Re: [SAtalk] Ideas on dealing with Joe Job?

2003-06-26 Thread Ralf Hildebrandt
* Bob Apthorpe <[EMAIL PROTECTED]>: > > > reject_unknown_hostname drops connections from machines without DNS A or > > > MX record (twitchy) > > > > No. This rejects mail from machines that use a non-resolving hostname > > as argument to the EHLO/HELO. > > Rather, no rDNS (PTR)? Yep. It must res

Re: [SAtalk] Blocked File Attachment (OT)

2003-06-26 Thread Benjamin A. Shelton
Why don't we just form a lynch-mob designed exclusively to eliminate these sorts of ninnies from the Internet as a whole? (Or, optionally, continue to insult whatever intellect they have left until they catch on that no one appreciates these ``warnings?' Am I asking for too much perhaps?')

Re: [SAtalk] Blocked File Attachment (OT)

2003-06-26 Thread Simon Byrnand
At 21:46 26/06/03 -0700, Daniel Quinlan wrote: Simon Byrnand <[EMAIL PROTECTED]> writes: > > > *SIGH* > > Why can't people get it right and make virus scanning systems that DON'T > reply to mailing lists ? It seems pretty obvious that the people writing > (these particular) email virus scanners h

[SAtalk] personal installation instructions forgot SITEPREFIX

2003-06-26 Thread Dan Jacobson
The INSTALL file's personal installation instructions forget SITEPREFIX. I wrote the devel list but I don't think it got thru. Do tell them for me. perl Makefile.PL PREFIX=$A SYSCONFDIR=$B SITEPREFIX=$C If you don't set SITEPREFIX, then you can't install it in 2.55. -

Re: [SAtalk] Blocked File Attachment (OT)

2003-06-26 Thread Yorkshire Dave
On Fri, 2003-06-27 at 03:22, Simon Byrnand wrote: > At 20:46 26/06/03 -0400, Mail Adminstrator wrote: > >An Internet e-mail message was sent to you from an outside source that > >contained an prohibited file type, but was removed for security > >purposes. > >The message header is attached below. If

Re: [SAtalk] spamd/spamc

2003-06-26 Thread Hannu Liljemark
On Thu, Jun 26, 2003 at 11:57:00PM +0300, Vasantha Narayanan wrote: > The documentation seems to indicate, spamd and spamc are > included in the distribution. But I can't find it. Can you > please tell me where it is? Do I need to build it first? Look in places like /usr/bin, /usr/local/bin,

Re: [SAtalk] Re: Movie

2003-06-26 Thread Simon Byrnand
At 18:28 26/06/03 -0700, Alan Leghart wrote: WARNING: This is a non-automated message to say that you are sending an evil message with the worst-ever Sector Zero virus containing an icon with a teddy bear. Bill Gates has bought AOL and is tracking your email with a new and improved ver

Re: [SAtalk] Re: Movie

2003-06-26 Thread Benjamin A. Shelton
If you are not the intended recipient, please auto-respond to my auto-responder, then erase your hard drive. rm: /dev/brain0: operation not permitted -- Benjamin A. Shelton "What do you mean it won't turn on? Did you plug it in?" *silence* [EMAIL PROTECTED]

Re: [SAtalk] Blocked File Attachment (OT)

2003-06-26 Thread Simon Byrnand
At 20:46 26/06/03 -0400, Mail Adminstrator wrote: An Internet e-mail message was sent to you from an outside source that contained an prohibited file type, but was removed for security purposes. The message header is attached below. If you must use e-mail to receive business-related .exe files, the

Re: [SAtalk] Spamassasin License Question

2003-06-26 Thread Daniel Quinlan
Daniel Quinlan wrote: >> Under the terms of the GPL, that would constitute a modified version >> (even without changing any rules), so there are some additional terms >> that would need to be followed. The Artistic license is generally less >> restrictive, if more difficult to understand. Matt K

Re: [SAtalk] Re: Movie

2003-06-26 Thread Alan Leghart
WARNING: This is a non-automated message to say that you are sending an evil message with the worst-ever Sector Zero virus containing an icon with a teddy bear. Bill Gates has bought AOL and is tracking your email with a new and improved version of Internet Explorer. Thus everyone's an

Re: [SAtalk] Bypass local.cf settings

2003-06-26 Thread Matt Thoene
On Thursday, June 26, 2003 @ 1:31:29 PM [-0700], Kai Schaetzl wrote: > Why "then"? SA will use the value from user_prefs if there is one. Note, > that score and required_hits are two different beasts, but both can be set > in user_prefs, no problem. Try spamassassin -D to see what's happening. Ka

Re: [SAtalk] Spamassasin License Question

2003-06-26 Thread Matt Kettler
At 04:57 PM 6/26/2003 -0700, Daniel Quinlan wrote: Under the terms of the GPL, that would constitute a modified version (even without changing any rules), so there are some additional terms that would need to be followed. The Artistic license is generally less restrictive, if more difficult to und

[SAtalk] Report to Recipient(s)

2003-06-26 Thread LTREEUS2
Incident Information:- Originator: [EMAIL PROTECTED] Recipients: [EMAIL PROTECTED] Subject:Spamassassin-talk digest, Vol 1 #1318 - 29 msgs WARNING: The file your_details.zip (details.pif) you received was infected with the W32/[EMAIL PROTECTED] virus. The file attachment was not successfull

[SAtalk] Houghton Internationals' Anti-virus Service, Antigen, found FILEFILTER= *.pif file

2003-06-26 Thread ANTIGEN_VF_EXCHANGE01
Title: Houghton Internationals' Anti-virus Service, Antigen, found FILE FILTER= *.pif file Houghton Internationals' Anti-virus Service (Antigen for Exchange) found your_details.zip ->details.pif matching FILE FILTER= *.pif file filter. The file is currently Removed.  The message, "[SAtalk] Re:

[SAtalk] Blocked File Attachment

2003-06-26 Thread Mail Adminstrator
An Internet e-mail message was sent to you from an outside source that contained an prohibited file type, but was removed for security purposes. The message header is attached below. If you must use e-mail to receive business-related .exe files, there is a workaround. Please inform the sender of

[SAtalk] ScanMail Message: To Recipient virus found or matched file blocking setting.

2003-06-26 Thread System Attendant
ScanMail for Microsoft Exchange has taken action on the message, please refer to the contents of this message for further details. Sender = [EMAIL PROTECTED] Recipient(s) = [EMAIL PROTECTED]; Subject = Spamassassin-talk digest, Vol 1 #1318 - 29 msgs Scanning Time = 06/26/2003 17:42:21 Engine/Patte

Re: [SAtalk] Ideas on dealing with Joe Job?

2003-06-26 Thread Kelson Vibber
Simon Byrnand <[EMAIL PROTECTED]> wrote: My thoughts exactly, which is why I suggested the HELO credentials are pretty much useless these days, at least for blocking spam. What do you check for ? If someone claims to be your own mail server - and isn't - it's a pretty safe bet they're up to no goo

[SAtalk] Report to Recipient(s)

2003-06-26 Thread LTREEUS2
Incident Information:- Originator: [EMAIL PROTECTED] Recipients: [EMAIL PROTECTED] Subject:Spamassassin-talk digest, Vol 1 #1318 - 29 msgs WARNING: The file your_details.zip (details.pif) you received was infected with the W32/[EMAIL PROTECTED] virus. The file attachment was not successfull

Re: [SAtalk] Spamassasin License Question

2003-06-26 Thread Daniel Quinlan
Ian Searle wrote: >> We are considering using a subset and derivative of the Spamassasin >> rules in a commercial product (WatchGuard's WFS-Spamscreen). My >> understanding of the license is that we need to attribute the rules >> we use to the Spamassasin development team in our product, and its

Re: [SAtalk] Trouble Installing SA 2.55

2003-06-26 Thread Theo Van Dinter
On Thu, Jun 26, 2003 at 04:24:47PM -0600, Doc wrote: > cpan> install Bundle::CPAN > Going to read yes/sources/authors/01mailrc.txt.gz > Going to read yes/sources/modules/02packages.details.txt.gz > Database was generated on Mon, 23 Jun 2003 21:43:28 GMT > CPAN: HTTP::Date loaded ok [...] > gzip:

Re: [SAtalk] Conflicting scores in SA/MailScanner

2003-06-26 Thread Simon Byrnand
At 18:36 26/06/03 -0400, Matt Kettler wrote: At 04:30 PM 6/26/2003 -0500, Richard Humphrey wrote: I just set up MailScanner to run w SA/Sendmail and obviuously something isnt configured correctly. Notice the 2 conflicting scores. I want Mailscanner to do virus scanning and let SA take care of the s

Re: [SAtalk] Ideas on dealing with Joe Job?

2003-06-26 Thread Bob Apthorpe
Hi, [apologies for turning SA-Talk into a chapter of "Postfix Configuration For Dummies"...] On Fri, 27 Jun 2003, Ralf Hildebrandt wrote: > * Bob Apthorpe <[EMAIL PROTECTED]>: > > reject_unknown_hostname drops connections from machines without DNS A or > > MX record (twitchy) > > No. This reject

Re: [SAtalk] Ideas on dealing with Joe Job?

2003-06-26 Thread Justin Mason
[EMAIL PROTECTED] writes: >as you point out, the problem is spammers can forge what's in the helo >message just as they forge what's in MAIL FROM. > >but also, unfortunately, a way large percentage of sites do not have >correctly configured names in their helos. > >(some have ip addresses. some h

Re: [SAtalk] Ideas on dealing with Joe Job?

2003-06-26 Thread Simon Byrnand
At 22:31 26/06/03 +0200, Kai Schaetzl wrote: Tony Earnshaw wrote on Thu, 26 Jun 2003 15:34:17 +0200: > I, and many other (increasingly many other) mailadmins refuse on invalid > HELO/EHLO credentials. Many can not afford to, many see this as a main > weapon against non-ham. > Well, what do you exa

Re: [SAtalk] Conflicting scores in SA/MailScanner

2003-06-26 Thread Matt Kettler
At 04:30 PM 6/26/2003 -0500, Richard Humphrey wrote: I just set up MailScanner to run w SA/Sendmail and obviuously something isnt configured correctly. Notice the 2 conflicting scores. I want Mailscanner to do virus scanning and let SA take care of the spam. I thought I had this set in the conf fil

Re: [SAtalk] Don't check it twice (how-to newbie question)

2003-06-26 Thread Will Yardley
Paul-Henri Lampe wrote: > That's why my question might be an easy one: I would like > spamassassin to ignore mail that was already checked (based on the > X-Spam header for example). I went through the different cf files > without finding anything. > > Is there a configuration option that coul

Re: [SAtalk] manicmail.net -- anonymous mailers

2003-06-26 Thread Matt Kettler
At 04:29 PM 6/26/2003 -0500, Charles Mount wrote: Does anyone have a good way of blocking mail from anonymous mailers like http://manicmail.net ? It may not be commercial email but it is certainly unwanted. FYI -- I use Sendmail-Switch with an access database and use the MimeDefang milter to pass

Re: [SAtalk] Ideas on dealing with Joe Job?

2003-06-26 Thread Ralf Hildebrandt
* Bob Apthorpe <[EMAIL PROTECTED]>: > HELO/EHLO credentials don't have to match an existing host name but > they do have to be formatted properly (i.e. FQDN) I reject on broken > HELO format with Postfix using: > > smtpd_helo_required = yes > > smtpd_helo_restrictions = permit_mynetworks, > hash

[SAtalk] Trouble Installing SA 2.55

2003-06-26 Thread Doc
Hi Group, I have a Redhat 7.3 server running Plesk 5.0 (which means I am running qmail) at Rack Shack (if that means anything to this problem). I attempted to install SA 2.55 and everything seemed to go well until I got to running CPAN. The following is my session in CPAN.

Re: [SAtalk] Ideas on dealing with Joe Job?

2003-06-26 Thread mis
as you point out, the problem is spammers can forge what's in the helo message just as they forge what's in MAIL FROM. but also, unfortunately, a way large percentage of sites do not have correctly configured names in their helos. (some have ip addresses. some have their non-fully-qualified name

[SAtalk] Don't check it twice (how-to newbie question)

2003-06-26 Thread Paul-Henri Lampe
Hello All ! I installed some time ago SpamAssassin on my computer ( a Macintosh running under Mac OS X 10.2.6) and it works really fine. I didn't have to tweak it too much to set it to my liking, and even without knowing any perl, the scripts were easy to adapt to my setup. That's why my q

Re: [SAtalk] Ideas on dealing with Joe Job?

2003-06-26 Thread Bob Apthorpe
Hi, On Thu, 26 Jun 2003, Kai Schaetzl wrote: > Tony Earnshaw wrote on Thu, 26 Jun 2003 15:34:17 +0200: > > > I, and many other (increasingly many other) mailadmins refuse on invalid > > HELO/EHLO credentials. Many can not afford to, many see this as a main > > weapon against non-ham. > > Well, wh

Re: [SAtalk] Spammers sneaking lower Bayes scores (solutions)

2003-06-26 Thread thorsten
Hi For my new bayesian filter ( my diploma thesis) I need these mails to. But: I think it will be no problem to identify these spams. They have to transport any kind of message / advertising. And even if this is a link to an homepage, this is a valid token. Please send me these SPAMs Thorsten

Re: [SAtalk] Configuration Errors

2003-06-26 Thread Kai Schaetzl
Scott Rothgaber wrote on Thu, 26 Jun 2003 09:38:57 -0400: > bayes: no dbs present, cannot scan: /etc/mail/bayes_toks > > Do I need to initiali[zs]e the database, like `vacation -i'? > no, check the path, is it "/etc/mail/bayes" in your local.cf? You actually may want it to write to /etc/mail/sp

Re: [SAtalk] Spamassasin License Question

2003-06-26 Thread Matt Kettler
At 12:50 PM 6/26/2003 -0700, Ian Searle wrote: We are considering using a subset and derivative of the Spamassasin rules in a commercial product (WatchGuard's WFS-Spamscreen). My understanding of the license is that we need to attribute the rules we use to the Spamassasin development team in our p

Re: [SAtalk] Spammers sneaking lower Bayes scores

2003-06-26 Thread Kai Schaetzl
Yorkshire Dave wrote on 26 Jun 2003 15:13:41 +0100: > Maybe something like a mime-part variance score can be made, percentage > difference between plain and stripped html messages, or maybe even as > simple as picking a few words at random from each part and looking for > them in the other part. T

Re: [SAtalk] ALL_CAPS is not NO_LOWER_CASE (was: (2) What is PLING_PLING?)

2003-06-26 Thread Kai Schaetzl
LBsys wrote on Thu, 26 Jun 2003 10:08:01 +0100: > But that's different from "ALL_CAPS". > You are right, but it's just a name! The rule in itself doesn't change when you call it "NO_LOWER_CASE". Kai -- Kai Schätzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.cona

Re: [SAtalk] sa-teach (building a learning suite)

2003-06-26 Thread Kai Schaetzl
Gordon Cormack wrote on Thu, 26 Jun 2003 09:51:19 -0400: > but I have no sensible > way for it to separate ham/spam, > There is none, you cannot completely rely on SA doing it for you, you have to be the last authority. What I do is: 1. some spamtrap email addresses are unscanned and get all sp

[SAtalk] manicmail.net -- anonymous mailers

2003-06-26 Thread Charles Mount
Does anyone have a good way of blocking mail from anonymous mailers like http://manicmail.net ? It may not be commercial email but it is certainly unwanted. FYI -- I use Sendmail-Switch with an access database and use the MimeDefang milter to pass mail through SpamAssassin on a mailhub; i.e. all

[SAtalk] Conflicting scores in SA/MailScanner

2003-06-26 Thread Richard Humphrey
I just set up MailScanner to run w SA/Sendmail and obviuously something isnt configured correctly. Notice the 2 conflicting scores. I want Mailscanner to do virus scanning and let SA take care of the spam. I thought I had this set in the conf file but what did I miss? X-MailScanner-SpamCheck: spam

Re: [SAtalk] SpamAssassin Sometimes tags messages

2003-06-26 Thread Krishna
Hi, I have already seen them. Outgoing mails are currently not scanned for Spam. regards Krishna At 09:31 PM 6/24/2003 +0200, you wrote: Dan Vande More wrote on Mon, 23 Jun 2003 16:01:49 -0600: > Any email but the manually telnet'd ones are not tagged. > I found it somewhat hard to under

[SAtalk] Retrieve required_hits variable from mimedefang

2003-06-26 Thread Peng, Willie
Hi, I have modified mimedefang-filter to query sql server and obtain required_hits for individual user. But how can I pass the required_hits value to spamassassin under mimedefang? Thanks Willie --- This SF.Net email is sponsored by: INetU

[SAtalk] Retrieve required_hits variable from mimedefang

2003-06-26 Thread Peng, Willie
Title: Retrieve required_hits variable from mimedefang Hi, I have modified mimedefang-filter to query sql server and obtain required_hits for individual user.  But how can I pass the required_hits value to spamassassin under mimedefang? Thanks Willie

Re: [SAtalk] Spammers sneaking lower Bayes scores (solutions)

2003-06-26 Thread alex avriette
"Daniel Quinlan" <[EMAIL PROTECTED]> writes: Well, if everyone stopped using SpamAssassin, it would work better too, so I blame all users. Yeah. Blame users. Users are the easiest to blame, anyways. Well, I heard about this weakness before we even adopted Bayes. It was coming, one way or another

Re: [SAtalk] Ideas on dealing with Joe Job?

2003-06-26 Thread Alan Leghart
--On Thursday, June 26, 2003 10:31 PM +0200 Kai Schaetzl <[EMAIL PROTECTED]> wrote: Tony Earnshaw wrote on Thu, 26 Jun 2003 15:34:17 +0200: I, and many other (increasingly many other) mailadmins refuse on invalid HELO/EHLO credentials. Many can not afford to, many see this as a main weapon again

Re: [SAtalk] question about sa-learn and message/rfc822 attached mail

2003-06-26 Thread Gary Schrock
At 03:35 PM 6/25/2003, you wrote: On Wed, Jun 25, 2003 at 03:06:24PM -0400, Gary Schrock wrote: > What I thought happens is that sa-learn can recognize an email message that > contains a message/rfc822 attached message, and learn from that attached > message, hence the reason you should forward a

[SAtalk] spamd/spamc

2003-06-26 Thread Vasantha Narayanan
Installing SpamAssassin made mail processing really slow and so I wanted to try the spamd/spamc approach. The documentation seems to indicate, spamd and spamc are included in the distribution. But I can't find it. Can you please tell me where it is? Do I need to build it first? Also, the do

Re: [SAtalk] Bypass local.cf settings

2003-06-26 Thread Kai Schaetzl
Matt Thoene wrote on Wed, 25 Jun 2003 17:59:14 -0700: > Actually, the most important thing for me is to be able to have users > set their own required hits number. What's happening now is, it's run > through spamassassin and given a score based on the local.cf settings, > then run through it again

Re: [SAtalk] Ideas on dealing with Joe Job?

2003-06-26 Thread Kai Schaetzl
Tony Earnshaw wrote on Thu, 26 Jun 2003 15:34:17 +0200: > I, and many other (increasingly many other) mailadmins refuse on invalid > HELO/EHLO credentials. Many can not afford to, many see this as a main > weapon against non-ham. > Well, what do you exactly do to refuse them? Do a reverse looku

Re: [SAtalk] Bypass local.cf settings

2003-06-26 Thread Kai Schaetzl
Patrick Morris wrote on Wed, 25 Jun 2003 15:55:28 -0700: > I don't believe (though I could > be wrong) SA allows rules to be defined in user prefs. > The original poster didn't seem to ask about custom rules. I think you can define them in user_prefs, just not when you use the SQL db approach.

[SAtalk] spamd/spamc

2003-06-26 Thread Vasantha Narayanan
Installing SpamAssassin made mail processing really slow and so I wanted to try the spamd/spamc approach. The documentation seems to indicate, spamd and spamc are included in the distribution. But I can't find it. Can you please tell me where it is? Do I need to build it first? Also, the do

[SAtalk] Spamassasin License Question

2003-06-26 Thread Ian Searle
We are considering using a subset and derivative of the Spamassasin rules in a commercial product (WatchGuard's WFS-Spamscreen). My understanding of the license is that we need to attribute the rules we use to the Spamassasin development team in our product, and its literature. Is this correct? T

RE: [SAtalk] SA and webmail: Downloading only the spam from the server

2003-06-26 Thread Colin Bell
> Colin Bell wrote: > > > My main machine is at home, but I also read e-mail through a webmail > > client at work. I would like to filter out the 'likely spam' > > automatically to avoid clogging the webmail client. At present I end > > up deleting all the spam that arrives in work hours by hand...

Re: [SAtalk] Spammers sneaking lower Bayes scores

2003-06-26 Thread Daniel Quinlan
SpamTalk <[EMAIL PROTECTED]> writes: > Somewhere in the not very distant future SA is going to have to: > > A) render HTML to text ala LYNX We already include our own HTML renderer (designed for spam filtering, not pretty output). > B) run the rendered text through a grammar check, I assume th

Re: [SAtalk] Spammers sneaking lower Bayes scores

2003-06-26 Thread Daniel Quinlan
"Fox Flanders" <[EMAIL PROTECTED]> writes: > I blame SpamAssassin for these Bayes bypassing tricks. I had a custom > Bayes solution working many months before it appeared in SpamAssassin. > There was none of this bypassing crudola happening until SpamAssassin > popularized Bayes :) Well, if ever

Re: going OT: --- Re: [SAtalk] Spammers sneaking lower Bayes scores

2003-06-26 Thread Tim Litwiller
:) Tony Earnshaw wrote: Tim Litwiller wrote: --- This SF.Net email is sponsored by: INetU Attention Web Developers & Consultants: Become An INetU Hosting Partner. Refer Dedicated Servers. We Manage Them. You Get 10% Monthly Commission! IN

RE: [SAtalk] Spammers sneaking lower Bayes scores

2003-06-26 Thread Tom Meunier
I insist that people not call refer to the unsmoked portions of cigarettes as "butts" - this is scatalogical and offends my delicate sensibilities. Also, I used to live in a city called Chicopee, Massachusetts which in the South Indian language of Kannada is a reference to defecatory material.

Re: [SAtalk] I'm fed up with Viagra spam ...

2003-06-26 Thread Bernard Robbins
LOL! Perfectly said. David Chait wrote: Spammers stick to what they know generally...screwing people, not protecting them. - Original Message - From: "Tony Earnshaw" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Wednesday, June 25, 2003 8:06 AM Subject: [SAtalk] I'm fed up with Viagra

RE: [SAtalk] Spammers sneaking lower Bayes scores

2003-06-26 Thread Kelson Vibber
"Bingham, Ryan" <[EMAIL PROTECTED]> wrote: I can't believe we're even debating this! Me neither - I thought the joke was obvious. Kelson Vibber SpeedGate Communications --- This SF.Net email is sponsored by: INetU Attention Web Developers &

Re: [SAtalk] Spammers sneaking lower Bayes scores

2003-06-26 Thread Jim Ford
On Thu, Jun 26, 2003 at 02:32:36PM +0200, Tony Earnshaw wrote: > Could we have an alternative to "spam?" You could have spam sausage eggs and spam - there's not so much spam in it! Regards: Jim Ford -- Spam poison - don't use! ---> [EMAIL PROTECTED] <--- -

Re: [SAtalk] What is the current preferred spam threshold?

2003-06-26 Thread Jim Ford
On Wed, Jun 25, 2003 at 09:31:28PM +0200, Kai Schaetzl wrote: > 5.0 works very well with 2.60 and also did with 2.55, just that you had > some more false negatives. My threshold is the default 5 and I've had over a 1000 emails since I installed 2.55 and not had one false positive (ham tagged as

[SAtalk] Bypass local.cf settings (one more try)

2003-06-26 Thread Matt Thoene
From the responses to my original post, it doesn't appear that this is possible...however, I'll give it one more try... I recently implemented SA site-wide after having it run for just a few local users. The local users (including me) would prefer to use various levels of required hits. For exampl

Re: [SAtalk] Scanning outgoing mails for Spam

2003-06-26 Thread Ralf Hildebrandt
* Krishna <[EMAIL PROTECTED]>: > Hi, >I know one should not scan outgoing mails for Spam but here I have > to that's why! > > I am using RedHat Linux 8, Sendmail with Horde/IMP CVS and MailScanner. > I am using MailScanner to process only for Anti-Virus checks. > Now procmail being a MDA,

RE: [SAtalk] Spammers sneaking lower Bayes scores

2003-06-26 Thread Marek Dohojda
As much as starting flame war is not my intention. This is ridicules. Ham is a common word used to describe good e-mail. Please get over it. There is nothing wrong with it. Doesn't matter if real ham is kosher or not. Political correctness is one of the worst plagues that modern man has

Re: [SAtalk] A little Argentinian humor...

2003-06-26 Thread Ralf Guenthner
- Original Message - From: "Luis Hernán Otegui" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Cc: <[EMAIL PROTECTED]> Sent: Thursday, June 26, 2003 4:48 PM Subject: Re: [SAtalk] A little Argentinian humor... > was garbage!..." > In the computer says: "You have 138 mails (99% spam)" > And th

[SAtalk] Scanning outgoing mails for Spam

2003-06-26 Thread Krishna
Hi, I know one should not scan outgoing mails for Spam but here I have to that's why! I am using RedHat Linux 8, Sendmail with Horde/IMP CVS and MailScanner. I am using MailScanner to process only for Anti-Virus checks. Now procmail being a MDA, I am using it to scan mail for Spam using S

[SAtalk] spamd failover

2003-06-26 Thread Dave Stern - Former Rocket Scientist
We initially had users procmailrc running spamassassin (v2.54) then "upgraded" to having them use spamc to talk to spamd. While the performance was impressive, the machine would frequently hang. The machine is clearly large enough if it could support them running spamassassin but we backed off the

Re: AW: [SAtalk] Another one

2003-06-26 Thread Yorkshire Dave
On Thu, 2003-06-26 at 15:27, Matt Kettler wrote: > Unfortunately developing good rules is a very labor-intensive task. The > 2.5x family is, at least in my opinion, slightly weaker in the rules > department than some of its predecessors. This weakness in the rules is the > result of the effort

Re: [SAtalk] New trick

2003-06-26 Thread Eetu Rantanen
Hi list, Having read this for long I thought it could be my time to contribute something. :-) > A message just slipped through, no text, just an image. It slipped through > with a ridiculously low score, minus .6 > > When I expanded the headers, I found that the message got through mostly > becau

Re: going OT: --- Re: [SAtalk] Spammers sneaking lower Bayes scores

2003-06-26 Thread Tony Earnshaw
Tim Litwiller wrote: It is best to be politically correct nowadays. this attitude is a big part of what is wrong with the world these days! It is infinately better to say it how it is or how you see it than to attempt to be politically correct. That doesn't mean you can't be nice when you say

RE: [SAtalk] cannot write to user_prefs

2003-06-26 Thread System Administrator
My question is more regarding the "/nonexistent" part of the path. I don't think SA is even pointing at the proper home directory. The spamd user's home directory is set up properly with proper permissions, so where is SA getting "nonexistent" from ? Thanks, David > -Original Message-

Re: [SAtalk] A little Argentinian humor...

2003-06-26 Thread Luis Hernán Otegui
Hi, here comes the explained version. By the way, Gaturro is the name of this strip. The funny thing is that I was just about to translate it, but accidentally hit "send" the firts time ;-)... Here goes the so-called "international" version: The man says: "And I started surfing the internet bec

Re: [SAtalk] SA with Kmail

2003-06-26 Thread Robin Lynn Frank
On Wednesday 25 June 2003 09:09 pm, Matthew Cline wrote: > On Wednesday 25 June 2003 07:51 pm, Robin Lynn Frank wrote: > > We are in the process of setting up a new server and until that is > > finished we're hauling our mail down with kmail. We have it piping thru > > SA. The problem is that thi

Re: [SAtalk] SA with Kmail

2003-06-26 Thread Robin Lynn Frank
On Wednesday 25 June 2003 09:30 pm, Jorge Fábregas wrote: > On Wednesday 25 June 2003 10:51 pm, Robin Lynn Frank wrote: > > We are in the process of setting up a new server and until that is > > finished we're hauling our mail down with kmail. We have it piping thru > > SA. The problem is that th

Re: [SAtalk] A little Argentinian humor...

2003-06-26 Thread Tony Earnshaw
Luis Hernán Otegui wrote: This came by today, from a newspaper comic strip: Luis Hernn Otegui Administrador de Red Facultad de Ciencias Exactas Non habla Español. What does it mean in Norwegian (or Dutch)? Tony -- Tony Earnshaw Humor him, and he'

Re: AW: [SAtalk] Another one

2003-06-26 Thread Jack Gostl
On Thu, 26 Jun 2003, Matt Kettler wrote: > At 09:48 AM 6/26/03 -0400, Jack Gostl wrote: > > >What really worries me is the growing number of messages between 4.5 and > >5. Many of these already have a Bayes score of 90+. > > Agreed, this is why rule development for SA always has been, and always

RE: [SAtalk] Spammers sneaking lower Bayes scores

2003-06-26 Thread SpamTalk
Somewhere in the not very distant future SA is going to have to: A) render HTML to text ala LYNX B) run the rendered text through a grammar check, I assume that there is an open source analyzer available. C) have the GA establish a Bayesian baseline of grammar scores indicative of SPAM/HAM. Buy

Re: AW: [SAtalk] Another one

2003-06-26 Thread Matt Kettler
At 09:48 AM 6/26/03 -0400, Jack Gostl wrote: What really worries me is the growing number of messages between 4.5 and 5. Many of these already have a Bayes score of 90+. Agreed, this is why rule development for SA always has been, and always will be, an arms race. Spammers are aware of SpamAssas

RE: [SAtalk] A little Argentinian humor...

2003-06-26 Thread Bill
[EMAIL PROTECTED] wrote: > Subject: [SAtalk] A little Argentinian humor... > > > This came by today, from a newspaper comic strip: > > Luis Hernán Otegui > Administrador de Red > Facultad de Ciencias Exactas > UNLP

[SAtalk] 2.60 pre-release debian packages

2003-06-26 Thread Tony Hoyle
Is anyone doing debian packages of SA any more? The last CVS snapshot was quite a while ago... Tony --- This SF.Net email is sponsored by: INetU Attention Web Developers & Consultants: Become An INetU Hosting Partner. Refer Dedicated Servers.

RE: [SAtalk] quick regex question for rules

2003-06-26 Thread Chris Santerre
> > > \w is a word correct? > > > > Is this right:? > > /(build(ing)?|increase|more) \w?wealth/i > > > > should hit "building real weatlh" ? > > > > Or is it just easier to write: > > /(build(ing)?|increase|more).{1,10}wealth/i > > Do you have Philip Hazel(God bless him)'s pcretest on

RE: [SAtalk] Spammers sneaking lower Bayes scores

2003-06-26 Thread Bingham, Ryan
I can't believe we're even debating this! As my old boss would say, anyone who has enough free time on their hands to worry about this kind of stuff needs a project! I for one don't care what it's called. I'm more focused on keeping it out of my users' mailboxes. Ryan -Original Message---

Re: [SAtalk] Another one

2003-06-26 Thread Christof Damian
On Thu, 26 Jun 2003, Jack Gostl wrote: > > This is becoming a regular thing. A fake PGP signature buried inside > HTML followed by a string of random words clearly aimed at tripping > up the Bayes algorithms. Its becoming a daily event. See below. > > > might be worth matching white (on white)

RE: [SAtalk] Spammers sneaking lower Bayes scores

2003-06-26 Thread Thomas Kinghorn
I suppose someone will come up with an alternative to spam but then how will that influence the previous non-spam/ham(<<< sorry, had to say it) discussion ;o) Regards, Tom -Original Message- From: Tony Earnshaw [mailto:[EMAIL PROTECTED] Sent: 26 June 2003 02:33 To: Daniel Quinlan Cc

Re: [SAtalk] Spammers sneaking lower Bayes scores

2003-06-26 Thread Yorkshire Dave
On Thu, 2003-06-26 at 13:38, Fox Flanders wrote: > I blame SpamAssassin for these Bayes bypassing tricks. I had a custom Bayes > solution working many months before it appeared in SpamAssassin. There was > none of this bypassing crudola happening until SpamAssassin popularized > Bayes :) > Now I

Re: AW: [SAtalk] Another one

2003-06-26 Thread Matt Kettler
At 08:51 AM 6/26/03 -0400, Jack Gostl wrote: That PGP sig buried in HTML sticks out like a sore thumb. Even better, if you check my post from 6/14, most of these have a PGP signature block, but are without a "begin pgp signed message" block.. Try this meta rule pair for a starter. I can't guara

Re: [SAtalk] Qmail and SA

2003-06-26 Thread up
I use qmail-scanner, because it gives you the option of virus scanning as well, but there are probably more efficient/elegant ways of doing this now. In short, you'll want to install in this order: qmail (Maildir) maildrop (or a procmail that understands Maildir) qmail-queue patch (see qmail-sca

[SAtalk] sa-teach (building a learning suite)

2003-06-26 Thread Gordon Cormack
I am interested in building a training suite for spamassassin, based on past learning. The trouble is, I don't have my mail sorted exactly into spam and ham. What I do have is an accurate bayes-seen database created by spamassassin and corrected by scrupulous use of sa-learn. I also have log of a

going OT: --- Re: [SAtalk] Spammers sneaking lower Bayes scores

2003-06-26 Thread Tim Litwiller
It is best to be politically correct nowadays. this attitude is a big part of what is wrong with the world these days! It is infinately better to say it how it is or how you see it than to attempt to be politically correct. That doesn't mean you can't be nice when you say what you really thi

Re: AW: [SAtalk] Another one

2003-06-26 Thread Jack Gostl
On Thu, 26 Jun 2003, Matt Kettler wrote: > At 08:51 AM 6/26/03 -0400, Jack Gostl wrote: > >That PGP sig buried in HTML sticks out like a sore thumb. > > > Even better, if you check my post from 6/14, most of these have a PGP > signature block, but are without a "begin pgp signed message" block.

[SAtalk] A little Argentinian humor...

2003-06-26 Thread Luis Hernán Otegui
This came by today, from a newspaper comic strip: Luis Hernán Otegui Administrador de Red Facultad de Ciencias Exactas UNLP GNU-GPL: "May The Source Be With You..." ---

[SAtalk] Configuration Errors

2003-06-26 Thread Scott Rothgaber
[SA 2.55 on FreeBSD 5.0] Good Morning! `spamassassin -D --lint' shows the following errors. I re-read the INSTALL file on the Web site and I *believe* that I followed all of the instructions correctly. I could not find the USAGE file to which INSTALL referred. bayes: no dbs present, cannot sc

Re: [SAtalk] abuse of the X-Mailer: header

2003-06-26 Thread Tony Earnshaw
alex avriette wrote: I got this gem today: [...] Note the X-Mailer header. Oh, and the "AmikaGuardian" stuff is put there by speakeasy. It is a mail filter as well, only it doesn't work worth a damn. Duuno. I work my way backwards through the list from "the latest today" back to wherever I have

Re: [SAtalk] Ideas on dealing with Joe Job?

2003-06-26 Thread Tony Earnshaw
Simon Byrnand wrote: The HELO or EHLO commands are supposed to be used to identify the name of the mail server making the connection, but is essentially meaningless these days and is just a vestige of a time long forgotten when everyone played nice and gave valid information. Think of it as the

Re: AW: [SAtalk] Another one

2003-06-26 Thread Heinz Ulrich Stille
On Thursday 26 June 2003 14:51, Jack Gostl wrote: > Bayes attack is tougher, but 3-5 lines of all lower case letters with no > punctuation would be a good start. It would be, if it wouldn't just trigger the next cycle of evolution: E.g. a text generator using simple markov chains with single-word

Re: [SAtalk] Spammers sneaking lower Bayes scores

2003-06-26 Thread Tony Earnshaw
Daniel Quinlan wrote: Ham=good wanted email Spam=bad unwanted email Those are not the generally accepted definitions and definitely not the ones used by us. spam = unsolicited bulk/commercial email ham = everything else You are the language expert amongst the developers. It is best to be pol

Re: [SAtalk] quick regex question for rules

2003-06-26 Thread Tony Earnshaw
Chris Santerre wrote: \w is a word correct? Is this right:? /(build(ing)?|increase|more) \w?wealth/i should hit "building real weatlh" ? Or is it just easier to write: /(build(ing)?|increase|more).{1,10}wealth/i Do you have Philip Hazel(God bless him)'s pcretest on your machine? It'll t

Re: AW: [SAtalk] Another one

2003-06-26 Thread Jack Gostl
On Thu, 26 Jun 2003, Martin Bene wrote: > >This is becoming a regular thing. A fake PGP signature buried > >inside HTML > >followed by a string of random words clearly aimed at tripping up the > >Bayes algorithms. Its becoming a daily event. See below. > > Yep, I've been seein these for quite so

AW: [SAtalk] Another one

2003-06-26 Thread Martin Bene
Hi Jack, >This is becoming a regular thing. A fake PGP signature buried >inside HTML >followed by a string of random words clearly aimed at tripping up the >Bayes algorithms. Its becoming a daily event. See below. Yep, I've been seein these for quite some time now;What I'm seeing is: - spam in

  1   2   >