Comments on: Blocklist

By: brian

brian — Tue, 30 Nov 1999 00:00:00 +0000

thanks michael! i was wondering how those have been slipping through.

By: Robb Beal

Robb Beal — Tue, 30 Nov 1999 00:00:00 +0000

Why isn't there a rule mime-type or url scheme?

By: Michael

Michael — Tue, 30 Nov 1999 00:00:00 +0000

Great idea; thanks, Robb!

By: Nat Irons

Nat Irons — Tue, 30 Nov 1999 00:00:00 +0000

I ran that first rule against the last thousand or so legit messages I'd received and came up with what would have been 76 false positives, including book release announcements, bug report replies, and complaints about the lack of coherence of the current season of 24.

Matching the expression from the beginning of the email subject reduced the number of false positives to three, and even caught a couple of spams that had snuck in from somewhere.

^(Re: )?[A-Z]{2,8}, [ a-z]*

But even that version matched 44 legit messages in my mailbox for the last year-to-date or so. I don't think that's safe enough.

The first time I saw "%RND_UC_CHAR" in a spam subject I laughed out loud, but I must have seen dozens of them since. (No knock on SpamSieve, since I see a lot of my mail at the shell before SpamSieve gets ahold of it.)

This bizarre glitch feels like confirmation of the worst fears about spam's business model. Anyone who can screw up so comprehensively and apparently not notice for weeks isn't going broke.

By: Michael

Michael — Tue, 30 Nov 1999 00:00:00 +0000

Thanks, Nat. The ^ should definitely be there. I've made a few other improvements to the pattern:

(?:(?-i)^(Re: )?[A-Z]{2,8}, [ a-z]*$)

and updated the entry and screenshot. I just used Mailsmith to test it on my last 10,000 good messages and got no false positives.

By: Michael

Michael — Tue, 30 Nov 1999 00:00:00 +0000

I've seen some more characters after the comma, so perhaps:

(?:(?-i)^(Re: )?[A-Z]{2,8}, [ a-z0-9'?]*$)

By: Nat Irons

Nat Irons — Tue, 30 Nov 1999 00:00:00 +0000

That's much improved. I see only three false positives against my whole personal mail archive with the first revised pattern, and four with the second. They're all some variation of, "OK, declaratory statement" or, "ACRONYM, pithy comment", and look enough like the spam pattern to verge on mechanical indistinguishability.