[SAtalk] removing viruses from mass-check submissions

I wrote a script to help me remove viruses from my test corpus. I think this script might be useful for anyone planning on submitting mass-check results especially if you don't want to install a complete virus-scanner (or figure out how to use one on already foldered email). This script can only

Re: [SAtalk] Cyrillic encoding raises the spam level to 3.8

Michael Moncur <[EMAIL PROTECTED]> writes: > I think the problem is simple: We have a SUBJ_FULL_OF_8BITS rule for 8-bit > subjects. People can score it however they want. The unexpected thing is > that every 8-bit subject also matches the SUBJ_ALL_CAPS rule, which it > shouldn't. I filed a bug r

Re: [SAtalk] Replying to list???

Olivier Nicole <[EMAIL PROTECTED]> writes: > Just considering how frequent the question is, couldn't it be added, > as a large warning, to the beginig of the email for subscribtion > confirmation? Well, it's not that frequent, but it's the second most second common FAQ across all mailing lists.

RE: [SAtalk] Getting AWL not apply to my address

This doesn't address my issue. I'm sending multiple good messages to myself, and so [EMAIL PROTECTED] definitely "deserves" to be whitelisted. However, when spammers forge the From address to be from me, they are "stealing" my karma/AWL listing. Therefore, we have: http://bugzilla.spamassassin.o

[SAtalk] Re: SA did something strange

On Thu, Jun 13, 2002 at 08:17:33PM -0700, Jonathan Nichols wrote: | Wow, this is strange.. | | Message-Id: <[EMAIL PROTECTED]> | X-Spam-Status: No, hits=-97.2 required=7.0 | tests=NO_REAL_NAME,CLICK_BELOW,COPYRIGHT_CLAIMED,EXCUSE_1,USER_IN_WHITELIST | version=2.20 | X-Spam-Level: | | hits are -9

[SAtalk] SA did something strange

Wow, this is strange.. Message-Id: <[EMAIL PROTECTED]> X-Spam-Status: No, hits=-97.2 required=7.0 tests=NO_REAL_NAME,CLICK_BELOW,COPYRIGHT_CLAIMED,EXCUSE_1,USER_IN_WHITELIST version=2.20 X-Spam-Level: hits are -97.2? I was trying to get it to whitelist stuff from slashdot.org. It doesn't mark t

Re: [SAtalk] Re: freqdiff script

On Wed, Jun 12, 2002 at 11:20:48PM -0700, Daniel Quinlan wrote: Content-Description: message body text > Here's the attachment for real this time. > How about adding it to cvs? -- Duncan Findlay ___ Don't miss the 2002 Sprint PCS A

Re: [SAtalk] Replying to list???

> How come this list does not have the reply to: set to the spamassassin list? > Every time I want to reply to the list I have to type in the email address. > Or as I see others do they use the reply to all feature and then the user > and the list gets a copy. Just considering how frequent the qu

RE: [SAtalk] Cyrillic encoding raises the spam level to 3.8

> The reality of the world doesn't match the RFCs - so we shouldn't > score 8bit > too high. Actually we should (it stops HEAPS of Spam for our ASCII site) - > but maybe it needs to be more obviously configurable? I think the problem is simple: We have a SUBJ_FULL_OF_8BITS rule for 8-bit subjects

[SAtalk] Re: Replying to list???

On Thu, Jun 13, 2002 at 04:56:03PM -0500, Skip Montanaro wrote: | | Jim> How come this list does not have the reply to: set to the | Jim> spamassassin list? | | Jim> Is it just me? | | Probably not. Search google for "reply-to considered harmful". It's here : http://www.u

Re: [SAtalk] Replying to list???

Jim> How come this list does not have the reply to: set to the Jim> spamassassin list? Jim> Is it just me? Probably not. Search google for "reply-to considered harmful". -- Skip Montanaro [EMAIL PROTECTED] consulting: http://manatee.mojam.com/~skip/resume.html ___

Re: [SAtalk] AUDIO_ATTACH eval test

On Thu, Jun 13, 2002 at 05:20:56PM -0400, Theo Van Dinter wrote: > I use: > > full AUDIO_ATTACHeval:check_for_audio_executables() > describe AUDIO_ATTACHHas an audio attachment with an executable extension > score AUDIO_ATTACH 10 Actually, I wasn't clear

Re: [SAtalk] Cyrillic encoding raises the spam level to 3.8

More of a FYI, but just in case you don't know, but there are LOTS of mailers out there in Europe/Asia where they DO send 8bit chars in the headers. Yes, they know it's not a good idea (due to lack of charset info), but when 90% of your mail is within the same site/country, you'll get away with i

Re: [SAtalk] Replying to list???

On Thu, Jun 13, 2002 at 01:59:52PM -0700, Jim Scott wrote: > How come this list does not have the reply to: set to the spamassassin list? > Every time I want to reply to the list I have to type in the email address. http://sourceforge.net/docman/display_doc.php?docid=6693&group_id=1 Marc -- "A

Re: [SAtalk] Trick to bypass Razor

On Thursday 13 June 2002 07:34 am, Fred Inklaar wrote: > Look at the next 3 mails, that were received by an address that > auto-reports to Razor. Usually when I receive multiple instances of the > same spam, all but the first are listed in Razor (the one that was > reported). > In this case howev

Re: [SAtalk] Re: Re: Re: C version

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Thu, 13 Jun 2002, Craig R. Hughes outgrape: > DdH> Oh, that's a limiting factor too. spamd takes up about 8MB on > DdH> its own. It should share most (if not all) of that when it > DdH> forks, but you don't want more than 2 or maybe 3 spamd's ru

Re: [SAtalk] Cyrillic encoding raises the spam level to 3.8

> "DQ" == Daniel Quinlan <[EMAIL PROTECTED]> writes: DQ> As I received it, the email that Arcady posted had 8-bit characters, DQ> but they were safely encoded in quoted-printable. DQ> Subject: =?koi8-r?b?18HX2cHX2Q==?= DQ> However, I checked the version of the rule in CVS and it seems to

Re: [SAtalk] Replying to list???

Jim Scott <[EMAIL PROTECTED]> writes: > How come this list does not have the reply to: set to the spamassassin list? > Every time I want to reply to the list I have to type in the email address. > Or as I see others do they use the reply to all feature and then the user > and the list gets a copy

[SAtalk] AUDIO_ATTACH eval test

I didn't want to submit this as an official patch since there's still some argument about whether or not SA should be watching for virus/worm mails. I've been getting enough of these things lately though that I wanted SA to catch them (why parse the message twice?) and then I can deal with them ba

Re: [SAtalk] problem with SA and Mail::Audit

On Thu, Jun 13, 2002 at 12:54:00PM -0700, Craig R Hughes wrote: > Mail::Audit doesn't let you change the contents of a mail message once it's > created, which SA needs to be able to do easily. So we implemented our own > more-or-less compatible Mail::Audit replacement, called > Mail::SpamAssassin

Re: [SAtalk] Re: Re: spamc message size limits

Craig R Hughes <[EMAIL PROTECTED]> writes: > Does TextCat identify it as english? Perhaps we could add a > language set to TextCat for "bad english" -- I suppose this is akin > to the "spam english" we've talked about before. I doubt "bad english" would work since word order has no effect on th

[SAtalk] Replying to list???

How come this list does not have the reply to: set to the spamassassin list? Every time I want to reply to the list I have to type in the email address. Or as I see others do they use the reply to all feature and then the user and the list gets a copy. Is it just me? Jim _

Re: [SAtalk] Fw: [Razor-users] Announce: Vipul's Razor v2

Yep, I see that now. Oh well will have to wait to see what the fix is to get it to work. It installed OK ;-) - Original Message - From: "Theo Van Dinter" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Cc: <[EMAIL PROTECTED]> Sent: Thursday, June 13, 2002 1:08 PM Subject: Re: [SAtalk] Fw: [

Re: [SAtalk] Trick to bypass Razor

On Thursday 13 June 2002 16:54, you wrote: > op 13-06-2002 16:42 schreef Bart Schaefer ([EMAIL PROTECTED]): > > On Thu, 13 Jun 2002, Fred Inklaar wrote: > >> In this case however, a single line of garbage is added to to the > >> message, making Razor generating a different CRC for each one, in > >

Re: [SAtalk] Re: Re: Re: C version

Derrick 'dman' Hudson wrote: DdH> OTOH, saying that DCC is I/O bound means that the limiting factor is DdH> bandwidth. In this case it is network bandwidth. You can put a DdH> super-powerful Athlon in that box, but DCC won't run any faster DdH> because it mostly sits idle waiting for data to co

Re: [SAtalk] C version

Actually, using -a with -S should increase the false _negative_ rate, not the false positive rate, since it will lower the AWL score for a spammy sender to around 5. C Duncan Findlay wrote: DF> On Mon, Jun 10, 2002 at 02:34:54PM +0200, Michael Stauber wrote: DF> > Hi Craig, DF> > DF> > > The -S

Re: [SAtalk] Re: Re: spamc message size limits

On Thu, 13 Jun 2002, Craig R Hughes wrote: > Bart Schaefer wrote: > > BS> Aside from the image attachments, the only identifying marks are > BS> extremely poor written English. > > Does TextCat identify it as english? TextCat wasn't part of SA yet the last time I got one. It might still be i

Re: [SAtalk] Fw: [Razor-users] Announce: Vipul's Razor v2

On Thu, Jun 13, 2002 at 12:55:07PM -0700, Jim Scott wrote: > debug: Razor is available > debug: Razor Agents 1.20, protocol version 2. As I just posted (crossed in the ether), SA is using Razor v1 modules which will still work. SA requires code changes for Razor v2 to

Re: [SAtalk] Re: Re: spamc message size limits

Bart Schaefer wrote: BS> Aside from the image attachments, the only identifying marks are extremely BS> poor written English. If they weren't so freaking huge, I'd read them for BS> the amusement value alone. Last time one slipped through, it included an BS> invitation to visit Mr. River's fact

Re: [SAtalk] Fw: [Razor-users] Announce: Vipul's Razor v2

On Thu, Jun 13, 2002 at 03:28:39PM -0400, rODbegbie wrote: > Initial signs are promising. Nothing seems "broken" in the SA integration. > Coolio! Warning: SA uses the Razor perl modules ... Razor v2 has the Razor2 perl modules, so you're not using the new Razor ... I was just about to upgrade

Re: [SAtalk] Fw: [Razor-users] Announce: Vipul's Razor v2

- Original Message - From: "rODbegbie" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Thursday, June 13, 2002 12:28 PM Subject: Re: [SAtalk] Fw: [Razor-users] Announce: Vipul's Razor v2 rODbegbie wrote: > Off to do a build now. I'll report back on how it does with SA later. Initial

Re: [SAtalk] problem with SA and Mail::Audit

Mail::Audit doesn't let you change the contents of a mail message once it's created, which SA needs to be able to do easily. So we implemented our own more-or-less compatible Mail::Audit replacement, called Mail::SpamAssassin::NoMailAudit -- try using that class instead. C Jake Edge wrote: JE>

Re: [SAtalk] Fw: [Razor-users] Announce: Vipul's Razor v2

rODbegbie wrote: > Off to do a build now. I'll report back on how it does with SA later. Initial signs are promising. Nothing seems "broken" in the SA integration. Coolio! rOD. -- You have the right to remain *fabulous* >> Doing the blogging thang again at http://www.groovymother.com/ <<

[SAtalk] Fw: [Razor-users] Announce: Vipul's Razor v2

Off to do a build now. I'll report back on how it does with SA later. rOD. -- I think I'm in love. Probably just hungry. >> Doing the blogging thang again at http://www.groovymother.com/ << - Original Message - From: "Vipul Ved Prakash" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Cc:

RE: [SAtalk] Getting AWL not apply to my address

http://www.hughes-family.org/bugzilla/show_bug.cgi?id=440 - dan -- Dan Kohn -Original Message- From: Daniel Quinlan [mailto:[EMAIL PROTECTED]] Sent: Thursday, June 13, 2002 11:20 To: Dan Kohn Cc: [EMAIL PROTECTED] Subject:

Re: [SAtalk] Cyrillic encoding raises the spam level to 3.8

Daniel Quinlan writes: >> If Russian email is supposed to have 8-bit characters in the Subject >> line, it seems like a bug to me. Can you file one in Bugzilla? Vivek Khera writes: > 8-bit data in email headers is non-sensical -- there is no context in > which to interpret them. Only 7-bit AS

Re: [SAtalk] Getting AWL not apply to my address

set auto_whitelist_threshold to 0 ...it works for me however i had to apply this patch in 2.20 but looks like its fixed in CVS --- SpamAssassin-orig/Conf.pmSun Apr 14 15:05:44 2002 +++ SpamAssassin/Conf.pm Sat May 25 06:06:52 2002 @@ -449,7 +449,7 @@ =cut if (/^auto[-_]whitelist[

[SAtalk] Getting AWL not apply to my address

I'm having about a spam a day slip through because it sets me as the From, and I'm rated highly in my AWL. Would someone be willing to add an option to the config file to enable setting certain addresses to 0 in the AWL? I suppose I could create a cron job that removed me from the AWL every hour

[SAtalk] Re: Cyrillic encoding raises the spam level to 3.8

On Thu, Jun 13, 2002 at 10:24:57AM -0400, Vivek Khera wrote: | > "DQ" == Daniel Quinlan <[EMAIL PROTECTED]> writes: | | DQ> If Russian email is supposed to have 8-bit characters in the Subject | DQ> line, it seems like a bug to me. Can you file one in Bugzilla? | | 8-bit data in email heade

Re: [SAtalk] Trick to bypass Razor

DCC should help in this case, right? Its model is to calculate a fuzzy checksum. I suppose when the next version of SA which works with DCC is out, you can expect to see a better result. Weidong - Original Message - From: "Fred Inklaar" <[EMAIL PROTECTED]> To: "SpamAssassin" <[EMAIL PROT

Re: [SAtalk] Trick to bypass Razor

On Thu, 13 Jun 2002, Fred Inklaar wrote: > In this case however, a single line of garbage is added to to the message, > making Razor generating a different CRC for each one, in effect escaping > Razor. And there's not SA rule yet to catch this unique id in the > messagebody. You'll excuse me for

Re: [SAtalk] (no subject)

Doug Crompton <[EMAIL PROTECTED]> wrote: > Well I got my first XXX that made it through SA today. [...] > Subject: (Adult) Eatme, Juicy ripe P*ssy for you. I got that too. It slipped right through the distribution SA but I checked it using the latest CVS SA and that tagged it right off with a sco

Re: [SAtalk] Cyrillic encoding raises the spam level to 3.8

> "DQ" == Daniel Quinlan <[EMAIL PROTECTED]> writes: DQ> If Russian email is supposed to have 8-bit characters in the Subject DQ> line, it seems like a bug to me. Can you file one in Bugzilla? 8-bit data in email headers is non-sensical -- there is no context in which to interpret them. O

[SAtalk] (no subject)

Well I got my first XXX that made it through SA today. They are getting very clever. Seems fairly easy to catch though. Any punctuation in a verbotten word should also be canned. Doug -- Forwarded message -- Date: Thu, 13 Jun 2002 04:36:56 -0500 (CDT) From: Karen <[EMAIL PROTECT

RE: [SAtalk] Cyrillic encoding raises the spam level to 3.8

> X-Spam-Status: No, hits=3.8 required=5.0 > tests=SUBJ_ALL_CAPS,SUBJ_FULL_OF_8BITS,AWL version=2.20 > X-Spam-Level: *** I've noticed this too. The trouble, I think, is with SUBJ_ALL_CAPS - it always triggers on an 8-bit subject, which combines with SUBJ_FULL_OF_8BITS to create a larger score tha

[SAtalk] Bruce Sterling on SpamAssassin

Brief, but kinda cool. http://www.infinitematrix.net/columns/sterling/sterling32.html ___ Don't miss the 2002 Sprint PCS Application Developer's Conference August 25-28 in Las Vegas - http://devcon.sprintpcs.com/adp/index.cfm?source=

Re: [SAtalk] spamc message size limits

Jason Haar wrote: > On Mon, Jun 10, 2002 at 10:18:51AM -0800, Pete Hanson wrote: > >>Looking at the source for spamc, it looks to me like a message that exceeds >>the maximum message size is simply skipped entirely, which actually requires >>reading in most of the message first - fair enough, as

Re: [SAtalk] Cyrillic encoding raises the spam level to 3.8

> If Russian email is supposed to have 8-bit characters in the Subject > line, it seems like a bug to me. Can you file one in Bugzilla? > > For now, you can work-around the issue by changing the score for > SUBJ_FULL_OF_8BITS to 0.0 and that will deactivate the rule. That's why the next big cha