Thank you all for your inputs, as you can see I am creating my own rules as
SA needs help on stopping spam.
I want to thank you KAM for the share of his rules, I have learned a lot
looking on them and thanks to that I have modified the rules that I had to
make them more easy to work, the arithmetic on the rules with the operand
"+" is working really nice I have joined a lot of rules and make them
active with ">=1" so if any of the rules on the group applies then the rule
is triggered.
With the porn rule that I have, it is working but it still left spam of
this type pass, the score line that I wrote on the email had a typo that is
not in my working rule and my major concern is in the garbled words like:
S:C H #O+O L "G l, R%L P *0 *R N*
T\E /EN"S} P)0_R \N
S:C H #O+O L "G l, R%L P *0 *R N*
G ,RA _N N}Y } P %0 ~R |N \
P,0_ R .N PI ~C}T+U-R(E%S.
TR %A *N #S S. E. X{UA`L P&0/R N_
What it will be the best way to catch any type of garbled word?
Sergio
On Sun, Nov 27, 2011 at 7:53 AM, Kevin A. McGrail <kmcgr...@pccc.com> wrote:
> On 11/27/2011 8:26 AM, Martin Gregorie wrote:
>
>>
>> Change the meta to this:
>>
>> meta PORN_RULES (__PORN_RULE01 || __PORN_RULE02)
>>
>> A quick glance at the SA rules for name prefixes would have told you
>> that rules with names that start with a double underscore have a zero
>> score, so your meta will never work: these rules are designed to be
>> combined by using logical operators.
>>
>>
>> Martin,
>
> That's not true from my knowledge or experience. The meta mathematical
> operators are binary. ("The value of the sub rule in an arithmetic meta
> rule is the true/false (1/0) value for whether or not the rule hit. " from
> http://wiki.apache.org/**spamassassin/WritingRules<http://wiki.apache.org/spamassassin/WritingRules>
> )
>
> i.e.
> True = 1
> False = 0
>
> However, your test would have worked as it simplifies the math with an OR
> condition.
>
> Thought, his meta of __PORN_RULE01 + __PORN_RULE02 >=1 will work.
>
> Though I wish sometimes you could do what you've described. I've done
> some crazy work to try and give meta rules extra weighting. But I think
> doing so would give the mass check algorithm more permutations than it
> could ever handle.
>
> For example, here's how I weighted two options to have the weight of just
> one in detecting a refinance spam:
>
> meta KAM_REFI (__KAM_REFI1 + __KAM_REFI2 + __KAM_REFI3 +
> __KAM_REFI4 + (__KAM_REFI5 + __KAM_REFI6 >= 1) + __KAM_REFI7 + __KAM_REFI8
> >= 4)
>
> Regards,
> KAM
>
