Re: [SAtalk] Problem with email=no content
On Tue, 2 Dec 2003, Robert Menschel wrote:
> headerRM_hx_from exists:From
> describe RM_hx_from From header found
> score RM_hx_from 0.001
> meta RM_hn_from !RM_hx_from
> describe RM_hn_from From header not found
> score RM_hn_from 1.00
>
> The first rule tests for the existence of a FROM header. Score minimal
> (could be a non-scoring __RM_hx_from rule for that matter).
>
> The second rule then reverses that test, checking for the lack of a FROM
> header. (There may be a better way to do this -- anyone?) Results:
>
> RM_hx_from -- 45925s/16069h of 63136 corpus
> RM_hn_from -- 1136s /0h of 63136 corpus
SA has a special 'missing-match' syntax to detect missing headers.
Here's a rule that I wrote to test for missing "Message-Id:" headers:
header L_MESSAGEID_MISSING Message-Id =~ /^UNSET$/ [if-unset: UNSET]
describe L_MESSAGEID_MISSING Missing Message-Id: header
scoreL_MESSAGEID_MISSING 1.5
So to cretate your rule:
headerRM_hn_from From =~ /^UNSET$/ [if-unset: UNSET]
describe RM_hn_from From header not found
score RM_hn_from 1.00
I do not know if it is any more efficient than the way that you
did it, I just copied somthing that I found in one of the distributed
rules.
Dave
--
Dave Funk University of Iowa
College of Engineering
319/335-5751 FAX: 319/384-0549 1256 Seamans Center
Sys_admin/Postmaster/cell_adminIowa City, IA 52242-1527
#include
Better is not better, 'standard' is better. B{
---
This SF.net email is sponsored by OSDN's Audience Survey.
Help shape OSDN's sites and tell us what you think. Take this
five minute survey and you could win a $250 Gift Certificate.
http://www.wrgsurveys.com/2003/osdntech03.php?site=8
___
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
RE: [SAtalk] Re: SA questions
> I've seen other people say this. My question is "why NOT > send the listserv traffic through sa-learn as well?". After > all, it is legit email you get, right? I would NOT recommend feeding SAtalk automatically through sa-learn, because people frequently include portions of spam in discussions. You would not like those tokens poisoning your Bayes database, would you? -- [EMAIL PROTECTED] GSM +358-40-767 8282 Oy Arrak Software Ab http://www.arrak.fi --- This SF.net email is sponsored by OSDN's Audience Survey. Help shape OSDN's sites and tell us what you think. Take this five minute survey and you could win a $250 Gift Certificate. http://www.wrgsurveys.com/2003/osdntech03.php?site=8 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] LOL - ascii art spam
On Tue, 2 Dec 2003 21:34:19 -0600 "Yackley, Matt" <[EMAIL PROTECTED]> wrote: > Damn are we back in the good old BBS days? :) > > I received this one today and damn near fell of my chair laughing. > > SA 2.55 only scored it at 2.36 points. Are there any known rules to catch ascii-art? LOL -- -- Marcio Merlone [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] ICQ UIN #13746928 - Linux user #104911 --- This SF.net email is sponsored by OSDN's Audience Survey. Help shape OSDN's sites and tell us what you think. Take this five minute survey and you could win a $250 Gift Certificate. http://www.wrgsurveys.com/2003/osdntech03.php?site=8 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] BIG HUGE EVIL RULE NEWS!!!!
On Tue, 2 Dec 2003, Chris Santerre wrote:
> BIG HUGE NEWS
>
> A major breakthrough has taken place
>
> ALL EVILRULES FILES HAVE BEEN COMBINED!! 2622 domains into 178 rules!!!
> Ramdon/tracking hosts tags removed!
>
> They only increase spamd memory by 1 meg!!! 1 meg!
>
> You read correctly! Every evil domain since august has been added! Remove
> all you old evilrules files. Grab BigEvil.cf and place it in either your
> /etc/mail/spamassassin dir and restart spamd; or into your
> $home/.spamassassin dir.
>
> I plan to just keep adding to this file!!!
>
> http://www.merchantsoverseas.com/wwwroot/gorilla/bigevil.cf
rule 43 hits on cauce.org ;(
That's ironic.
--
Dave Funk University of Iowa
College of Engineering
319/335-5751 FAX: 319/384-0549 1256 Seamans Center
Sys_admin/Postmaster/cell_adminIowa City, IA 52242-1527
#include
Better is not better, 'standard' is better. B{
---
This SF.net email is sponsored by OSDN's Audience Survey.
Help shape OSDN's sites and tell us what you think. Take this
five minute survey and you could win a $250 Gift Certificate.
http://www.wrgsurveys.com/2003/osdntech03.php?site=8
___
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] BIG HUGE EVIL RULE NEWS!!!!
On Tue, 2 Dec 2003 15:56:15 -0500 Chris Santerre <[EMAIL PROTECTED]> wrote: (...) > ALL EVILRULES FILES HAVE BEEN COMBINED!! 2622 domains into 178 rules!!! > Ramdon/tracking hosts tags removed! (...) Real big work! Grats! But, for the sake of archiveness, and for one less dumb in the world, why you use rawbody on those rules instead of uri? On time: the dumb I mention here is me! :) -- -- Marcio Merlone [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] ICQ UIN #13746928 - Linux user #104911 --- This SF.net email is sponsored by OSDN's Audience Survey. Help shape OSDN's sites and tell us what you think. Take this five minute survey and you could win a $250 Gift Certificate. http://www.wrgsurveys.com/2003/osdntech03.php?site=8 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
[SAtalk] Re: LOL - ascii art spam
On Wed, 3 Dec 2003 09:18:10 -0200, Marcio Merlone <[EMAIL PROTECTED]> writes: > On Tue, 2 Dec 2003 21:34:19 -0600 > "Yackley, Matt" <[EMAIL PROTECTED]> wrote: > > > Damn are we back in the good old BBS days? :) > > > > I received this one today and damn near fell of my chair laughing. > > > > SA 2.55 only scored it at 2.36 points. > > > Are there any known rules to catch ascii-art? LOL > They could be written. Look for gibberish or too many symbols. On the other hand, they're going to be rather ineffective advertisements if that's the only type of ad that gets through. Scott --- This SF.net email is sponsored by OSDN's Audience Survey. Help shape OSDN's sites and tell us what you think. Take this five minute survey and you could win a $250 Gift Certificate. http://www.wrgsurveys.com/2003/osdntech03.php?site=8 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] sa-learn
On Friday 28 November 2003 20:08, Erwan Le Moing wrote:
> my question is :
> if someone send an spam mail to [EMAIL PROTECTED], spamassassin will learn
> to consider spam to non-spam .
Set up a local dns server and use {spam,[EMAIL PROTECTED] or something like
that. Or use @127.0.0.1.
Of course this still leaves those concerns voiced in the other replies.
MfG, Ulrich
--
Heinz Ulrich Stille / Tel.: +49-541-9400463 / Fax: +49-541-9400450
design_d gmbh / Lortzingstr. 2 / 49074 Osnabrück / www.design-d.de
---
This SF.net email is sponsored by OSDN's Audience Survey.
Help shape OSDN's sites and tell us what you think. Take this
five minute survey and you could win a $250 Gift Certificate.
http://www.wrgsurveys.com/2003/osdntech03.php?site=8
___
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
RE: [SAtalk] BIG HUGE EVIL RULE NEWS!!!!
> -Original Message- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] > Sent: Tuesday, December 02, 2003 10:07 PM > To: Chris Santerre > Subject: Re: [SAtalk] BIG HUGE EVIL RULE NEWS > > > > I've been using your popcorn, weeds and nov2rules.cf rules for about a > month now, and it doesn't seem to be causing any increase in false > positives that I can tell...I shied away from the Evil rules > due to the > resources and potential false positive issues...now that the former is > dealt with, have you gotten any feedback WRT false positives? > The ONLY FPs are done when I miss something during a large update. I've removed 3 already. But once done, there is zero chance of an FP. These are SPAM hosts only. So the FPs are just my mistakes, and I've placed measures so the chances are reduced even more. There will also be fewer chances of that now, as I will have smaller updates to this file. Instead of recreating a new file every 15 days. I may add only 10-30 new domains in 15 days. Easier to chck against ham corpi. > I'm not a huge hockey fan, I'll pretend I didn't hear that ;) >by am overcome with Eagles fever at the > moment...I'm predicting an Eagles-Pats Superbowl.. :) > Wouldn't that be nice!! --- This SF.net email is sponsored by OSDN's Audience Survey. Help shape OSDN's sites and tell us what you think. Take this five minute survey and you could win a $250 Gift Certificate. http://www.wrgsurveys.com/2003/osdntech03.php?site=8 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
RE: [SAtalk] BIG HUGE EVIL RULE NEWS!!!!
What version of Bigevil do you have? 1.51 has fixed 2 typos in 141 and 153. I had '.com||somedome' empty pipes. site updated within minutes. You got version 1.5 I expect :) --Chris > -Original Message- > From: Larry Rosenman [mailto:[EMAIL PROTECTED] > Sent: Tuesday, December 02, 2003 5:43 PM > To: Chris Santerre; 'Marc Steuer'; 'Spamassassin-Talk (E-mail)' > Subject: RE: [SAtalk] BIG HUGE EVIL RULE NEWS > > > > > --On Tuesday, December 02, 2003 17:22:00 -0500 Chris Santerre > <[EMAIL PROTECTED]> wrote: > > >> > ALL EVILRULES FILES HAVE BEEN COMBINED!! 2622 domains into > >> 178 rules!!! > >> > Ramdon/tracking hosts tags removed! > >> > >> Thanks a lot for your work on this. > >> > >> BigEvilList_74 hit on a message we received from the > >> Financial Executives > >> Institute because it contained ...fasb.org. Is the Financial > >> Accounting > >> Standards Board _really_ a spam source according to your > spam corpus? > >> > >> Regards, > >> Marc > >> > > > > > > Interesting! I'll check all my spam corpi tomorrow. I was > typing like a > > mad man, so there may have been a character before it that > got deleted. > > I'll give it a check in the AM! Thanks! > I got hits on tntdental.com. If you have **ANY** spam from > that domain, > I'd like to know about it (I help them sysadmin it) (they are hosted > at catalog.com, if that matters). > > (141 and 153, fwiw). > > I can send you the actual message, If it matters. > > LER > > > > > --Chris > > > > > > --- > > This SF.net email is sponsored by OSDN's Audience Survey. > > Help shape OSDN's sites and tell us what you think. Take this > > five minute survey and you could win a $250 Gift Certificate. > > http://www.wrgsurveys.com/2003/osdntech03.php?site=8 > > ___ > > Spamassassin-talk mailing list > > [EMAIL PROTECTED] > > https://lists.sourceforge.net/lists/listinfo/spamassassin-talk > > > > > > -- > Larry Rosenman http://www.lerctr.org/~ler > Phone: +1 972-414-9812 E-Mail: [EMAIL PROTECTED] > US Mail: 1905 Steamboat Springs Drive, Garland, TX 75044-6749 > --- This SF.net email is sponsored by OSDN's Audience Survey. Help shape OSDN's sites and tell us what you think. Take this five minute survey and you could win a $250 Gift Certificate. http://www.wrgsurveys.com/2003/osdntech03.php?site=8 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
RE: [SAtalk] BIG HUGE EVIL RULE NEWS!!!!
Fixed, thanks. Version 1.52 posted. Once these small mistakes of mine are
removed, there will be NO FP's!! Doing this on such a grand scale the first
time was BRUTAL. Updates will be easier to manage.
That domain got there from an SA post. SA list was CC'd instead of To:'d. So
It got filtered :/
> -Original Message-
> From: David B Funk [mailto:[EMAIL PROTECTED]
> Sent: Wednesday, December 03, 2003 5:59 AM
> To: Chris Santerre
> Cc: Spamassassin-Talk (E-mail)
> Subject: Re: [SAtalk] BIG HUGE EVIL RULE NEWS
>
>
> On Tue, 2 Dec 2003, Chris Santerre wrote:
>
> > BIG HUGE NEWS
> >
> > A major breakthrough has taken place
> >
> > ALL EVILRULES FILES HAVE BEEN COMBINED!! 2622 domains into
> 178 rules!!!
> > Ramdon/tracking hosts tags removed!
> >
> > They only increase spamd memory by 1 meg!!! 1 meg!
> >
> > You read correctly! Every evil domain since august has been
> added! Remove
> > all you old evilrules files. Grab BigEvil.cf and place it
> in either your
> > /etc/mail/spamassassin dir and restart spamd; or into your
> > $home/.spamassassin dir.
> >
> > I plan to just keep adding to this file!!!
> >
> > http://www.merchantsoverseas.com/wwwroot/gorilla/bigevil.cf
>
> rule 43 hits on cauce.org ;(
>
> That's ironic.
>
>
> --
> Dave Funk University of Iowa
> College of Engineering
> 319/335-5751 FAX: 319/384-0549 1256 Seamans Center
> Sys_admin/Postmaster/cell_adminIowa City, IA 52242-1527
> #include
> Better is not better, 'standard' is better. B{
>
---
This SF.net email is sponsored by OSDN's Audience Survey.
Help shape OSDN's sites and tell us what you think. Take this
five minute survey and you could win a $250 Gift Certificate.
http://www.wrgsurveys.com/2003/osdntech03.php?site=8
___
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] BIG HUGE EVIL RULE NEWS!!!!
Thanks for all your hard work Chris!! Between your rules and Jennifer's I
have reduced the number of spams that come through today from nearly 85% of
incoming mails, to less than 1%..
Could not have done it without your hard work and help.. and that from the
rest of the list!
Happy Holidays!!
- Original Message -
From: "Chris Santerre" <[EMAIL PROTECTED]>
To: "'David B Funk'" <[EMAIL PROTECTED]>
Cc: "Spamassassin-Talk (E-mail)" <[EMAIL PROTECTED]>
Sent: Wednesday, December 03, 2003 6:40 AM
Subject: RE: [SAtalk] BIG HUGE EVIL RULE NEWS
> Fixed, thanks. Version 1.52 posted. Once these small mistakes of mine are
> removed, there will be NO FP's!! Doing this on such a grand scale the
first
> time was BRUTAL. Updates will be easier to manage.
>
> That domain got there from an SA post. SA list was CC'd instead of To:'d.
So
> It got filtered :/
>
> > -Original Message-
> > From: David B Funk [mailto:[EMAIL PROTECTED]
> > Sent: Wednesday, December 03, 2003 5:59 AM
> > To: Chris Santerre
> > Cc: Spamassassin-Talk (E-mail)
> > Subject: Re: [SAtalk] BIG HUGE EVIL RULE NEWS
> >
> >
> > On Tue, 2 Dec 2003, Chris Santerre wrote:
> >
> > > BIG HUGE NEWS
> > >
> > > A major breakthrough has taken place
> > >
> > > ALL EVILRULES FILES HAVE BEEN COMBINED!! 2622 domains into
> > 178 rules!!!
> > > Ramdon/tracking hosts tags removed!
> > >
> > > They only increase spamd memory by 1 meg!!! 1 meg!
> > >
> > > You read correctly! Every evil domain since august has been
> > added! Remove
> > > all you old evilrules files. Grab BigEvil.cf and place it
> > in either your
> > > /etc/mail/spamassassin dir and restart spamd; or into your
> > > $home/.spamassassin dir.
> > >
> > > I plan to just keep adding to this file!!!
> > >
> > > http://www.merchantsoverseas.com/wwwroot/gorilla/bigevil.cf
> >
> > rule 43 hits on cauce.org ;(
> >
> > That's ironic.
> >
> >
> > --
> > Dave Funk University of Iowa
> > College of Engineering
> > 319/335-5751 FAX: 319/384-0549 1256 Seamans Center
> > Sys_admin/Postmaster/cell_adminIowa City, IA 52242-1527
> > #include
> > Better is not better, 'standard' is better. B{
> >
>
>
> ---
> This SF.net email is sponsored by OSDN's Audience Survey.
> Help shape OSDN's sites and tell us what you think. Take this
> five minute survey and you could win a $250 Gift Certificate.
> http://www.wrgsurveys.com/2003/osdntech03.php?site=8
> ___
> Spamassassin-talk mailing list
> [EMAIL PROTECTED]
> https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
>
---
This SF.net email is sponsored by OSDN's Audience Survey.
Help shape OSDN's sites and tell us what you think. Take this
five minute survey and you could win a $250 Gift Certificate.
http://www.wrgsurveys.com/2003/osdntech03.php?site=8
___
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
RE: [SAtalk] Problem with email=no content
Ahhh, which one to put on site? :) Is the UNSET feature in ALL versions of
SA?
> -Original Message-
> From: David B Funk [mailto:[EMAIL PROTECTED]
> Sent: Wednesday, December 03, 2003 5:14 AM
> To: Robert Menschel
> Cc: [EMAIL PROTECTED]; Chris Santerre
> Subject: Re: [SAtalk] Problem with email=no content
>
>
> On Tue, 2 Dec 2003, Robert Menschel wrote:
>
> > headerRM_hx_from exists:From
> > describe RM_hx_from From header found
> > score RM_hx_from 0.001
> > meta RM_hn_from !RM_hx_from
> > describe RM_hn_from From header not found
> > score RM_hn_from 1.00
> >
> > The first rule tests for the existence of a FROM header.
> Score minimal
> > (could be a non-scoring __RM_hx_from rule for that matter).
> >
> > The second rule then reverses that test, checking for the
> lack of a FROM
> > header. (There may be a better way to do this -- anyone?) Results:
> >
> > RM_hx_from -- 45925s/16069h of 63136 corpus
> > RM_hn_from -- 1136s /0h of 63136 corpus
>
> SA has a special 'missing-match' syntax to detect missing headers.
> Here's a rule that I wrote to test for missing "Message-Id:" headers:
>
> header L_MESSAGEID_MISSING Message-Id =~ /^UNSET$/
> [if-unset: UNSET]
> describe L_MESSAGEID_MISSING Missing Message-Id: header
> scoreL_MESSAGEID_MISSING 1.5
>
> So to cretate your rule:
>
> headerRM_hn_from From =~ /^UNSET$/ [if-unset: UNSET]
> describe RM_hn_from From header not found
> score RM_hn_from 1.00
>
> I do not know if it is any more efficient than the way that you
> did it, I just copied somthing that I found in one of the distributed
> rules.
>
> Dave
>
> --
> Dave Funk University of Iowa
> College of Engineering
> 319/335-5751 FAX: 319/384-0549 1256 Seamans Center
> Sys_admin/Postmaster/cell_adminIowa City, IA 52242-1527
> #include
> Better is not better, 'standard' is better. B{
>
---
This SF.net email is sponsored by OSDN's Audience Survey.
Help shape OSDN's sites and tell us what you think. Take this
five minute survey and you could win a $250 Gift Certificate.
http://www.wrgsurveys.com/2003/osdntech03.php?site=8
___
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
RE: [SAtalk] BIG HUGE EVIL RULE NEWS!!!!
--On Wednesday, December 03, 2003 09:31:24 -0500 Chris Santerre <[EMAIL PROTECTED]> wrote: What version of Bigevil do you have? 1.51 has fixed 2 typos in 141 and 153. I had '.com||somedome' empty pipes. site updated within minutes. You got version 1.5 I expect :) Yep. updated to 1.52. Thanks! LER -- Larry Rosenman http://www.lerctr.org/~ler Phone: +1 972-414-9812 E-Mail: [EMAIL PROTECTED] US Mail: 1905 Steamboat Springs Drive, Garland, TX 75044-6749 pgp0.pgp Description: PGP signature
RE: [SAtalk] BIG HUGE EVIL RULE NEWS!!!!
Thanks for the modifications. Updated to 1.52. Regards, Marc -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Larry Rosenman Sent: Wednesday, December 03, 2003 7:08 AM To: Chris Santerre; 'Marc Steuer'; 'Spamassassin-Talk (E-mail)' Subject: RE: [SAtalk] BIG HUGE EVIL RULE NEWS --On Wednesday, December 03, 2003 09:31:24 -0500 Chris Santerre <[EMAIL PROTECTED]> wrote: > What version of Bigevil do you have? 1.51 has fixed 2 typos in 141 and > 153. I had '.com||somedome' > > empty pipes. site updated within minutes. You got version 1.5 I expect > :) Yep. updated to 1.52. Thanks! LER -- Larry Rosenman http://www.lerctr.org/~ler Phone: +1 972-414-9812 E-Mail: [EMAIL PROTECTED] US Mail: 1905 Steamboat Springs Drive, Garland, TX 75044-6749 --- This SF.net email is sponsored by OSDN's Audience Survey. Help shape OSDN's sites and tell us what you think. Take this five minute survey and you could win a $250 Gift Certificate. http://www.wrgsurveys.com/2003/osdntech03.php?site=8 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
[SAtalk] Re: SAproxy no longer free edition?
At 11:07 AM 11/19/2003 -0500, you wrote: I guess I missed something. When did SAproxy stop having a free edition? Does the demo expire after 15 days? I'm bummed there is no longer a free version for home users if this is so :( I also just noticed that the free version of SAproxy seems to have disappeared. I have a copy of version 1.2.1 (2003-07-21). If anybody wants it, I can post it on my web site for download. -dougl Doug Ledbetter -- Hagen Software, Inc. [EMAIL PROTECTED] My PGP Public Key: http://dougledbetter.org/public_key.html --- This SF.net email is sponsored by OSDN's Audience Survey. Help shape OSDN's sites and tell us what you think. Take this five minute survey and you could win a $250 Gift Certificate. http://www.wrgsurveys.com/2003/osdntech03.php?site=8 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
RE: [SAtalk] BIG HUGE EVIL RULE NEWS!!!!
> > (...) > > ALL EVILRULES FILES HAVE BEEN COMBINED!! 2622 domains into > 178 rules!!! > > Ramdon/tracking hosts tags removed! > (...) > > Real big work! Grats! > > But, for the sake of archiveness, and for one less dumb in the world, > why you use rawbody on those rules instead of uri? > > On time: the dumb I mention here is me! :) > I'm simply giving back to the community that gave me so much! None of this would be possible without Yorkshire Dave's reg2rule script! I can't thank him enough. I've since bastardised that script into a mutant script. Perl is cool. I've yet to look at a single book/web page on how to program in it, yet thinking it to be like C/C++ I actually guessed at what my code changes needed to be. Imagine my surprise when the darn thing ran! :) I honestly can't remember why I use rawbody. I think it was because the rules are created from URIs, but after that, I don't care where in the spam the domain is, as long as it is there. I think rawbody may also be faster? --Chris --- This SF.net email is sponsored by OSDN's Audience Survey. Help shape OSDN's sites and tell us what you think. Take this five minute survey and you could win a $250 Gift Certificate. http://www.wrgsurveys.com/2003/osdntech03.php?site=8 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
RE: [SAtalk] BIG HUGE EVIL RULE NEWS!!!!
Chris Santerre said: > That domain got there from an SA post. SA list was CC'd instead of To:'d. > So > It got filtered :/ Chris, Instead of checking To or CC, you might want to look for headers the list software adds: http://www.mail-archive.com/[EMAIL PROTECTED]/msg25589.html -- Chris Thielen Easily generate SpamAssassin rules to catch obfuscated spam phrases: http://www.sandgnat.com/cmos/ --- This SF.net email is sponsored by OSDN's Audience Survey. Help shape OSDN's sites and tell us what you think. Take this five minute survey and you could win a $250 Gift Certificate. http://www.wrgsurveys.com/2003/osdntech03.php?site=8 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
[SAtalk] configure: error: C preprocessor "/lib/cpp" fails sanity check
Hi all, I'd like to install SA 2.60 from source on a RH 9 box and get the following error when doing a make: (perl Makefile.PL successfully done) make cd spamd; ./configure --prefix="/usr" --sysconfdir="/etc" --datadir="/usr/share/spamassassin" --enable-ssl="no" checking for gcc... gcc checking for C compiler default output... a.out checking whether the C compiler works... yes checking whether we are cross compiling... no checking for suffix of executables... checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether gcc accepts -g... yes checking for gcc option to accept ANSI C... none needed checking how to run the C preprocessor... /lib/cpp configure: error: C preprocessor "/lib/cpp" fails sanity check See `config.log' for more details. make: *** [spamd/binaries.mk] Error 1 The same when trying to install from CPAN: cd spamd; ./configure --prefix="/usr" --sysconfdir="/etc" --datadir="/usr/share/spamassassin" --enable-ssl="no" checking for gcc... gcc checking for C compiler default output... a.out checking whether the C compiler works... yes checking whether we are cross compiling... no checking for suffix of executables... checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether gcc accepts -g... yes checking for gcc option to accept ANSI C... none needed checking how to run the C preprocessor... /lib/cpp configure: error: C preprocessor "/lib/cpp" fails sanity check See `config.log' for more details. make: *** [spamd/binaries.mk] Error 1 /usr/bin/make -- NOT OK Running make test Can't test without successful make Running make install make had returned bad status, install seems impossible Google and list archives did not help me very much. Has anybody experienced this kind of problem too? Am I missing something? Best regards, Jürgen R. Plasser --- This SF.net email is sponsored by OSDN's Audience Survey. Help shape OSDN's sites and tell us what you think. Take this five minute survey and you could win a $250 Gift Certificate. http://www.wrgsurveys.com/2003/osdntech03.php?site=8 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [WL] [SAtalk] configure: error: C preprocessor "/lib/cpp" fails sanity check
On Wed, 3 Dec 2003, [ISO-8859-1] Jürgen R. Plasser wrote: > I'd like to install SA 2.60 from source on a RH 9 box I used the binary rpms and as long as I uninstalled the old spamassassin manually, the new multiple rpms went in fine. - Charles --- This SF.net email is sponsored by OSDN's Audience Survey. Help shape OSDN's sites and tell us what you think. Take this five minute survey and you could win a $250 Gift Certificate. http://www.wrgsurveys.com/2003/osdntech03.php?site=8 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] configure: error: C preprocessor "/lib/cpp" fails sanity check
On Wed, Dec 03, 2003 at 04:59:10PM +0100, J?rgen R. Plasser wrote: > Hi all, > > I'd like to install SA 2.60 from source on a RH 9 box and get the following > error when doing a make: > > (perl Makefile.PL successfully done) > > make > cd spamd; ./configure --prefix="/usr" --sysconfdir="/etc" > --datadir="/usr/share/spamassassin" --enable-ssl="no" > checking for gcc... gcc > checking for C compiler default output... a.out > checking whether the C compiler works... yes > checking whether we are cross compiling... no > checking for suffix of executables... > checking for suffix of object files... o > checking whether we are using the GNU C compiler... yes > checking whether gcc accepts -g... yes > checking for gcc option to accept ANSI C... none needed > checking how to run the C preprocessor... /lib/cpp > configure: error: C preprocessor "/lib/cpp" fails sanity check > See `config.log' for more details. > make: *** [spamd/binaries.mk] Error 1 I'd hazard a guess there's something missing in your install of RH's program development stuff. What does 'config.log' say? The additional details should be near the end. -- - Dan Wilder <[EMAIL PROTECTED]> Technical Manager SSC, Inc. P.O. Box 55549 Phone: 206-782-8808 Seattle, WA 98155-0549ICQ UIN 216717075 - --- This SF.net email is sponsored by OSDN's Audience Survey. Help shape OSDN's sites and tell us what you think. Take this five minute survey and you could win a $250 Gift Certificate. http://www.wrgsurveys.com/2003/osdntech03.php?site=8 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
[SAtalk] Re: SAproxy no longer free edition?
I have posted a copy of the free version of SAproxy version 1.2.1 (2003-07-21) to the following location for download: http://www.dougledbetter.org/downloads/SAproxyInstaller.exe Enjoy, -dougl Doug Ledbetter -- Hagen Software, Inc. [EMAIL PROTECTED] My PGP Public Key: http://dougledbetter.org/public_key.html --- This SF.net email is sponsored by OSDN's Audience Survey. Help shape OSDN's sites and tell us what you think. Take this five minute survey and you could win a $250 Gift Certificate. http://www.wrgsurveys.com/2003/osdntech03.php?site=8 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] BIG HUGE EVIL RULE NEWS!!!!
2003-12-02 kl. 21.56 skrev Chris Santerre: BIG HUGE NEWS A major breakthrough has taken place ALL EVILRULES FILES HAVE BEEN COMBINED!! 2622 domains into 178 rules!!! Ramdon/tracking hosts tags removed! They only increase spamd memory by 1 meg!!! 1 meg! You read correctly! Every evil domain since august has been added! Remove all you old evilrules files. Grab BigEvil.cf and place it in either your /etc/mail/spamassassin dir and restart spamd; or into your $home/.spamassassin dir. I plan to just keep adding to this file!!! http://www.merchantsoverseas.com/wwwroot/gorilla/bigevil.cf Mike Kuentz, you are no longer allowed to put ideas into my head :) My fingers now hurt! Thanks for lighting the spark! Payment for use of this has to be more then the old evilrules. All users are now required to see at least 2 NHL games live! (and NY Islanders don't count!) The only thing i have to do is to place the file in the right dir as told above, right? Will the mails be checked through both this file and the online services? Thanks / Martin --- This SF.net email is sponsored by OSDN's Audience Survey. Help shape OSDN's sites and tell us what you think. Take this five minute survey and you could win a $250 Gift Certificate. http://www.wrgsurveys.com/2003/osdntech03.php?site=8 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [WL] [SAtalk] configure: error: C preprocessor "/lib/cpp" fails sanity check
Hi Charles, --On 03.12.2003 11:07 -0500 Charles Gregory wrote: On Wed, 3 Dec 2003, [ISO-8859-1] Jürgen R. Plasser wrote: I'd like to install SA 2.60 from source on a RH 9 box I used the binary rpms and as long as I uninstalled the old spamassassin manually, the new multiple rpms went in fine. This works, indeed. I just installed SA on a SuSE 8.2 box from source and everything worked fine. Just wondering... Jürgen -- DI Jürgen R. Plasser * *** * ** * [EMAIL PROTECTED] HEXAGON EDV-Dienstleistungen | A-4221 Steyregg | Weissenwolffstraße 14 www.hexagon.at | [EMAIL PROTECTED] | it-sicherheit | internet | software --- This SF.net email is sponsored by OSDN's Audience Survey. Help shape OSDN's sites and tell us what you think. Take this five minute survey and you could win a $250 Gift Certificate. http://www.wrgsurveys.com/2003/osdntech03.php?site=8 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] configure: error: C preprocessor "/lib/cpp" fails sanity check
Hi Dan, --On 03.12.2003 08:07 -0800 Dan Wilder wrote: I'd hazard a guess there's something missing in your install of RH's program development stuff. What does 'config.log' say? The additional details should be near the end. I had the same thought and installed some developer stuff but it seems that I am still missing something (in the meantime I successfully installed SA from the binary rpms). make now says this (did not really help me that much): make -f spamd/binaries.mk spamd/spamc make[1]: Entering directory `/root/Spamassassin/Mail-SpamAssassin-2.60' gcc -g -O2 spamd/spamc.c spamd/libspamc.c spamd/utils.c \ -o spamd/spamc -ldl In file included from /usr/include/bits/posix1_lim.h:126, from /usr/include/limits.h:144, from /usr/lib/gcc-lib/i386-redhat-linux/3.2.2/include/limits.h:132, from /usr/lib/gcc-lib/i386-redhat-linux/3.2.2/include/syslimits.h:7, from /usr/lib/gcc-lib/i386-redhat-linux/3.2.2/include/limits.h:11, from /usr/include/bits/socket.h:31, from /usr/include/sys/socket.h:35, from spamd/libspamc.h:13, from spamd/spamc.c:9: /usr/include/bits/local_lim.h:36:26: linux/limits.h: No such file or directory In file included from /usr/include/sys/socket.h:35, from spamd/libspamc.h:13, from spamd/spamc.c:9: /usr/include/bits/socket.h:305:24: asm/socket.h: No such file or directory spamd/spamc.c: In function `main': spamd/spamc.c:260: `SIGPIPE' undeclared (first use in this function) spamd/spamc.c:260: (Each undeclared identifier is reported only once spamd/spamc.c:260: for each function it appears in.) spamd/spamc.c:260: `SIG_IGN' undeclared (first use in this function) In file included from /usr/include/bits/posix1_lim.h:126, from /usr/include/limits.h:144, from /usr/lib/gcc-lib/i386-redhat-linux/3.2.2/include/limits.h:132, from /usr/lib/gcc-lib/i386-redhat-linux/3.2.2/include/syslimits.h:7, from /usr/lib/gcc-lib/i386-redhat-linux/3.2.2/include/limits.h:11, from /usr/include/bits/socket.h:31, from /usr/include/sys/socket.h:35, from spamd/libspamc.h:13, from spamd/libspamc.c:10: /usr/include/bits/local_lim.h:36:26: linux/limits.h: No such file or directory In file included from /usr/include/sys/socket.h:35, from spamd/libspamc.h:13, from spamd/libspamc.c:10: /usr/include/bits/socket.h:305:24: asm/socket.h: No such file or directory spamd/libspamc.c:59:1: warning: "h_errno" redefined In file included from spamd/libspamc.h:15, from spamd/libspamc.c:10: /usr/include/netdb.h:58:1: warning: this is the location of the previous definition spamd/libspamc.c:75:1: warning: "EX__MAX" redefined In file included from spamd/libspamc.c:27: /usr/include/sysexits.h:112:1: warning: this is the location of the previous definition spamd/libspamc.c: In function `translate_connect_errno': spamd/libspamc.c:120: `EBADF' undeclared (first use in this function) spamd/libspamc.c:120: (Each undeclared identifier is reported only once spamd/libspamc.c:120: for each function it appears in.) spamd/libspamc.c:121: `EFAULT' undeclared (first use in this function) spamd/libspamc.c:122: `ENOTSOCK' undeclared (first use in this function) spamd/libspamc.c:123: `EISCONN' undeclared (first use in this function) spamd/libspamc.c:124: `EADDRINUSE' undeclared (first use in this function) spamd/libspamc.c:125: `EINPROGRESS' undeclared (first use in this function) spamd/libspamc.c:126: `EALREADY' undeclared (first use in this function) spamd/libspamc.c:127: `EAFNOSUPPORT' undeclared (first use in this function) spamd/libspamc.c:130: `ECONNREFUSED' undeclared (first use in this function) spamd/libspamc.c:131: `ETIMEDOUT' undeclared (first use in this function) spamd/libspamc.c:132: `ENETUNREACH' undeclared (first use in this function) spamd/libspamc.c:135: `EACCES' undeclared (first use in this function) spamd/libspamc.c: In function `opensocket': spamd/libspamc.c:188: `errno' undeclared (first use in this function) spamd/libspamc.c:194: `EPROTONOSUPPORT' undeclared (first use in this function) spamd/libspamc.c:195: `EINVAL' undeclared (first use in this function) spamd/libspamc.c:198: `EACCES' undeclared (first use in this function) spamd/libspamc.c:201: `ENFILE' undeclared (first use in this function) spamd/libspamc.c:202: `EMFILE' undeclared (first use in this function) spamd/libspamc.c:203: `ENOBUFS' undeclared (first use in this function) spamd/libspamc.c:204: `ENOMEM' undeclared (first use in this function) spamd/libspamc.c: In function `try_to_connect_unix': spamd/libspamc.c:283: `errno' undeclared (first use in this function) spamd/libspamc.c: In function `transport_setup': spamd/libspamc.c:1281: `errno' undeclared (first use in this function) In file included from /usr/include/
[SAtalk] reverse scoring question
Hello, Sorry is this has been asked but I haven't seen it in the FAQ nor the general readme. I have installed SA on a server for a NPO that generates a very large amount of email traffic. It has done a good job of filtering a lot of the spam for us thus far. The big problem is this NPO sends emails back and forth that discuss in some graphic detail some things that by default causes SA to assume that it's spam. I know I can white list IP's and accounts but sometimes these come from a variety of places. The question: What I was wondering if I can create a new rule that filteres on a specific piece of text (like the normal rules) but apply a negative score value. This would allow the NPO to tell the sender to put a key into the email to allow it to pass through. What's the best way to accomplish this? Gary Smith --- This SF.net email is sponsored by OSDN's Audience Survey. Help shape OSDN's sites and tell us what you think. Take this five minute survey and you could win a $250 Gift Certificate. http://www.wrgsurveys.com/2003/osdntech03.php?site=8 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] BIG HUGE EVIL RULE NEWS!!!!
On 2003/12/03 09:31:24 -0500, Chris Santerre wrote: > What version of Bigevil do you have? 1.51 has fixed 2 typos in 141 and 153. > I had > '.com||somedome' > > empty pipes. site updated within minutes. You got version 1.5 I expect :) > The first few lines of: http://www.merchantsoverseas.com/wwwroot/gorilla/bigevil.cf are: # BigEvilList Beta version 1.5 ! # Chris Santerre # All Evilrule files combined into one! # 2622 domains reduced to 178 rules Am I using the wrong link? Should that say something other than 1.5? p.s. Kudos, these rules have made a dramatic improvement on my servers. p.p.s. I may have missed it, but I suggest that the evil rules be made into a sourceforge project, or something like it. A little version control goes a long way! --- This SF.net email is sponsored by OSDN's Audience Survey. Help shape OSDN's sites and tell us what you think. Take this five minute survey and you could win a $250 Gift Certificate. http://www.wrgsurveys.com/2003/osdntech03.php?site=8 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] configure: error: C preprocessor "/lib/cpp" fails sanity check
On Wed, Dec 03, 2003 at 05:21:19PM +0100, J?rgen R. Plasser wrote: > Hi Dan, > > --On 03.12.2003 08:07 -0800 Dan Wilder wrote: > > >I'd hazard a guess there's something missing in your install > >of RH's program development stuff. > > > >What does 'config.log' say? The additional details should be > >near the end. > > I had the same thought and installed some developer stuff but it seems that > I am still missing something (in the meantime I successfully installed SA > from the binary rpms). > > make now says this (did not really help me that much): > > make -f spamd/binaries.mk spamd/spamc > make[1]: Entering directory `/root/Spamassassin/Mail-SpamAssassin-2.60' > gcc -g -O2 spamd/spamc.c spamd/libspamc.c spamd/utils.c \ >-o spamd/spamc -ldl > In file included from /usr/include/bits/posix1_lim.h:126, > from /usr/include/limits.h:144, > from > /usr/lib/gcc-lib/i386-redhat-linux/3.2.2/include/limits.h:132, > from > /usr/lib/gcc-lib/i386-redhat-linux/3.2.2/include/syslimits.h:7, > from > /usr/lib/gcc-lib/i386-redhat-linux/3.2.2/include/limits.h:11, > from /usr/include/bits/socket.h:31, > from /usr/include/sys/socket.h:35, > from spamd/libspamc.h:13, > from spamd/spamc.c:9: > /usr/include/bits/local_lim.h:36:26: linux/limits.h: No such file or > directory You're missing a package which provides kernel includes. In /usr/src/ there should be a directory or a symlink called linux, and /usr/include should have some symlinks pointing into that, or into whatever it points into. It's another piece of the basic development environment on a Linux system. -- - Dan Wilder <[EMAIL PROTECTED]> Technical Manager SSC, Inc. P.O. Box 55549 Phone: 206-782-8808 Seattle, WA 98155-0549ICQ UIN 216717075 - --- This SF.net email is sponsored by OSDN's Audience Survey. Help shape OSDN's sites and tell us what you think. Take this five minute survey and you could win a $250 Gift Certificate. http://www.wrgsurveys.com/2003/osdntech03.php?site=8 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
RE: [SAtalk] BIG HUGE EVIL RULE NEWS!!!!
latest is 1.52. Fixed 2 typos and 3 domains. An SF project..Hm... :) > -Original Message- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] > Sent: Wednesday, December 03, 2003 11:32 AM > To: Chris Santerre > Cc: 'Spamassassin-Talk (E-mail)' > Subject: Re: [SAtalk] BIG HUGE EVIL RULE NEWS > > > On 2003/12/03 09:31:24 -0500, Chris Santerre wrote: > > > What version of Bigevil do you have? 1.51 has fixed 2 typos > in 141 and 153. > > I had > > '.com||somedome' > > > > empty pipes. site updated within minutes. You got version > 1.5 I expect :) > > > > The first few lines of: > > http://www.merchantsoverseas.com/wwwroot/gorilla/bigevil.cf > > are: > > # BigEvilList Beta version 1.5 ! > # Chris Santerre > # All Evilrule files combined into one! > # 2622 domains reduced to 178 rules > > Am I using the wrong link? Should that say something other > than 1.5? > > p.s. Kudos, these rules have made a dramatic improvement on > my servers. > > p.p.s. I may have missed it, but I suggest that the evil rules be made > into a sourceforge project, or something like it. A little version > control goes a long way! > > --- This SF.net email is sponsored by OSDN's Audience Survey. Help shape OSDN's sites and tell us what you think. Take this five minute survey and you could win a $250 Gift Certificate. http://www.wrgsurveys.com/2003/osdntech03.php?site=8 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] BIG HUGE EVIL RULE NEWS!!!!
[EMAIL PROTECTED] said: > On 2003/12/03 09:31:24 -0500, Chris Santerre wrote: > >> What version of Bigevil do you have? 1.51 has fixed 2 typos in 141 >> and 153. >> I had >> '.com||somedome' >> >> empty pipes. site updated within minutes. You got version 1.5 I >> expect :) >> > > The first few lines of: > > http://www.merchantsoverseas.com/wwwroot/gorilla/bigevil.cf > > are: > > # BigEvilList Beta version 1.5 ! > # Chris Santerre > # All Evilrule files combined into one! > # 2622 domains reduced to 178 rules > > Am I using the wrong link? Should that say something other than > 1.5? > > p.s. Kudos, these rules have made a dramatic improvement on my > servers. > > p.p.s. I may have missed it, but I suggest that the evil rules be > made > into a sourceforge project, or something like it. A little version > control goes a long way! That's a good idea. Chris, if you want to set up a Sourceforge project and need any information/help, I am volunteering. I say this because the Sourceforge project administrative interface can be a bit overwhelming to new project admins. I could even set it up for you and then hand you the reins if you want. -- Kurt Yoder Sport & Health network administrator --- This SF.net email is sponsored by OSDN's Audience Survey. Help shape OSDN's sites and tell us what you think. Take this five minute survey and you could win a $250 Gift Certificate. http://www.wrgsurveys.com/2003/osdntech03.php?site=8 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] reverse scoring question
At 11:29 AM 12/3/2003, Gary Smith wrote: The question: What I was wondering if I can create a new rule that filteres on a specific piece of text (like the normal rules) but apply a negative score value. Yes, that's easy to do. Here's a howto guide: http://mywebpages.comcast.net/mkettler/sa/SA-rules-howto.txt (Note: there's one minor error in the meta rules section that I've fixed, but last time I tried to update the page Comcast's FTP service wasn't working properly) --- This SF.net email is sponsored by OSDN's Audience Survey. Help shape OSDN's sites and tell us what you think. Take this five minute survey and you could win a $250 Gift Certificate. http://www.wrgsurveys.com/2003/osdntech03.php?site=8 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
RE: [SAtalk] reverse scoring question
> > The question: > What I was wondering if I can create a new rule that filteres > on a specific piece of text (like the normal rules) but apply > a negative score value. This would allow the NPO to tell the > sender to put a key into the email to allow it to pass through. > > What's the best way to accomplish this? > > Gary Smith > Yes, same way as writing any rule, but negative score. Easiest way is to use maybe a phone number from their signiture file? This way no one has to type a pass phrase like, "ScoobyMcNasty" into every email :) --Chris --- This SF.net email is sponsored by OSDN's Audience Survey. Help shape OSDN's sites and tell us what you think. Take this five minute survey and you could win a $250 Gift Certificate. http://www.wrgsurveys.com/2003/osdntech03.php?site=8 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
RE: [SAtalk] reverse scoring question
Thanks for the quick response guys... 14 minutes... Your betting Dell for their award winning response :) This will surely help. Gary Smith -Original Message- From: Matt Kettler [mailto:[EMAIL PROTECTED] Sent: Wednesday, December 03, 2003 8:44 AM To: Gary Smith; [EMAIL PROTECTED] Subject:Re: [SAtalk] reverse scoring question At 11:29 AM 12/3/2003, Gary Smith wrote: >The question: >What I was wondering if I can create a new rule that filteres on a >specific piece of text (like the normal rules) but apply a negative score >value. Yes, that's easy to do. Here's a howto guide: http://mywebpages.comcast.net/mkettler/sa/SA-rules-howto.txt (Note: there's one minor error in the meta rules section that I've fixed, but last time I tried to update the page Comcast's FTP service wasn't working properly) --- This SF.net email is sponsored by OSDN's Audience Survey. Help shape OSDN's sites and tell us what you think. Take this five minute survey and you could win a $250 Gift Certificate. http://www.wrgsurveys.com/2003/osdntech03.php?site=8 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
RE: [SAtalk] BIG HUGE EVIL RULE NEWS!!!!
how agressive are these rules? I am hearing great things about them but dont want to produce FP's on my production system. Any feedback? thanks adam On Wed, 2003-12-03 at 11:42, Chris Santerre wrote: > latest is 1.52. Fixed 2 typos and 3 domains. An SF > project..Hm... :) > > > -Original Message- > > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] > > Sent: Wednesday, December 03, 2003 11:32 AM > > To: Chris Santerre > > Cc: 'Spamassassin-Talk (E-mail)' > > Subject: Re: [SAtalk] BIG HUGE EVIL RULE NEWS > > > > > > On 2003/12/03 09:31:24 -0500, Chris Santerre wrote: > > > > > What version of Bigevil do you have? 1.51 has fixed 2 typos > > in 141 and 153. > > > I had > > > '.com||somedome' > > > > > > empty pipes. site updated within minutes. You got version > > 1.5 I expect :) > > > > > > > The first few lines of: > > > > http://www.merchantsoverseas.com/wwwroot/gorilla/bigevil.cf > > > > are: > > > > # BigEvilList Beta version 1.5 ! > > # Chris Santerre > > # All Evilrule files combined into one! > > # 2622 domains reduced to 178 rules > > > > Am I using the wrong link? Should that say something other > > than 1.5? > > > > p.s. Kudos, these rules have made a dramatic improvement on > > my servers. > > > > p.p.s. I may have missed it, but I suggest that the evil rules be made > > into a sourceforge project, or something like it. A little version > > control goes a long way! > > > > > > > --- > This SF.net email is sponsored by OSDN's Audience Survey. > Help shape OSDN's sites and tell us what you think. Take this > five minute survey and you could win a $250 Gift Certificate. > http://www.wrgsurveys.com/2003/osdntech03.php?site=8 > ___ > Spamassassin-talk mailing list > [EMAIL PROTECTED] > https://lists.sourceforge.net/lists/listinfo/spamassassin-talk > --- This SF.net email is sponsored by OSDN's Audience Survey. Help shape OSDN's sites and tell us what you think. Take this five minute survey and you could win a $250 Gift Certificate. http://www.wrgsurveys.com/2003/osdntech03.php?site=8 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
[SAtalk] Spammer with dot in the mail from header
Hello,
I
would like to block spammer that sends me emails with mail from [EMAIL PROTECTED]
Which
X is a random words and numbers.
My
problem is the dot in the mail from.
Can
some one help me to configure a rule for that ?
I
try this one:
header
LOCAL_SAPM_FROM_WALLA ALL =~ /\abcd.\w{0,[EMAIL PROTECTED]/i
score
LOCAL_SAPM_FROM_WALLA 10.0
Thanks
in advance
[SAtalk] Force Feeding The Bayesian Database
I'm setting up per user bayesian databases but as i've mentioned in other posts, many of the people using the system recieve low volumes of spam... 4-10 a day maybe. Accordingly it would take them 1-2 months for the database to kick in. Does anybody have a bayesian database that is fairly generic and would serve as a good starting point for each user as their own messages begin to train the system? Thanks! Arlo On Dec 3, 2003, at 10:46 AM, Chris Santerre wrote: The question: What I was wondering if I can create a new rule that filteres on a specific piece of text (like the normal rules) but apply a negative score value. This would allow the NPO to tell the sender to put a key into the email to allow it to pass through. What's the best way to accomplish this? Gary Smith Yes, same way as writing any rule, but negative score. Easiest way is to use maybe a phone number from their signiture file? This way no one has to type a pass phrase like, "ScoobyMcNasty" into every email :) --Chris --- This SF.net email is sponsored by OSDN's Audience Survey. Help shape OSDN's sites and tell us what you think. Take this five minute survey and you could win a $250 Gift Certificate. http://www.wrgsurveys.com/2003/osdntech03.php?site=8 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk --- This SF.net email is sponsored by OSDN's Audience Survey. Help shape OSDN's sites and tell us what you think. Take this five minute survey and you could win a $250 Gift Certificate. http://www.wrgsurveys.com/2003/osdntech03.php?site=8 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
[SAtalk] SA-Learn
I recently trained SA-Learn and its working very well. The question I have is can I feed the 5 or 6 spams I get a day into SA-Learn without have to give it 1000+ ham\spam? I see in the documentation a reference to do something like this with the no-rebuild option but Im still a bit confused. If someone could please let me know the syntax that would be Great Thanks Josh --- This SF.net email is sponsored by OSDN's Audience Survey. Help shape OSDN's sites and tell us what you think. Take this five minute survey and you could win a $250 Gift Certificate. http://www.wrgsurveys.com/2003/osdntech03.php?site=8 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] Force Feeding The Bayesian Database
At 09:10 AM 12/3/2003, you wrote: I'm setting up per user bayesian databases but as i've mentioned in other posts, many of the people using the system recieve low volumes of spam... 4-10 a day maybe. Accordingly it would take them 1-2 months for the database to kick in. Does anybody have a bayesian database that is fairly generic and would serve as a good starting point for each user as their own messages begin to train the system? Are all of your users in the same company/organization? If so, you could use the same database for all of them for a while, and then split it out once it kicks in. It's still a better idea to train individually, but your users (may) have more in common with each other than they do with, say, my users. --Ernest Thanks! Arlo On Dec 3, 2003, at 10:46 AM, Chris Santerre wrote: > >> >> The question: >> What I was wondering if I can create a new rule that filteres >> on a specific piece of text (like the normal rules) but apply >> a negative score value. This would allow the NPO to tell the >> sender to put a key into the email to allow it to pass through. >> >> What's the best way to accomplish this? >> >> Gary Smith >> > > Yes, same way as writing any rule, but negative score. Easiest way is > to use > maybe a phone number from their signiture file? > > This way no one has to type a pass phrase like, "ScoobyMcNasty" into > every > email :) > > --Chris > > > --- > This SF.net email is sponsored by OSDN's Audience Survey. > Help shape OSDN's sites and tell us what you think. Take this > five minute survey and you could win a $250 Gift Certificate. > http://www.wrgsurveys.com/2003/osdntech03.php?site=8 > ___ > Spamassassin-talk mailing list > [EMAIL PROTECTED] > https://lists.sourceforge.net/lists/listinfo/spamassassin-talk --- This SF.net email is sponsored by OSDN's Audience Survey. Help shape OSDN's sites and tell us what you think. Take this five minute survey and you could win a $250 Gift Certificate. http://www.wrgsurveys.com/2003/osdntech03.php?site=8 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk --- This SF.net email is sponsored by OSDN's Audience Survey. Help shape OSDN's sites and tell us what you think. Take this five minute survey and you could win a $250 Gift Certificate. http://www.wrgsurveys.com/2003/osdntech03.php?site=8 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
RE: [SAtalk] BIG HUGE EVIL RULE NEWS!!!!
How can I tell that SA is actually using these rules (located in /etc/mail/spamassassin/bigevil.cf) ? --- This SF.net email is sponsored by OSDN's Audience Survey. Help shape OSDN's sites and tell us what you think. Take this five minute survey and you could win a $250 Gift Certificate. http://www.wrgsurveys.com/2003/osdntech03.php?site=8 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
[SAtalk] MIME_MISSING_BOUNDARY
Hi, I am working on our newsletter and I have been testing it against spamassassin to make sure I am not doing anything too stupid. I am being tripped up by MIME_MISSING_BOUNDARY. A modified version of the message is below-- can anyone easily tell what I am doing wrong with the mime boundary? =-=-=-=-=- Return-Path: <[EMAIL PROTECTED]> Received: from server3.example.com (server3.internal [10.202.2.134]) by server2.example.com (Cyrus v2.1.9) with LMTP; Wed, 03 Dec 2003 11:55:32 -0500 X-Sieve: CMU Sieve 2.2 X-Spam-score: 2.6 X-Spam-hits: BAYES_00, HTML_FONTCOLOR_BLUE, HTML_FONTCOLOR_RED, HTML_MESSAGE, MIME_HTML_MOSTLY, MIME_MISSING_BOUNDARY, MSGID_FROM_MTA_SHORT Reply-To: [EMAIL PROTECTED] Subject: Member Newsletter To: [EMAIL PROTECTED] From: "member newsletter" <[EMAIL PROTECTED]> Content-Type: multipart/alternative; boundary="=-1070470530-866003-65583-1972-1-=" MIME-Version: 1.0 Message-Id: <[EMAIL PROTECTED]> Date: Wed, 3 Dec 2003 08:55:30 -0800 (PST) --=-1070470530-866003-65583-1972-1-= Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit You are seeing this message because your email program is not configured to read html messages. You can view this message on-line at: http://www.example.com/newsletter/4.html --=-1070470530-866003-65583-1972-1-= Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: 7bit html cut out of message... --=-1070470530-866003-65583-1972-1-=-- --- This SF.net email is sponsored by OSDN's Audience Survey. Help shape OSDN's sites and tell us what you think. Take this five minute survey and you could win a $250 Gift Certificate. http://www.wrgsurveys.com/2003/osdntech03.php?site=8 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
RE: [SAtalk] BIG HUGE EVIL RULE NEWS!!!!
Watch for hits? It shouldn't take long, those rules hit about 1 in 5 for me. -Original Message- From: Vee Persaud [mailto:[EMAIL PROTECTED] Sent: Wednesday, December 03, 2003 10:48 AM To: Spamassassin-Talk (E-mail) Subject: RE: [SAtalk] BIG HUGE EVIL RULE NEWS How can I tell that SA is actually using these rules (located in /etc/mail/spamassassin/bigevil.cf) ? --- This SF.net email is sponsored by OSDN's Audience Survey. Help shape OSDN's sites and tell us what you think. Take this five minute survey and you could win a $250 Gift Certificate. http://www.wrgsurveys.com/2003/osdntech03.php?site=8 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk --- This SF.net email is sponsored by OSDN's Audience Survey. Help shape OSDN's sites and tell us what you think. Take this five minute survey and you could win a $250 Gift Certificate. http://www.wrgsurveys.com/2003/osdntech03.php?site=8 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] Force Feeding The Bayesian Database
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Wednesday 03 December 2003 09:10 am, Arlo Gilbert wrote: > I'm setting up per user bayesian databases but as i've mentioned in > other posts, many of the people using the system recieve low volumes of > spam... 4-10 a day maybe. Accordingly it would take them 1-2 months for > the database to kick in. > > Does anybody have a bayesian database that is fairly generic and would > serve as a good starting point for each user as their own messages > begin to train the system? > > Thanks! > Arlo I have amde an rpm with just such a thing along with some extra filter sets and things. I use it for server installs I do. It works so far flawlessly. - -- -~`'~-~`'~-~`'~-~`'~-~`'~-~`'~-~`'~-~`'~-~`'~-~`'~-~`'~-~`'~-~`'~-~`'~-~`'~- Brook Humphrey Mobile PC Medic, 420 1st, Cheney, WA 99004, 509-235-9107 http://www.webmedic.net, [EMAIL PROTECTED], [EMAIL PROTECTED] Holiness unto the Lord -~`'~-~`'~-~`'~-~`'~-~`'~-~`'~-~`'~-~`'~-~`'~-~`'~-~`'~-~`'~-~`'~-~`'~-~`'~- -BEGIN PGP SIGNATURE- Version: GnuPG v1.2.3 (GNU/Linux) iD8DBQE/zhvtnT1TkA6FgPgRAnbqAJ9X7LZ3RlbTSvCxTlyxfIDXxOkvIACfbQgS XMfdHKpxjNswvPlyzKdq7h0= =+ttI -END PGP SIGNATURE- --- This SF.net email is sponsored by OSDN's Audience Survey. Help shape OSDN's sites and tell us what you think. Take this five minute survey and you could win a $250 Gift Certificate. http://www.wrgsurveys.com/2003/osdntech03.php?site=8 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] Spammer with dot in the mail from header
Idan Lerer said:
> I would like to block spammer that sends me emails with mail from
> [EMAIL PROTECTED]
> header LOCAL_SAPM_FROM_WALLA ALL =~ /\abcd.\w{0,[EMAIL PROTECTED]/i
Idan,
quote the dot "\.":
header LOCAL_SAPM_FROM_WALLA ALL =~ /abcd\.\w{0,[EMAIL PROTECTED]/i
--
Chris Thielen
Easily generate SpamAssassin rules to catch obfuscated spam phrases:
http://www.sandgnat.com/cmos/
---
This SF.net email is sponsored by OSDN's Audience Survey.
Help shape OSDN's sites and tell us what you think. Take this
five minute survey and you could win a $250 Gift Certificate.
http://www.wrgsurveys.com/2003/osdntech03.php?site=8
___
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] BIG HUGE EVIL RULE NEWS!!!!
On Wed, Dec 03, 2003 at 11:48:03AM -0500, Vee Persaud wrote: > > How can I tell that SA is actually using these rules (located in > /etc/mail/spamassassin/bigevil.cf) ? Feed your MTA a mail designed to match one or more of the rules, and look for the match in your logs. Ir just put the rules in place and wait a bit. My first hit came within about 3 minutes after I put the rules in place. *sigh* -- Mike Andrews [EMAIL PROTECTED] Tired old sysadmin --- This SF.net email is sponsored by OSDN's Audience Survey. Help shape OSDN's sites and tell us what you think. Take this five minute survey and you could win a $250 Gift Certificate. http://www.wrgsurveys.com/2003/osdntech03.php?site=8 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
RE: [SAtalk] BIG HUGE EVIL RULE NEWS!!!!
They score a 3.0 because there should be NO FPs other them my own mistakes. Which can be edited out in seconds. They match specific spamhosts only. There is no regex formula other then the spamhost name. Those who know me, know I don't like high scoring rules. But these are dead on, unless I goof up on one. IF you find any FPs, remove that one domain from rule and report it to me right away. I'm guessing this should only be a problem right now as posting 2200+ domains I'm bound to typo a few. So I'm thinking there may be 1-3 minor fixes this week as people find a typo here and there. But after that, it should be 100%! So yes they are agressive, but solid. You could always lower the score. Only 178 to change :) (Hey that is nothing compared to how many times I had to hit ' | , DELETE, END ' because I was in a hurry to get done!) --Chris Santerre > -Original Message- > From: Adam Denenberg [mailto:[EMAIL PROTECTED] > Sent: Wednesday, December 03, 2003 11:57 AM > To: 'Spamassassin-Talk (E-mail)' > Subject: RE: [SAtalk] BIG HUGE EVIL RULE NEWS > > > how agressive are these rules? I am hearing great things > about them but > dont want to produce FP's on my production system. > > Any feedback? > > thanks > adam > > On Wed, 2003-12-03 at 11:42, Chris Santerre wrote: > > latest is 1.52. Fixed 2 typos and 3 domains. An SF > > project..Hm... :) > > > > > -Original Message- > > > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] > > > Sent: Wednesday, December 03, 2003 11:32 AM > > > To: Chris Santerre > > > Cc: 'Spamassassin-Talk (E-mail)' > > > Subject: Re: [SAtalk] BIG HUGE EVIL RULE NEWS > > > > > > > > > On 2003/12/03 09:31:24 -0500, Chris Santerre wrote: > > > > > > > What version of Bigevil do you have? 1.51 has fixed 2 typos > > > in 141 and 153. > > > > I had > > > > '.com||somedome' > > > > > > > > empty pipes. site updated within minutes. You got version > > > 1.5 I expect :) > > > > > > > > > > The first few lines of: > > > > > > http://www.merchantsoverseas.com/wwwroot/gorilla/bigevil.cf > > > > > > are: > > > > > > # BigEvilList Beta version 1.5 ! > > > # Chris Santerre > > > # All Evilrule files combined into one! > > > # 2622 domains reduced to 178 rules > > > > > > Am I using the wrong link? Should that say something other > > > than 1.5? > > > > > > p.s. Kudos, these rules have made a dramatic improvement on > > > my servers. > > > > > > p.p.s. I may have missed it, but I suggest that the evil > rules be made > > > into a sourceforge project, or something like it. A > little version > > > control goes a long way! > > > > > > > > > > > > --- > > This SF.net email is sponsored by OSDN's Audience Survey. > > Help shape OSDN's sites and tell us what you think. Take this > > five minute survey and you could win a $250 Gift Certificate. > > http://www.wrgsurveys.com/2003/osdntech03.php?site=8 > > ___ > > Spamassassin-talk mailing list > > [EMAIL PROTECTED] > > https://lists.sourceforge.net/lists/listinfo/spamassassin-talk > > > > > > --- > This SF.net email is sponsored by OSDN's Audience Survey. > Help shape OSDN's sites and tell us what you think. Take this > five minute survey and you could win a $250 Gift Certificate. > http://www.wrgsurveys.com/2003/osdntech03.php?site=8 > ___ > Spamassassin-talk mailing list > [EMAIL PROTECTED] > https://lists.sourceforge.net/lists/listinfo/spamassassin-talk > --- This SF.net email is sponsored by OSDN's Audience Survey. Help shape OSDN's sites and tell us what you think. Take this five minute survey and you could win a $250 Gift Certificate. http://www.wrgsurveys.com/2003/osdntech03.php?site=8 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] Force Feeding The Bayesian Database
On Dec 3, 2003, at 11:18 AM, Ernest W. Lessenger wrote: Are all of your users in the same company/organization? If so, you could use the same database for all of them for a while, and then split it out once it kicks in. It's still a better idea to train individually, but your users (may) have more in common with each other than they do with, say, my users. --Ernest All of the users are home users and they have nothing in common. --- This SF.net email is sponsored by OSDN's Audience Survey. Help shape OSDN's sites and tell us what you think. Take this five minute survey and you could win a $250 Gift Certificate. http://www.wrgsurveys.com/2003/osdntech03.php?site=8 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
RE: [SAtalk] BIG HUGE EVIL RULE NEWS!!!!
Go to hotmail or whatever, send yourself an email with an Evil domain in it: kievonline.org check when it comes in. :) --Chris > -Original Message- > From: Vee Persaud [mailto:[EMAIL PROTECTED] > Sent: Wednesday, December 03, 2003 11:48 AM > To: Spamassassin-Talk (E-mail) > Subject: RE: [SAtalk] BIG HUGE EVIL RULE NEWS > > > > How can I tell that SA is actually using these rules (located > in /etc/mail/spamassassin/bigevil.cf) ? > > > > > > --- > This SF.net email is sponsored by OSDN's Audience Survey. > Help shape OSDN's sites and tell us what you think. Take this > five minute survey and you could win a $250 Gift Certificate. > http://www.wrgsurveys.com/2003/osdntech03.php?site > ___ > Spamassassin-talk mailing list > [EMAIL PROTECTED] > https://lists.sourceforge.net/lists/listinfo/spamassassin-talk > --- This SF.net email is sponsored by OSDN's Audience Survey. Help shape OSDN's sites and tell us what you think. Take this five minute survey and you could win a $250 Gift Certificate. http://www.wrgsurveys.com/2003/osdntech03.php?site=8 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
RE: [SAtalk] BIG HUGE EVIL RULE NEWS!!!!
They're all scored at 3.0 -- so a lot depends on where you've set your spam level. The "original" had a few typoes that have since been corrected. Before the "big evil" was released, I was using a portion of the original "evil rules" to filter mail for around 3000 customers. Now I'm using the "big evil" and getting better performance. I'm using spamassassin 2.60, a few locally grown rules and whitelist entries, bigevil, and popcorn/backhair/weeds/chickenpox (some with adjusted scores). My spam level is 4.9 -- and I can count all of the FP's I've seen in three months on my fingers. Most of those have come from either the popcorn/backhair/weeds/chickenpox collection or my own sets. My users are still reporting a lot of spam--but now, I just take the links from their reports and add them to my own "localevil" file. I personally haven't seen any FPs yet from bigevil--but then again, it's only been out a couple of days. --jenni On Wed, 3 Dec 2003, Adam Denenberg wrote: > how agressive are these rules? I am hearing great things about them but > dont want to produce FP's on my production system. > > Any feedback? > > thanks > adam > > On Wed, 2003-12-03 at 11:42, Chris Santerre wrote: > > latest is 1.52. Fixed 2 typos and 3 domains. An SF > > project..Hm... :) > > > > > -Original Message- > > > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] > > > Sent: Wednesday, December 03, 2003 11:32 AM > > > To: Chris Santerre > > > Cc: 'Spamassassin-Talk (E-mail)' > > > Subject: Re: [SAtalk] BIG HUGE EVIL RULE NEWS > > > > > > > > > On 2003/12/03 09:31:24 -0500, Chris Santerre wrote: > > > > > > > What version of Bigevil do you have? 1.51 has fixed 2 typos > > > in 141 and 153. > > > > I had > > > > '.com||somedome' > > > > > > > > empty pipes. site updated within minutes. You got version > > > 1.5 I expect :) > > > > > > > > > > The first few lines of: > > > > > > http://www.merchantsoverseas.com/wwwroot/gorilla/bigevil.cf > > > > > > are: > > > > > > # BigEvilList Beta version 1.5 ! > > > # Chris Santerre > > > # All Evilrule files combined into one! > > > # 2622 domains reduced to 178 rules > > > > > > Am I using the wrong link? Should that say something other > > > than 1.5? > > > > > > p.s. Kudos, these rules have made a dramatic improvement on > > > my servers. > > > > > > p.p.s. I may have missed it, but I suggest that the evil rules be made > > > into a sourceforge project, or something like it. A little version > > > control goes a long way! > > > > > > > > > > > > --- > > This SF.net email is sponsored by OSDN's Audience Survey. > > Help shape OSDN's sites and tell us what you think. Take this > > five minute survey and you could win a $250 Gift Certificate. > > http://www.wrgsurveys.com/2003/osdntech03.php?site=8 > > ___ > > Spamassassin-talk mailing list > > [EMAIL PROTECTED] > > https://lists.sourceforge.net/lists/listinfo/spamassassin-talk > > > > > > --- > This SF.net email is sponsored by OSDN's Audience Survey. > Help shape OSDN's sites and tell us what you think. Take this > five minute survey and you could win a $250 Gift Certificate. > http://www.wrgsurveys.com/2003/osdntech03.php?site=8 > ___ > Spamassassin-talk mailing list > [EMAIL PROTECTED] > https://lists.sourceforge.net/lists/listinfo/spamassassin-talk > --- This SF.net email is sponsored by OSDN's Audience Survey. Help shape OSDN's sites and tell us what you think. Take this five minute survey and you could win a $250 Gift Certificate. http://www.wrgsurveys.com/2003/osdntech03.php?site=8 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
[SAtalk] spamd, rewrite_subject being ignored everywhere
Hi, I'm having an odd problem with SpamAssassin 2.60, Qmail-Scanner 1.20 and "net"qmail 1.04 compiled from source (RedHat 9). I have ran spamd in debug mode and looked at the spamd script to verify my config files are located here: /usr/share/spamassassin /etc/mail/spamassassin /home/spamd/.spamassassin/user_prefs I'm running spamd using daemontools with this set of flags: /usr/bin/spamd -m 20 -L -u spamd -H /home/spamd when I run it like that using -D too, everything looks great. I have a test rule set up to = 200 points, and see this at the very end: debug: is spam? score=200 required=5 tests=JWM_TEST2 logmsg: identified spam (200.0/5.0) for [EMAIL PROTECTED]:508 in 0.1 seconds, 776 bytes. debug: cleaned up kid 3595, pool=20 When I get the message it has X-Spam-Status: Yes in the headers (hits=200.0 required=5.0) ... but the subject doesn't get rewritten and there's no report. I'm just using the custom report in /usr/share/spamassassin/10_misc.cf my /etc/mail/spamassassin/local.cf file (which is readable by the spamd account) contains this plus my test rule: required_hits 5 rewrite_subject 1 report_safe 1 subject_tag * SPAM allow_user_rules1 I also tried putting that into /home/spamd/.spamassassin/user_prefs but it didn't help. I then put that in /usr/share/spamassassin/10_misc.cf as a test even though I know that's not where it really goes... and it still didn't help. I can't see anything in the -D info when running spamd that talks about using a report or not, or rewriting the subject or not. It just says its spam and uses the X-Spam-Flag: YES but doesn't rewrite the subject. It bugs me because my custom rule is getting used just fine, just not the rewrite_Subject and report_safe 1... (which is set to the default of 1 in /usr/share/spamassassin/ anyway). I restarted spamd after each config change.. and checked the FAQ.. any ideas? Is it because spamd is running in "taint" mode as the user spamd (which is set to use the /sbin/nologin shell in redhat9)? I still need to try running spamd without the -u and -H flags but I was hoping to be able to use them. I also need to check more, maybe there's a clear_report_whatever command somewhere that's erasing the default report? But it should still be rewriting the subject, argh.. Take care, Jeremy --- This SF.net email is sponsored by OSDN's Audience Survey. Help shape OSDN's sites and tell us what you think. Take this five minute survey and you could win a $250 Gift Certificate. http://www.wrgsurveys.com/2003/osdntech03.php?site=8 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] SA-Learn
On December 03, 2003 12:07 pm, Tobin wrote: > I recently trained SA-Learn and its working very well. The question I > have is can I feed the 5 or 6 spams I get a day into SA-Learn without > have to give it 1000+ ham\spam? I see in the documentation a reference > to do something like this with the no-rebuild option but Im still a bit > confused. I'm not quite sure what you mean by "without have to give it 1000+ ham/spam". But if you mean you are concerned that sa-learn with re-learn your existing messages in your mailbox, then don't worry about it. sa-learn will ignore messages already learnt, and will only take time proportional to that required to learn new messages. -- If you don't have a nasty obituary you probably didn't matter. -- Freeman Dyson --- This SF.net email is sponsored by OSDN's Audience Survey. Help shape OSDN's sites and tell us what you think. Take this five minute survey and you could win a $250 Gift Certificate. http://www.wrgsurveys.com/2003/osdntech03.php?site=8 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
RE: [SAtalk] Spammer with dot in the mail from header
HI there
> -Original Message-
> From: [EMAIL PROTECTED]
[mailto:spamassassin-
> [EMAIL PROTECTED] On Behalf Of Chris Thielen
> Sent: Wednesday, December 03, 2003 12:26 PM
> To: Spamassassin-Talk
> Cc: Idan Lerer
> Subject: Re: [SAtalk] Spammer with dot in the mail from header
>
> Idan Lerer said:
> > I would like to block spammer that sends me emails with mail from
> > [EMAIL PROTECTED]
>
> > header LOCAL_SAPM_FROM_WALLA ALL =~ /\abcd.\w{0,[EMAIL PROTECTED]/i
>
> Idan,
>
> quote the dot "\.":
> header LOCAL_SAPM_FROM_WALLA ALL =~ /abcd\.\w{0,[EMAIL PROTECTED]/i
oops.. missed the second dot
header LOCAL_SAPM_FROM_WALLA ALL =~ /abcd\.\w{0,[EMAIL PROTECTED]/i
Jennifer
>
> --
> Chris Thielen
>
> Easily generate SpamAssassin rules to catch obfuscated spam phrases:
> http://www.sandgnat.com/cmos/
>
>
> ---
> This SF.net email is sponsored by OSDN's Audience Survey.
> Help shape OSDN's sites and tell us what you think. Take this
> five minute survey and you could win a $250 Gift Certificate.
> http://www.wrgsurveys.com/2003/osdntech03.php?site=8
> ___
> Spamassassin-talk mailing list
> [EMAIL PROTECTED]
> https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
---
This SF.net email is sponsored by OSDN's Audience Survey.
Help shape OSDN's sites and tell us what you think. Take this
five minute survey and you could win a $250 Gift Certificate.
http://www.wrgsurveys.com/2003/osdntech03.php?site=8
___
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
RE: [SAtalk] BIG HUGE EVIL RULE NEWS!!!!
> You could always lower the score. Only 178 to change :) > (Hey that is nothing compared to how many times I had to hit ' | , DELETE, > END ' because I was in a hurry to get done!) Hi Chris, You should grab multiedit. Rockage. You can do your edits with little macros. Jennifer > > --Chris Santerre > > > > -Original Message- > > From: Adam Denenberg [mailto:[EMAIL PROTECTED] > > Sent: Wednesday, December 03, 2003 11:57 AM > > To: 'Spamassassin-Talk (E-mail)' > > Subject: RE: [SAtalk] BIG HUGE EVIL RULE NEWS > > > > > > how agressive are these rules? I am hearing great things > > about them but > > dont want to produce FP's on my production system. > > > > Any feedback? > > > > thanks > > adam > > > > On Wed, 2003-12-03 at 11:42, Chris Santerre wrote: > > > latest is 1.52. Fixed 2 typos and 3 domains. An SF > > > project..Hm... :) > > > > > > > -Original Message- > > > > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] > > > > Sent: Wednesday, December 03, 2003 11:32 AM > > > > To: Chris Santerre > > > > Cc: 'Spamassassin-Talk (E-mail)' > > > > Subject: Re: [SAtalk] BIG HUGE EVIL RULE NEWS > > > > > > > > > > > > On 2003/12/03 09:31:24 -0500, Chris Santerre wrote: > > > > > > > > > What version of Bigevil do you have? 1.51 has fixed 2 typos > > > > in 141 and 153. > > > > > I had > > > > > '.com||somedome' > > > > > > > > > > empty pipes. site updated within minutes. You got version > > > > 1.5 I expect :) > > > > > > > > > > > > > The first few lines of: > > > > > > > > http://www.merchantsoverseas.com/wwwroot/gorilla/bigevil.cf > > > > > > > > are: > > > > > > > > # BigEvilList Beta version 1.5 ! > > > > # Chris Santerre > > > > # All Evilrule files combined into one! > > > > # 2622 domains reduced to 178 rules > > > > > > > > Am I using the wrong link? Should that say something other > > > > than 1.5? > > > > > > > > p.s. Kudos, these rules have made a dramatic improvement on > > > > my servers. > > > > > > > > p.p.s. I may have missed it, but I suggest that the evil > > rules be made > > > > into a sourceforge project, or something like it. A > > little version > > > > control goes a long way! > > > > > > > > > > > > > > > > > --- > > > This SF.net email is sponsored by OSDN's Audience Survey. > > > Help shape OSDN's sites and tell us what you think. Take this > > > five minute survey and you could win a $250 Gift Certificate. > > > http://www.wrgsurveys.com/2003/osdntech03.php?site=8 > > > ___ > > > Spamassassin-talk mailing list > > > [EMAIL PROTECTED] > > > https://lists.sourceforge.net/lists/listinfo/spamassassin-talk > > > > > > > > > > > --- > > This SF.net email is sponsored by OSDN's Audience Survey. > > Help shape OSDN's sites and tell us what you think. Take this > > five minute survey and you could win a $250 Gift Certificate. > > http://www.wrgsurveys.com/2003/osdntech03.php?site=8 > > ___ > > Spamassassin-talk mailing list > > [EMAIL PROTECTED] > > https://lists.sourceforge.net/lists/listinfo/spamassassin-talk > > > > > --- > This SF.net email is sponsored by OSDN's Audience Survey. > Help shape OSDN's sites and tell us what you think. Take this > five minute survey and you could win a $250 Gift Certificate. > http://www.wrgsurveys.com/2003/osdntech03.php?site=8 > ___ > Spamassassin-talk mailing list > [EMAIL PROTECTED] > https://lists.sourceforge.net/lists/listinfo/spamassassin-talk --- This SF.net email is sponsored by OSDN's Audience Survey. Help shape OSDN's sites and tell us what you think. Take this five minute survey and you could win a $250 Gift Certificate. http://www.wrgsurveys.com/2003/osdntech03.php?site=8 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
[SAtalk] Re: BIG HUGE EVIL RULE NEWS!!!!
Rich Puhek <[EMAIL PROTECTED]> wrote: > Now to see if the payment terms mean that I can write off purchases > of Wild tickets :-) I'm planning on visiting my brother, who has 2 season tickets to the Dallas Stars... Where did I put that that Madano jersey? -- + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Chris Barnes AOL IM: CNBarnes [EMAIL PROTECTED]Yahoo IM: chrisnbarnes Computer Systems Manager ph: 979-845-7801 Department of Physics fax: 979-845-2590 Texas A&M University --- This SF.net email is sponsored by OSDN's Audience Survey. Help shape OSDN's sites and tell us what you think. Take this five minute survey and you could win a $250 Gift Certificate. http://www.wrgsurveys.com/2003/osdntech03.php?site=8 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
[SAtalk] Bigevil domain hat-check help
I've got a domain listed in Bigevil that could be legit. I need a hatcheck on this one. It is not that obvious. Can someone give me info on: as1.emv2.com or the emv2.com domain in general? (not WHOIS, I can do that!) *sigh* 1.54 is up. This domain IS still listed in it. Chris Santerre System Admin and SA Custom Rules Emporium keeper http://www.merchantsoverseas.com/wwwroot/gorilla/sa_rules.htm "A little nonsense now and then, is relished by the wisest men." - Willy Wonka --- This SF.net email is sponsored by OSDN's Audience Survey. Help shape OSDN's sites and tell us what you think. Take this five minute survey and you could win a $250 Gift Certificate. http://www.wrgsurveys.com/2003/osdntech03.php?site=8 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
RE: [SAtalk] Re: BIG HUGE EVIL RULE NEWS!!!!
> -Original Message- > From: Chris Barnes [mailto:[EMAIL PROTECTED] > Sent: Wednesday, December 03, 2003 12:53 PM > To: [EMAIL PROTECTED] > Subject: [SAtalk] Re: BIG HUGE EVIL RULE NEWS > > > Rich Puhek <[EMAIL PROTECTED]> wrote: > > Now to see if the payment terms mean that I can write off purchases > > of Wild tickets :-) > > I'm planning on visiting my brother, who has 2 season tickets to the > Dallas Stars... > > Where did I put that that Madano jersey? > Check the trash bin! :) Sorry I couldn't resist! GO BRUINS! OK, just hold the lead,nook a tie is good.N!!! --Chris --- This SF.net email is sponsored by OSDN's Audience Survey. Help shape OSDN's sites and tell us what you think. Take this five minute survey and you could win a $250 Gift Certificate. http://www.wrgsurveys.com/2003/osdntech03.php?site=8 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] spamd, rewrite_subject being ignored everywhere
At 12:40 PM 12/3/2003, Martin, Jeremy wrote: I'm having an odd problem with SpamAssassin 2.60, Qmail-Scanner 1.20 and "net"qmail 1.04 compiled from source (RedHat 9). qmail-scanner does not use spamd/spamc's modification of subject lines, it does the subject taggigng itself. Please read the qmail-scanner FAQ #'s 12 through 15. http://qmail-scanner.sourceforge.net/FAQ.php --- This SF.net email is sponsored by OSDN's Audience Survey. Help shape OSDN's sites and tell us what you think. Take this five minute survey and you could win a $250 Gift Certificate. http://www.wrgsurveys.com/2003/osdntech03.php?site=8 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] Bigevil domain hat-check help
Chris Santerre wrote: I've got a domain listed in Bigevil that could be legit. I need a hatcheck on this one. It is not that obvious. Can someone give me info on: as1.emv2.com or the emv2.com domain in general? (not WHOIS, I can do that!) Hi, http://www.openrbl.org and pop in the domain. They are listed by a few rbl's. Regards, Rick --- This SF.net email is sponsored by OSDN's Audience Survey. Help shape OSDN's sites and tell us what you think. Take this five minute survey and you could win a $250 Gift Certificate. http://www.wrgsurveys.com/2003/osdntech03.php?site=8 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
RE: [SAtalk] Spammer with dot in the mail from header
On Wed, 3 Dec 2003, Jennifer Wheeler wrote:
> > Idan Lerer said:
> > > I would like to block spammer that sends me emails with mail from
> > > [EMAIL PROTECTED]
> >
> > > header LOCAL_SAPM_FROM_WALLA ALL =~ /\abcd.\w{0,[EMAIL PROTECTED]/i
> >
> > Idan,
> >
> > quote the dot "\.":
> > header LOCAL_SAPM_FROM_WALLA ALL =~ /abcd\.\w{0,[EMAIL PROTECTED]/i
>
> oops.. missed the second dot
> header LOCAL_SAPM_FROM_WALLA ALL =~ /abcd\.\w{0,[EMAIL PROTECTED]/i
Too, do be sure that you include that "domain\.com" piece. Lots
of companies use [EMAIL PROTECTED] as the primary e-mail
addy for their employees (mine is one of them). If you don't localise
that on the "domain\.com" part you're just about guaranteed to over-
block.
++-+
| Carl Richard Friend (UNIX Sysadmin)| West Boylston |
| Minicomputer Collector / Enthusiast| Massachusetts, USA |
| mailto:[EMAIL PROTECTED]+-+
| http://users.rcn.com/crfriend/museum | ICBM: 42:22N 71:47W |
++-+
---
This SF.net email is sponsored by OSDN's Audience Survey.
Help shape OSDN's sites and tell us what you think. Take this
five minute survey and you could win a $250 Gift Certificate.
http://www.wrgsurveys.com/2003/osdntech03.php?site=8
___
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
RE: [SAtalk] Bigevil domain hat-check help
> -Original Message- > From: [EMAIL PROTECTED] [mailto:spamassassin- > [EMAIL PROTECTED] On Behalf Of Chris Santerre > Sent: Wednesday, December 03, 2003 1:08 PM > To: Spamassassin-Talk (E-mail) > Subject: [SAtalk] Bigevil domain hat-check help > > I've got a domain listed in Bigevil that could be legit. I need a hatcheck > on this one. It is not that obvious. Can someone give me info on: > > as1.emv2.com > > or the emv2.com domain in general? (not WHOIS, I can do that!) http://www.google.com/groups?as_q=emv2.com&as_oq=spam%20uce%20ube&safe=i mages&ie=UTF-8&oe=UTF-8&lr=&num=100&as_scoring=d&hl=en they look a little suspect to me ;) Jennifer > > *sigh* 1.54 is up. This domain IS still listed in it. > > Chris Santerre > System Admin and SA Custom Rules Emporium keeper > http://www.merchantsoverseas.com/wwwroot/gorilla/sa_rules.htm > "A little nonsense now and then, is relished by the wisest men." - Willy > Wonka > > > --- > This SF.net email is sponsored by OSDN's Audience Survey. > Help shape OSDN's sites and tell us what you think. Take this > five minute survey and you could win a $250 Gift Certificate. > http://www.wrgsurveys.com/2003/osdntech03.php?site=8 > ___ > Spamassassin-talk mailing list > [EMAIL PROTECTED] > https://lists.sourceforge.net/lists/listinfo/spamassassin-talk --- This SF.net email is sponsored by OSDN's Audience Survey. Help shape OSDN's sites and tell us what you think. Take this five minute survey and you could win a $250 Gift Certificate. http://www.wrgsurveys.com/2003/osdntech03.php?site=8 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
RE: [SAtalk] BIG HUGE EVIL RULE NEWS!!!!
Not to start a text editor war, but it can be done in Textpad with a regex search and replace. Hit F8, check the Regular Expression textbox -> Find: \t3.0$ -> Replace with: \t1.0 (or whatever you want the score to be). Mike > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On > Behalf Of Jennifer Wheeler > Sent: Wednesday, December 03, 2003 12:43 PM > To: 'Chris Santerre'; 'Adam Denenberg'; 'Spamassassin-Talk (E-mail)' > Subject: RE: [SAtalk] BIG HUGE EVIL RULE NEWS > > > > > You could always lower the score. Only 178 to change :) > > (Hey that is nothing compared to how many times I had to hit ' | , > DELETE, > > END ' because I was in a hurry to get done!) > > Hi Chris, > You should grab multiedit. Rockage. You can do your edits > with little > macros. > Jennifer > > > > > --Chris Santerre > > > > --- This SF.net email is sponsored by OSDN's Audience Survey. Help shape OSDN's sites and tell us what you think. Take this five minute survey and you could win a $250 Gift Certificate. http://www.wrgsurveys.com/2003/osdntech03.php?site=8 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
RE: [SAtalk] spamd, rewrite_subject being ignored everywhere
[EMAIL PROTECTED] wrote: > Hi, > > I'm having an odd problem with SpamAssassin 2.60, Qmail-Scanner 1.20 > and "net"qmail 1.04 compiled from source (RedHat 9). > > I have ran spamd in debug mode and looked at the spamd script to > verify my config files are located here: > > /usr/share/spamassassin > /etc/mail/spamassassin > /home/spamd/.spamassassin/user_prefs > > I'm running spamd using daemontools with this set of flags: > /usr/bin/spamd -m 20 -L -u spamd -H /home/spamd > > when I run it like that using -D too, everything looks great. I have a > test rule set up to = 200 points, and see this at the very end: > > debug: is spam? score=200 required=5 tests=JWM_TEST2 > logmsg: identified spam (200.0/5.0) for [EMAIL PROTECTED]:508 in 0.1 > seconds, 776 bytes. > debug: cleaned up kid 3595, pool=20 > > When I get the message it has X-Spam-Status: Yes in the headers > (hits=200.0 required=5.0) ... but the subject doesn't get rewritten > and there's no report. > > I'm just using the custom report in /usr/share/spamassassin/10_misc.cf > > my /etc/mail/spamassassin/local.cf file (which is readable by the > spamd account) contains this plus my test rule: > > required_hits 5 > rewrite_subject 1 > report_safe 1 > subject_tag * SPAM > allow_user_rules1 > > I also tried putting that into /home/spamd/.spamassassin/user_prefs > but it didn't help. I then put that in > /usr/share/spamassassin/10_misc.cf as a test even though I know > that's not where it really goes... and it still didn't help. I can't > see anything in the -D info when running spamd that talks about using > a report or not, or rewriting the subject or not. It just says its > spam and uses the X-Spam-Flag: YES but doesn't rewrite the subject. > > It bugs me because my custom rule is getting used just fine, just not > the rewrite_Subject and report_safe 1... (which is set to the default > of 1 in /usr/share/spamassassin/ anyway). > > I restarted spamd after each config change.. and checked the FAQ.. any > ideas? Is it because spamd is running in "taint" mode as the user > spamd (which is set to use the /sbin/nologin shell in redhat9)? I > still need to try running spamd without the -u and -H flags but I was > hoping to be able to use them. I also need to check more, maybe > there's a clear_report_whatever command somewhere that's erasing the > default report? But it should still be rewriting the subject, argh.. > > Take care, > Jeremy > > > --- > This SF.net email is sponsored by OSDN's Audience Survey. > Help shape OSDN's sites and tell us what you think. Take this > five minute survey and you could win a $250 Gift Certificate. > http://www.wrgsurveys.com/2003/osdntech03.php?site= > ___ > Spamassassin-talk mailing list > [EMAIL PROTECTED] > https://lists.sourceforge.net/lists/listinfo/spamassassin-talk qmail-scanner-queue.pl has 2 compile options, scanner="fast_spamassassin" and scanner="verbose_spamassassin". If you use "fast_spamassassin", spamc is then run with the -c option, which does not rewrite the subject. Edit qmail-scanner-queue.pl and find spamc where it has the variable (my $spamc_binary='/opt/bin/spamc'; my $spamc_options=' -c -f';) and remove the -c from the options line. The other option is to recompile qmail-scanner-queue.pl with scanner= "verbose_spamassassin". --- This SF.net email is sponsored by OSDN's Audience Survey. Help shape OSDN's sites and tell us what you think. Take this five minute survey and you could win a $250 Gift Certificate. http://www.wrgsurveys.com/2003/osdntech03.php?site=8 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
RE: [SAtalk] Re: BIG HUGE EVIL RULE NEWS!!!!
[EMAIL PROTECTED] wrote: >> -Original Message- >> From: Chris Barnes [mailto:[EMAIL PROTECTED] >> Sent: Wednesday, December 03, 2003 12:53 PM >> To: [EMAIL PROTECTED] >> Subject: [SAtalk] Re: BIG HUGE EVIL RULE NEWS >> >> >> Rich Puhek <[EMAIL PROTECTED]> wrote: >>> Now to see if the payment terms mean that I can write off purchases >>> of Wild tickets :-) >> >> I'm planning on visiting my brother, who has 2 season tickets to the >> Dallas Stars... >> >> Where did I put that that Madano jersey? >> > > Check the trash bin! :) > > Sorry I couldn't resist! GO BRUINS! OK, just hold the > lead,nook a tie is good.N!!! > I probably shouldn't be saying this, but GO SENATORS GO. The opposite to the Bruins, they can't get a lead...and yes, a TIE is very good right now... --- This SF.net email is sponsored by OSDN's Audience Survey. Help shape OSDN's sites and tell us what you think. Take this five minute survey and you could win a $250 Gift Certificate. http://www.wrgsurveys.com/2003/osdntech03.php?site=8 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
[SAtalk] Spamd probs with bayes
Hi all, I get the following errors from spamd (tons of them in my logfiles) and I have no idea how to fix this. Ditching my bayes_* files isn't a good option as it takes several hours to regenerate them (I have a spam corpus of about 2 which I collected over a period of 7 months...). Sa-learn --rebuild doesn't fix it also; it gives the same errors. I'm using 2.60. Argument "\098145539,7¼?" isn't numeric in numeric lt (<) at /usr/local/lib/perl5/site_perl/5.8.0/Mail/SpamAssassin/BayesStore.pm line 1245. Any help is appreciated. Erik --- This SF.net email is sponsored by OSDN's Audience Survey. Help shape OSDN's sites and tell us what you think. Take this five minute survey and you could win a $250 Gift Certificate. http://www.wrgsurveys.com/2003/osdntech03.php?site=8 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
[SAtalk] Re: BIG HUGE EVIL RULE NEWS!!!!
Thanks, Chris, for the update! One problem, though: I see c1tracking.com is still on the list. As I mentioned before, this shows up frequently in YahooGroups-hosted mailing lists, in some of the text ads they attach to the message. In fact, I *only* see this one in ham. Giving 30-50% of Yahoo Groups postings a base score of 3 doesn't strike me as a good idea, so I've removed it from my copy of the file. One could argue that the ad being attached is spam, but the whole message generally is not. Kelson Vibber SpeedGate Communications --- This SF.net email is sponsored by OSDN's Audience Survey. Help shape OSDN's sites and tell us what you think. Take this five minute survey and you could win a $250 Gift Certificate. http://www.wrgsurveys.com/2003/osdntech03.php?site=8 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
[SAtalk] Custom Rules
hi i am trying to setup a rule so that we wont get mail to our local alias from an outside address, this is what i wrote but it doesnt seem to work as i thought it would, can u give any advice header BLOCKTTOFFICEOUT To = [EMAIL PROTECTED] header BLOCKTTOFFICEOUT From != [EMAIL PROTECTED] scoreBLOCKTTOFFICEOUT 100.0 describe BLOCKTTOFFICEOUT No Email To alias from outside thanks Nayana --- This SF.net email is sponsored by OSDN's Audience Survey. Help shape OSDN's sites and tell us what you think. Take this five minute survey and you could win a $250 Gift Certificate. http://www.wrgsurveys.com/2003/osdntech03.php?site=8 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
RE: [SAtalk] BIG HUGE EVIL RULE NEWS!!!!
Doesn't anyone use VI anymore?!! :-) Sorry, couldn't resist adding to the war. :%s/old stuff/new stuff/g -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Mike Kuentz (2) Sent: Wednesday, December 03, 2003 10:46 AM To: Spamassassin-Talk (E-mail) Subject: RE: [SAtalk] BIG HUGE EVIL RULE NEWS Not to start a text editor war, but it can be done in Textpad with a regex search and replace. Hit F8, check the Regular Expression textbox -> Find: \t3.0$ -> Replace with: \t1.0 (or whatever you want the score to be). Mike > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of > Jennifer Wheeler > Sent: Wednesday, December 03, 2003 12:43 PM > To: 'Chris Santerre'; 'Adam Denenberg'; 'Spamassassin-Talk (E-mail)' > Subject: RE: [SAtalk] BIG HUGE EVIL RULE NEWS > > > > > You could always lower the score. Only 178 to change :) (Hey that is > > nothing compared to how many times I had to hit ' | , > DELETE, > > END ' because I was in a hurry to get done!) > > Hi Chris, > You should grab multiedit. Rockage. You can do your edits with > little macros. > Jennifer > > > > > --Chris Santerre > > > > --- This SF.net email is sponsored by OSDN's Audience Survey. Help shape OSDN's sites and tell us what you think. Take this five minute survey and you could win a $250 Gift Certificate. http://www.wrgsurveys.com/2003/osdntech03.php?site= ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk --- This SF.net email is sponsored by OSDN's Audience Survey. Help shape OSDN's sites and tell us what you think. Take this five minute survey and you could win a $250 Gift Certificate. http://www.wrgsurveys.com/2003/osdntech03.php?site=8 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
[SAtalk] Config File Location....
Is the normal location for the local.cf in the etc\mail\spamassassin\ folder? How can I verify that SA is reading this file? (I am using spamc) I am having problems with settings seemingly not being used. This is on a windows 2k box. In installed it according to www.exit0.com instructions for installing SA in a cygwin environment. I was able to run sa-learn (spam/ham) or ~ 1k messages each with no problems. It is returning spam probability to the command prompt, but is now writing the header information to the email. Thanks in advance Thanks, James --- This SF.net email is sponsored by OSDN's Audience Survey. Help shape OSDN's sites and tell us what you think. Take this five minute survey and you could win a $250 Gift Certificate. http://www.wrgsurveys.com/2003/osdntech03.php?site=8 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
RE: [SAtalk] Re: BIG HUGE EVIL RULE NEWS!!!!
And just like that, we are at ver1.56 :) All fixed. You had told me this in the past, and it was fixed in evilrules. The problem is that when I made Bigevil, I used the list files used to create the old evilrules. Not the old evilrules themselves. So this was still in the list. Thanks for the find. I'm checking on the dmnews.com one now. Not sure how I feel about that one. --Chris > -Original Message- > From: Kelson Vibber [mailto:[EMAIL PROTECTED] > Sent: Wednesday, December 03, 2003 2:06 PM > To: [EMAIL PROTECTED] > Subject: [SAtalk] Re: BIG HUGE EVIL RULE NEWS > > > Thanks, Chris, for the update! One problem, though: > > I see c1tracking.com is still on the list. As I mentioned > before, this > shows up frequently in YahooGroups-hosted mailing lists, in > some of the > text ads they attach to the message. In fact, I *only* see > this one in ham. > > Giving 30-50% of Yahoo Groups postings a base score of 3 > doesn't strike me > as a good idea, so I've removed it from my copy of the file. > > One could argue that the ad being attached is spam, but the > whole message > generally is not. > > > Kelson Vibber > SpeedGate Communications > > > > > --- > This SF.net email is sponsored by OSDN's Audience Survey. > Help shape OSDN's sites and tell us what you think. Take this > five minute survey and you could win a $250 Gift Certificate. > http://www.wrgsurveys.com/2003/osdntech03.php?site=8 > ___ > Spamassassin-talk mailing list > [EMAIL PROTECTED] > https://lists.sourceforge.net/lists/listinfo/spamassassin-talk > --- This SF.net email is sponsored by OSDN's Audience Survey. Help shape OSDN's sites and tell us what you think. Take this five minute survey and you could win a $250 Gift Certificate. http://www.wrgsurveys.com/2003/osdntech03.php?site=8 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
RE: [SAtalk] Bigevil domain hat-check help
> -Original Message- > From: Rick Macdougall [mailto:[EMAIL PROTECTED] > Sent: Wednesday, December 03, 2003 1:24 PM > To: Spamassassin-Talk (E-mail) > Subject: Re: [SAtalk] Bigevil domain hat-check help > > > > > Chris Santerre wrote: > > > I've got a domain listed in Bigevil that could be legit. I > need a hatcheck > > on this one. It is not that obvious. Can someone give me info on: > > > > as1.emv2.com > > > > or the emv2.com domain in general? (not WHOIS, I can do that!) > > Hi, > > http://www.openrbl.org and pop in the domain. They are > listed by a few > rbl's. > > Regards, > > Rick > Thanks, I always use that site. One of the best. Unfortunetly that would only tell me if they sent spam, not hosted within spam. :) Grey line, I know. --Chris --- This SF.net email is sponsored by OSDN's Audience Survey. Help shape OSDN's sites and tell us what you think. Take this five minute survey and you could win a $250 Gift Certificate. http://www.wrgsurveys.com/2003/osdntech03.php?site=8 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
[SAtalk] SA Learn question
I received an email on one of my systems that is not running SA and I decided to forward it to my SA system to see if it would get rejected. The subject was "Have amazing s\ex up to 20 times per day lugpsxw". They use the "/" in the body also to avoid spam detection. It got a score of 3.3. I ran sa-learn --spam on this message and now I get a score of 3.0 if I resend the message. I'm a bit confused. Did I do something wrong ??? Thx --- This SF.net email is sponsored by OSDN's Audience Survey. Help shape OSDN's sites and tell us what you think. Take this five minute survey and you could win a $250 Gift Certificate. http://www.wrgsurveys.com/2003/osdntech03.php?site=8 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
RE: [SAtalk] Bigevil domain hat-check help
They do look like they are in a lot of spam. The reason I asked is it gets a FP from Tomshardware.com newsletter. SO I pose the question to the list: Highly probable spam host domain, that generates an FP on a popular newsletter. Leave in the bigevil or remove? I'm leaning towards removal. --Chris > -Original Message- > From: Jennifer Wheeler [mailto:[EMAIL PROTECTED] > Sent: Wednesday, December 03, 2003 1:35 PM > To: 'Chris Santerre'; 'Spamassassin-Talk (E-mail)' > Subject: RE: [SAtalk] Bigevil domain hat-check help > > > > > > -Original Message- > > From: [EMAIL PROTECTED] > [mailto:spamassassin- > > [EMAIL PROTECTED] On Behalf Of Chris Santerre > > Sent: Wednesday, December 03, 2003 1:08 PM > > To: Spamassassin-Talk (E-mail) > > Subject: [SAtalk] Bigevil domain hat-check help > > > > I've got a domain listed in Bigevil that could be legit. I need a > hatcheck > > on this one. It is not that obvious. Can someone give me info on: > > > > as1.emv2.com > > > > or the emv2.com domain in general? (not WHOIS, I can do that!) > > http://www.google.com/groups?as_q=emv2.com&as_oq=spam%20uce%20 > ube&safe=i > mages&ie=UTF-8&oe=UTF-8&lr=&num=100&as_scoring=d&hl=en > > they look a little suspect to me ;) > > Jennifer > > > > > *sigh* 1.54 is up. This domain IS still listed in it. > > > > Chris Santerre > > System Admin and SA Custom Rules Emporium keeper > > http://www.merchantsoverseas.com/wwwroot/gorilla/sa_rules.htm > > "A little nonsense now and then, is relished by the wisest men." - > Willy > > Wonka > > > > > > --- > > This SF.net email is sponsored by OSDN's Audience Survey. > > Help shape OSDN's sites and tell us what you think. Take this > > five minute survey and you could win a $250 Gift Certificate. > > http://www.wrgsurveys.com/2003/osdntech03.php?site=8 > > ___ > > Spamassassin-talk mailing list > > [EMAIL PROTECTED] > > https://lists.sourceforge.net/lists/listinfo/spamassassin-talk > --- This SF.net email is sponsored by OSDN's Audience Survey. Help shape OSDN's sites and tell us what you think. Take this five minute survey and you could win a $250 Gift Certificate. http://www.wrgsurveys.com/2003/osdntech03.php?site=8 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
RE: [SAtalk] BIG HUGE EVIL RULE NEWS!!!!
Jennifer Wheeler said: > >> You could always lower the score. Only 178 to change :) >> (Hey that is nothing compared to how many times I had to hit ' | , > DELETE, >> END ' because I was in a hurry to get done!) > > Hi Chris, > You should grab multiedit. Rockage. You can do your edits with little > macros. > Jennifer Or my personal favorite, Vim :) qqA|Jq [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] ... Did somebody mention editor wars? C'mon let's hear from you Emacs people ;) -- Chris Thielen Easily generate SpamAssassin rules to catch obfuscated spam phrases: http://www.sandgnat.com/cmos/ --- This SF.net email is sponsored by OSDN's Audience Survey. Help shape OSDN's sites and tell us what you think. Take this five minute survey and you could win a $250 Gift Certificate. http://www.wrgsurveys.com/2003/osdntech03.php?site=8 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
RE: [SAtalk] BIG HUGE EVIL RULE NEWS!!!!
Scott Harris said: > Doesn't anyone use VI anymore?!! :-) > Sorry, couldn't resist adding to the war. > > :%s/old stuff/new stuff/g Or even better: :g/^score/s/3.0/1.0/ --- This SF.net email is sponsored by OSDN's Audience Survey. Help shape OSDN's sites and tell us what you think. Take this five minute survey and you could win a $250 Gift Certificate. http://www.wrgsurveys.com/2003/osdntech03.php?site=8 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
[SAtalk] 312.649.0007
alert_OA0_1070477447_INI-MAIL_1#Map.pif.txt Description: MIDI audio
[SAtalk] SORRY, RE: 312.649.0007
I sent this to the wrong email account... -Original Message-From: Matt Van Gordon Sent: Wednesday, December 03, 2003 11:28 AMTo: [EMAIL PROTECTED] Sourceforge. Net (E-mail)Subject: 312.649.0007 McAfee GroupShield for Microsoft Exchange ** ** Alert generated on: Wednesday, December 03, 2003 11:27:44 AM Pacific Standard Time The body of this message has been replaced as it contains the Exploit-MIME.gen.b virus. Please consult your administrator for further help quoting your ticket number: OB3_1070479664_INI-MAIL_1
Re: [SAtalk] BIG HUGE EVIL RULE NEWS!!!!
I am trying to test out these new rules, but so far all of my tests have not showing them as being active. $ ls /etc/mail/spamassassin bigevil.cf local.cf And I restarted spamd... What else do I have to do to make them work? Thanks for the help. -- :wq! Matthew Daubenspeck http://www.oddprocess.org --- This SF.net email is sponsored by OSDN's Audience Survey. Help shape OSDN's sites and tell us what you think. Take this five minute survey and you could win a $250 Gift Certificate. http://www.wrgsurveys.com/2003/osdntech03.php?site=8 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] SA Learn question
--On Wednesday, December 03, 2003 2:24 PM -0500 Vee Persaud <[EMAIL PROTECTED]> wrote: > I received an email on one of my systems that is not running SA and I > decided to forward it to my SA system to see if it would get rejected. > The subject was "Have amazing s\ex up to 20 times per day lugpsxw". > They use the "/" in the body also to avoid spam detection. It got a > score of 3.3. I ran sa-learn --spam on this message and now I get a > score of 3.0 if I resend the message. I'm a bit confused. Did I do > something wrong ??? How about the score rules from before and after? You did also read that you need to learn ham and spam for either to be of any use? Evan --- This SF.net email is sponsored by OSDN's Audience Survey. Help shape OSDN's sites and tell us what you think. Take this five minute survey and you could win a $250 Gift Certificate. http://www.wrgsurveys.com/2003/osdntech03.php?site=8 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] SA Learn question
Vee Persaud said: > I received an email on one of my systems that is not running SA and I > decided to forward it to my SA system to see if it would get rejected. > The subject was "Have amazing s\ex up to 20 times per day lugpsxw". > They use the "/" in the body also to avoid spam detection. It got a score > of 3.3. I ran sa-learn --spam on this message and now I get a score of > 3.0 if I resend the message. I'm a bit confused. Did I do something > wrong ??? Vee, Please send the headers from both the first and the second messages. Without more information all anyone can do is wildly guess. Also, it's worth noting that learning a message as spam does not necessarily mean it will be marked as spam if tested again. Instead of learning the entire email as a spam (which would be very rigid), the tokens inside the spam are added to the bayes db, which is an aggregate of spam AND ham tokens. The next time you check another copy of that spam, the tokens in the spam are checked against the tokens in the bayes db and are statistically analyzed to create a spam probability. This probability is used to compute a score that is added to the spam core. --- This SF.net email is sponsored by OSDN's Audience Survey. Help shape OSDN's sites and tell us what you think. Take this five minute survey and you could win a $250 Gift Certificate. http://www.wrgsurveys.com/2003/osdntech03.php?site=8 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
RE: [SAtalk] BIG HUGE EVIL RULE NEWS!!!!
On Wed, 2003-12-03 at 14:25, Chris Thielen wrote: > Did somebody mention editor wars? C'mon let's hear from you Emacs people ;) emacs rocks alt-% for search/replace or ctrl-alt-% for regex search/replace -- Adam Lanier Bernard L. Madoff Investment Securities LLC 212.230.2491 signature.asc Description: This is a digitally signed message part
RE: [SAtalk] SA Learn question
[EMAIL PROTECTED] wrote: > I received an email on one of my systems that is not running SA and I > decided to forward it to my SA system to see if it would get > rejected. The subject was "Have amazing s\ex up to 20 times per day > lugpsxw". They use the "/" in the body also to avoid spam detection. > It got a score of 3.3. I ran sa-learn --spam on this message and now > I get a score of 3.0 if I resend the message. I'm a bit confused. > Did I do something wrong ??? > > Now everytime that I send the same message(just as a test), the score keeps getting lower. --- This SF.net email is sponsored by OSDN's Audience Survey. Help shape OSDN's sites and tell us what you think. Take this five minute survey and you could win a $250 Gift Certificate. http://www.wrgsurveys.com/2003/osdntech03.php?site=8 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] Custom Rules
Just a minor correction, try this: header__BLOCKTOFFICEOUTTo =~ /[EMAIL PROTECTED]/i header__BLOCKFOFFICEOUTFrom =~ /[EMAIL PROTECTED]/i metaBLOCK_MY_OFFICE(__BLOCKTOFFICEOUT && !__BLOCKFOFFICEOUT) describeBLOCK_MY_OFFICENo E-mail to alias from outside scoreBLOCK_MY_OFFICE100.0 The syntax is slightly different in my rule and I used a meta rule to accomplish what you want. Frederic Tarasevicius Internet Information Services, Inc. http://www.i-is.com/ | Nayana Hettiarachchi wrote: > hi i am trying to setup a rule so that we wont get mail to our local > alias from an outside address, this is what i wrote but it doesnt seem > to work as i thought it would, can u give any advice > > header BLOCKTTOFFICEOUT To = [EMAIL PROTECTED] > header BLOCKTTOFFICEOUT From != [EMAIL PROTECTED] > scoreBLOCKTTOFFICEOUT 100.0 > describe BLOCKTTOFFICEOUT No Email To alias from outside > > thanks > > Nayana > > > > > --- > This SF.net email is sponsored by OSDN's Audience Survey. > Help shape OSDN's sites and tell us what you think. Take this > five minute survey and you could win a $250 Gift Certificate. > http://www.wrgsurveys.com/2003/osdntech03.php?site=8 > ___ > Spamassassin-talk mailing list > [EMAIL PROTECTED] > https://lists.sourceforge.net/lists/listinfo/spamassassin-talk --- This SF.net email is sponsored by OSDN's Audience Survey. Help shape OSDN's sites and tell us what you think. Take this five minute survey and you could win a $250 Gift Certificate. http://www.wrgsurveys.com/2003/osdntech03.php?site=8 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
RE: [SAtalk] Bigevil domain hat-check help
Chris Santerre said: > They do look like they are in a lot of spam. The reason I asked is it gets > a > FP from Tomshardware.com newsletter. > > SO I pose the question to the list: > > Highly probable spam host domain, that generates an FP on a popular > newsletter. Leave in the bigevil or remove? > > I'm leaning towards removal. I would say removal, if you're sticking with the said purpose of evilrules having a 100% hit rate. -- Chris Thielen Easily generate SpamAssassin rules to catch obfuscated spam phrases: http://www.sandgnat.com/cmos/ --- This SF.net email is sponsored by OSDN's Audience Survey. Help shape OSDN's sites and tell us what you think. Take this five minute survey and you could win a $250 Gift Certificate. http://www.wrgsurveys.com/2003/osdntech03.php?site=8 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] BIG HUGE EVIL RULE NEWS!!!!
--On Wednesday, December 03, 2003 14:31:27 -0500 Matthew Daubenspeck <[EMAIL PROTECTED]> wrote: I am trying to test out these new rules, but so far all of my tests have not showing them as being active. $ ls /etc/mail/spamassassin bigevil.cf local.cf And I restarted spamd... What else do I have to do to make them work? nothing. Thanks for the help. -- :wq! Matthew Daubenspeck http://www.oddprocess.org --- This SF.net email is sponsored by OSDN's Audience Survey. Help shape OSDN's sites and tell us what you think. Take this five minute survey and you could win a $250 Gift Certificate. http://www.wrgsurveys.com/2003/osdntech03.php?site=8 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk -- Larry Rosenman http://www.lerctr.org/~ler Phone: +1 972-414-9812 E-Mail: [EMAIL PROTECTED] US Mail: 1905 Steamboat Springs Drive, Garland, TX 75044-6749 pgp0.pgp Description: PGP signature
Re: [SAtalk] BIG HUGE EVIL RULE NEWS!!!!
Matthew Daubenspeck said: > I am trying to test out these new rules, but so far all of my tests have > not showing them as being active. > > $ ls /etc/mail/spamassassin > bigevil.cf local.cf > > And I restarted spamd... What else do I have to do to make them work? Matthew, I'd make sure your config files are being read from /etc/mail/spamassassin (on my system they're /etc/spamassassin) spamassassin -D --lint 2>&1 | grep "site rules dir" debug: using "/etc/spamassassin" for site rules dir -- Chris Thielen Easily generate SpamAssassin rules to catch obfuscated spam phrases: http://www.sandgnat.com/cmos/ --- This SF.net email is sponsored by OSDN's Audience Survey. Help shape OSDN's sites and tell us what you think. Take this five minute survey and you could win a $250 Gift Certificate. http://www.wrgsurveys.com/2003/osdntech03.php?site=8 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] Config File Location....
Hello, In cygwin I see the default rule location as: /etc/mail/spamassassin/ Try running: spamassassin -D --lint and it'll tell you where it's looking to find your rules. The subject re-write issue has been discussed a lot but I don't know anything about it. What is the contents of your local.cf regarding subject re-writing? Thanks, Frederic Tarasevicius Internet Information Services, Inc. http://www.i-is.com/ James wrote: > Is the normal location for the local.cf in the etc\mail\spamassassin\ > folder? How can I verify that SA is reading this file? (I am using > spamc) I am having problems with settings seemingly not being used. > This is on a windows 2k box. In installed it according to > www.exit0.com instructions for installing SA in a cygwin environment. > I was able to run sa-learn (spam/ham) or ~ 1k messages each with no > problems. It is returning spam probability to the command prompt, > but is now writing the header information to the email. Thanks in > advance > > Thanks, > James > > > > > > > --- > This SF.net email is sponsored by OSDN's Audience Survey. > Help shape OSDN's sites and tell us what you think. Take this > five minute survey and you could win a $250 Gift Certificate. > http://www.wrgsurveys.com/2003/osdntech03.php?site=8 > ___ > Spamassassin-talk mailing list > [EMAIL PROTECTED] > https://lists.sourceforge.net/lists/listinfo/spamassassin-talk --- This SF.net email is sponsored by OSDN's Audience Survey. Help shape OSDN's sites and tell us what you think. Take this five minute survey and you could win a $250 Gift Certificate. http://www.wrgsurveys.com/2003/osdntech03.php?site=8 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
[SAtalk] I'm starting to have flashback nightmares..
Reported on the Spam-L anti-spam list.. Someone asking if this is a legit bounce or something else. Look familiar? - Forwarded message from [EMAIL PROTECTED] - Return-path: <> Received: from mx10.comingsoon.namescout.com ([199.85.4.241]) by s-rogue.tsc.com (iPlanet Messaging Server 5.2 Patch 1 (built Aug 20 2002)) with SMTP id <[EMAIL PROTECTED]> (ORCPT [EMAIL PROTECTED]) ; Wed, 03 Dec 2003 08:19:39 -0500 (US Eastern Standard Time) Received: from mailnull by mx10.comingsoon.namescout.com with local (Exim 4.24; FreeBSD) id 1ARWp8-0007rj-41 for [EMAIL PROTECTED]; Wed, 03 Dec 2003 13:13:46 + Date: Wed, 03 Dec 2003 13:13:46 + From: [EMAIL PROTECTED] Subject: Undeliverable Mail: Delivery Status Notification (Failure) In-reply-to: <[EMAIL PROTECTED]> To: [EMAIL PROTECTED] Message-id: <[EMAIL PROTECTED]> Auto-submitted: auto-replied We were unable to deliver your email. The domain you are sending to was recently registered at at Namescout.com For more information on how you can register a domain, please visit http://www.namescout.com Regards, Customer Service [EMAIL PROTECTED] --- This SF.net email is sponsored by OSDN's Audience Survey. Help shape OSDN's sites and tell us what you think. Take this five minute survey and you could win a $250 Gift Certificate. http://www.wrgsurveys.com/2003/osdntech03.php?site=8 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
RE: [SAtalk] Bayes Expiry limits and Journal size
A little more help, if I may... OK, I now understand the memory issue is when doing a --rebuild on a huge database, memory needs to be available for load the token database. Right?! Is there a reason that the journal needs to be synced more than once per day? Why is the default set to 100KB? Is the goal to get the journal syncing about the same frequency as an expiry run is made? TIA <> | -Original Message- | From: Ted Cabeen [mailto:[EMAIL PROTECTED] | Sent: Friday, November 14, 2003 6:22 PM | To: [EMAIL PROTECTED] | Cc: Smart,Dan; [EMAIL PROTECTED] | Subject: Re: [SAtalk] Bayes Expiry limits and Journal size | | [EMAIL PROTECTED] (Justin Mason) writes: | | > Smart,Dan writes: | >> I'm running Bayes site wide with about 45,000 messages per | day. Is | >> there any harm in increasing the bayes_expiry_max_db_size and | >> bayes_journal_max_size limits? | >> | >> If it's ok to make bigger, what is the maximum before | something bad | >> starts happening? | > | > It's fine to do so -- as long as you don't run out of | memory! That's | > the limiting factor. | | Yeah, particularly on an import. I have a site-wide db that | I've cranked up to 2,000,000 tokens. It works fine, but | doing the upgrade from db version 0 to version 2 took over a | GB of memory to complete. | | And watch out for timeouts on your SA queries if the database | is large. | | -- | Ted Cabeen http://www.pobox.com/~secabeen | [EMAIL PROTECTED] | Check Website or Keyserver for PGP/GPG Key BA0349D2 | [EMAIL PROTECTED] | "I have taken all knowledge to be my province." -F. Bacon | [EMAIL PROTECTED] | "Human kind cannot bear very much reality."-T.S.Eliot | [EMAIL PROTECTED] | --- This SF.net email is sponsored by OSDN's Audience Survey. Help shape OSDN's sites and tell us what you think. Take this five minute survey and you could win a $250 Gift Certificate. http://www.wrgsurveys.com/2003/osdntech03.php?site=8 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
RE: [SAtalk] Config File Location....
Thanks Frederic for the quick response... When I ran what you described, it said that it was infact using the /etc/mail/spamassassin/ path, however, it said that it did not have enough spam entries, I am having sa-learn run again to see if it picks up more. Here is my local.cf file: #This is the config file for SA required_hits 7.5 check_mx_delay 10 rbl_timeout 30 spam_level_char * subject_tag *SPAM-DETECTED* fold_headers1 always_add_headers 1 always_add_report 1 report_contact [EMAIL PROTECTED] rewrite_subject 1 spam_level_stars1 use_terse_report0 skip_rbl_checks 0 report_safe 1 dns_available yes use_razor2 0 use_pyzor 0 use_dcc 0 # Bayes use_bayes 1 BAYES_auto_learn0 BAYES_auto_learn_threshold_spam 12.0 BAYES_auto_learn_threshold_nonspam 0.1 bayes_auto_expire 1 bayes_learn_to_journal 0 bayes_expiry_max_db_size15 bayes_journal_max_size 102400 add_header all Status _YESNO_, hits=_HITS_ required=_REQD_ tests=_TESTS_ autolearn=_AUTOLEARN_ version=_VERSION_ # Miscellaneous Entries ok_languagesen fr ok_locales en trusted_networks192.168.0. Thanks, James -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Fred I-IS.COM Sent: Wednesday, December 03, 2003 2:40 PM To: [EMAIL PROTECTED]; 'Spamassassin' Subject: Re: [SAtalk] Config File Location Hello, In cygwin I see the default rule location as: /etc/mail/spamassassin/ Try running: spamassassin -D --lint and it'll tell you where it's looking to find your rules. The subject re-write issue has been discussed a lot but I don't know anything about it. What is the contents of your local.cf regarding subject re-writing? Thanks, Frederic Tarasevicius Internet Information Services, Inc. http://www.i-is.com/ James wrote: > Is the normal location for the local.cf in the etc\mail\spamassassin\ > folder? How can I verify that SA is reading this file? (I am using > spamc) I am having problems with settings seemingly not being used. > This is on a windows 2k box. In installed it according to > www.exit0.com instructions for installing SA in a cygwin environment. > I was able to run sa-learn (spam/ham) or ~ 1k messages each with no > problems. It is returning spam probability to the command prompt, > but is now writing the header information to the email. Thanks in > advance > > Thanks, > James > > > > > > > --- > This SF.net email is sponsored by OSDN's Audience Survey. > Help shape OSDN's sites and tell us what you think. Take this > five minute survey and you could win a $250 Gift Certificate. > http://www.wrgsurveys.com/2003/osdntech03.php?site=8 > ___ > Spamassassin-talk mailing list > [EMAIL PROTECTED] > https://lists.sourceforge.net/lists/listinfo/spamassassin-talk --- This SF.net email is sponsored by OSDN's Audience Survey. Help shape OSDN's sites and tell us what you think. Take this five minute survey and you could win a $250 Gift Certificate. http://www.wrgsurveys.com/2003/osdntech03.php?site=8 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk --- This SF.net email is sponsored by OSDN's Audience Survey. Help shape OSDN's sites and tell us what you think. Take this five minute survey and you could win a $250 Gift Certificate. http://www.wrgsurveys.com/2003/osdntech03.php?site=8 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
RE: [SAtalk] SA Learn question
> Please send the headers from both the first and the second messages. > Without more information all anyone can do is wildly guess. > BEFORE sa-learn Delivered-To: [EMAIL PROTECTED] Received: (qmail 18730 invoked by uid 197); 3 Dec 2003 18:59:54 - Received: from [EMAIL PROTECTED] by rocco by uid 212 with qmail-scanner-1.20 (spamassassin: 2.60. Clear:RC:1(142.226.172.23):SA:0(3.3/5.0):. Processed in 1.949557 secs); 03 Dec 2003 18:59:54 - Received: from mh-ncr-103.ncr.pwgsc.gc.ca (HELO mh-ncr-103.ad.pwgsc-tpsgc.gc.ca) (142.226.172.23) by rocco.pwgsc.gc.ca with SMTP; 3 Dec 2003 18:59:52 - Received: from mb-ncr-021.ad.pwgsc-tpsgc.gc.ca ([10.20.19.139]) by mh-ncr-103.ad.pwgsc-tpsgc.gc.ca with Microsoft SMTPSVC(5.0.2195.5329); Wed, 3 Dec 2003 13:59:52 -0500 X-MimeOLE: Produced By Microsoft Exchange V6.0.6487.1 content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="_=_NextPart_001_01C3B9CF.A18EB283" Subject: FW: Have amazing s\ex up to 20 times per day lugpsxw Date: Wed, 3 Dec 2003 13:59:51 -0500 Message-ID: <[EMAIL PROTECTED]> Thread-Topic: Have amazing s\ex up to 20 times per day lugpsxw Thread-Index: AcO5s+amHfQkM0hNS/uYux5VdXtAvgAHMQRA From: "Vee Persaud" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> X-OriginalArrivalTime: 03 Dec 2003 18:59:52.0096 (UTC) FILETIME=[A1D4EA00:01C3B9CF] X-Spam-Level: *** X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on rocco.ncr.pwgsc.gc.ca X-Spam-Status: No, hits=3.3 required=5.0 tests=AWL,HTML_20_30,HTML_MESSAGE autolearn=no version=2.60 Return-Path: [EMAIL PROTECTED] AFTER sa-learn Delivered-To: [EMAIL PROTECTED] Received: (qmail 19485 invoked by uid 197); 3 Dec 2003 19:08:26 - Received: from [EMAIL PROTECTED] by rocco by uid 212 with qmail-scanner-1.20 (spamassassin: 2.60. Clear:RC:1(142.226.172.23):SA:0(3.0/5.0):. Processed in 1.890262 secs); 03 Dec 2003 19:08:26 - Received: from mh-ncr-103.ncr.pwgsc.gc.ca (HELO mh-ncr-103.ad.pwgsc-tpsgc.gc.ca) (142.226.172.23) by rocco.pwgsc.gc.ca with SMTP; 3 Dec 2003 19:08:24 - Received: from mb-ncr-021.ad.pwgsc-tpsgc.gc.ca ([10.20.19.139]) by mh-ncr-103.ad.pwgsc-tpsgc.gc.ca with Microsoft SMTPSVC(5.0.2195.5329); Wed, 3 Dec 2003 14:08:24 -0500 X-MimeOLE: Produced By Microsoft Exchange V6.0.6487.1 content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="_=_NextPart_001_01C3B9D0.D2DFCF6F" Subject: FW: Have amazing s\ex up to 20 times per day lugpsxw Date: Wed, 3 Dec 2003 14:08:23 -0500 Message-ID: <[EMAIL PROTECTED]> Thread-Topic: Have amazing s\ex up to 20 times per day lugpsxw Thread-Index: AcO5s+amHfQkM0hNS/uYux5VdXtAvgACXtuwAAUeLlA= From: "Vee Persaud" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> X-OriginalArrivalTime: 03 Dec 2003 19:08:24.0187 (UTC) FILETIME=[D30FCCB0:01C3B9D0] X-Spam-Level: ** X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on rocco.ncr.pwgsc.gc.ca X-Spam-Status: No, hits=3.0 required=5.0 tests=AWL,HTML_20_30,HTML_MESSAGE autolearn=no version=2.60 Return-Path: [EMAIL PROTECTED] --- This SF.net email is sponsored by OSDN's Audience Survey. Help shape OSDN's sites and tell us what you think. Take this five minute survey and you could win a $250 Gift Certificate. http://www.wrgsurveys.com/2003/osdntech03.php?site=8 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] Bayes Expiry limits and Journal size
On Wed, Dec 03, 2003 at 01:47:55PM -0600, Smart,Dan wrote: > Is there a reason that the journal needs to be synced more than once per > day? Why is the default set to 100KB? The default was reasonable for most users. There's no need, really, to sync more than once a day, but a large journal means a large sync time/memory use when it does happen. > Is the goal to get the journal syncing about the same frequency as an expiry > run is made? If you're not learning to the journal (ie: it only gets atime updates), you could just let the journal sync when the expire happens, since the atime updates are for the expire only. The goal, however, is just to make sure the DB is up-to-date periodically. It's more efficient to journal the changes than it is to lock the DB when updating atimes. Then at some point, the journal gets synced in one lump. -- Randomly Generated Tagline: Unlike most of you, I am not a nut. -- Homer Simpson Homer's Odyssey pgp0.pgp Description: PGP signature
Re: [SAtalk] SA Learn question
At 02:24 PM 12/3/2003, Vee Persaud wrote: It got a score of 3.3. I ran sa-learn --spam on this message and now I get a score of 3.0 if I resend the message. I'm a bit confused. Did I do something wrong ??? How did you "resend" the message? If you "resend" the message, merely by making a new message with the same body, the headers will be different and you'll loose the score of all the old header rules. Look at the list of matching rules, not just the score.. --- This SF.net email is sponsored by OSDN's Audience Survey. Help shape OSDN's sites and tell us what you think. Take this five minute survey and you could win a $250 Gift Certificate. http://www.wrgsurveys.com/2003/osdntech03.php?site=8 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
RE: [SAtalk] BIG HUGE EVIL RULE NEWS!!!!
Shhh1.57:) Sorry. But there are a few things. 100% spam rate is the goal. So any chance of FP can't happen. I removed the domain with the tomshardware fp in it. Also Matt Yackley, (What is it with Matts straightening me out!), has shown me an error in my ways. With such wide use of this file I need to think better what I mark. For instance astrology.com image hosts. While I didn't want anypart of this in my company, they are OPT-IN lists. So I removed the ones Matt mentioned. So for those with doubts on using, don't doubt. My goal is ZERO FPs. This list is helping get there. Again, updates will be much easier to check instead of this one time monstrocity. I think I've fixed ~14 things out of 2622 domains. That ain't too bad :) Oh, while I'm at it. There will be no updates next week. I will not have access to email next week and I don't trust anyone else at my company with touching my baby :) So after Friday, don't feel bad if I don't email you back for a week! --Chris (Feeling sorry for Dolphin fans come Sunday) Santerre --- This SF.net email is sponsored by OSDN's Audience Survey. Help shape OSDN's sites and tell us what you think. Take this five minute survey and you could win a $250 Gift Certificate. http://www.wrgsurveys.com/2003/osdntech03.php?site=8 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
[SAtalk] Tests: What do "local", "net", and "bayes" technically mean?
Hello, From http://www.spamassassin.org/tests.html: -- DEFAULT SCORES (local, net, with bayes, with bayes+net) -- What do "local", "net", and "bayes" mean? I can't find that anywhere. First: I assume that "bayes" means I have put the options "bayes_path" and "bayes_file_mode" in my site-wide config, as desribed in the spamd README. Is this correct? Second: What is the difference between "local" and "net"? How do I tell which mode I am running in, and how to I switch to "net"? I'm trying to figure out whether my install of S.A. is running in "local" or "net" mode. This is for a site-wide installation tied into Exim using the SA-Exim patch. (A big Thank You to Tim Jackson for the excellent work posted at http://www.timj.co.uk/linux/exim.php.) Any help is greatly appreciated. Thanks, Derek --- This SF.net email is sponsored by OSDN's Audience Survey. Help shape OSDN's sites and tell us what you think. Take this five minute survey and you could win a $250 Gift Certificate. http://www.wrgsurveys.com/2003/osdntech03.php?site=8 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
RE: [SAtalk] SA Learn question
Matt Kettler wrote: > At 02:24 PM 12/3/2003, Vee Persaud wrote: >> It got a score of 3.3. I ran sa-learn --spam on this message and >> now I get a score of 3.0 if I resend the message. I'm a bit >> confused. Did I do something wrong ??? > > How did you "resend" the message? > > If you "resend" the message, merely by making a new message with the > same body, the headers will be different and you'll loose the score > of all the old header rules. > > Look at the list of matching rules, not just the score.. Yes, I just did a forward from one account to another. I was planning on just forwarding any suspect spam emails to an email account on my SA server and running it through sa-learn. I guess that this isn't the correct way to do it ??? --- This SF.net email is sponsored by OSDN's Audience Survey. Help shape OSDN's sites and tell us what you think. Take this five minute survey and you could win a $250 Gift Certificate. http://www.wrgsurveys.com/2003/osdntech03.php?site=8 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] BIG HUGE EVIL RULE NEWS!!!!
Nice list. I have two recommendations/suggestions: 1) put the full URL of the canonical source into the file itself, so people know from where to get updates 2) put a date into the file, so people will know how "fresh" the info is. And add "china-inflatable.com" and "cn-inflatables.com" ;-) -- =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Vivek Khera, Ph.D.Khera Communications, Inc. Internet: [EMAIL PROTECTED] Rockville, MD +1-240-453-8497 AIM: vivekkhera Y!: vivek_khera http://www.khera.org/~vivek/ --- This SF.net email is sponsored by OSDN's Audience Survey. Help shape OSDN's sites and tell us what you think. Take this five minute survey and you could win a $250 Gift Certificate. http://www.wrgsurveys.com/2003/osdntech03.php?site=8 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] BIG HUGE EVIL RULE NEWS!!!!
--On Wednesday, December 03, 2003 15:29:05 -0500 Vivek Khera <[EMAIL PROTECTED]> wrote: Nice list. I have two recommendations/suggestions: 1) put the full URL of the canonical source into the file itself, so people know from where to get updates 2) put a date into the file, so people will know how "fresh" the info is. and a time, since we seem to be getting multiple updates/day (at least in the beginning). LER -- Larry Rosenman http://www.lerctr.org/~ler Phone: +1 972-414-9812 E-Mail: [EMAIL PROTECTED] US Mail: 1905 Steamboat Springs Drive, Garland, TX 75044-6749 pgp0.pgp Description: PGP signature
[SAtalk] Spamassassin with qmai land dotqmails sending blank messages
I'm using Michael Devogelaere's qmail-sql qmail server for several domains. Prior to implementing spamassassin, dotqmails was working fine. Now that spamassassin is running via the qmail /var/qmail/bin/qmail-queue shell script: #!/bin/sh spamc | /var/qmail/bin/qmail-queue.orig any message that is sent to a dotqmail (which in sendmail terms is the same as an /etc/alias entry), is delivered to the recipient with everything blank - no subject, no message body, no nothing. Can anybody please advise on corrective action? Thank you, Dave --- This SF.net email is sponsored by OSDN's Audience Survey. Help shape OSDN's sites and tell us what you think. Take this five minute survey and you could win a $250 Gift Certificate. http://www.wrgsurveys.com/2003/osdntech03.php?site=8 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
RE: [SAtalk] BIG HUGE EVIL RULE NEWS!!!!
Done and Done and Will do :) Yes I even put the time. No need to update if you have 1.57, as these were just info changes. I'm sure 1.58 could be lurking just around the corner. I'm just waiting for the next "Matt" email to come in, or possibly an "RM" email. He has been quiet.too quiet :) --Chris (I top post in your general direction) Santerre > -Original Message- > From: Vivek Khera [mailto:[EMAIL PROTECTED] > Sent: Wednesday, December 03, 2003 3:29 PM > To: [EMAIL PROTECTED] > Subject: Re: [SAtalk] BIG HUGE EVIL RULE NEWS > > > Nice list. I have two recommendations/suggestions: > > 1) put the full URL of the canonical source into the file itself, so >people know from where to get updates > > 2) put a date into the file, so people will know how "fresh" the info >is. > > And add "china-inflatable.com" and "cn-inflatables.com" ;-) > > > -- > =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= > Vivek Khera, Ph.D.Khera Communications, Inc. > Internet: [EMAIL PROTECTED] Rockville, MD +1-240-453-8497 > AIM: vivekkhera Y!: vivek_khera http://www.khera.org/~vivek/ > > > --- > This SF.net email is sponsored by OSDN's Audience Survey. > Help shape OSDN's sites and tell us what you think. Take this > five minute survey and you could win a $250 Gift Certificate. > http://www.wrgsurveys.com/2003/osdntech03.php?site=8 > ___ > Spamassassin-talk mailing list > [EMAIL PROTECTED] > https://lists.sourceforge.net/lists/listinfo/spamassassin-talk > --- This SF.net email is sponsored by OSDN's Audience Survey. Help shape OSDN's sites and tell us what you think. Take this five minute survey and you could win a $250 Gift Certificate. http://www.wrgsurveys.com/2003/osdntech03.php?site=8 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
RE: [SAtalk] BIG HUGE EVIL RULE NEWS!!!!
On Dec 3, 2003 at 12:43, Jennifer Wheeler wrote: >You should grab multiedit. Rockage. You can do your edits with little >macros. Perl! sed! Makefiles! -- Satya. http://www.thesatya.com/> The lab called: your brain is ready --- This SF.net email is sponsored by OSDN's Audience Survey. Help shape OSDN's sites and tell us what you think. Take this five minute survey and you could win a $250 Gift Certificate. http://www.wrgsurveys.com/2003/osdntech03.php?site=8 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] Tests: What do "local", "net", and "bayes" technically mean?
At 03:26 PM 12/3/2003, Derek Simkowiak wrote: DEFAULT SCORES (local, net, with bayes, with bayes+net) What do "local", "net", and "bayes" mean? I can't find that anywhere. These refer to "groups" of optional tests in SpamAssassin. "net" - Tests which must send data across a network to complete - ie: any dns blacklists, DCC, pyzor, and/or razor. "bayes" - Tests which use the bayesian classifier. This is a learning token database system which is "trained" about spam and nonspam (aka ham) using sa-learn. "local" - a bit of a misnomer, but in the case of the statement at the top, refers to a configuration using neither bayes, nor network based test. Technically bayes is run locally, but "local" is shorter to write than "neither bayes nor net". First: I assume that "bayes" means I have put the options "bayes_path" and "bayes_file_mode" in my site-wide config, as desribed in the spamd README. Is this correct? Well, technically those options aren't needed in most cases, they have working defaults. They really exist for when you want to force SA to share a database between several users, instead of creating separate ones in the user's home directory. use_bayes is another related option, but it defaults to 1 (enabled). What is really needed, given a default configuration, is that you train at least 200 spam and 200 nonspam messages using sa-learn. Otherwise SA will skip the bayes tests due to lack of sufficient data. Second: What is the difference between "local" and "net"? How do I tell which mode I am running in, and how to I switch to "net"? You can switch to "net" by installing the proper tools to do RBLs or razor/dcc/pyzor. "net" scoring will be used if *any* of the network checks are enabled. RBLS - install the perl module Net::DNS, make sure you have not set skip_rbl_checks in your config. razor - install the razor client (http://razor.sf.net), make sure use_razor2 isn't set to 0 (default is 1). If using SA 2.60, make sure you patch the razor code with the taint-safeness patch included in SA. DCC - install the dcc client (http://www.rhyolite.com/anti-spam/dcc/), make sure use_dcc isn't set to 0. (default is 1). pyzor - install the pyzor client (http://pyzor.sourceforge.net/), make sure use_pyzor isn't set to 0. (default is 1). --- This SF.net email is sponsored by OSDN's Audience Survey. Help shape OSDN's sites and tell us what you think. Take this five minute survey and you could win a $250 Gift Certificate. http://www.wrgsurveys.com/2003/osdntech03.php?site=8 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
RE: [SAtalk] SA Learn question
At 03:28 PM 12/3/2003, Vee Persaud wrote: I was planning on just forwarding any suspect spam emails to an email account on my SA server and running it through sa-learn. I guess that this isn't the correct way to do it ??? No.. that is a *VERY* bad idea to do, because it will cause sa-learn to learn that forwarded messages are spam, and not learn much about the spam itself. sa-learn *must* be trained on a more-or-less unadulterated copy of the message to be effective. This includes the headers because SA does tokenize headers as much as it tokenizes the body. Read the FAQ http://spamassassin.taint.org/faq/index.cgi?req=show&file=faq05.001.htp http://spamassassin.taint.org/faq/index.cgi?req=show&file=faq05.003.htp --- This SF.net email is sponsored by OSDN's Audience Survey. Help shape OSDN's sites and tell us what you think. Take this five minute survey and you could win a $250 Gift Certificate. http://www.wrgsurveys.com/2003/osdntech03.php?site=8 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
