I'm WAY behind in list readings today. So forgive me if this has been said.
But since J.M. has told us that eval rules are boolean, is this idea dead in
the water, or did I miss a post?
Was there talk of maybe testing accum rules for future SA versions? Is that
what this thread is now?
Just
Hello David,
Looks good...
Friday, November 7, 2003, 10:03:38 PM, you wrote:
Or better: what if we specified in the rule a maximum score to accumulate
to? ...
DBF ... for each rule add two new variables: 'maxhits', default to the
DBF value 1 'nhits' init to 0. ...
DBF The score part,
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
Hello David,
I like your idea -- improves efficiency by providing a stop point,
while maintaining the ability to reasonably accumulate hits. Thanks.
Bob Menschel
-BEGIN PGP SIGNATURE-
Version: PGP 8.0
It seems to me that many accumulator rules (including many that
have been proposed on the list) would require a way of
specifying a minimum number of occurrences below which there
would be no score at all. I don't think a single long string
of consonants, for example, is worth any points, but
On Fri, 7 Nov 2003, Robert Menschel wrote:
So you'd be suggesting something like:
body T_SAMPLE /(?:word1|word2|word3|word4|word5)/i
describe T_SAMPLE Message has medical words frequently used in spam
score T_SAMPLE 0.5
accum T_SAMPLEA ( T_SAMPLE 5 )
score T_SAMPLEA
DBF On Fri, 7 Nov 2003, Robert Menschel wrote:
Or better: what if we specified in the rule a maximum score to accumulate
to? Maybe something like:
accumbody T_SAMPLE /(?:word1|word2|word3|word4|word5)/i,max=2.5
describe T_SAMPLE Message has medical words frequently used in spam
