RulesDeJour is a script for pulling down the non-official SARE rules sets.
The sa-update script is used to pull down official SA rule updates (updating
the default rule sets that come with SA).
Bill
----- Original Message -----
From: "Colbeck, Andrew" <[EMAIL PROTECTED]>
To: <Declude.JunkMail@declude.com>
Sent: Thursday, May 04, 2006 2:00 PM
Subject: RE: [Declude.JunkMail] image spam
For what it's worth, SARE has their own download script (I'm not
familiar with the sa-update script Bill mentioned) called RulesDuJour
which is a bash shell script:
http://www.exit0.us/index.php?pagename=RulesDuJour
And that page contains a howto link for us Windows users who are running
CygWin:
http://www.exit0.us/index.php?pagename=InstallRdjOnCygwin
Andrew 8)
-----Original Message-----
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Nick Hayer
Sent: Thursday, May 04, 2006 1:50 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] image spam
Thanks Bill. I have been using the SARE stock rules but the
others I was unaware of - as well as the update script!
-Nick
Bill Landry wrote:
> You might also want to look at using the SARE rules at
> http://www.rulesemporium.com/rules.htm, particularly the SARE Stock
> rules (70_sare_stocks.cf). Also, a couple of Fred's rule sets at
> http://www.rulesemporium.com/other-rules.htm (88_FVGT_rawbody.cf &
> 99_FVGT_meta.cf) can be quite helpful, as well.
>
> If you are running SA 3.1.1, you can also use the sa-update
script to
> pull down the latest SA rules, which includes additional
rules found
> in the 80_additional.cf rule set that are very good at
tagging these
> kinds of image spams.
>
> And finally, Sniffer seems to successfully tag almost 100% of these
> image spams, and Razor tags a majority of them, as well.
>
> Bill
> ----- Original Message ----- From: "Nick Hayer"
> <[EMAIL PROTECTED]>
> To: <Declude.JunkMail@declude.com>
> Sent: Thursday, May 04, 2006 7:39 AM
> Subject: [Declude.JunkMail] image spam
>
>
>> fyi -
>>
>> I just found these 2 plugins for spamassassin
>> http://wiki.apache.org/spamassassin/OcrPlugin
>> http://antispam.imp.ch/patches/patch-ocrtext
>>
>> That will ocr the gifs, etc. These should help SA be even more
>> effective within Declude..
>>
>> -Nick
>> ---
>> This E-mail came from the Declude.JunkMail mailing list. To
>> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
>> "unsubscribe Declude.JunkMail". The archives can be found at
>> http://www.mail-archive.com.
>>
>
> ---
> This E-mail came from the Declude.JunkMail mailing list. To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
> "unsubscribe Declude.JunkMail". The archives can be found at
> http://www.mail-archive.com.
>
>
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be
found at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
