procmail
[Top] [All Lists]

Re: cyberpromo got thru

1997-05-17 05:55:00
At 05:11 PM 5/15/97 -0500, David W. Tamkin wrote:
Bob Weissman wrote,

| Don't forget that procmail processes your .procmailrc sequentially.
| Just put your spam filter first.  I have a rather heavy-handed recipe
| which works well:
| 
|     # Anything with cyberpromo.com anywhere in the header other than
|     # the subject is spam.
|     :0
|     *        \<cyberpromo\.com\>
|     *        ! ^Subject: .*\<cyberpromo\.com\>
|     {
|          EXITCODE=77
|          :0:
|          spam
|     }

Unfortunately, Bob's recipe will pass any mail with "cyberpromo.com" in the
subject, even if it comes from cyberpromo.com.  Try this (and we'll count
lines, not strings, just in case "cyberpromo.com" occurs twice in the
subject: for example, a legitimate letter from a friend has a subject of "I'm
sick of cyberpromo.com!  Damn cyberpromo.com to hell!").

   :0
   * 1^1 ^.*\<cyberpromo\.com\>
   * -1^1 ^Subject:(.*\<)?cyberpromo.com\>
   {
    EXITCODE=77
    :0:
    spam
   }

While less "perfect", I can never remember the scoring rules, and I'd likely
use something like the following, since next month I'll still be able to
figure out what it does and how; plus it's probably faster (if anyone cares):

    :0
    * ^[^S].*\<cyberpromo\.com\>
    {
        EXITCODE=77
        :0:
        spam
    }

(This catches "cyberpromo.com" in any header not starting with "S", and
it happens that none of the ones we need to catch it in start with "S", so
it probably works the same on "real-life" mail headers.  The condition can
be modified to check for headers not starting with "Su" by changing it to:
    * ^([^S]|S[^u]).*\<cyberpromo\.com\>
if needed; further extensions should be obvious.)

Cheers,
Stan

<Prev in Thread] Current Thread [Next in Thread>