On Tue, 13 Jun 2017, Dianne Skoll wrote:
Hi,
Something I and possibly others might find useful would be rules that
expire. Quite often, we might make some very specific rules to handle
a particular spam run and they lose their effectiveness pretty quickly.
What if we did something like:
expire MYRULE_FOO 2017-09-01
or maybe
tflags MYRULE_FOO expire=2017-09-01
Then the file parser would ignore expired rules, and if expired rules
have already been parsed into memory from before they expired, the run-time
would skip them.
Thoughts?
Dependencies. Rules that depend on expired rules would suddenly become
invalid. That could be caught at lint time and avoid impacting a running
system, but if the expiry is being checked and enforced dynamically at
runtime as well that's a bit of a problem - either the rule goes invalid,
or the dependency becomes an always-false (or always-true if the
dependency is !negated).
Perhaps, for simplicity: expiry cannot be set on a rule that has other
rules depending on it / you cannot use a rule having expiry in a META?
Force that to be a lint-time check and avoid runtime complications.
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhar...@impsec.org FALaholic #11174 pgpk -a jhar...@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
The promise of nuclear power: electricity too cheap to meter
The reality of nuclear power: FUD too cheap to meter
-----------------------------------------------------------------------
5 days until SWMBO's Birthday
