Re: spamprobe-1.3x2 released

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

David A. Lee wrote:
> Now THIS is a feature !
> This last month or 2 I've been blasted with these stock-tip spams ... 
> that spamprobe just cant figure out.
> Entirely empty email except an embedded GIF, different From and IP's 
> every time.  Sometimes 4+ a day !

Last night I saw the first spam that was caught by this feature but 
would otherwise have made it through.  Nice. :-)


> I just installed this new version ... is there anything I need to do to 
> enable the GIF stuff ? configure found the library fine and it built 
> fine, but I see nothing in the README.txt file about any comannd options 
> or whatever to enable it ... so I'm assumeing "it just works".

It's supposed to just work.  I really should have explained it better in 
my announcement though.  The image related terms have a common prefix of 
Igif_ so you can see them in your database using this command:

   spamprobe dump Igif_

If you use -T with score or whatever you should see Igif_ terms in the 
top terms lists of some messages.

You will see different types of image terms.  Igif_prefix_ terms contain 
the MD5 digest of individual images and can be helpful when a single 
identical image appears often in spam.  I might change the way these are 
added to the database to force them to be immediately relevent (i.e. not 
have the 0.3 prob until they are seen 5 times).

Igif_image_ terms contain information about image dimensions, colors, 
color depth, extension codes, and comments.

Currently entire comments appear as a single, long term.  I need to 
change that and break up long comments like I do other text.

One caveat - linking in libungif opens SP to whatever vulnerabilities 
that library has.  If you are using this version then you should upgrade 
to libungif 4.1.4 (or a patched 4.1.3) because there was a crash bug in 
4.1.3 and earlier.

All the best,
++Brian

-----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 9.0.3 (Build 2932)

iQEVAwUBQ5MTYzxRyEoJfXIFAQgK6Af+OfEcysAMMvVWYW4JJYw04Aib+qjsM5qh
YLBKfjFC4VlmdEic/2haaBTLsobeN9bP59VEn+ditJeQlzSfagTcvIQ05qL6DUy5
i8xEKANq5rFTYzrBgCTtRVjKBX+e/K8hgx/QUI5rZVWCWt8ByDcC7iYR4jFxcevE
i47fBtfT5ypyeLC5XoSg3LDEe8QyspRElmaLTmyj0BIrwB8vS1//YtroV9ZE5ncm
qrxzoS/ExLi+mUcHL9FYC+AMvagKx5mhV3nh9rT1SyCBuKG/zIo+yfD8N/CzFfdF
JaHcfWhsDI12yNmpfT3cQEpfkzZUzsb0j18ZsHdfEo317aCB8MED7g==
=bezb
-----END PGP SIGNATURE-----


-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click