RE: [Declude.JunkMail] sure to be silly question
Here's what I did with the comments: I created the following tests COMMENTS20 comments20 x 10 0 COMMENTS40 comments40 x 10 0 COMMENTS60 comments60 x 10 0 COMMENTS80 comments80 x 10 0 COMMENTS100 comments100 x 10 0 COMMENTS120 comments120 x 10 0 This allows me to increment the penalty by the number of comments in a message. For each of 20 comments, a cumulative weight of 10 is added. Seems to work. Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of paul Sent: Tuesday, August 19, 2003 11:04 To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] sure to be silly question Ok, I've got a question about the COMMENTS test. Since I have a copy of every email I've gotten from this and the AV list since I joined, I looked through them and didn't see my answer. I also looked at the JM revisions page and found nothing either, so here goes. Below is the line from the message source of an email I got this morning. VERY bad idea to spam the guy in charge of email. =) anyway, since the words gen*eric via*gra minus the *s in case of filters, are shoen in the email, but seperated by the junk in the . What's the way to set a block/test for this? I've yet to use the COMMENTS test, but want to know the BEST way to do so. Geinput type=hidden name=zZKIrRcpWfFgeyDneric Vip style=margin-bottom: -20font size=1 color=#FFxvtAXyZLNqZbKsaWiqfpg/font/pagra Any help is appreciated! Paul --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] sure to be silly question
Ok, I've got a question about the COMMENTS test. Since I have a copy of every email I've gotten from this and the AV list since I joined, I looked through them and didn't see my answer. I also looked at the JM revisions page and found nothing either, so here goes. Below is the line from the message source of an email I got this morning. VERY bad idea to spam the guy in charge of email. =) anyway, since the words gen*eric via*gra minus the *s in case of filters, are shoen in the email, but seperated by the junk in the . What's the way to set a block/test for this? I've yet to use the COMMENTS test, but want to know the BEST way to do so. Geinput type=hidden name=zZKIrRcpWfFgeyDneric Vip style=margin-bottom: -20font size=1 color=#FFxvtAXyZLNqZbKsaWiqfpg/font/pagra Any help is appreciated! Paul --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] sure to be silly question
That's right. Each is incremental, so if you have 75 comments it will give a weight of 10+10+10=30 You may wish to change the weight assigned for each to suit your circumstances. We use a weight system at approx. twice the default ones in order to arrive at a safe delete point of 100. Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of paul Sent: Tuesday, August 19, 2003 11:47 To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] sure to be silly question Here's what I did with the comments: I created the following tests COMMENTS20 comments 20 x 10 0 COMMENTS40 comments 40 x 10 0 COMMENTS60 comments 60 x 10 0 COMMENTS80 comments 80 x 10 0 COMMENTS100 comments 100 x 10 0 COMMENTS120 comments 120 x 10 0 Hmmm, ok, so am I reading this right? COMMENTS20 checks for 20 comments? if there are 20 comments, 10 is added to the weight, etc etc. ? Let me know if I'm right and I'll add them in, sounds promising, I think I may give these a HOLD action / zero weight first, to see how they work. Thanks Erik, Paul --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] sure to be silly question
Another way to scale the weight of this test is to use: COMMENTS comments weight x 5 0 where the test will accumulate the total number of obfuscation comments it finds and add 5 to that number and apply that to the weight result for the test. I don't see the comments test documented on the JunkMail manual site yet, so Scott, please correct me if I am wrong. Bill - Original Message - From: Tandem Group [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, August 19, 2003 11:46 AM Subject: RE: [Declude.JunkMail] sure to be silly question That's right. Each is incremental, so if you have 75 comments it will give a weight of 10+10+10=30 You may wish to change the weight assigned for each to suit your circumstances. We use a weight system at approx. twice the default ones in order to arrive at a safe delete point of 100. Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of paul Sent: Tuesday, August 19, 2003 11:47 To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] sure to be silly question Here's what I did with the comments: I created the following tests COMMENTS20 comments 20 x 10 0 COMMENTS40 comments 40 x 10 0 COMMENTS60 comments 60 x 10 0 COMMENTS80 comments 80 x 10 0 COMMENTS100 comments 100 x 10 0 COMMENTS120 comments 120 x 10 0 Hmmm, ok, so am I reading this right? COMMENTS20 checks for 20 comments? if there are 20 comments, 10 is added to the weight, etc etc. ? Let me know if I'm right and I'll add them in, sounds promising, I think I may give these a HOLD action / zero weight first, to see how they work. Thanks Erik, Paul --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] sure to be silly question
That would be cool, but wouldn't that increment from zero, so that even one single comment would score a 6? Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Bill Landry Sent: Tuesday, August 19, 2003 12:28 To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] sure to be silly question Another way to scale the weight of this test is to use: COMMENTS comments weight x 5 0 where the test will accumulate the total number of obfuscation comments it finds and add 5 to that number and apply that to the weight result for the test. I don't see the comments test documented on the JunkMail manual site yet, so Scott, please correct me if I am wrong. Bill - Original Message - From: Tandem Group [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, August 19, 2003 11:46 AM Subject: RE: [Declude.JunkMail] sure to be silly question That's right. Each is incremental, so if you have 75 comments it will give a weight of 10+10+10=30 You may wish to change the weight assigned for each to suit your circumstances. We use a weight system at approx. twice the default ones in order to arrive at a safe delete point of 100. Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of paul Sent: Tuesday, August 19, 2003 11:47 To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] sure to be silly question Here's what I did with the comments: I created the following tests COMMENTS20 comments 20 x 10 0 COMMENTS40 comments 40 x 10 0 COMMENTS60 comments 60 x 10 0 COMMENTS80 comments 80 x 10 0 COMMENTS100 comments 100 x 10 0 COMMENTS120 comments 120 x 10 0 Hmmm, ok, so am I reading this right? COMMENTS20 checks for 20 comments? if there are 20 comments, 10 is added to the weight, etc etc. ? Let me know if I'm right and I'll add them in, sounds promising, I think I may give these a HOLD action / zero weight first, to see how they work. Thanks Erik, Paul --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] sure to be silly question
Another way to scale the weight of this test is to use: COMMENTS comments weight x 5 0 where the test will accumulate the total number of obfuscation comments it finds and add 5 to that number and apply that to the weight result for the test. So which is a preferrable approach? I've added the COMMENTS20,40,60,80,100 lines to Global, and WARN actions in $default$, so I'm guessing it's set now, but if this way is easier, I'd switch. Right now no weight is added, and just warnings are added to the headers. 80 + 100 are set to HOLD for review. Thanks all! Paul --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] sure to be silly question
That's correct. However, you can set the value I showed in the example as 5, to anything you want, including zero 0, which would then add a weight exactly matching the number of obfuscated comments found in the message. Bill - Original Message - From: Tandem Group [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, August 19, 2003 12:52 PM Subject: RE: [Declude.JunkMail] sure to be silly question That would be cool, but wouldn't that increment from zero, so that even one single comment would score a 6? Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Bill Landry Sent: Tuesday, August 19, 2003 12:28 To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] sure to be silly question Another way to scale the weight of this test is to use: COMMENTS comments weight x 5 0 where the test will accumulate the total number of obfuscation comments it finds and add 5 to that number and apply that to the weight result for the test. I don't see the comments test documented on the JunkMail manual site yet, so Scott, please correct me if I am wrong. Bill - Original Message - From: Tandem Group [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, August 19, 2003 11:46 AM Subject: RE: [Declude.JunkMail] sure to be silly question That's right. Each is incremental, so if you have 75 comments it will give a weight of 10+10+10=30 You may wish to change the weight assigned for each to suit your circumstances. We use a weight system at approx. twice the default ones in order to arrive at a safe delete point of 100. Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of paul Sent: Tuesday, August 19, 2003 11:47 To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] sure to be silly question Here's what I did with the comments: I created the following tests COMMENTS20 comments 20 x 10 0 COMMENTS40 comments 40 x 10 0 COMMENTS60 comments 60 x 10 0 COMMENTS80 comments 80 x 10 0 COMMENTS100 comments 100 x 10 0 COMMENTS120 comments 120 x 10 0 Hmmm, ok, so am I reading this right? COMMENTS20 checks for 20 comments? if there are 20 comments, 10 is added to the weight, etc etc. ? Let me know if I'm right and I'll add them in, sounds promising, I think I may give these a HOLD action / zero weight first, to see how they work. Thanks Erik, Paul --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
