02 March 2007 Changes (HHH) --------------------------- 1. Action: Added rule for "youngdemocrats.net" Added: GoodDomains[i++] = "youngdemocrats.net"; Reason: defeat "young" rule which needs to be looked at Okay, I looked at it ... (note with youngrepublicans) 1678 young_Parts.txt 248 young_Starts_and_Ends.txt 770 young_Passed_All_Rules.txt ------------------------------- 2696 total Okee-dokee, this rule stays. Note that it only applies to hosts anyway. BadHostParts[i++] = "young"; 2. Action: Adde rule for ".x-traceur.com" Added: BadDomains[i++] = ".x-traceur.com"; Reason: Considered as a bad tracker, primarily for French pseudo-free Porn sites. They are NOT really free. Mike Burgess keeps adding new ones each month. 3. Action: Added "spycam" rule Added: BadURL_Parts[i++] = "spycam"; Reason: Mike has come up with quite a few "spycam" host names that STING. I can't think of very many legitimate reasons for the word. 42 spycam_Parts.txt 14 spycam_Starts_and_Ends.txt 48 spycam_Passed_All_Rules.txt ------------------------------- 104 total 4. Action: Added "secret" rule Added: BadURL_Parts[i++] = "secret"; Reason: Mike has come up with a few "spycam" host names that STING. I can't think of very many legitimate reasons for the word in a hostname, but in the URL we may end up with too many. But I am adding it to the URL test with comment "// PERSONAL" rule. If it causes problems, we will drop to HOST rule. 320 secret_Parts.txt 70 secret_Starts_and_Ends.txt 283 secret_Passed_All_Rules.txt 673 total 5. Action: Added "beast" rule Added: BadHostParts[i++] = "beast"; Reason: juliebeast.com 489 beast_Parts.txt 66 beast_Starts_and_Ends.txt 314 beast_Passed_All_Rules.txt ------------------------------ 869 total We already have the following rule: BadURL_Parts[i++] = "beastial"; There is no good solution but 150+ hosts slipping through is too much, and "beast" alone in the URL could probably even cause false positives at pbskids.org (the Lions). 6. Action: Exclusion for "netsafeutah.org" Added: GoodDomains[i++] = "netsafeutah.org"; Reason: // COUNTERS MANY RULES - They wander into areas where IT IS GOING TO FAIL 7. Action: Counter "free[^d]" rule Added: GoodDomains[i++] = "freepatentsonline.com"; Reason: I just realized a LOT of people may want this one. Have had it as PERSONAL for a LONG time. 02 March 2007 UNresolved False Positives (HHH) ---------------------------------------------- 1. Pattern: "lips" Rules: BadHostWordStarts[i++]="lips"; BadURL_WordEnds[i++]="[^c]lips"; Reason: creativosparc.ads.uigc.net/RealMedia/ads/Creatives/\ OasDefault/BR_20061201_BUSCAPE-BOND/br_20061201_\ buscape-bond-BP-hometheaterphilips_pop.gif My initial hunch is to just downgrade the rules. The pattern is too short. Here is what happens if remove the rules for the hosts ... Both rules removed: =================== 454 lips_Parts.txt 110 lips_Starts_and_Ends.txt 263 lips_Passed_All_Rules.txt ----------------------------- 827 total Start rule removed: =================== 454 lips_Parts.txt 206 lips_Starts_and_Ends.txt 167 lips_Passed_All_Rules.txt ----------------------------- 827 total End rule removed: ================= 454 lips_Parts.txt 148 lips_Starts_and_Ends.txt 225 lips_Passed_All_Rules.txt 2. Pattern: "hot" OLD, NOW "hot[^em]" Rules: BadHostWordStarts[i++]="hot[^em]" Reason: hotmail.com I added the exclusion for e & m for hotel, AND hotmail (but that means I now need to scope out if the exclusion rules are needed any more for hotmail and what hosts need to be added. 3. Pattern: "oral" Rules: BadURL_WordStarts[i++]="oral"; BadURL_WordEnds[i++]="oral"; Reason: Nov 28 20:20:53 www.wliw.org/productions/images/doral_logo.jpg Sun Dec 17 20:24:37 byub.org/programaz/images/byuphilharmonicchoral.jpg Jan 15 08:09:51 iowa.brickriver.com/files/oZone_Objects_XNCYVE/\ 070112_Moral_Witness_PWMXY96T.jpg hostsfile.mine.nu/img/coral.gif The START rule is okay; it is the END rule that kills us. suggested "[^cdhm]oral" ? Here is the moral count for the hosts (immoral): 8 moral_Parts.txt 11 moral_Starts_and_Ends.txt 8 moral_Passed_All_Rules.txt ----------------------------- 27 total From a hosts perspective we can drop the END rule. 02 March 2007 RESOLVED False Positives (HHH) --------------------------------------------- NONE