Re: [SAtalk] bug with AWL in 2.60?

2003-11-15 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Rob Mangiafico writes: >Before I submit a bug, I wanted to see if this was a known issue in 2.60. Yep, it is -- and there's a patch if you don't feel like waiting for 2.61 ;) http://bugzilla.spamassassin.org/show_bug.cgi?id=2734 - --j. -BEGIN

Re: [SAtalk] SA 2.60 - idle spamd childs

2003-11-15 Thread David B Funk
On Sat, 15 Nov 2003, Matthias Fuhrmann wrote: > > Hello, > > on my system i get many idling spamd childs, which wont die by itself. > this happens from time to time, if machines load gets higher by other > processes. eg. mimedefang kills its idling childs after a while; is this a > possible future

[SAtalk] SA problem

2003-11-15 Thread Johnno
Hello All, I have got SA working fine.. What i am wanting to know is how do i stop SA putting there msg's in the email telling it is spam.. all i want SA to do is put in the header [spam] which does, but is still adding. Spam detection software, running on this system, has identified this incom

[SAtalk] Auto Learn

2003-11-15 Thread Johnno
I have just noticed in my email headers this X-Spam-Status: Yes, hits=24.8 required=7.5 tests=autolearn=no version=2.60 I want to use autolearn I used auto_learn 1 is this not the cmd? Many Thanks, Johnno --- This SF.

[SAtalk] updating filters?

2003-11-15 Thread Aaron Levitt
Title: updating filters? Hello everyone- I am using an older version of SA (2.50) and have been using it for quite some time.  Recently more and more spam is starting to get past the filters.  Is there a way to update all of the filters so that more spam is getting stopped again without upda

Re: [SAtalk] Empty Return-Path?

2003-11-15 Thread Charles Gregory
On Fri, 14 Nov 2003, Robert Menschel wrote: > See my stats below -- I developed a rule for this test, and running it > against my corpus I found that it matched more ham than spam. I was actually thinking that it might be possible to build a rule that only triggers when the message is not 'legtima

Re: [SAtalk] Biz.Yahoo.com 'PRNews' abuse?

2003-11-15 Thread Charles Gregory
On Fri, 14 Nov 2003, Carl R. Friend wrote: > > I got a spam today that just missed being spam by a few fractions of a > > point. The "Click here" URL was: > > http://biz.yahoo.com/prnews/031112/lnw017_1.html >This would work, but you'll need to be very sensitive about > FPs. If your target

[SAtalk] Re: Biz.Yahoo.com 'PRNews' abuse?

2003-11-15 Thread Charles Gregory
On Fri, 14 Nov 2003, Jeremy Zawodny wrote: > > I got a spam today that just missed being spam by a few fractions of a > > point. The "Click here" URL was: > > http://biz.yahoo.com/prnews/031112/lnw017_1.html > I know the PRNewswire and BusinessWire are pretty good about the > clients they take.

Re: [SAtalk] Filtering.

2003-11-15 Thread Nix
On Tue, 11 Nov 2003, Rajdeep Larha stipulated: > Hi Jennifer, > I read your mail. But this is something little above it. There are certain > words in 20_porn.cf. When I use only those words even then the rating given > is too low. I used 5 words from the list in same case.. even then the mail > was

Re: [SAtalk] bug with AWL in 2.60?

2003-11-15 Thread Yorkshire Dave
On Sat, 15 Nov 2003 13:17:10 -0500 "Fred I-IS.COM" <[EMAIL PROTECTED]> wrote: > P.S. Your message contains this week's new tracking header, thanks > for posting it, this person has been rotating the tracking header > about once a week. > Hel-Tracking: > That's base64, just in case anyone had

Re: [SAtalk] bug with AWL in 2.60?

2003-11-15 Thread Fred I-IS.COM
Yes, this is a known issue and has been fixed for 2.61. There is a patch on Bugzilla now to correct it. P.S. Your message contains this week's new tracking header, thanks for posting it, this person has been rotating the tracking header about once a week. Hel-Tracking: Frederic Tarasevicius Int

RE: [SAtalk] bug with AWL in 2.60?

2003-11-15 Thread Bill
Sounds like you forgot to restart spamd after your change. --- This SF. Net email is sponsored by: GoToMyPC GoToMyPC is the fast, easy and secure way to access your computer from any Web browser or wireless device. Click here to Try it Free! ht

Re: [SAtalk] LIST ADMIN - SUGGESTION: pool.com

2003-11-15 Thread Keith C. Ivey
Dan Wilder <[EMAIL PROTECTED]> wrote: > Some mailing list software has the so-called VERP capability, in > which "From: " headers contain the recipient address, encoded > thus: > > From: List Name <[EMAIL PROTECTED] > > or some such. VERP stands for "variable envelope return path". The special

Re: [SAtalk] LIST ADMIN - SUGGESTION: pool.com

2003-11-15 Thread Jacob S.
On Sat, 15 Nov 2003 09:30:51 -0800 Dan Wilder <[EMAIL PROTECTED]> wrote: > Some mailing list software has the so-called VERP capability, in > which "From: " headers contain the recipient address, encoded thus: > I don't know whether this is possible at SourceForge, but if it > is, it might make

Re: [SAtalk] dnsbl and fake helo functions

2003-11-15 Thread dimon
> > I'm trying to optimize my MIMEDefang milter and reject the whole message > even > > before it is received and scanned with SpamAssassin. My question is: > > Is there a function in Mail::Spamassassin perl module which I can use to > > determine if specific host or IP address listed in any (of

RE: [SAtalk] LIST ADMIN - SUGGESTION: pool.com

2003-11-15 Thread Bill
> I don't know whether this is possible at SourceForge, but if > it is, it might make sense to turn on these settings once in a while. Would it be possible for SF to release the entire subscription list to someone, say the list admin, who could then generate the "mailing run" locally? That might

Re: [SAtalk] LIST ADMIN - SUGGESTION: pool.com

2003-11-15 Thread Dan Wilder
Eh. On looking at the headers a little bit closer, I see the list is hosted on mailman-2.0.9. Unfortunately this ancient version of Mailman does not support VERP. Looks like the only immediate answer is some scripting outside Mailman. It really is great not to have to spend a lot of time doing

[SAtalk] Confused spammer?

2003-11-15 Thread William Stearns
Good day, all, I think the person putting together http://plusherbal.biz/dpatch/ might have been a bit confused. Given the first guarantee I saw on the page, I'm, not sure I'd buy it. :-) Cheers, - Bill -

[SAtalk] SA 2.60 - idle spamd childs

2003-11-15 Thread Matthias Fuhrmann
Hello, on my system i get many idling spamd childs, which wont die by itself. this happens from time to time, if machines load gets higher by other processes. eg. mimedefang kills its idling childs after a while; is this a possible future option for spamd too? i'm using miltrassassin as milter ap

Re: [SAtalk] LIST ADMIN - SUGGESTION: pool.com

2003-11-15 Thread Dan Wilder
On Sat, Nov 15, 2003 at 10:16:46AM -0500, Charles Gregory wrote: > On Fri, 14 Nov 2003, Matt Kettler wrote: > > Unfortunately the list admins can't track which address is generating these > > bounces. There's no subscribed addresses that seem to match the very little > > bit of information that's

[SAtalk] bug with AWL in 2.60?

2003-11-15 Thread Rob Mangiafico
Before I submit a bug, I wanted to see if this was a known issue in 2.60. It seems some spams can somehow interject false AWL points to get their spam through. This morning, I cleared out the AWL entry for the email address [EMAIL PROTECTED] Only an hour later, I got the spam below, and here

RE: [SAtalk] Runtime problem SA 2.60 on RH 7.3

2003-11-15 Thread Frederick M Avolio
At 08:19 AM 11/15/2003 -0500, Frederick M Avolio wrote: ... X-Spam-Status: No, hits=0.0 required=5.0 tests=none version=2.55 X-Spam-Level: X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp) Should have mentioned when test

[SAtalk] Foreign characters

2003-11-15 Thread Michael Satterwhite
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Please forgive me if this has been asked before. With all the spam now using foreign characters in messages to obfuscate them, is there an easy way to enter these characters into rules. eg: in "övërweight", I want to be able to match the "ë" as well

[SAtalk] LIST ADMIN - SUGGESTION: pool.com

2003-11-15 Thread Charles Gregory
On Fri, 14 Nov 2003, Matt Kettler wrote: > Unfortunately the list admins can't track which address is generating these > bounces. There's no subscribed addresses that seem to match the very little > bit of information that's in the bounce itself.. If contacting the domains does no good, may I su

[SAtalk] pool.com

2003-11-15 Thread Charles Gregory
Just curious: Has anyone actually written to either 'pool.com' or to 'thewizard.net' and complained about this bounce? - C On Fri, 14 Nov 2003, Marcio Merlone wrote: > FYI. > Begin forwarded message: > Date: Fri, 14 Nov 2003 16:45:05 + > From: [EMAIL PROTECTED] > To: Marcio Merlone <[EMAIL P

Re: [SAtalk] Spam score in the subject?

2003-11-15 Thread Carl R. Friend
On Sat, 15 Nov 2003, Rick [Kitty5] wrote: > Is it possible to put the spam score in the subject? Yes. A quick read of the FM ((friendly|fine) manual) shows: subject_tag STRING ...(default: *SPAM*) Text added to the "Subject:" line of mails that are

[SAtalk] Re: URI database lookup feature (was Re: Sanity checking new uri rules?)

2003-11-15 Thread Carl R. Friend
On Sat, 15 Nov 2003, David B Funk wrote: > On Fri, 14 Nov 2003, Carl R. Friend wrote: > > >For the assembled group -- is it possible to do a DB lookup, > > either in an eval() or some other mechanism, in a "uri" rule? > > If we could do a DB lookup on URIs (or, more properly, the > > domai

Re: [SAtalk] SA-Learn. Clarification question.

2003-11-15 Thread Martin Radford
At Fri Nov 14 23:03:42 2003, Alan Munday wrote: > > Having just read the FAQ's can I just check the requirements for the > source SPAM/HAM mail for sa-learn? > > Do the contents of the sources messages need to be false positives > for the HAM file and false negatives for the SPAM file? No. To w

Re: [SAtalk] Salutation in subject

2003-11-15 Thread Martin Radford
At Sat Nov 15 10:12:56 2003, Kenneth Porter wrote: > > --On Friday, November 14, 2003 11:16 PM + Martin Radford > <[EMAIL PROTECTED]> wrote: > > > I don't think I've ever received legitimate mail like that, but I've > > certainly sent legitimate mail with the user's username in the subject >

Re: [SAtalk] dnsbl and fake helo functions

2003-11-15 Thread Kenneth Porter
--On Saturday, November 15, 2003 4:44 AM -0600 David B Funk <[EMAIL PROTECTED]> wrote: You say "MIMEDefang milter" which I take to indicate that you're using sendmail as your MTA. Sendmail has a built-in ability to use DNSBL and access databases to enable spam control based upon hostname & IP add

RE: [SAtalk] Runtime problem SA 2.60 on RH 7.3

2003-11-15 Thread Frederick M Avolio
At 01:31 PM 11/14/2003 -0800, ian douglas wrote: > Anyway, I downloaded the sources, built it, and installed it with no > problems. I rebuilt the Bayes db. When I started it (in debug mode) it > logged this and then exited: My first install (2.55) was via CPAN, and upgraded (also via CPAN) to 2.60

[SAtalk] Spam score in the subject?

2003-11-15 Thread Rick [Kitty5]
Is it possible to put the spam score in the subject? -- Rick Kitty5 NewMedia http://Kitty5.com POV-Ray News & Resources http://Povray.co.uk TEL : +44 (01270) 501101 - ICQ : 15776037 PGP Public Key http://pgpkeys.mit.edu:11371/pks/lookup?op=get&search=0x231E1CEA ---

Re: [SAtalk] Razor does not work with spamd?

2003-11-15 Thread MIKE YRABEDRA
on 11/15/03 5:59 AM, David B Funk at [EMAIL PROTECTED] wrote: > When logged in as your 'spamd' user, if you do the test: > > spamassassin -D --lint > > do you see spamassassin using razor? Yes ++ Mike Yrabedra (President) 323 Incorporated Home of

[SAtalk] SpamAssassin Log??

2003-11-15 Thread MIKE YRABEDRA
Does SA generate a log? If no, can it? It would help me do some debugging. ++ Mike Yrabedra (President) 323 Incorporated Home of MacDock.com, MacAgent.com and MacShirt.com ++ W: http://www.323inc.com/ P: 7

Re: [SAtalk] Run spamd as root ?

2003-11-15 Thread David B Funk
On Thu, 13 Nov 2003, MIKE YRABEDRA wrote: > > I have found that spamd will not use razor on my system because of > permissions. Is it safe to run spamd as root? Mike, spamd will not run as root, it is a security risk. If you start it as root and you do not tell it who you want to run as (IE leave

Re: [SAtalk] Razor does not work with spamd?

2003-11-15 Thread David B Funk
On Thu, 13 Nov 2003, MIKE YRABEDRA wrote: > on 11/13/03 6:07 PM, Chip Paswater at [EMAIL PROTECTED] wrote: > > > Have you gotten razor working by itself? > > Yes, it works fine. I have just never been able to use it with spamd?? OK, next test spamassassin+razor. When logged in as your 'spamd' us

Re: [SAtalk] dnsbl and fake helo functions

2003-11-15 Thread David B Funk
On Thu, 13 Nov 2003 [EMAIL PROTECTED] wrote: > > Hi, > > I'm trying to optimize my MIMEDefang milter and reject the whole message even > before it is received and scanned with SpamAssassin. My question is: > Is there a function in Mail::Spamassassin perl module which I can use to > determine if sp

Re: [SAtalk] Salutation in subject

2003-11-15 Thread Kenneth Porter
--On Friday, November 14, 2003 11:16 PM + Martin Radford <[EMAIL PROTECTED]> wrote: I don't think I've ever received legitimate mail like that, but I've certainly sent legitimate mail with the user's username in the subject line. This was some years ago, and I don't think I'd do that nowaday

[SAtalk] URI database lookup feature (was Re: Sanity checking new uri rules?)

2003-11-15 Thread David B Funk
On Fri, 14 Nov 2003, Carl R. Friend wrote: >For the assembled group -- is it possible to do a DB lookup, > either in an eval() or some other mechanism, in a "uri" rule? > If we could do a DB lookup on URIs (or, more properly, the > domain portion of URIs) I think that'd be a win (at, of course

Re: [SAtalk] Problem with spamd spinning on bayes_toks

2003-11-15 Thread David B Funk
On Fri, 14 Nov 2003, Bob Amen wrote: > > We've been seeing a problem with spamd that happens at random times. > Occasionally, a spamd thread will spin, clocking up CPU time and never > finish. This causes other spamd processes to hang and eventually all > memory and swap is used up by multip

Re: [SAtalk] Sanity checking new uri rules?

2003-11-15 Thread Robert Menschel
Hello William, Friday, November 14, 2003, 12:53:45 PM, you wrote: WS> I'm now trying WS> to take these domains and check the URI's in the body for them as well. WS> My first attempt to do URI rules is at WS> http://www.stearns.org/sa-blacklist/sa-blacklist.2003111402.uri.cf I'd run these thro

[SAtalk] Listwashing Token Rules Update

2003-11-15 Thread Yorkshire Dave
New ciphers added, update time for anyone that uses 'em. http://www.wot.no-ip.com/cgi-bin/detoken.pl With the exception of a few missing letters, that's all I have left, no more ciphers to crack. Anyone spotted any others? -- Dave --- This