jhardin at impsec
Feb 2, 2012, 8:44 AM
Post #2 of 3
(189 views)
Permalink
|
On Thu, 2 Feb 2012, Tom Kinghorn wrote:
> Good afternoon List.
>
> Could anyone elaborate on the following rule.
> I have tried searching for an explanation, without success.
>
> TVD_SPACE_RATIO_MINFP
The base __TVD_SPACE_RATIO calls an eval:
eval:tvd_vertical_words('0','10')
It looks like it's checking for a text-to-space ratio that would indicate
vertical-words obfuscation to avoid text matching.
The _MINFP variant was my adding some FP avoidance rules (different ones
than in the TVD_SPACE_RATIO rule) to try to improve the performance of the
base rule.
http://ruleqa.spamassassin.org/?rule=%2FTVD_SPACE_RATIO
The _MINFP version is apparently performing better, and should probably
replace the base TVD_SPACE_RATIO rule.
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin [at] impsec FALaholic #11174 pgpk -a jhardin [at] impsec
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
Warning Labels we'd like to see #1: "If you are a stupid idiot while
using this product you may hurt yourself. And it won't be our fault."
-----------------------------------------------------------------------
10 days until Abraham Lincoln's and Charles Darwin's 203rd Birthdays
|
