From: "Matthias Fuhrmann" <[EMAIL PROTECTED]>
> On Fri, 27 Feb 2004, Alton Danks wrote:
>
> > Hello,
> >
> > Am I correct that Tripwire is case sensitive? A message with the
following
> > content did not score Tripwire.
> >
> > <!-- MKMQGTJVYVCPUNTOGZEEMZEMMMEQKSZRVQTPJQNIZKOBPPNAEGZKXZWWWNKYKX -->
> > <!--
CKQGBAHKONVLGBZCHATYIUFIALWWHKEGGSFBIANDYTBUJCGPGIWZKDJLVXTEOLMYMQG -->
> > <html>
> > <head>
> > <title>Untitled Document</title>
> >
> > </head>
> > ...
> >
> >
> > Looking at the Tripwire tests they appear to be case sensitive. Is there
a
> > reason for this? How would I modify the test to be case insensitive?
> >
> > body TW_AJ /[-<!\s]\w{0,10}aj[fqtvxz]\w{0,10}[->\s]/
>
> just add a i to the regex:
>
> body TW_AJ /[-<!\s]\w{0,10}aj[fqtvxz]\w{0,10}[->\s]/i
Matthias, if you do this mimed attachments will get tagged, too. Some
consider this a good idea. Others send software development related
zip files back and forth with their customers. So filtering the base64
coding would be a bad thing, perhaps a very bad thing.
IMAO one should filter spam with spam filters and filter pathogens
with pathogen filters. I've violated this principle twice with a
couple particular piece of nonsense that were over 100k that was
clogging my mailbox when I was on the road with 56k dialups. I
found a working signature line in the files and built a redirector
into procmail to save them in a junk box.
So far I am happy working that way. I lose nothing important. And I
have my spam tossed aside for a quick vetting before I toss it.
{^_^}
