On Sun, Apr 22, 2001 at 04:00:15AM +0100,
Andromeda <andromeda@???> is thought to have said:
> At 22:12 21/04/2001 -0400, you wrote:
> >Ok. I've figured out the answer but I'm not sure I that I understand
> >fully.
>
> The string expansion filter page explained it quite well:
>
> Standard RegEx: \s{25,}
> Exim filter: \\s{25,}
> quoted Exim filter: \\\\s{25,}
No, my point is that I'm curious why "\]_by" matches "]_by" in one of my
other checks. Why does it not have to be "\\\\]_by"? That's what tripped
me up.
> You may want to adjust your filter to:
>
> $header_subject matches "\\\\s{25,}\\\\[?\\\\w{3,}\\\\]?\\$"
>
> It will match the [ ] and a standard alphanumeric code. This thing's
> removed 27 spam messages in just over a week.
Indeed. That's more generic than the two seperate rules I had. Thanks!
Although I'd suggest that you'll do a lot better with \\\\s{10,}. I've
had 10-15 today alone with less than 25 whitespace chars (10 is about
the lower limit I've seen in any of my spamtraps). Also I wouldn't
anchor it to the end. I've occasionally seen some of the form:
Subject: Something 1234 23
Tabor
--
--------------------------------------------------------------------
Tabor J. Wells twells@???
Fsck It! Just another victim of the ambient morality
