Re: Help with rule for geocities spam

2006-05-23 Thread Daryl C. W. O'Shea
On 5/23/2006 2:51 AM, Benny Pedersen wrote: http://wiki.apache.org/spamassassin/WebRedirectPlugin there is a slight config error on the page [WWW] http://people.apache.org/~dos/sa-plugins/3.1/WebRedirect.cf [WWW] http://people.apache.org/~dos/sa-plugins/3.1/WebRedirect.pm in the cf file the

RE: Help with rule for geocities spam

2006-05-22 Thread Bowie Bailey
Kenneth Porter wrote: I just grepped my entire mail hierarchy for .geocities.com and the only legitimate stuff I see either uses the www or uk subdomains. How can I write a rule that matches on that? If it were just one subdomain I could write one rule for all subdomains and one for just the

RE: Help with rule for geocities spam

2006-05-22 Thread Kenneth Porter
On Monday, May 22, 2006 12:28 PM -0400 Bowie Bailey [EMAIL PROTECTED] wrote: I assume you mean www.geocites.com and uk.geocities.com, right? Try this: /(?:www|uk)\.geocities\.com/ Add other anchors as appropriate... Doh! That was too easy! :P BTW, in my corpus the only legit use of

Re: Help with rule for geocities spam

2006-05-22 Thread Michael Monnerie
On Montag, 22. Mai 2006 18:28 Bowie Bailey wrote: /(?:www|uk)\.geocities\.com/ Or the full line could be: uri ZMIgeocitiesGOOD m{(?:www|uk)\.geocities\.com} describe ZMIgeocitiesGOOD probably good geocities site scoreZMIgeocitiesGOOD -1.2 or whatever score you want to give them. mfg

Re: Help with rule for geocities spam

2006-05-22 Thread Kenneth Porter
On Monday, May 22, 2006 7:24 PM +0200 Michael Monnerie [EMAIL PROTECTED] wrote: Or the full line could be: uri ZMIgeocitiesGOOD m{(?:www|uk)\.geocities\.com} describe ZMIgeocitiesGOOD probably good geocities site scoreZMIgeocitiesGOOD -1.2 or whatever score you want to give them.

RE: Help with rule for geocities spam

2006-05-22 Thread Bowie Bailey
Kenneth Porter wrote: On Monday, May 22, 2006 7:24 PM +0200 Michael Monnerie [EMAIL PROTECTED] wrote: Or the full line could be: uri ZMIgeocitiesGOOD m{(?:www|uk)\.geocities\.com} describe ZMIgeocitiesGOOD probably good geocities site scoreZMIgeocitiesGOOD -1.2 or

RE: Help with rule for geocities spam

2006-05-22 Thread Matthew.van.Eerde
Bowie Bailey wrote: Kenneth Porter wrote: Alternatively, is there regex syntax to match all patterns *except* the one given? Can I somehow express all geocities.com subdomains except www and uk as a regex? That is a bit trickier because Perl does not currently support variable length

RE: Help with rule for geocities spam

2006-05-22 Thread Bowie Bailey
[EMAIL PROTECTED] wrote: Bowie Bailey wrote: Kenneth Porter wrote: Alternatively, is there regex syntax to match all patterns *except* the one given? Can I somehow express all geocities.com subdomains except www and uk as a regex? That is a bit trickier because Perl does not

Re: Help with rule for geocities spam

2006-05-22 Thread Kenneth Porter
As it turns out, I had a SARE rule installed that should catch these, but I found some spams leaking through due to the insecure dependency bug (bug 3838), even though I'm running Perl 5.8.3. I'm applying Daryl C. W. O'Shea's patch for that bug. Here's the SARE rule:

Re: Help with rule for geocities spam

2006-05-22 Thread jdow
From: [EMAIL PROTECTED] Bowie Bailey wrote: Kenneth Porter wrote: Alternatively, is there regex syntax to match all patterns *except* the one given? Can I somehow express all geocities.com subdomains except www and uk as a regex? That is a bit trickier because Perl does not currently support

Re: Help with rule for geocities spam

2006-05-22 Thread jdow
From: Justin Mason [EMAIL PROTECTED] Kenneth Porter writes: As it turns out, I had a SARE rule installed that should catch these, but I found some spams leaking through due to the insecure dependency bug (bug 3838), even though I'm running Perl 5.8.3. I'm applying Daryl C. W. O'Shea's patch

Re: Help with rule for geocities spam

2006-05-22 Thread Daryl C. W. O'Shea
On 5/22/2006 6:14 PM, Kenneth Porter wrote: As it turns out, I had a SARE rule installed that should catch these, but I found some spams leaking through due to the insecure dependency bug (bug 3838), even though I'm running Perl 5.8.3. I'm applying Daryl C. W. O'Shea's patch for that bug.