| Main Archive Page > Month Archives > spamassassin-users archives |
Re: rule to catch subject spamming
From: Karsten Bräckelmann <guenther_at_nospam>Date: Sun Oct 24 2010 - 20:08:14 GMT
To: users@spamassassin.apache.org
On Sun, 2010-10-24 at 16:05 -0230, Lawrence @ Rogers wrote:
> I have settled on the following as it's more specific and less prone to
> FPs (I can't think of any possibilities right now)
> header __LOCAL_SUBJECT_SPAMMY Subject =~ /^[0-9a-zA-Z,.+]{42,}$/
> meta LOCAL_SUBJECT_SPAMMY1 ((__LOCAL_SUBJECT_SPAMMY + HTML_MESSAGE +
> MIME_QP_LONG_LINE + MPART_ALT_DIFF + TRACKER_ID) > 2)
I don't think that meta logic is actually what you intended. At least
three of these rules must be true. Any three. It does *not* guarantee
your subject rule to match, it does not further constrain or safe-guard
it.
> describe LOCAL_SUBJECT_SPAMMY1 Subject looks spammy (contains a lot of
> characters, and no spaces)
> score LOCAL_SUBJECT_SPAMMY1 5.0
> tflags LOCAL_SUBJECT_SPAMMY1 noautolearn
-- char *t="\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4"; main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1: (c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}