On Thu, 24 Sep 2026, Kris Deugau wrote:
John Hardin wrote:
Any such that I have received in spams are recorded in
URI_GOOG_STO_SPAMMY, which gets a high score.
Side question about building rules - how do you create and manage something
like the subrule __URI_GOOG_STO_SPAMMY?
I've created similar rules by hand but they've gotten unmaintainable long
before they've gotten that long. (And several started to trigger false
positives due to a few too many optional fragments reducing a minimal match
to something utterly trivial and innocuous.)
It really depends on the target.
Google Storage is pretty easy as the alternating bit is the account ID in
the URL, so it's a static pattern and is not likely to reduce into
minimal-match FPs like generic text matches may, and fairly safe as an
account being used to host spammy content likely is not going to be also
hosting legitimate content.
Basically:
1. extract the google storage URL account IDs from my spam corpus (scripted)
2. dedupe against history to get a list of unique account IDs
3. build an alternation list via Regexp::Trie
4. drop that into a rule
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
[email protected] pgpk -a [email protected]
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
We should endeavour to teach our children to be gun-proof
rather than trying to design our guns to be child-proof
-----------------------------------------------------------------------
3 days until the 85th anniversary of the massacre at Babi Yar
Disarmament enables genocide - Registration enables disarmament
