From schampeo@hesketh.com Wed Aug 11 20:29:50 2004
From: Steven Champeon <schampeo@hesketh.com>
To: discuss@lists.surbl.org
Subject: Re: [SURBL-Discuss] RE: Pesky Pron Spam
Date: Wed, 11 Aug 2004 14:29:02 -0400
Message-ID: <20040811182902.GW27855@hesketh.com>
In-Reply-To: <Pine.HPX.4.58.0408111304480.25242@d-is00.icaen.uiowa.edu>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============3253341065260769805=="

--===============3253341065260769805==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit

on Wed, Aug 11, 2004 at 01:10:48PM -0500, David B Funk wrote:
> On Wed, 11 Aug 2004, Steven Champeon wrote:
> 
> > on Wed, Aug 11, 2004 at 09:49:39AM -0400, Chris Santerre wrote:
> > > Look at these things they have in common. Need to look at rawbody code.
> > >
> > > alt=3d
> > > =2e(org|gif|htm) #split into 3
> > > name=3dgenerator
> > > ==.HTM
> > > bgColor=3d
> > > face=3d
> > > src=3d
> > > border=3d
> > > title=3d
> > > face=3d
> > > <STYLE></STYLE>
> > >
> > > Needs to be one big meta rule
> >
> > ...that will also catch pretty much every last MSHTML email ever sent.
> > That's just base64-encoded HTML, Chris. The empty STYLE element may
> > be unique, but I doubt it.
> 
> Beg to differ with you Steve, that is NOT base64-encoded HTML, that is
> BASTARD-64-encoded HTML. If you read the MIME RFCs, they state very
> clearly (with 'MUST' wording) that the Hex Digits MUST BE IN CAPS.
> EG: "bgColor=3D" is valid, "bgColor=3d" is NOT.

Aha - very cool. I must admit I don't give many HTML email clients high
marks in following any kind of standards, so I didn't distinguish. But
that's good to know.

Looks like =2e in any URL would be a pretty good indicator, too.
 
-- 
hesketh.com/inc. v: +1(919)834-2552 f: +1(919)834-2554 w: http://hesketh.com
Buy "Cascading Style Sheets: Separating Content from Presentation, 2/e" today!
http://www.amazon.com/exec/obidos/ASIN/159059231X/heskecominc-20/ref=nosim/

--===============3253341065260769805==--