I put a couple of PRs in GitHub to introduce some new features that I've been using in production for a while. I know we're in the middle of a new release so these can wait until after 4.0.3 lands. I just wanted to get them out in the open. A couple other thoughts: I would like to deprecate normalize_charset at some point. It was introduced 20 years ago when UTF-8 support in Perl was relatively new. Keeping it around makes the code more complex to maintain. We have to do one thing if it's on and another thing if it's off. And with it off, it's impossible to write effective rules because you don't know what charset you're targeting. Most rules won't fire on a UTF-16 encoded message unless normalize_charset is on. I can't think of a reason anyone would want it off but perhaps it's out there. Maybe it's something we could discuss for version 5. Plugins such as PDFInfo, ImageInfo, and OLEVBMacro could eventually be phased out now that we have handlers. They all have the limitation that they can't see embedded parts, but they're also inefficient and outdated. For example, ImageInfo only support 3 image formats (gif, png & jpg) and PDFInfo can't read encrypted or compressed PDFs. I'm not sure exactly how or when this could happen. Again just sharing my long-term thoughts. Thanks Kent
