Chipping in my two cents (Hi, I'm back from vacation!) I'm waiting for something like BODYTEXT instead of BODY so that I can stop getting false positives from short sequences showing up in attachment encoding.
I had to stop trying to filter: grx grx2 t1t MLM d0rm /ad /ads because they came up an astonishing number of times in the BASE64 encoding of normal attachments. Pardon me for putting words in his mouth, but Scott's stock answer has been that this has been noted as a feature request but would mean a significant effort for Declude to write a full MIME parser to include in their products. Andrew 8) -----Original Message----- From: Matthew Bramble [mailto:[EMAIL PROTECTED] Sent: Tuesday, September 09, 2003 4:56 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Detecting gibberish Thanks Scott, that explains pretty much everything. I'm sure you are well aware of the problem with gibberish in spam, especially if you are moving towards Bayes filtering with Declude. Is it possible to come up with a filter like say BODYTEXT that processes just decoded text and ignores anything in HTML tags and attachments? ----- Markus, and a question for you about SpamChk...can your app be limited to just the decoded non-HTML text or does it only do it all ways? It would appear that this would be a reasonable alternative if so. Thanks, Matt R. Scott Perry wrote: > >> Regarding the gibberish detection and decoding...I am running the >> most recent version and have not disabled decoding, however the >> following test message gets a hit on [BODY 0 CONTAINS qi] even >> though that string only appears in the link: > > > Ah, I was mistaken. What happens is Declude JunkMail checks against > *both* the original contents and the decoded contents. > >> I also found that the the Base64 encoded words that appear in a >> subject aren't getting found by my filters either. > > > That is correct. Declude JunkMail does not attempt to decode subjects > (which use a different encoding system than attachments). > > -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
