[lnkForumImage]
TotalShareware - Download Free Software

Confronta i prezzi di migliaia di prodotti.
Asp Forum
 Home | Login | Register | Search 


 

Forums >

comp.lang.ruby

Re: POP3Filter for SoBig.F Virus:

Austin Ziegler

9/20/2003 2:53:00 PM

On Sat, 20 Sep 2003 22:15:40 +0900, Gavin Sinclair wrote:
> On Saturday, September 20, 2003, 9:03:18 PM, Shashank wrote:
>> Thank you very Austin and Gavin.
>>
>> I have been inundated with spam in the last few hours and this nice
>> little utility has helped me a lot.
>>
>> I have a question though: the size of email defaults to 120_000. Is
>> there some significance to this number or is it just an arbitrary
>> number you picked. I have been getting some spam with attachments which
>> are 106K or in that range. Of course, I have changed my version to
>> catch them too but was curious to find out.
> All of my virus-spam messages have been around 140Kb. One exception was
> about 15Kb.

The Perl version I translated from -- and I just modified the WikiPage to
include the historic influences -- had 150_000 as the size default. I
figured it was a bit high, so I dropped it to 120_000. In one of my later
changes to the tool, though, I moved it from a constant to the fourth
parameter (defaulted) in the constructor.

>> Also, would it possible for you to add something like the "kill file"
>> support so that I can keep adding new patterns to it instead of
>> modifying the source code.
> No need really, and I don't have the time. But you can go for it and
> change the Wiki code if you like. Or if your version is significantly
> different then offer it as a separate implementation.

Actually, it's even easier than that. I just modified the last line so that
it looks like:

if __FILE__ == $0
POP3Filter.new("server", "user", "pass").process
end

Now, pop3filter is easy to include into a separate program. What you would
do to use this is:

require 'pop3filter.rb'

POP3Filter.SUBJECT_RE << %r{enlarge}i
POP3Filter.new("server", "user", "pass", 80_000).process

This will now look for subjects that have the word "enlarge" in them, and it
will look for messages of 80,000 bytes.

The code could be abstracted a bit further -- so that we can (via
meta-programming) tell it what headers we want and have multiple categories,
but this is simply a quick hack to get rid of the current infestation.
Another nice change would be to actually have a Tk (or other graphical)
interface so that you could select which messages you want deleted without
having to either (a) delete them all or (b) respond to each message
interactively.

-austin
--
austin ziegler * austin@halostatue.ca * Toronto, ON, Canada
software designer * pragmatic programmer * 2003.09.20
* 10.42.42



2 Answers

Jose Quesada

9/20/2003 4:56:00 PM

0

On Sat, 20 Sep 2003 23:52:39 +0900, Austin Ziegler <austin@halostatue.ca>
wrote:

> The Perl version I translated from -- and I just modified the WikiPage to
> include the historic influences -- had 150_000 as the size default. I
> figured it was a bit high, so I dropped it to 120_000. In one of my later
> changes to the tool, though, I moved it from a constant to the fourth
> parameter (defaulted) in the constructor.

Austin,

Can you post a link to the original code? It would be neat to compare perl
and ruby code for the same task.
THanks,
-Jose

--
Jose Quesada, PhD.

quesadaj@psych.colorado.edu Research associate
http://lsa.colorado.edu... Institute of Cognitive Science
University of Colorado (Boulder)
Muenzinger psychology building Phone:303 492 1522
office D447A Fax: 303 492 7177
Campus Box 344
University of Colorado at Boulder
Boulder, CO 80309-0344


Xavier Noria

9/20/2003 5:08:00 PM

0

On Saturday 20 September 2003 18:56, Jose Quesada wrote:

> Can you post a link to the original code? It would be neat to compare
> perl and ruby code for the same task.

Well, the original code was the first dirty iteration I wrote in a hurry
because my mailbox was being flooded by minutes. I shared it because of
the thread in case it could be helpful to anyone else.

I have cleaned it up a bit since then, factored it, and added
interactive and nonstop modes:

http://www.hashref.com/prj/pop3filter/pop...

I think that''s a more appropiate version for a fair comparison.

-- fxn