Right, as has been the concnsus when the regexp idea's has been discussed before. Declude is clean small and straightforward. Regexp support adds complexiy which add's to CPU load.
We run a postfix gateway as well (that's where we actually run message sniffer, to keep the CPU load on IMAIL as low as possible, we do a good volume). Simple checking to watch for this specific pattern might be a good idea, but IMO full blown regexp support is an overkill for what declude is designed for. There are people developing external tests to accomplish this, which I believe is the best win win solution for the broad customer base declude is targeted at. -----Original Message----- From: Bill Landry [mailto:[EMAIL PROTECTED] Sent: Monday, February 24, 2003 1:01 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Idea for a test... I run regexp for header check on my Postfix gateways, but not for body checks because of the CPU usage it takes to scan message bodies. I like the fact the Declude JunkMail is fast and efficient and would be opposed to adding code that would substantially slow it down. Just my 2 cents... Bill ----- Original Message ----- From: "Mike K" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Monday, February 24, 2003 10:22 AM Subject: Re: [Declude.JunkMail] Idea for a test... > Scott: > > You may just want to build support for unix style regular expressions. > > Complicated, but they can do this and much more. > > Note: Len's IMGate solution can do this also but with half the cpu > horsepower that NT/2K require. I use IMGATE as a front end to IMAIL/Declude > do exactly this. > > Expression matching does get cpu intensive if you don't limit it to > say the > first 5K bytes (scanning a 5 meg attachment for ex.) or so and make > sure it > runs after less resource intensive tests (rbls). > > Mike > > ----- Original Message ----- > From: "R. Scott Perry" <[EMAIL PROTECTED]> > To: <[EMAIL PROTECTED]> > Sent: Monday, February 24, 2003 10:36 AM > Subject: Re: [Declude.JunkMail] Idea for a test... > > > > > > >As we all know the spammers insert special characters in the middle > > >of subject words to bypass the filters, e.g. P/O/R/N, or all sort > > >of other variations. > > > > > >Can a test we devised, similar to the COMMENT test that counts the number > > >of special characters or detect similar characters appearing in the > middle > > >of words. > > > > > >I guess one way to approach this is to first count if there are > > >more than > > >1 or 2 special characters and if yes then determine if they are followed > > >by text. > > > > > >This could be a weight test. > > > > This does sound like a good idea. Our spamtraps don't seem to get > > much spam like that, but a test looking for non-alphanumeric > > characters that > are > > surrounded by alphanumeric characters might make some sense (which > > would catch "P/O/R/N"). > > -Scott > > > > --- > > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > > > --- > > This E-mail came from the Declude.JunkMail mailing list. To > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type > > "unsubscribe Declude.JunkMail". The archives can be found at > > http://www.mail-archive.com. > > > > > > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type > "unsubscribe Declude.JunkMail". The archives can be found at > http://www.mail-archive.com. > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
