substantially slow it down.
Just my 2 cents... Bill ----- Original Message ----- From: "Mike K" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Monday, February 24, 2003 10:22 AM Subject: Re: [Declude.JunkMail] Idea for a test... > Scott: > > You may just want to build support for unix style regular expressions. > > Complicated, but they can do this and much more. > > Note: Len's IMGate solution can do this also but with half the cpu > horsepower that NT/2K require. I use IMGATE as a front end to IMAIL/Declude > do exactly this. > > Expression matching does get cpu intensive if you don't limit it to say the > first 5K bytes (scanning a 5 meg attachment for ex.) or so and make sure it > runs after less resource intensive tests (rbls). > > Mike > > ----- Original Message ----- > From: "R. Scott Perry" <[EMAIL PROTECTED]> > To: <[EMAIL PROTECTED]> > Sent: Monday, February 24, 2003 10:36 AM > Subject: Re: [Declude.JunkMail] Idea for a test... > > > > > > >As we all know the spammers insert special characters in the middle of > > >subject words to bypass the filters, e.g. P/O/R/N, or all sort of other > > >variations. > > > > > >Can a test we devised, similar to the COMMENT test that counts the number > > >of special characters or detect similar characters appearing in the > middle > > >of words. > > > > > >I guess one way to approach this is to first count if there are more than > > >1 or 2 special characters and if yes then determine if they are followed > > >by text. > > > > > >This could be a weight test. > > > > This does sound like a good idea. Our spamtraps don't seem to get much > > spam like that, but a test looking for non-alphanumeric characters that > are > > surrounded by alphanumeric characters might make some sense (which would > > catch "P/O/R/N"). > > -Scott > > > > --- > > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > > > --- > > This E-mail came from the Declude.JunkMail mailing list. To > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > type "unsubscribe Declude.JunkMail". The archives can be found > > at http://www.mail-archive.com. > > > > > > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
