Re: Anyone using DCC to block spam? How to config Gnus based on X-DCC-* ?

[Daniel Pittman <daniel@rimspace.net>]

On 11 Jan 2002, Chris Shenton wrote:
> I recently started trying to use DCC (Distributed Checksum 
> Clearinghouse, http://www.rhyolite.com/anti-spam/dcc/) to block 
> spam.  [...]  X-DCC-Etherboy-Metrics: thanatos.shenton.org 1002; 
> env_From=1 From=1 Subject=1 Message-ID=1 Received=1 Body=many 
> Fuz1=many
>
> indicating the same body was received by "many" DCC users, 
> though the From, Subject, and Message-ID were all different.  
> Another DCC header:
>
>   X-DCC-wanadoo-be-Metrics: thanatos.shenton.org 1016; 
>   env_From=1 From=1 Subject=many Message-ID=1 Received=1 
>   Body=many Fuz1=many
>
> indicates less clever spam with the exact same Subject, as well 
> as Body.

Ah, how suitably clever. It actually uses a different header for 
each
record. What a /useful/ feature. (Ahem. I feel better now.)

> So my question is how can I get Gnus to nuke or filter based on 
> this line? I realize I could do something like:
>
> (setq nnmail-split-methods '( ("in.spam" "^X-DCC-.*Body=many") 
> ...))
>
> But seems that more complicated decisions would require truly 
> hairy regexps.

Well, that works for splitting, and it's going to be a PITA to get 
it to
match. IIRC, you can use a function that gets called to do some of 
the
splitting, though, which may well be easier. Check the info.

...personally, though, I would tend to use this header in scoring 
and
mark up or down based on the appropriate bits of the header, in
all.SCORE.

        Daniel

--
Love is like Hearts. You want to follow suit, but you don't want
to have the lead.  -- Dustin Fisher