[Mimedefang] Considering an additional spam filter

[Jim McCullars]

On Sat, 24 May 2003, Michael Sims wrote:

> Yeah, I'm seeing this too.  I first noticed it when I saw the word "Oprah" in

   They are increasing.  I have gotten six so far today.

   And now someone has a new take on doing hidden html.  I saw another
spam today that had valid HTML tags (<INPUT type=hidden name=fdas>)
breaking up the "catch" words.  Don't know if SA should have caught that
or not.  I'll have to experiment when I get back to the office.

> I think it's a good idea to try and strip these tags out, but this is one of
> those things that's extremely complicated.  Tags can be split across multiple
> lines and can be nested inside HTML comments, and you can also have tags like
> this:

   Yeah I realize my solution isn't perfect (I read the caveat in the Perl
Cookbook also).  I'm just curious as to whether anyone sees anything
obvious that might break something legit.

> Personally this is a bit too involved for me...I'm hoping that the next version
> of SpamAssassin will be better at catching this sort of thing...

   Ditto.  But from reading the SATALK archives, I get the impression this
is something they are struggling with also.

Jim