Subject: Re: [SAdev]  New: Rule improvement

Here's some of my offer rules. The offer rules are some of my best rules.

body OFFER            
/\b(?:free|trial|full|phone|points?|hottest|internet|great|of this|about 
this|dealer|responded|not an|pay|are able 
to|future|valuable|partner|receiv(?:e|ed|ing)|introductory|exclusive|promotional|coupon|bonus|further|following|product|proud 
to|additional|website|amazing|discounts?) 
.{0,9}(?:this|these|)\boffer(?:s|ings?|ed|)\b/i
describe OFFER            Offers you Something

body OFFER_2            /\boffer(?:s|ings?|) 
.{0,9}\b(?:expires|subject|limited|ends|mailed|originator|contained|discounts?|confidential|is 
good|available|valid|in error|!)\b/i
describe OFFER_2        Offers you Something (2)

body OFFER_3            /this offer is|we offer (?:you|over)|offers?@/i
describe OFFER_3        Offers you Something (3)

body SPECIAL_OFFER        /\bspecial .{0,15}\boffer(?:s|ings?|ed|)/i
describe SPECIAL_OFFER        Special Offer

Subject: Re: [SAdev]  Rule improvement

On Thu, 2003-05-01 at 20:22, bugzilla-daemon@hughes-family.org wrote:

> Here's some of my offer rules. The offer rules are some of my best rules.

Your first and second rule are classic word-count (and run a fair risk
of FPing), I would think those are covered nicely by Bayes. If spam
containing those doesn't trip Bayes, then please attach a sample.
Otherwise, I think you would have gotten the same effect as those two
rules by bumping the Bayes score up for BAYES_60+, but here's the cool
part: doing that catches a lot of new variations and other sorts of
word-counts that you might not have thought of!

> body OFFER_3            /this offer is|we offer (?:you|over)|offers?@/i
> describe OFFER_3        Offers you Something (3)

You want to make that:

	/\b(?:this offer is|we offer (?:you|over)|offers?@)\b/i

But that's a nice phrase-match. Perhaps offers?@ should be added to one
of the existing spam-address matches instead, though.

> body SPECIAL_OFFER        /\bspecial .{0,15}\boffer(?:s|ings?|ed|)/i
> describe SPECIAL_OFFER        Special Offer

Here you really NEED that trailing \b, otherwise your rule and:

	/\bspecial .{0,15}\boffer/i

Are EXACTLY the same (and simpler is very important for body tests).

I would also add an "s" modifier.

Subject: Re: [SAdev]  Rule improvement

I'm very good at spotting good rules - but I'm not the best at regular 
expressions. So - I have no problem with others taking my rules and 
making them better.

Subject: Re: [SAdev]  Rule improvement

Since I posted some of my OFFER rules and got some interest, here's more.

header ADDR_OFFER        ALL =~ /(?:to|from|reply-to):.*<.*offer.*\n/i
describe ADDR_OFFER        From address contains OFFER

uri OFFER_URI            
/^https?:\/\/.*?(?:offer[sz]?\.\w|[.\/]offer|offer=)/i
describe OFFER_URI        Offer in link address

I like these rules and think that they are worth developing.  I think the 
points about BAYES that Aaron makes are true but not every system/user will use 
BAYES.  It is very important for SpamAssassin to be as self sufficient as 
possible.

If the Devs aren't interested in incorporating them into the standard rulesets, 
I'm sure that we will be more than happy to take them over at the RulesEmporium 
and either incorporate them into existing rulesets or create a new ruleset.  We 
could probably get them into circulation in 3-4 days, considering the time to 
run a few mass checks on them.

more accuracy and performance bugs going to 3.1.0 milestone

rules rules rules

hmm, most of these seem to be already in there.