Anti-Phishing Update -- New data feed
steve.freegard at fsl.com
Thu Jun 18 21:54:27 IST 2009
Mark Sapiro wrote:
> On Thu, Jun 18, 2009 at 09:14:27AM +0100, Julian Field wrote:
>> On 17/06/2009 17:01, Steve Freegard wrote:
>>> In addition to removing the 'full' rules; change (match|match|match) to
>>> (?:match|match|match) which is non-capturing and should save a
>>> considerable amount of memory in SA and should reduce these times.
>> I have made both those changes.
> v2.02 has changed the regexps in the rules from the form
> ((local1 at example.com)|(local2 at example.com) ... (localn at example.com))
> (?:(local1 at example.com)|(local2 at example.com) ... (localn at example.com))
> but wouldn't
> (?:(?:local1 at example.com)|(?:local2 at example.com) ... (?:localn at example.com))
> be much better in terms of saving memory by not capturing matches?
> See the attached Spear.Phishing.Rules.patch
I hadn't noticed that; but both are wrong - it should be:
As the inner parenthesis are unnecessary.
More information about the MailScanner