Thanks Matt, I was curious, your explanation is enough :) Ruben.
> -----Mensaje original----- > De: Matt Kettler [mailto:[EMAIL PROTECTED] > Enviado el: domingo, 26 de febrero de 2006 17:01 > Para: Ruben Cardenal > CC: Spamassassin > Asunto: Re: I catch all this spam, but just for curiosity... > > Ruben Cardenal wrote: > > > > How could a rule score catch those 3 things at a time? I know how to > do it > > for the headers part (someone in this lists told me how), but I don't > know > > how to relate that line of the body with the "To" part of the headers. I > > mean, the "john" word in that line of the body matches the "john" word > in > > the "To". I hope I've explained myself enough :) Thanks for any > suggestions > > about this. > > Correlating headers to body text can be done, but it's not practical... > > 1) you can use a "full" rule with the /s option and backtracking (i.e. > \1). This is *horribly* slow, and memory hungry. For a non-matching > message SA is going to have to check every byte of the complete message, > including all attachments. Backreferences are expensive, that's why we > normally use (:? instead of ( for most things. Full rules are expensive. > Put the two together and you have a very expensive rule. > > 2) you can write a perl plugin for spamassassin that does this. > Unfortunately, this is a fair amount of work. > > Given 1 and 2, this generally isn't very practical. It's certainly not > practical enough to be worth the effort when there are better ways. > > Realistically, I'd be more apt to try to match the presence of a short > "Subject" header in the body text and meta that with the numeric real > subject header.
