Anti-spear-phishing, round 2

[Kai Schaetzl]

Guy Story KC5GOI wrote on Sat, 10 Jan 2009 11:55:24 -0600 (GMT-06:00):

> My original and poorly worded question was more along the lines of
> how much work MS has to do using the list of addresses in the spam
> blacklist verses a SA rule.  It it more work processing the blacklist
> than the SA rule?

No, probably less. You asked about efficiency and I took that as meaning 
the result. I didn't check out Jules script, but according to his 
description it's taking also all body appearances into account and it 
"normalizes" or wildcards the names with numbers. That makes it match much 
better against mutations. If you use wildcards in your blacklist then this 
will make it gain efficiency, but still loose out on the body checks. If 
you just use the basic name list without even wildcarding then I wouldn't 
use it at all, it's not worth it.
I think Denis made a good suggestion how to use that script with an older 
MS version.

Kai

-- 
Kai Schätzl, Berlin, Germany
Get your web at Conactive Internet Services: http://www.conactive.com