On 04/05/2014 06:42 PM, John Hardin wrote:
I'd rather not have to resort to hitting the masscheck system over the head with the "tflags publish" cluebat, but I will if it keeps ignoring these rules.
this would by very unwise and would create rule bloat as obviosuly the corpus isn't seeing much spams with whatever pattern you'd wan to publish.
If the corpus is pathetically small then the results reflect this or the rulex X only applies to very specific traffic which is not representative.
The idea of the GA is to conservatively publish rules which are useful on a global basis. Bypassing this mechanism seems to defeat GA and we might as well stop using it.
If Darxus sees so much of this type, why isn't he running a masschecker?
