On Sat, May 14, 2022 at 10:57:19AM -0700, Matt Corallo wrote: > > At the same time, the ESP module was one of the features of SA 4 that I was > most excited about - the ability to learn on and classify specific senders > even though they hide behind ESPs sounds like it could, at least in theory, > be quite effective. > > Of course updates for such a thing are going to be a problem, and I don't > know enough about the SA updates architecture, but if that could provide > feeds to keep the ESP match-and-decode (regex) rules up-to-date it seems > like it'd be very powerful for semi-default-install SA, which isn't all that > uncommon.
AFAIK most of the stuff that Esp.pm does could now be done in plain rules only with the new 4.0.0 features. Having the module or not is irrevant. What matters is if Giovanni or someone can provide the necessary rules for the "Esp" stuff for stock sa-update. The proper way looking up this stuff would be using a DNS query anyway, maybe we can enhance askdns to look up the new regex capture stuff.
