Milter-greylist

Jake Di Toro wrote:
> On Thu, Dec 21, 2006 at 03:35:25PM -0500, Matt Kettler wrote:
>> That said, the the characters matched are really likely to be . or -, so it
>> seems inefficient to use back references there anyway.
>>
>> Personally I'd use one of these instead:
>>
>> /[0-9]{1,3}[-._][0-9]{1,3}[-._][0-9]{1,3}[-._][0-9]{1,3}[-._]/
>>
>> /[0-9]+[-._][0-9]+[-._][0-9]+[-._][0-9]+[-._]/
>>
>> The primary difference being the first one won't match sequences involving more
>> than three numbers at a time, but the second one will.
>> (ie: 123-123-123-1234.example.com will not match the first one, but will match
>> the second.)
> 
> I think the theroy behind the use of backreferences is, the
> backrefrence will only pick up the following:
> 
> 123.132.123.123
> 123-123-123-123
> 123_123_123_123
> 
> where yours would pickup
> 
> 123.123-123_123
> 
> which, while unlikely to occur, if it did, probably wouldn't be
> desired.  Though then again you might want to as well.
> 

True, the back reference will also pick up:

1a4443K23_1

Which may or may not be desirable.

IMHO, the extra overhead of using the back-references isn't worth it in this
application. But that's just my subjective opinion based on my own experiences
in spam analysis.