[SAtalk] Some questions about SA and Razor

Hi, I just installed SpamAssassin and Anomy on our mail server and it worked! :) BTW, just wondering about the role of Razor in SpamAssassin. --- francis a. vidal [bitstop network services] | http://www.bitstop.ph streaming media + web hosting | http://www.keystone.ph v(02)330-2

Re: [SAtalk] Graphics-only spam?

On Wednesday 24 July 2002 09:43 am, Michael Moncur wrote: > This would be an easy rule to add to SA but I'm wondering about speed - > stripping HTML tags is a messy regexp and SA already does this. Is there a > way for the same eval test to access the 'rawbody' and 'body' parts at the > same time

Re: [SAtalk] Graphics-only spam?

On Wed, 24 Jul 2002 the voices made Matthew Cline write: > > The GA can only handle rules that give a simple hit or miss-result, right? > > There would be multiple rules, like "ratio < 0.9", "ratio < 0.5", "ratio < > 0.3", and so on. I was just interested in the limitations, lack thereof, in t

Re: [SAtalk] Graphics-only spam?

On Wednesday 24 July 2002 06:49 pm, Tony L. Svanstrom wrote: > On Wed, 24 Jul 2002 the voices made Matthew Cline write: > > On Wednesday 24 July 2002 09:02 am, Hess, Mtodd, /mth wrote: > > > I hate to bring this up, but I see more and more spams that contain > > > very little, if any, text. Inst

Re: [SAtalk] Graphics-only spam?

On Wed, 24 Jul 2002 the voices made Matthew Cline write: > On Wednesday 24 July 2002 09:02 am, Hess, Mtodd, /mth wrote: > > I hate to bring this up, but I see more and more spams that contain very > > little, if any, text. Instead, most of the spam text is in a graphic > > image. How will we be

Re: [SAtalk] 2.20 -> 2.31 update install problem

Gosh, I recall running into this when I installed spamassassin on art.net. We ended up getting the lib package for the Time::HiRes. I am running netbsd so we just found it on the netbsd.org website. There was no way to opt out that I could tell. -lile hacker artist [EMAIL PROTECTED]

Re: [SAtalk] compiling problems on a SGI

Dave Encisco wrote: > Hi, > > When compiling Mail-SpamAssassin-2.31 on an SGI running 6.5.15 I run > into the following error: > > cp lib/Mail/SpamAssassin/PerMsgStatus.pm blib/lib/Mail/SpamAssassin/PerMsgStatus.pm > gcc -fno-strict-aliasing -I/usr/local/include -DLANGUAGE_C -O spamd/sp

[SAtalk] Upgrade Question

I am ready (I think) to upgrade from 2.20 but I have made a large number of changes to the actual spamd/spamc, spamassassin and the rule sets themselves. I have the new version downloaded and ready to go, but I am assuming that if I backup everything up and install the new version, I would just n

Re: [SAtalk] Graphics-only spam?

On Wednesday 24 July 2002 09:02 am, Hess, Mtodd, /mth wrote: > I hate to bring this up, but I see more and more spams that contain very > little, if any, text. Instead, most of the spam text is in a graphic > image. How will we be able to detect those as spam? OCR? There have been suggestions f

Re: [SAtalk] 2.20 -> 2.31 update install problem

On Thursday 25 July 2002 00:23 CET Michael C. Berch wrote: > That did the trick! Thanks. Perhaps this should be noted in the > README? Even better: This module is needed for debugging only and the next release won't belch anymore if it isn't available :) Malte -- -- Coding is art. --

Re: [SAtalk] Scoring Yahoo Ads

On Wednesday 24 July 2002 13:46 CET Justin Mason wrote: >[...] > As a result I'm now collecting a corpus of nonspam SCEs, using a few > common FP'ing SCE sources. BTW if anyone knows of more FP'ing SCE > sources, I'd appreciate if they posted them; the more the better. > > I'm currently getting C

Re: [SAtalk] help diagnose a mis-tagged email (not spam, tagged as spam)

> A user forwarded me a non-spam email that was tagged as spam. Here's the > spamcheck header: > > X-MailScanner-SpamCheck: SpamAssassin (score=11.9, required 9, FROM_NAME_NO_SPACES, >AWL) ^^^ This looks like

[SAtalk] perl 5.8.0 issue

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 when issuing 'perl Makefile.PL' with SA 2.31 on a system with Per 5.8.0, I get: WARNING: PL_FILES takes a hash reference not a string/nu,ber. Please inform the author. consider yourself informed ;) - -- Douglas J Hunley (doug at hunley.homeip.net)

Re: [SAtalk] 2.20 -> 2.31 update install problem

That did the trick! Thanks. Perhaps this should be noted in the README? --Michael On Wednesday, July 24, 2002, at 03:06 PM, Steve Thomas wrote: > From the command line (as root), type: > > -- > # perl -MCPAN -e shell > > cpan> install Time::HiRes >

RE: [SAtalk] 2.20 -> 2.31 update install problem

>From the command line (as root), type: -- # perl -MCPAN -e shell cpan> install Time::HiRes -- (don't type the prompts ;) HTH, Steve | -Original Message- | From: [EMAIL PROTECTED] | [mailto:[EMAIL PROTECTED]]On Behalf Of | Michael C. Be

[SAtalk] help diagnose a mis-tagged email (not spam, tagged as spam)

howdy I'm posting this to both the mailscanner and spamassassin lists since I'm not sure where the problem lies. A user forwarded me a non-spam email that was tagged as spam. Here's the spamcheck header: X-MailScanner-SpamCheck: SpamAssassin (score=11.9, required 9, FROM_NAME_NO_SPACES, AWL)

[SAtalk] 2.20 -> 2.31 update install problem

I'm just now getting around to updating from SA 2.20 to 2.31, and downloaded and built the package just like before. No errors in the make. I went to test it, though, and got the following: % spamassassin -t < sample-nonspam.txt > nonspam.out Can't locate Time/HiRes.pm in @INC (@INC contains:

RE: [SAtalk] Reporting....

Oops. Finally saw the last Procmail example. Ok, I know why the E flag is being used. But why the EXITCODE. I use Postfix for MTA. Will it understand some specific errorlevel that SPAMC is setting? <> |-Original Message- |From: Smart, Dan [mailto:[EMAIL PROTECTED]] |Sent: Wednesday, J

Re: [SAtalk] porn rules

Yevgeniy Miretskiy wrote: > None of the porn rules fired on this message: well, unless the phrase "her ass[!|?|.|,]" is in the porn filter, why would it? --- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkge

Re: [SAtalk] Re: [SAdev] Scoring Yahoo Ads

On Wed, Jul 24, 2002 at 12:46:23PM +0100, Justin Mason wrote: > As a result I'm now collecting a corpus of nonspam SCEs, using a few > common FP'ing SCE sources. BTW if anyone knows of more FP'ing SCE > sources, I'd appreciate if they posted them; the more the better. The Amphenol Connector news

[SAtalk] compiling problems on a SGI

Hi, When compiling Mail-SpamAssassin-2.31 on an SGI running 6.5.15 I run into the following error: cp lib/Mail/SpamAssassin/PerMsgStatus.pm blib/lib/Mail/SpamAssassin/PerMsgStatus.pm gcc -fno-strict-aliasing -I/usr/local/include -DLANGUAGE_C -O spamd/spamc.c \ -o

Re: [SAtalk] Proactively blocking relays identified by SA

On Wed, Jul 24, 2002 at 01:14:44PM -0400, Jeff Garvas wrote: > Has this idea been thought of? Sure, the equivilant would be to just forward > these messages to ORDB or a similar blacklist, but maybe this would be more > effective? http://www.kluge.net/~felicity/random/handlespam.txt It automate

[SAtalk] Proactively blocking relays identified by SA

I have a feeling someone may have already thought of this, but I've been tossing this idea around in my head lately. If you're scanning on a domain basis (or just one account) and you drop a copy of every identified spam into a place for later review, couldn't we somehow extract the IP address o

Re: [SAtalk] Re: [SAdev] Scoring Yahoo Ads

Justin Mason wrote: > As a result I'm now collecting a corpus of nonspam SCEs, using a few > common FP'ing SCE sources. BTW if anyone knows of more FP'ing SCE > sources, I'd appreciate if they posted them; the more the better. The e-mail club at www.newbury.com is a good one -- It's a weekly lis

Re: [SAtalk] Graphics-only spam?

On Wed, Jul 24, 2002 at 09:53:25AM -0700, John Rudd wrote: > Though, I'd also like to have a handy-dandy filter that would take HTML > as input and convert it to plain text. Doesn't bother me that fancy > formatting would be lost. For links it would put the URL in parenthesis > after the link te

Re: [SAtalk] Graphics-only spam?

> From: "rODbegbie" <[EMAIL PROTECTED]> > > 3) Analyse the HTML source. eg. If the graphic is hosted on > bigandbouncey.com, there's a high chance of spam. > Could also come up with new blacklist catagories: blacklist_url and blacklist_site where if there is a URL that starts out the same as

RE: [SAtalk] Graphics-only spam?

> or, alternatively, giveaway patterns in the HTML? That's what's happening > with most obfuscating techniques the spammers are trying -- they become > a very reliable sign of spam in themselves! I agree. I've been playing with a little perl script that calculates a ratio of (length of full body

Re: [SAtalk] Graphics-only spam?

Hess, Mtodd, /mth wrote: > I hate to bring this up, but I see more and more spams that contain > very little, if any, text. Instead, most of the spam text is in a > graphic image. How will we be able to detect those as spam? OCR? There are still ways to analyse it. 1) Analyse the headers. Ar

Re: [SAtalk] Graphics-only spam?

"Hess, Mtodd, /mth" said: > I hate to bring this up, but I see more and more spams that contain very > little, if any, text. Instead, most of the spam text is in a graphic image. > How will we be able to detect those as spam? OCR? or, alternatively, giveaway patterns in the HTML? That's what

Re: [SAtalk] Spam through - insanefunnies - clairification of X-Spam-Status fi elds?

Amis-v or there is another prefs file that SA is using. I had a heck of a time figuring out where to find my site wide file because of my configuration. If your using spamd and you want your users to have some control using user_prefs then check their ~/spamassassin file. If your using spamd and

Re: [SAtalk] [SAdev] Scoring Yahoo Ads

On Tue, 23 Jul 2002, John Rudd wrote: > > So what brilliant metric do you have in mind to measure unsolicited vs. > > solicited commercial email? > > Personally, I'd rather not see them differentiated. (and, I'm going to > assume that "commercial" means "advertisement", and not things like tech

[SAtalk] Graphics-only spam?

I hate to bring this up, but I see more and more spams that contain very little, if any, text. Instead, most of the spam text is in a graphic image. How will we be able to detect those as spam? OCR? MTodd --- This sf.net email is sponsore

RE: Re: [SAtalk] Spamassassin and Microsoft Exchange

I just started using SA with Exim on a Linux machine ahead of my Exchange servers. It works great. MTodd -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] Sent: Wednesday, July 24, 2002 6:25 AM To: [EMAIL PROTECTED] Subject: Re: Re: [SAtalk] Spamassassin and Micro

Re: [SAtalk] Spam through - insanefunnies - clairification of X-Spam-Status fi elds?

On Wed, Jul 24, 2002 at 10:18:28AM -0500, Stewart, John wrote: > X-Virus-Scanned: by amavisd-new amavisd-new-20020630 > X-Spam-Status: No, hits=6.5 tagged_above=5.1 required=6.9 tests=PLING, > MONEY_BACK, CLICK_BELOW, POR > N_14, CLICK_HERE_LINK, FREQ_SPAM_PHRASE > X-Razor-id: d92173a8dfc60567e55e

Re: [SAtalk] Is there a HOW-TO doc on writing rules in SA ?

On Wed, Jul 24, 2002 at 11:15:40AM -0400, Dave Strickler wrote: > I can glean info from the included examples, but would love to see > something that really delves into them. man Mail::SpamAssassin::Conf ?? -- Randomly Generated Tagline: I've always maintained a cordial dislike for indent, beca

[SAtalk] Spam through - insanefunnies - clairification of X-Spam-Status fields?

I'm scanning mail flowing through a mail server (on its way to our internal mail server) using amavisd-new and SpamAssassin 2.31. Works great; it's literally changed my life. In /etc/mail/spamassassin/local.cf, I have: required_hits 5 (which I think is the default anyway), so all mail with a s

Re: [SAtalk] Problem with rewrite_mail when is_mime

On Wed, 24 Jul 2002 the voices made Joerg Henner write: > I've a similar problem. When mail is tagged as SPAM, and the mail itself is > encoded (MIME, multipart, ...) i cant see/view those attachments (it looks > like, there is all-in-one part after the "spamassassin -P" command). > Any solution

[SAtalk] Is there a HOW-TO doc on writing rules in SA ?

I can glean info from the included examples, but would love to see something that really delves into them.   Thanks,   Dave

RE: [SAtalk] Spamassassin and Microsoft Exchange

> I'd like to use spamassassin to filter our e-mail. However > the poweres that be have dcreed that our mail service shall > run on MS Exchange. Is there a way to insert Spamassassin > into the system so that it will filter incoming mail before > it reaches the Exchange server? We have Exc

[SAtalk] user_prefs ignored by spamd

Hello   Together with my web hoster I try to get SA running on a Red Hat/Apache virtual host system that uses qmail and vmailmgr system wide. So far we have been able to make it work together with procmail and also without procmail but it seems that spamd ignores the ./spamassassin/user_pref

Re: [SAtalk] audio/x-wav rule suggestion

On Wed, Jul 24, 2002 at 10:26:00AM -0400, Theo Van Dinter wrote: > I posted my AUDIO_ATTACH patch a while ago. :) I've reattached the patch. I hate doing this, but I was just noticing a bug or two in that patch ... I've attached a new one. :) -- Randomly Generated Tagline: Circular Definition

RE: [SAtalk] Reporting....

Olivier: Looked at your Procmail script What comes before the recipe: :0fwE | /usr/local/bin/spamc -u $LOGNAME The "E" flag says run of preceding recipe conditions were not met. What is this test? Also, why do you set the ExITCODE in case of a failure? :0e { EXITCODE=$? } Does Procmail

Re: [SAtalk] audio/x-wav rule suggestion

On Tue, Jul 23, 2002 at 11:08:45PM -0600, Bob Proulx wrote: > That is not quite what I want. First, it does not trigger on this > message I think because of the mime chaining? Shouldn't that body > rule match? Secondly, I wanted audio/x-wav with a name that ends in a > virus indicator like *.(b

Re: [SAtalk] Problem with rewrite_mail when is_mime

On Fre, 19 Jul 2002, [EMAIL PROTECTED] wrote: > >Hopefully I didn't miss the solution in the archives. I'm having a problem when a >mime messages is tagged as spam. The rewrite_mail routine is bouncing the message >with the following (from postfix log): > >Jul 17 12:17:15 chaos postfix/local[

Re: [SAtalk] Sitewide Spam Filtering with Qmail ??

On Wednesday 24 July 2002 20:47, zenn wrote: > Is it possible to setup SA to act as a sitewide Spam filter ? Yes. > Is there any documentation on setting this up ? Not much as far as I know. > Suggestions would be appreciated. qmail-scanner can do it. --- Lars Hansson

Re: [SAtalk] Sitewide Spam Filtering with Qmail ??

* zenn ([EMAIL PROTECTED]) [24 Jul 2002 22:50]: [...] > I'm thinking of setting up SA with my Qmail(Maildir) server acting as > our gateway. See qmail-scanner. (Google.) cheers, -- Iain 'Spoon' Truskett. -

[SAtalk] Sitewide Spam Filtering with Qmail ??

Hi all... I'm new to SpamAssasin so I appologies if the question has been asked before. I'm thinking of setting up SA with my Qmail(Maildir) server acting as our gateway. It currently provides inline virus scanning and ORDB open relay filtering. Is it possible to setup SA to act as a sitewide Spa

Re: [SAtalk] Re: [SAdev] Scoring Yahoo Ads

Ross Vandegrift said: > Obviously an interim solution is to whitelist, but long term is probably > harder. What kind of SCE, like MSDN newsletters, product updates, etc > is in the corpus for the GA? Maybe seeding the corpus with a bigger set > of these type of mails will have some interesting

Re: Re: [SAtalk] Spamassassin and Microsoft Exchange

This sounds like exactly what I wanted to do. I've never used Exim tho. It sounds easy enough ( doesnt it always :) The config for Exim should be pretty straight foward tho shouldnt it? Simply accept the mail and pass it straight on to the exchange server for delivery? > > From: John Horne

Re: [SAtalk] Spamassassin and Microsoft Exchange

On 24-Jul-2002 at 08:18:07 [EMAIL PROTECTED] wrote: > I'd like to use spamassassin to filter our e-mail. However the poweres > that be have dcreed that our mail service shall run on MS Exchange. Is > there a way to insert Spamassassin into the system so that it will filter > incoming mail before

Re: [SAtalk] audio/x-wav rule suggestion

Rossz Vamos-Wentworth <[EMAIL PROTECTED]> asked: > Can someone tell me how to call f-prot from procmail and > nuke the message if it is virused? This is the recipe I used to use before I installed mimedefang to do it earlier in the mail processing. It is more complicated than absolutely necessary

Re: [SAtalk] SpamAssassin on IRIX 6.5

Hello, * Frank Bures <[EMAIL PROTECTED]> [22.07.02 20:07]: > could please anyone point me to instructions how to install SpamAssassin on > IRIX 6.5, specifically the spamd and spamc. Hm, you do not need any special information, just build spamassassin the normal way: [unzip/untar the archive]

[SAtalk] Spamassassin and Microsoft Exchange

Apologies if this has been covered elsewhere, I tried the archives but couldnt find anything. I'd like to use spamassassin to filter our e-mail. However the poweres that be have dcreed that our mail service shall run on MS Exchange. Is there a way to insert Spamassassin into the system so th

Re: [SAtalk] audio/x-wav rule suggestion

> I use f-prot, which has a linux version free for individual use and > can be updated via a cron job. I have mimedefang call it and > SpamAssassin. There are other, similar solutions. And now I don't have > to worry about tweaking my procmail filters or SpamAssassin rules to > catch every nuance