Kenneth Porter wrote:
> On Monday, May 22, 2006 7:24 PM +0200 Michael Monnerie
> <[EMAIL PROTECTED]> wrote:
>
> > Or the full line could be:
> > uri ZMIgeocitiesGOOD m{(?:www|uk)\.geocities\.com}
> > describe ZMIgeocitiesGOOD probably good geocities site
> > score ZMIgeocitiesGOOD -1.2
> >
> > or whatever score you want to give them.
>
> Does a uri rule count once per instance or for all matching uris? If,
> for instance, I have that rule and one matching *all* subdomains with
> a +1.2, does a spammer just have to insert a "good" uri to nullify
> the score for the bad one?
The URI rule just says "does this exist in the message?" So it will
only hit once per message. And yes, spammers could take advantage of
this rule. This is why there are not many negative scoring rules in
SA.
> Alternatively, is there regex syntax to match all patterns *except*
> the one given? Can I somehow express "all geocities.com subdomains
> except www and uk" as a regex?
That is a bit trickier because Perl does not currently support
variable length look-behinds. But you can get around that by using
two separate look-behinds like this:
/(?<!\bwww)(?<!\buk)\.geocities\.com/
Note that you have to anchor both options separately.
--
Bowie
