Re: [SAtalk] SUBJ_ALL_CAPS regex broken

Charlie Watts wrote: >On Sat, 9 Mar 2002, Rob McMillin wrote: > >> >>s/b >> >> return $subject cmp uc($subject); >> >> >> > >'s OK, I'll share my prize with you. Everybody goes home a winner here at >"The Regex is Right!" > Okay, so here's my mods: cd ~/src/RPMS/BUILD/Mail-SpamAssassin/lib/Mail/

[SAtalk] Mime null block report fix *still* not quite right...

Grrr The previous patch I submitted *still* wasn't quite right; a malicious user could still send a mail which would result in an infinite loop, eating up CPU resources and slowing down the mail server. *This* patched I've stared at, slept on, and stared at again, and I'm positive that i

Re: [SAtalk] SUBJ_ALL_CAPS regex broken

Charlie Watts wrote: >On Sat, 9 Mar 2002, Rob McMillin wrote: > >> >>s/b >> >> return $subject cmp uc($subject); >> >> >> > >'s OK, I'll share my prize with you. Everybody goes home a winner here at >"The Regex is Right!" > Cool, I was just hoping for a board game version of the show as a consol

Re: [SAtalk] SUBJ_ALL_CAPS regex broken

On Sat, 9 Mar 2002, Rob McMillin wrote: > > s/b > > return $subject cmp uc($subject); > > 's OK, I'll share my prize with you. Everybody goes home a winner here at "The Regex is Right!" -- Charlie Watts [EMAIL PROTECTED] Frontier Internet, Inc. http://www.frontier.net/ ___

Re: [SAtalk] Misc. rule ideas

On Saturday 09 March 2002 09:39 pm, Rob McMillin wrote: > Kerry Nice wrote: > >#this one will only work for me, but if it there, it > >is 100% GUARANTEED to be spam > >#not sure how to make a general case for this > >header KERRYSUBJECT Subject =~ /kerry_nice/ > >describe KERRYSUBJECT

Re: [SAtalk] SUBJ_ALL_CAPS regex broken

Charlie Watts wrote: >On Sat, 9 Mar 2002, Rob McMillin wrote: > >>Charlie Watts wrote: >> >>>The current SUBJ_ALL_CAPS is broken. >>> >>>(The one from CVS - this: >>>header SUBJ_ALL_CAPS Subject =~ /^[^a-z]*([A-Z][^a-z]*){3,}[^a-z]*$/ >>>) >>> >>Congratulations, Charlie! You're the next winner on

Re: [SAtalk] SUBJ_ALL_CAPS regex broken

On Sat, 9 Mar 2002, Rob McMillin wrote: > Charlie Watts wrote: > > >The current SUBJ_ALL_CAPS is broken. > > > >(The one from CVS - this: > >header SUBJ_ALL_CAPS Subject =~ /^[^a-z]*([A-Z][^a-z]*){3,}[^a-z]*$/ > >) > > > Congratulations, Charlie! You're the next winner on "The Regex Is Right!" T

Re: [SAtalk] SUBJ_ALL_CAPS regex broken

Charlie Watts wrote: >The current SUBJ_ALL_CAPS is broken. > >(The one from CVS - this: >header SUBJ_ALL_CAPS Subject =~ /^[^a-z]*([A-Z][^a-z]*){3,}[^a-z]*$/ >) > Congratulations, Charlie! You're the next winner on "The Regex Is Right!" Heh. The problem is that this RE has exponential backoff t

Re: [SAtalk] Misc. rule ideas

Kerry Nice wrote: >Here are some rules I added to my local.cf that seem >to be catching a few things. > >#Seems to be a broken bulk mail program that puts some >of the headers in the email body >rawbody MESSAGEIDINBODY /^Message-Id: ><.*\@message-Id>$/ >describe MESSAGEIDINBODY Distictive Mess

[SAtalk] More complex customizations (MIME, etc)

I'd like to make two changes to how SpamAssassin behaves: 1) If a message is spam, it should not be modified, but instead be replaced by a multipart/mixed message where the first part is a text/plain containing the SpamAssassin report and the second part is a message/rfc822 containing t

[SAtalk] Re: [SA] Tired of those speeding tickets?

This message posted to -sightings is interesting, because it does have a valid signature line "^-- $" ... (I've blocked em5000.net entirely in my MTA; I've blocked many tens of thousands of messages from them, and haven't gotten a single complaint from my users.) On Sat, 9 Mar 2002, it was writt

[SAtalk] SUBJ_ALL_CAPS regex broken

The current SUBJ_ALL_CAPS is broken. (The one from CVS - this: header SUBJ_ALL_CAPS Subject =~ /^[^a-z]*([A-Z][^a-z]*){3,}[^a-z]*$/ ) Scanning this message takes 10 seconds: From: Charlie Watts <[EMAIL PROTECTED]> Subject: A foofoo token body This takes 20 seconds: From: C

[SAtalk] Spam with "To:" including text file names?

I just got this weird spam who's "To:" field is "\unabad.txt, \8un.txt, \8bad.txt"; looks like a piece of Chinese spam. Is this malconfigured spam software, or something else? -- Visit http://dmoz.org, the world's | Give a man a match, and he'll be warm largest human edited web directory.

Re: [SAtalk] new spamd doesn't reap children

On Sat, 9 Mar 2002, Charlie Watts wrote: > On Fri, 8 Mar 2002, Duncan Findlay wrote: > > On Fri, Mar 08, 2002 at 02:18:25PM -0700, Charlie Watts wrote: > > > On Fri, 8 Mar 2002, Charlie Watts wrote: > > > > > > > spamd from last night sometimes doesn't always reap its children; This is > > > > wi

[SAtalk] Re: Catching virus distribution with SpamAssassin (was Re: Misc.rule ideas)

On Sat, 09 Mar 2002, Michael Shields wrote: > In article <[EMAIL PROTECTED]>, > Daniel Pittman <[EMAIL PROTECTED]> wrote: >> MIMEdefang does exactly >> what you want. It will strip away executable files and discard them >> completely for you -- perfect f

[SAtalk] Re: (?: in regexps

On Sat, 9 Mar 2002, Matthew Cline wrote: > Why is "(?:" used in the rules regexps instead of just "("? Because a back-reference to that group is not needed. > Does the engine that applies the rules put normal parens around the > whole regexp, and we don't want to interfere with it generating $1

[SAtalk] Re: Proposed 'FROM_SPAMLAND' user response summary

On Fri, 08 Mar 2002, Rob McMillin wrote: > Justin Mason wrote: > >> Mind you, I don't think this is a good idea; it will make SA even >> more westerner-oriented. :( Pretty much all the GA corpus is from >> western >>sources and in western charsets, so the GA will totally skew it. > > Further: the

[SAtalk] help with whitelist?

Hi, I'm trying to figure out why my whitelist setup (in /etc/mail/spamassassin/local.cf) doesn't work sometimes? I'll often have messages with the corresponding from or to get flagged as spam. How can I debug this? ___ Spamassassin-talk mailing list

Re: [SAtalk] BUG: Documentation wrong about sitewide/etc/mail/spamassassin/user_prefs.template

On Sat, 9 Mar 2002, Duncan Findlay wrote: > On Sat, Mar 09, 2002 at 07:45:20AM -0600, Scott Walde wrote: > > On Fri, 8 Mar 2002, Duncan Findlay wrote: > > > > > If you delete one path, delete /etc/mail/spamassassin. I don't know what > > > distribution has /etc/mail and what software supports this

Re: [SAtalk] new spamd doesn't reap children

On Fri, 8 Mar 2002, Duncan Findlay wrote: > On Fri, Mar 08, 2002 at 02:18:25PM -0700, Charlie Watts wrote: > > On Fri, 8 Mar 2002, Charlie Watts wrote: > > > > > spamd from last night sometimes doesn't always reap its children; This is > > > with the -S setting on or off, with auto-whitelist on or

Re: [SAtalk] BUG: Documentation wrong about sitewide /etc/mail/spamassassin/user_prefs.template

On Fri, Mar 08, 2002 at 10:54:57PM -0800, Timothy Demarest wrote: > Duncan: > > Thanks for the comments. > > > > >I think it is perfectly acceptible to let the local admin decide where > >he/she wants to put files. Why restrict, especially when the performance > >gain/loss is so incredibly insig

Re: [SAtalk] BUG: Documentation wrong about sitewide /etc/mail/spamassassin/user_prefs.template

On Sat, Mar 09, 2002 at 07:45:20AM -0600, Scott Walde wrote: > On Fri, 8 Mar 2002, Duncan Findlay wrote: > > > If you delete one path, delete /etc/mail/spamassassin. I don't know what > > distribution has /etc/mail and what software supports this, but Debian > > certainly does not. (Wouldn't it b

[SAtalk] Re: Catching virus distribution with SpamAssassin

Take a look at MailScanner (http://www.mailscanner.info). It is meant to be the interface between sendmail or Exim and a commercial command line virus scanner. But wait...there's more 8-) It also has a attachment manager so you can filter out .exe files (and any/all the other popular virus-cre

[SAtalk] Re: HUNZA_DIET_BREAD

On 3/6/02 9:40 AM, "Michael Shields" <[EMAIL PROTECTED]> wrote: > In article > <[EMAIL PROTECTED]>, > Craig R Hughes <[EMAIL PROTECTED]> wrote: >> What the heck, I changed it to /HUNZA/i > > Shouldn't this at least be /\bHUNZA\b/i? Yeah, wouldn't want to match longer words like "hunzardly" or

[SAtalk] Re: Matching on attribution lines (was Re: Misc. rule ideas)

Well, that wasn't what this rule does, but it does make a good point. If I get an email with a subject like 'Hello kerry_nice, get your free porn here', it is spam, no question about it. I'm not looking to whitelist these. But what would be nice, and maybe is needed to really make this thing

[SAtalk] -W and -R not working

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Trying to set up aliases to spamassassin -W and spamassassin -R but they don't seem to work. I get this error. - - - The following addresses had permanent fatal errors - "| /usr/bin/spamassassin -W" (reason: internal software error)

[SAtalk] Matching on attribution lines (was Re: Misc. rule ideas)

Kerry Nice just mooed: > > Here are some rules I added to my local.cf that seem > to be catching a few things. > > #this one will only work for me, but if it there, it > is 100% GUARANTEED to be spam > #not sure how to make a general case for this > header KERRYSUBJECT Subject =~ /kerry_ni

Re: [SAtalk] Misc. rule ideas

Here are some rules I added to my local.cf that seem to be catching a few things. #Seems to be a broken bulk mail program that puts some of the headers in the email body rawbody MESSAGEIDINBODY /^Message-Id: <.*\@message-Id>$/ describe MESSAGEIDINBODY Distictive Message ID in email body score

[SAtalk] Re: Catching virus distribution with SpamAssassin (was Re: Misc.rule ideas)

In article <[EMAIL PROTECTED]>, Daniel Pittman <[EMAIL PROTECTED]> wrote: > MIMEdefang does exactly what > you want. It will strip away executable files and discard them > completely for you -- perfect filtering of the "junk" you get. It looks like MIME

Re: [SAtalk] Postfix +mysql spamproxyd anyone?

Keith, Look through the archives. Somebody posted an answer to this before. Basically, what they did, was follow the "simple" configuration described in the README.filter and in the shell script they used "spamc". I don't know that anyone has used spamproxyd, but the trick is that yo

Re: [SAtalk] Razor whitelist ignored

What line in Reporter.pm do i have to comment out? Andrew Heberle wrote: > I am currently running SA 2.11 and razor-agents 1.20 > > I have commented out the line in both Dns.pm and Reporter.pm which prevented > SA and razor 1.20 working correctly together. > > Razor works perfectly by itself an

[SAtalk] Razor whitelist ignored

I am currently running SA 2.11 and razor-agents 1.20 I have commented out the line in both Dns.pm and Reporter.pm which prevented SA and razor 1.20 working correctly together. Razor works perfectly by itself and almost perfectly with SA, but razor's whitelisting options do not work. Adding the

Re: [SAtalk] rewrite_mail changing 'Return-Path: ' into 'From '

CertaintyTech - Ed Henderson wrote: > > Use the "-F 0" switch for spamd/spamassassin I'm not using spamassassin, but a custom script with Mail::SpamaAssassin and Mail::Audit directly. There doesn't seem to be an option affecting this except in SA::NoMailAudit, which I'm not using. In addition,

RE: [SAtalk] rewrite_mail changing 'Return-Path: ' into 'From '

Use the "-F 0" switch for spamd/spamassassin --- Ed. > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED]]On Behalf Of > Rodent of Unusual Size > Sent: Saturday, March 09, 2002 9:30 AM > To: [EMAIL PROTECTED] > Subject: [SAtalk] rewrite_mail changing 'Return-Path: '

RE: [SAtalk] Failure using razor

Downgrade to Razor 1.19 and it will work. There has been several discussions about this on the list the last few days. > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED]]On Behalf Of > [EMAIL PROTECTED] > Sent: Saturday, March 09, 2002 9:15 AM > To: [EMAIL PROTE

[SAtalk] Newbie

I am new to SA but after reading a lot I seem to be missing something. I am in need of a good spam filter for a network of about 30 machines, so I have looked at spambouncer and now spamassassin. I have setup SA on a workstation, with this in my .procmailrc :0fw | spamassassin -P :0: * ^X-S

[SAtalk] rewrite_mail changing 'Return-Path: ' into 'From '

After turning SA loose on my inbound mail last night, I found a bunch of my mail misfiled this morning. Close examination shows that the 'Return-path:' fields have been rewritten to 'From ' instead -- breaking my filing filters. I find no mention if this in the archives, and it seems completely

Re: [SAtalk] Failure using razor

I just installed it yesterday and have the same problem, I just hadn't gotten to asking yet. Any idea what it might be? > I've installed spamassassin (2.01) and razor (1.20) and all the other > required perl modules. > > When I run the tests for spamassassin I see the following for several > tes

[SAtalk] Failure using razor

I've installed spamassassin (2.01) and razor (1.20) and all the other required perl modules. When I run the tests for spamassassin I see the following for several tests: razor check skipped: No such file or directory undefined Razor::Client razor seems to be o.k. as when I call razor-check dire

Re: [SAtalk] BUG: Documentation wrong about sitewide/etc/mail/spamassassin/user_prefs.template

On Fri, 8 Mar 2002, Duncan Findlay wrote: > If you delete one path, delete /etc/mail/spamassassin. I don't know what > distribution has /etc/mail and what software supports this, but Debian > certainly does not. (Wouldn't it be stupid to have an /etc/mail with just > spamassassin stuff in it?) w

Re: [SAtalk] 'Can't locate method "head"'?

Rodent of Unusual Size wrote: > > I've installed SA 2.01 and Mail::Audit 2.1 on an RH 5.2 system > running Perl 5.6.1. Mail::Internet is from MailTools 1.43. > I am trying to pipe mail through a filter from sendmail with > the following script: : > Can't locate object method "head" via p

[SAtalk] Postfix +mysql spamproxyd anyone?

Anyone have spamassassin working with postfix with the mysql patch making everyone a virtual user? I'd like to run everything through spamproxyd, the directions appear simple enough. However mail just loops constantly in every configuation I've tried. Postfix -> spamproxyd -> postfix -> spamprox

[SAtalk] (?: in regexps

Why is "(?:" used in the rules regexps instead of just "("? Does the engine that applies the rules put normal parens around the whole regexp, and we don't want to interfere with it generating $1, $2 and such? Does "(?:" use less resources? Something else? -- Visit http://dmoz.org, the worl

[SAtalk] WE_HONOR_ALL

body WE_HONOR_ALL /we (?:honou?r|respect)(?: all|) remov[eal] requests/i Shouldn't "remov[eal]" be "remov(?:e|al)"? The way it is now, it matches "remove", "remova", or "removl". -- Visit http://dmoz.org, the world's | Give a man a match, and he'll be warm largest human edited web directory