Dan wrote: > Follow up question: > > Is URI the way to go when tracking obsfucation, as in: > uri __LINKAGE_A284 [EMAIL PROTECTED] > > ...or will URI's translation get in the way, requiring something more > like?: > rawbody __LINKAGE_A284 [EMAIL PROTECTED] > Neither of the above will work.. Both uri and rawbody rules are run after QP (and base 64) decoding is done.
There's some proposals to have a more configurable set of choices but right now "raw" is really "half cooked", and uri is "fully cooked" just like body.
