On 03/25/2011 07:22 AM, Kevin A. McGrail wrote:
> On 3/25/2011 10:13 AM, Jari Fredriksson wrote:
>> Yes, it contains "cialis".
>>
>> I just looked at my mass check results, and this came out. Dunno what
>> could be done to it...
>>
> Agreed.  The rule should have a low score or be used with other metas
> because it clearly has known false positives.
> 
> Some rules have to fire on ham.  That doesn't make them bad rules.

However, it does make them sub-optimal.

I've revised the rule from:

header  HK_NAME_DRUGS  From:name =~ /(viagra|cialis)/mi

to:

header  HK_NAME_DRUGS  From:name =~ /(viagra|\bcialis|cialis\b)/mi

My multi-lingual dictionary only has four matches for that now,
judicialis, sternofacialis, viagram, and viagraph, all of which are
limited to the american-english-insane dictionary obtained from
http://wordlist.sourceforge.net/ (apt-get install wamerican-insane) and
should be sufficiently rare as From names (or anything else for that
matter).  The previous pattern matched 287 words.

Attachment: signature.asc
Description: OpenPGP digital signature

Reply via email to