regexp syntax, nnmail split: "s1 not-followed-by s2"

regexp syntax, nnmail split: "s1 not-followed-by s2"

[Karl Kleinpaste]

I want to experiment with an acquaintance's 2-rule anti-spam trap.  If:
1. Neither To: nor Cc: contains one's own address, and
2. The origin is not a known mailing list,
then it's probably spam.  I've got a bunch of other spam-avoidant
rules, but I'd like to try these out.  Unfortunately, it's not clear
to me how I go about expressing a not-followed-by condition in a
regexp.  Any suggestions?

Obviously, this simple rule is not perfect, as it will mis-classify as
spam any mail in which one was properly addressed using Bcc:.

Also, in looking at the documentation for nnmail-split-fancy, because
I thought it might be necessary for my anti-spam effort (but now that
I think I understand -fancy, it won't help -- I have nnmail-crosspost
set to nil), the 1st line of the example contains a token `mail' (not
a string) which should be enclosed in quotes as a string.

Re: regexp syntax, nnmail split: "s1 not-followed-by s2"

[Harald Meland]

[Karl Kleinpaste]

| Any suggestions?

The most straightforward setup I can think of which does this, is:

(setq nnmail-split-fancy 
      '(|	 
	("gnus-warning" ".*" "duplicates")
	(to "Karl Kleinpaste" "Personal")
	(from mail "Mailer-daemon")
	<bunch of splits saying where mail to and from known addresses
	 should go>
	"Junkmail"))

If you have included explicit splits for all the obscure aliases,
lists and whatnot you want to receive mail from, the "Junkmail"
mailbox will come very close to containing nothing but spam (and very
little of the spam I'm receiving has my name anywhere in it).  Bcc: is
a problem, but are there many of us who receive lots and lots of
Bcc'ed mail from different places all the time?

| Also, in looking at the documentation for nnmail-split-fancy, because
| I thought it might be necessary for my anti-spam effort (but now that
| I think I understand -fancy, it won't help -- I have nnmail-crosspost
| set to nil), the 1st line of the example contains a token `mail' (not
| a string) which should be enclosed in quotes as a string.

Nope, see the variable `nnmail-split-abbrev-alist'.
-- 
Harald

Re: regexp syntax, nnmail split: "s1 not-followed-by s2"

[Colin Rafferty]

Karl Kleinpaste writes:

> I want to experiment with an acquaintance's 2-rule anti-spam trap.  If:
> 1. Neither To: nor Cc: contains one's own address, and
> 2. The origin is not a known mailing list,
> then it's probably spam.  I've got a bunch of other spam-avoidant
> rules, but I'd like to try these out.  Unfortunately, it's not clear
> to me how I go about expressing a not-followed-by condition in a
> regexp.  Any suggestions?

Check out the Gnus Info:

    Gnus -> Various -> Thwarting Email Spam

It has a topic on exactly what you want to do.

Basically, I end nnmail-split-fancy with this:

         (
          ....

          (to "craffert" "mail.misc")
          "mail.auto.spam")

-- 
Colin

Re: regexp syntax, nnmail split: "s1 not-followed-by s2"

[Karl Kleinpaste]

Colin Rafferty <craffert@ml.com> writes:
> Check out the Gnus Info:
>     Gnus -> Various -> Thwarting Email Spam

Many thanx to the several folks who replied.  My "tomb" mail group is
now accepting additions at a respectable pace...and they aren't
bothering personal.general at all. :-)

(And I didn't have to resort to nnmail-split-fancy.  *phew*)

BTW, if anyone is interested, here's a rule which catches
	leading `!' (a perverse recent bizarreness)
	excessive excitement ("!!!")
	get-rich-quick pyramids ("$$")
	SCREAMING UPPERCASE
in Subject:
    ("tomb" "Subject:\\( !\\|.*!!!\\|.*\\$\\$\\| \\(Re: \\)?[^a-z]+$\\)")

The SCREAMING UPPERCASE catcher requires, however, that one also do
	(add-hook 'nnmail-split-hook (lambda nil (setq case-fold-search nil)))
because split comparisons are case-insensitive by default.  (Just as
for R scorefile comparisons.)

--karl