Mailing List Archive

On Mon, 2004-03-08 at 21:37, Al Danks wrote:
> Does anyone have a rule along this line:
>
> Many superlatives-est: best, greatest, quickest, biggest, largest, etc.
>
> Many superlatives-er:super, bigger, larger, quicker, thinner, etc.
>
> Many superlatives exceptional, quick, completely, totally, absolutely
>
> I'm thinking of something along the lines of:
>
> body MANY_SUPERLATIVES_EST \b[best|greatest|quickest]\b/i{5}
>
> another for 6, 7, 8, 9, at least 10.
[...]

DISCLAIMER: This is only my second attempt at writing rules so you
should definitely test this first!

body __superlatives_est /\bbest|greatest|quickest|biggest|largest\b/
body __superlatives_er /\bsuper|bigger|larger|quicker|thinner\b/
body __superlatives /\bexceptional|quick|completely|totally|absolutely\b/
meta MANY_SUPERLATIVES_EST (( __superlatives_est + __superlatives_er + __superlatives) > 1)
score MANY_SUPERLATIVES_EST 0.1

This should trigger if 2 or more words from the different superlatives
are found in the message...

Again, I haven't tested this so make sure you run "spamassassin --lint"
after adding this to your user_prefs or a .cf file in
/etc/mail/spamassassin/ !

Please let me know how this worked out!

Bram
--
# Mertens Bram "M8ram" <bram-mertens@linux.be> Linux User #249103 #
# SuSE Linux 8.2 (i586) kernel 2.4.20-4GB i686 256MB RAM #
# 9:57pm up 5:04, 2 users, load average: 0.03, 0.06, 0.02 #

Once again, a suggestion for a rule based on the number of
matches/occurences. I still say this should be a generic mechanism
in SA, allowing flexible scoring, including zero for low counts.

On Mon, 8 Mar 2004, Al Danks wrote:
> Does anyone have a rule along this line:
>
> Many superlatives-est: best, greatest, quickest, biggest, largest, etc.
>
> Many superlatives-er:super, bigger, larger, quicker, thinner, etc.
>
> Many superlatives exceptional, quick, completely, totally, absolutely
>
> I'm thinking of something along the lines of:
>
> body MANY_SUPERLATIVES_EST \b[best|greatest|quickest]\b/i{5}
>
> another for 6, 7, 8, 9, at least 10.
>
> Since I'm totally new to rule writing I hope I'm in the ballpark enough to
> communicate what I'm trying to do, but I don't expect what I have will work.
>
> Al
>

On Mon, 2004-03-08 at 15:08, Charles Gregory wrote:
> Once again, a suggestion for a rule based on the number of
> matches/occurences. I still say this should be a generic mechanism

Added to bugzilla earlier today.

--
John Hardin KA7OHZ
Internal Systems Administrator/Guru voice: (425) 672-1304
Apropos Retail Management Systems, Inc. fax: (425) 672-0192
-----------------------------------------------------------------------
If you smash a computer to bits with a mallet, that appears to count
as encryption in the state of Nevada.
- CRYPTO-GRAM 12/2001
-----------------------------------------------------------------------

John Hardin <johnh <at> aproposretail.com> writes:

> > Once again, a suggestion for a rule based on the number of
> > matches/occurences. I still say this should be a generic mechanism
>
> Added to bugzilla earlier today.

So you're saying I can't get there from here - quite yet?

Al

On Mon, 2004-03-08 at 15:48, Al Danks wrote:
> John Hardin <johnh <at> aproposretail.com> writes:
>
> > > Once again, a suggestion for a rule based on the number of
> > > matches/occurences. I still say this should be a generic mechanism
> >
> > Added to bugzilla earlier today.
>
> So you're saying I can't get there from here - quite yet?

Maybe never, if nobody decides to implement the feature.

--
John Hardin KA7OHZ
Internal Systems Administrator/Guru voice: (425) 672-1304
Apropos Retail Management Systems, Inc. fax: (425) 672-0192
-----------------------------------------------------------------------
If you smash a computer to bits with a mallet, that appears to count
as encryption in the state of Nevada.
- CRYPTO-GRAM 12/2001
-----------------------------------------------------------------------

> -----Original Message-----
> From: news [mailto:news@sea.gmane.org]On Behalf Of Al Danks
> Sent: Monday, March 08, 2004 6:49 PM
> To: spamassassin-users@incubator.apache.org
> Subject: Re: [spa] Suggested rule - beyond my ability to make
>
>
> John Hardin <johnh <at> aproposretail.com> writes:
>
> > > Once again, a suggestion for a rule based on the number of
> > > matches/occurences. I still say this should be a
> generic mechanism
> >
> > Added to bugzilla earlier today.
>
> So you're saying I can't get there from here - quite yet?
>
> Al
>
Wouldn't this do what you want? (of course I didn't use as many
superlatives so it would fit the message width better without
wrapping)

body __RC_B_05 /(?:(?=totally|absolutely|best)\b(\w+)\b.*?){5}/i
body __RC_B_06 /(?:(?=totally|absolutely|best)\b(\w+)\b.*?){6}/i
body __RC_B_07 /(?:(?=totally|absolutely|best)\b(\w+)\b.*?){7}/i
body __RC_B_08 /(?:(?=totally|absolutely|best)\b(\w+)\b.*?){8}/i

meta RC_B_05 (__RC_B_05 && !__RC_B_06 && !__RC_B_07 &&
!__RC_B_08)
meta RC_B_06 (__RC_B_06 && !__RC_B_07 && !__RC_B_08)
meta RC_B_07 (__RC_B_07 && !__RC_B_08)
meta RC_B_08 (__RC_B_08)

describe RC_B_05 BODY: Five Superlatives
describe RC_B_06 BODY: Six Superlatives
describe RC_B_07 BODY: Seven Superlatives
describe RC_B_08 BODY: Eight Superlatives

score RC_B_05 1.0
score RC_B_06 1.5
score RC_B_07 1.75
score RC_B_08 2.0

I missed the original post, so maybe I am missing something, of
course the scores are purely arbitrary, and you would need to
carry the pattern to 10. Doing it this way would allow you to
score on 8 without also scoring on 5, 6 and 7, etc.

On Tue, 2004-03-09 at 04:15, Rick Cooper wrote:

Is that the Rick Cooper I know from college?

> Wouldn't this do what you want?

> body __RC_B_05 /(?:(?=totally|absolutely|best)\b(\w+)\b.*?){5}/i
> body __RC_B_06 /(?:(?=totally|absolutely|best)\b(\w+)\b.*?){6}/i
> body __RC_B_07 /(?:(?=totally|absolutely|best)\b(\w+)\b.*?){7}/i
> body __RC_B_08 /(?:(?=totally|absolutely|best)\b(\w+)\b.*?){8}/i
>
> meta RC_B_05 (__RC_B_05 && !__RC_B_06 && !__RC_B_07 &&
> !__RC_B_08)
> meta RC_B_06 (__RC_B_06 && !__RC_B_07 && !__RC_B_08)
> meta RC_B_07 (__RC_B_07 && !__RC_B_08)
> meta RC_B_08 (__RC_B_08)
>
> describe RC_B_05 BODY: Five Superlatives
> describe RC_B_06 BODY: Six Superlatives
> describe RC_B_07 BODY: Seven Superlatives
> describe RC_B_08 BODY: Eight Superlatives
>
> score RC_B_05 1.0
> score RC_B_06 1.5
> score RC_B_07 1.75
> score RC_B_08 2.0

Maybe, but I think this is a lot less opaque and easier for non-RE types
to understand and use:

body SUPERLATIVE /(totally|absolutely|best)/
describe SUPERLATIVE superlatives
score SUPERLATIVE .25
additive SUPERLATIVE

Granted, straight addition isn't terribly flexible. I really like
procmail's weighted scoring technique (see "man procmailsc"), where
subsequent matches can increase the score faster or slower. Maybe:

additive NAME [weight]

like:

score SUPERLATIVE .1
additive SUPERLATIVE 2

Which would give a sequence of scores something like:

matches score
1 .1
2 .3
3 .7
4 1.5
5 3.1

(The formula is more complex than the above example, but you get the
idea.)

--
John Hardin KA7OHZ
Internal Systems Administrator/Guru voice: (425) 672-1304
Apropos Retail Management Systems, Inc. fax: (425) 672-0192
-----------------------------------------------------------------------
If you smash a computer to bits with a mallet, that appears to count
as encryption in the state of Nevada.
- CRYPTO-GRAM 12/2001
-----------------------------------------------------------------------

Fred did this in a custom Eval, except it wouldn't return a custom score.
You would call the rule like :

body rulename eval dookie(blah,5) (Syntax might be a little off, I'm
tired)

and it wouldn't hit unless "blah" hit 5 times. Or something like that. But
then it turned into a huge list of rules. One for 5 w/ a score, 8 w/ bigger,
10+ even bigger.

I think we abandond it until we could write one rule that would return a
custom score based on count. However JM informed us that this had been a
Perl problem I think. It was a while ago, and its tough to keep track of all
the daily things we cover. I'm lucky I even remembered to wear socks today.
*Checks to make sure* Yup, socks today.

--Chris

> -----Original Message-----
> From: Charles Gregory [mailto:cgregory@hwcn.org]
> Sent: Monday, March 08, 2004 6:09 PM
> To: spamassassin-users@incubator.apache.org
> Subject: Re: [spa] Suggested rule - beyond my ability to make
>
>
>
> Once again, a suggestion for a rule based on the number of
> matches/occurences. I still say this should be a generic mechanism
> in SA, allowing flexible scoring, including zero for low counts.
>
> On Mon, 8 Mar 2004, Al Danks wrote:
> > Does anyone have a rule along this line:
> >
> > Many superlatives-est: best, greatest, quickest, biggest,
> largest, etc.
> >
> > Many superlatives-er:super, bigger, larger, quicker, thinner, etc.
> >
> > Many superlatives exceptional, quick, completely, totally,
> absolutely
> >
> > I'm thinking of something along the lines of:
> >
> > body MANY_SUPERLATIVES_EST \b[best|greatest|quickest]\b/i{5}
> >
> > another for 6, 7, 8, 9, at least 10.
> >
> > Since I'm totally new to rule writing I hope I'm in the
> ballpark enough to
> > communicate what I'm trying to do, but I don't expect what
> I have will work.
> >
> > Al
> >
>

Chris Santerre wrote:
> Fred did this in a custom Eval, except it wouldn't return a custom
> score. You would call the rule like :

I can't take credit for this one, it was Carl ;)

> -----Original Message-----
> From: Fred [mailto:spamassassin@freddyt.com]
> Sent: Tuesday, March 09, 2004 7:08 PM
> To: Chris Santerre; 'Charles Gregory';
> spamassassin-users@incubator.apache.org
> Subject: Re: [spa] Suggested rule - beyond my ability to make
>
>
> Chris Santerre wrote:
> > Fred did this in a custom Eval, except it wouldn't return a custom
> > score. You would call the rule like :
>
> I can't take credit for this one, it was Carl ;)

Oops sorry Carl :) I've been a little under the weather. It's effecting my
concentration. I can't seem t.........


--Chris