On Wed, 2 Sep 2015, Axb wrote:
On 09/02/15 16:12, John Hardin wrote:
On Wed, 2 Sep 2015, Olivier Nicole wrote:
> Malware Patrol (malwarepatrol.net) has a file with over 100,000 rules of
> the form:
>
> body MBL_2931645 /files\.oqayiq\.biz\/javasoft\/different\//i
>
> This causes spamassassin --lint to never terminate (well, I killed it
> afetr one hour).
I would think uri rules would be a lot better than body rules, no?
100k URI rules?
Remember the days before the SpamCopURI plugin showed up?
Bill Stearns & Chris Santerre published such a file and it was a HUGE hog -
the SpamCopURI showed up and SURBL was born...
Years later SpamCopURI became URIDNSBL.pm
Do we really want to go back to 2001?
I was suggesting URI rules would perform better than BODY rules, not that
100k+ rules is a good idea.
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhar...@impsec.org FALaholic #11174 pgpk -a jhar...@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
15 days until the 228th anniversary of the signing of the U.S. Constitution
