10 November 2006 Changes (HHH) ------------------------------- 1. Action: Dropped the "spread" rule Removed: BadURL_Parts[i++] = "spread"; Reason: spreadfirefox.com, too many possibilities for other false positives and I can handle the rest in the hosts file. 2. Action: Added GoodDomains ".avast.com" rule Added: GoodDomains[i++] = ".avast.com"; Reason: download17.avast.com download18.avast.com We need to look at any other Antivirus, or other security packages to make SURE we don't stop them! 3. Action: Addded BadDomains ".cjb.net" Added: BadDomains[i++] = ".cjb.net"; Reason: This is a porn clearing house and that is all it does. 222 slipping through the cracks is way too many. (see the cjb.net pattern files) 353 cjb.net_Parts.txt 106 cjb.net_Starts_and_Ends.txt 222 cjb.net_Passed_All_Rules.txt -------------------------------- 681 total 4. Action: Added URL "vixen" block rule Added: BadURL_Parts[i++] = "vixen"; Reason: www.piercedvixen.com was automatically called by the host www.spreadandready.com while I was looking at hosts that fell through the cracks when I removed the "spread" rule. 90 vixen_Parts.txt 22 vixen_Starts_and_Ends.txt 106 vixen_Passed_All_Rules.txt ------------------------------ 218 total 5. Action: Added URL "redlight" block rule Added: BadURL_Parts[i++] = "redlight"; Reason: Another one from the dropped "spread" rule 25 redlight_Parts.txt 6 redlight_Starts_and_Ends.txt 70 redlight_Passed_All_Rules.txt --------------------------------- 101 total 6. Action: Removed "hard" start rule Removed: BadURL_WordStarts[i++]="hard"; Reason: www.hardin.k12.ky.us/res_techn/sbjarea/math/\ MathJeopardy.htm was the URL. After extensive analysis I realize that is allowing 461 HOSTS through. There is NOTHING I can do about that right now. This may need perhaps 3-4 rules, because there are 42 hard-* words in the dictionary. Only one stands out clearly as Porn: hard-core. There are two possibles: hard-featured, and hard-fisted. So I did a histogram on the what followd and came up with with the following count: 82 s WILL TRY TO FIND PATTERN FOR 52 c WILL TRY TO FIND PATTERN FOR 52 e WILL TRY TO FIND PATTERN FOR 36 b WILL TRY TO FIND PATTERN FOR 28 p MAY TRY TO FIND PATTERN FOR I am not saying I am scuttling the rule permanently. I just don't know what to do with it at the moment and I would rather have it GONE than being there for a while. I will try to come up with reasonable patterns in the others and put the rest in the blocking hosts file.