[SAtalk] Another newbie

2002-02-21 Thread Brian Prescott-Decie
Dear all at Spamassassin, First, thank you very much for a beautiful piece of work! Now the questions! I'm running a website on a virtual (FreeBSD) server. As a result, I have login privileges but not as root. Since the server providers didn't show any interest in a public installation, I h

[SAtalk] Installing with CPAN shell

2002-02-21 Thread Bart Schaefer
Preliminary question: Is there a searchable archive of this list? I hate jumping in without looking for past threads, but visually scanning the geocrawler archive is just not cutting it. Now for the real discussion: I just tried installing SpamAssassin from the CPAN shell. The test phase fai

Re: [SAtalk] testing spam

2002-02-21 Thread Craig Hughes
Oh, it may also have something to do with using "Header" instead of "header" for the rule type. C On Thu, 2002-02-21 at 16:14, Craig Hughes wrote: > More importantly though, you can't create rules in userprefs; you can > only modify descriptions and scores, do whitelisting, and a few other > thi

Re: [SAtalk] testing spam

2002-02-21 Thread Craig Hughes
More importantly though, you can't create rules in userprefs; you can only modify descriptions and scores, do whitelisting, and a few other thing. perldoc Mail::SpamAssassin::Conf On Thu, 2002-02-21 at 15:46, Daniel Rogers wrote: > On Thu, Feb 21, 2002 at 06:40:22PM -0500, Landy Roman wrote: >

Re: Re: Re: Re: Re: [SAtalk] slooooow rules

2002-02-21 Thread Craig Hughes
> I don't want to spend many time making the patch, unless it goes immediately > into CVS, as keeping it sync with CVS for weeks/months is a nightmare... > If I have to do the fork&sync way, i'll fork everything and redesign ruleset > syntax to better fit my needs for the C version... Rules tend

Re: [SAtalk] testing spam

2002-02-21 Thread Landy Roman
On Thu, 21 Feb 2002 15:46:58 -0800 Daniel Rogers <[EMAIL PROTECTED]> wrote: > On Thu, Feb 21, 2002 at 06:40:22PM -0500, Landy Roman wrote: > > Header TEST_FROM From =~ /adomainname/i > > describe TEST_tandom this is a test rr > > score TEST_FOR_SPAM 7.0 > > The scond field needs to be the same

Re: [SAtalk] testing spam

2002-02-21 Thread Daniel Rogers
On Thu, Feb 21, 2002 at 06:40:22PM -0500, Landy Roman wrote: > Header TEST_FROM From =~ /adomainname/i > describe TEST_tandom this is a test rr > score TEST_FOR_SPAM 7.0 The scond field needs to be the same for all three. ie: Header MY_TEST_FROM From =~ /adomainname/i describe MY_TEST_FROM th

[SAtalk] testing spam

2002-02-21 Thread Landy Roman
i tried adding this to my .spamassassin/user_pref hoping it would tag mail from a domain as spam but it seem not to be working any hints? Header TEST_FROM From =~ /adomainname/i describe TEST_tandom this is a test rr score TEST_FOR_SPAM 7.0 ___ Spam

Re: Re: Re: Re: Re: [SAtalk] slooooow rules

2002-02-21 Thread Arpi
Hi, > On Thu, 2002-02-21 at 13:42, Arpi wrote: > > when will it be implemented, or better: when will you accept such patch fo > r > > ruleset? (i cannot modify the perl code, as i don't know the perl languege > > nor the spamassassin core enough, but i could help making this optimzation > > to th

[SAtalk] Re: slooooow rules

2002-02-21 Thread Daniel Pittman
On 21 Feb 2002, Craig Hughes wrote: > On Thu, 2002-02-21 at 10:22, Arpi wrote: [...] >> body FOR_INSTANT_ACCESS /\sINSTANT\s+ACCESS.{0,20}\s+/i >> >> correct me if i'm wrong, i'm still newbie in regexp world :) > > I think > body FOR_INSTANT_ACCESS /INSTANT ACCESS/i > is fine b

Re: Re: Re: Re: [SAtalk] slooooow rules

2002-02-21 Thread Craig Hughes
Ok, so this thread got my to go read through man perlre in a little more detail. I've found the following as a result: PerMsgStatus.pm uses $& and $', which apparently will cause *all* regex matching to be much slower program wide. I'll try to rewrite the one line on which that occurs; we shoul

Re: Re: Re: Re: [SAtalk] slooooow rules

2002-02-21 Thread Craig Hughes
Heh, yeah. My syntax would make it seem that it would allow that. And I agree that allowing that would be better. But allowing that would mean more coding ;) I'll probably do it anyway... C On Thu, 2002-02-21 at 14:20, Arpi wrote: > Hi, > > > On 21 February 2002, Craig Hughes said: > > > I

Re: Re: Re: [SAtalk] slooooow rules

2002-02-21 Thread Craig Hughes
This syntax makes the rule parse more complicated, given the way it works now. Though it is a little nicer because it makes it clearer that something like: rawbody A/rule1/ and header A /rule2/ will not work as expected. C On Thu, 2002-02-21 at 13:40, Greg Ward wrote: > On 21 February 200

Re: Re: Re: Re: [SAtalk] slooooow rules

2002-02-21 Thread Craig Hughes
On Thu, 2002-02-21 at 13:42, Arpi wrote: > when will it be implemented, or better: when will you accept such patch for > ruleset? (i cannot modify the perl code, as i don't know the perl languege > nor the spamassassin core enough, but i could help making this optimzation > to the ruleset) You ca

Re: Re: Re: Re: [SAtalk] slooooow rules

2002-02-21 Thread Greg Ward
On 21 February 2002, Arpi said: > anyway, i have a request: > could you add a new rule type, for plain text matches? > searching for a text string is always simpler and faster than for regexps, > and many of your regexps are such strings (/some words/i) and there will be > much more when start add

Re: Re: Re: Re: [SAtalk] slooooow rules

2002-02-21 Thread Arpi
Hi, > On 21 February 2002, Craig Hughes said: > > I had been thinking about creating a "multiple-rule" format for rules, > > where in order to match a rule, you would have to match a sequence of > > regexes, eg: > > > > rawbody ASCII_FORM_ENTRY /_{30,}/ > > and rawbody ASCII_FORM_ENTRY /[

Re: Re: Re: [SAtalk] slooooow rules

2002-02-21 Thread Greg Ward
On 21 February 2002, Craig Hughes said: > I had been thinking about creating a "multiple-rule" format for rules, > where in order to match a rule, you would have to match a sequence of > regexes, eg: > > rawbody ASCII_FORM_ENTRY /_{30,}/ > and rawbody ASCII_FORM_ENTRY /[^<][A-Za-z][A-Za-z]

Re: Re: Re: Re: [SAtalk] slooooow rules

2002-02-21 Thread Arpi
Hi, > I had been thinking about creating a "multiple-rule" format for rules, > where in order to match a rule, you would have to match a sequence of > regexes, eg: > > rawbody ASCII_FORM_ENTRY /_{30,}/ > and rawbody ASCII_FORM_ENTRY /[^<][A-Za-z][A-Za-z]+.{1,15}?\s+_{30,}/ > > the "and"

Re: Re: Re: [SAtalk] slooooow rules

2002-02-21 Thread Craig Hughes
I had been thinking about creating a "multiple-rule" format for rules, where in order to match a rule, you would have to match a sequence of regexes, eg: rawbody ASCII_FORM_ENTRY /_{30,}/ and rawbody ASCII_FORM_ENTRY /[^<][A-Za-z][A-Za-z]+.{1,15}?\s+_{30,}/ the "and" prefix on a rule mean

Re: [SAtalk] slooooow rules

2002-02-21 Thread Craig Hughes
On Thu, 2002-02-21 at 10:22, Arpi wrote: > Hi, > > > I've ran my C version through your really big spam collection at night, and > > filtered out 'slow' messages. Then I've checked which regexps makes them so > > slow (slow mean 5..25 secs/mail on p4 1.8ghz). > > more on this... > > > FOR_INSTA

Re: [SAtalk] False positive on FORGED_HOTMAIL_RCVD test

2002-02-21 Thread Craig Hughes
Yeah, I guess I should send myself a hotmail message and see how they've changed headers... C On Thu, 2002-02-21 at 07:20, Dallas Engelken wrote: > > I was just debugging some (non-spamassassin related) mail problems so I > > sent a message from a hotmail account to my real mail address. It was

Re: Re: Re: [SAtalk] slooooow rules

2002-02-21 Thread Arpi
Hi, > > > rawbody ASCII_FORM_ENTRY/[^<][A-Za-z][A-Za-z]+.{1,15}?\s+_{30,}/ > > [^<] means "any character except '<'". > anyway, it explains why is this regexp so slow :( > it partially matches at every character position of text, and only at the > end (_{30,}) turns out that bad match..

Re: [SAtalk] slooooow rules

2002-02-21 Thread Craig Hughes
Slightly more accurately, ^ as the *first* character inside [] means not. Later in the [] it means ^ C On Thu, 2002-02-21 at 10:42, Charlie Watts wrote: > On Thu, 21 Feb 2002, Arpi wrote: > > > rawbody ASCII_FORM_ENTRY/[^<][A-Za-z][A-Za-z]+.{1,15}?\s+_{30,}/ > > > > could someone pleas

Re: [SAtalk] Nigeria Scam not working?

2002-02-21 Thread Craig Hughes
You have an out-of-date rules file somewhere -- the A_FROM_IN_AUTO_WHITELIST rule thing is caused by the changes in AWL stuff. Old rules files with new code will show that problem. C On Thu, 2002-02-21 at 05:28, Jason wrote: > > For some reason the Nigeria scam seems to be getting through... >

Re: [SAtalk] Reporting for new AWL?

2002-02-21 Thread Craig Hughes
Doh! Yes of course -- I forgot about adding info to the report. I'll do that now. C On Thu, 2002-02-21 at 02:16, Michael Moncur wrote: > I've just been toying with the new auto-whitelist and was convinced it wasn't > working for a while because the spam reporting is a bit confusing. Case in >

Re: Re: [SAtalk] slooooow rules

2002-02-21 Thread Arpi
Hi, > On Thu, 21 Feb 2002, Arpi wrote: > > > rawbody ASCII_FORM_ENTRY/[^<][A-Za-z][A-Za-z]+.{1,15}?\s+_{30,}/ > > > > could someone please explain what does [^<] matches ? > > afaik ^ means beginning-of-line but it's strange in [] character array. > > so, what does ^ mean there? begin-of

Re: [SAtalk] slooooow rules

2002-02-21 Thread James Golovich
On Thu, 21 Feb 2002, Arpi wrote: > rawbody ASCII_FORM_ENTRY/[^<][A-Za-z][A-Za-z]+.{1,15}?\s+_{30,}/ > > could someone please explain what does [^<] matches ? > afaik ^ means beginning-of-line but it's strange in [] character array. > so, what does ^ mean there? begin-of-line or '^' char

Re: [SAtalk] slooooow rules

2002-02-21 Thread Arpi
Hi, > I've ran my C version through your really big spam collection at night, and > filtered out 'slow' messages. Then I've checked which regexps makes them so > slow (slow mean 5..25 secs/mail on p4 1.8ghz). more on this... > FOR_INSTANT_ACCESS: > /(?:CLICK HERE|).{0,20}\s+INSTANT\s+ACCESS.{0,

Re: [SAtalk] False positive on FORGED_HOTMAIL_RCVD test

2002-02-21 Thread Dallas Engelken
> I was just debugging some (non-spamassassin related) mail problems so I > sent a message from a hotmail account to my real mail address. It was > tagged with FORGED_HOTMAIL_RCVD even though it was sent from hotmail. > This is with the Spamassassin in Debian unstable. FYI This has been covered

RE: [SAtalk] False positive on FORGED_HOTMAIL_RCVD test

2002-02-21 Thread Seth H. Bokelman
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Yep, I've noticed it flagging a lot of e-mails from friends that have legitimate hotmail accounts as well. That's on 2.0 on my Red Hat Linux box. Seth Bokelman PC Support Specialist College of Social & Behavioral Sciences University of Northern Iowa

[SAtalk] False positive on FORGED_HOTMAIL_RCVD test

2002-02-21 Thread Henrik Enberg
FYI, I was just debugging some (non-spamassassin related) mail problems so I sent a message from a hotmail account to my real mail address. It was tagged with FORGED_HOTMAIL_RCVD even though it was sent from hotmail. This is with the Spamassassin in Debian unstable. -- We spent a lot of time

Re: Re: Re: [SAtalk] spamassassin in 100% C

2002-02-21 Thread Charlie Watts
On Thu, 21 Feb 2002, Matt Sergeant wrote: > On Wed, 20 Feb 2002, Colm MacCárthaigh wrote: > > On Wed, Feb 20, 2002 at 01:06:06PM +, Matt Sergeant wrote: > > > On 20 Feb 2002, Nigel Metheringham wrote: > > > > > > > The biggest problem with razor at present is the lack of vetting of > > > > inp

[SAtalk] Nigeria Scam not working?

2002-02-21 Thread Jason
For some reason the Nigeria scam seems to be getting through... --- Just a snip of what I'm seeing... STRICTLY CONFIDENTIAL & URGENT I am a member of the Federal Government of Nigeria Contract Award and Monitoring Committee in the Nigerian National Petroleum Corporation (NNPC). ---

Re: [SAtalk] custom

2002-02-21 Thread Landy Roman
thanks; On Wed, 20 Feb 2002 21:47:44 -0500 dman <[EMAIL PROTECTED]> wrote: > On Wed, Feb 20, 2002 at 06:35:50PM -0500, Landy Roman wrote: > | nice article in LM about spamassassin, i hope the spammers don't > | read it > > Doesn't make much difference. The only thing they can do is turn > the

[SAtalk] Reporting for new AWL?

2002-02-21 Thread Michael Moncur
I've just been toying with the new auto-whitelist and was convinced it wasn't working for a while because the spam reporting is a bit confusing. Case in point, this report from a deliberately spammy email I sent myself: X-Spam-Report: 6.624167 hits, 5 required; * 1.0 -- Subject conta

Re: [SAtalk] New AWL implementation now done

2002-02-21 Thread Matt Sergeant
On 19 Feb 2002, Craig Hughes wrote: > This system has a number of advantages over the simple counting method > of the old AWL implementation: > > 1. Spammers before could just send you 3 "clean" messages and thereby > get themselves permanently obtaining a -100 bonus. Now they would have > to ke

Re: Re: Re: [SAtalk] spamassassin in 100% C

2002-02-21 Thread Matt Sergeant
On Wed, 20 Feb 2002, Colm MacCárthaigh wrote: > On Wed, Feb 20, 2002 at 01:06:06PM +, Matt Sergeant wrote: > > On 20 Feb 2002, Nigel Metheringham wrote: > > > > > The biggest problem with razor at present is the lack of vetting of > > > input, and some form of input validation is essential if

Re: Re: Re: [SAtalk] spamassassin in 100% C

2002-02-21 Thread Matt Sergeant
On Wed, 20 Feb 2002, Charlie Watts wrote: > On Wed, 20 Feb 2002, Matt Sergeant wrote: > > > On Tue, 19 Feb 2002, Charlie Watts wrote: > > > > > And I'm actually playing with Razor again. It isn't nearly as broken as it > > > was for a while. But I've got some spare CPU cycles to throw at Razor >