Re: negative correlation in spamprobe?

> I just read this additional suggestion on anti-image spam regexes and
> the post about mime headers and it made me wonder if there could be some
> sufficiently reasonable way to implement checking for patterns where one
> token exists and another doesn't.
> 
> In this example you'd get a token for "Content-Type: multipart/related"
> and *not* one for "type=".  (RFC 2387 has examples of the actual
> syntax.)
> I realize for every email you train on you're not going to want to store
> the absence of every other (non-present token listed in the database.
> And I haven't thought of a practical way to do anything with this yet.

You have to be careful with ad hoc MIME parsers. As I found out through my 
experience with renattach (an email attachment filter), there are many 
legitimate and "legal" variations on what you might expect is a very simple 
invocation of a MIME feature.

For example, the variations of "type=", where it can be placed, line 
continuations, encoded representations of it, or how about MIME embedded 
within another MIME section. Ugly stuff!



-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys - and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV