On Fri, 8 May 2009, Adam Katz wrote:
John Hardin wrote:
rawbody __TWO_WORD_LINES /^\S\+\s\+\S\+$/
tflags __TWO_WORD_LINES multiple
meta STACKED_TEXT (__TWO_WORD_LINES > 10)
Likely somewhat FP-prone...
I think quite FP-prone; think about emailed system logs, lists,
invoices, etc. Your example used lots of real words, so I'd trust Bayes
to find it. It also had a URL, so the URIBLs can detect it too.
Yeah. I certainly wouldn't score such a rule very high, unless in concert
with something like BAYES > 80 or MIME_HTML_ONLY.
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhar...@impsec.org FALaholic #11174 pgpk -a jhar...@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
Liberals love sex ed because it teaches kids to be safe around their
sex organs. Conservatives love gun education because it teaches kids
to be safe around guns. However, both believe that the other's
education goals lead to dangers too terrible to contemplate.
-----------------------------------------------------------------------
Today: the 64th anniversary of VE day
