[SAtalk] Razor and DCC

2003-11-19 Thread Zlatko Hristov
Title: SignatureENCH Stationery Hello,   Does Razor and DCC do a direct lookup to same database on the internet every time SA scans a message? Or its storing that database localy somehow.   Thank you.   Regards,   Zlatko.

RE: [SAtalk] Where to place new rules of my own?

2003-11-19 Thread Larry Gilson
Hi Kevin, Any .cf file will be processed in /etc/mail/spamassassin and /usr/share/spamassassin. However, you are advised to avoid /usr/share/spamassassin as an update/upgrade will delete the directory and install a new - one so any custom rules will be wiped out. The links below will help you in

Re: [SAtalk] bug in the report reserved words list

2003-11-19 Thread Matt Kettler
At 03:52 PM 11/19/03 -0500, Matt Cramer wrote: Any string that ends and begins with an "_" will be parsed as a variable. It was driving me nuts trying to figure out why the url I was putting in the report linking our users to customized filtering instructions based on our MUA was not working in any

RE: [SAtalk] [RD] second weeds set

2003-11-19 Thread Larry Gilson
> -Original Message- > From: jennifer [mailto:[EMAIL PROTECTED] > Sent: Wednesday, November 19, 2003 8:45 PM > To: 'Larry Gilson'; [EMAIL PROTECTED] > Subject: RE: [SAtalk] [RD] second weeds set > > > Hi Larry, > > I agree, it would be nice if there was a way to consolidate, > and ma

Re: [SAtalk] Spam Message not nearly picked up by rules

2003-11-19 Thread Matt Kettler
At 07:03 PM 11/18/03 -0500, erin o'brien wrote: I am not a programmer, so I could not think of any "rule" to catch this one. I only hope that someone here can. I have gotten quite a few of these (at least two per day), and it's always from my forged email address from someone named wilfred or ar

[SAtalk] Using SA to check a string

2003-11-19 Thread Andrew
Hi All, I am creating a Perl script to check a phrase (of plain text) for spam. I was wondering if anybody could verify my script for me? Is there a better way to accomplish this? -- start script -- my $spamtest = new Mail::SpamAssassin ({ ... }); my $mail = "test spam phrase"; my $stat

[SAtalk] Where to place new rules of my own?

2003-11-19 Thread Kevin Old
Hello everyone, I'm using SA 2.6.1 out of the box and continue to receive 20-100 pieces of SPAM a day that is obviously SPAM, but for some reason it gets a 4.9 or 4.7 score and is passed through. My score limit is 5. I receive a lot of "repeat SPAM" where the messages are exactly the same over a

Re: [SAtalk] Need help with a simple custom rule (solved)

2003-11-19 Thread Robert Davidson
Hi Everyone, Thankyou to all of you that offered advice, it was much appreciated. The problem now appears to be solved. Frederic Tarasevicius gave me a solution which appears to be working fine. I will look into MIMEDefang as well as Dave Funk suggested. Cya's. -- Regards, Robert Davidson. h

Re: [SAtalk] Need help with a simple custom rule

2003-11-19 Thread David B Funk
On Wed, 19 Nov 2003, Robert Davidson wrote: > > Hi everyone, > > I set up a SpamAssassin system for a company but they alerted me to a > problem today. > > They have content filtering rules to stop people from abusing their > employees. Basically any e-mails with naughty words are given 50 points

Re: [SAtalk] Negative score for SAtalk messages

2003-11-19 Thread David B Funk
On Wed, 19 Nov 2003, Marc Steuer wrote: > Hi list members, > > I want to score messages from [SAtalk] with a negative score so examples > posted to the list won't be tagged as spam. This is my first venture into > regex and I've tried: > > header MY_SATALK Subject =~ /\[SAtal

Re[2]: [SAtalk] Bug in SA? Anyone else get messages like this?

2003-11-19 Thread Robert Menschel
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hello Chris, Wednesday, November 19, 2003, 7:56:21 AM, you wrote: CS> Somtimes, and this may NOT be one of those times, spammers will send CS> an empty message. At first I thought this was just their stupidity. CS> But then I thought about it longer.

[OT] Long-running processes (was: RE: [SAtalk] bayes works!)

2003-11-19 Thread Chris Thielen
Bryan: Whenever I perform a long-running task on my mailserver, I use a handy utility called 'screen'. It allows you to detach from an interactive shell at any time and re-attach later. More here: http://www.gnu.org/software/screen/screen.html -- Chris Thielen Easily generate SpamAssassin r

Re: [SAtalk] bayes works!

2003-11-19 Thread Matt Kettler
At 08:10 PM 11/19/2003, Bryan Hoover wrote: Just wanted to mention that I'd been trying to clean up a polluted ham corpus by using 'forget', but I continued to get poor results. Long story short, I cleaned up my ham, and removed both ham, and spam that had spambouncer headers - which I assume sa-l

RE: [SA Hits: 14.10] [SAtalk] Spam Message not nearly picked up b y rules

2003-11-19 Thread Larry Gilson
I have been experimenting with rules that will catch periods and pipes obfuscating text. Attached is my punctuation.cf file. It caught your example. * 0.5 -- BODY: MY: Word obfu by periods (a.bcd) * 0.5 -- BODY: MY: Word obfu by periods (abcde.fghij) * 0.5 -- BODY: MY: Word obfu by peri

Re: [SAtalk] Pyzor trouble

2003-11-19 Thread Simon Byrnand
At 01:38 20/11/2003 +0100, Mark wrote: Has anyone else problems with Pyzor? I am getting these, all throughout the day, Pyzor: couldn't grok response "66.250.40.33:24441 TimeoutError: " I did a "/usr/local/bin/pyzor discover", but to no avail. And I do not have them blocked on the firewall either.

Re: [SAtalk] bayes countering nigerian spam rules

2003-11-19 Thread Robert Menschel
Hello Matt, Wednesday, November 19, 2003, 12:47:22 PM, you wrote: MC> However it seems the latest rounds of Nigerian Scam mails look like MC> ham to Bayes. All of them are scoring bayes_00, which brings them MC> below our threshold. I keep feeding copies of it into sa-learn, but MC> without luc

Re: [SAtalk] bayes works!

2003-11-19 Thread David B Funk
On Wed, 19 Nov 2003, Bryan Hoover wrote: > The reason I mention it - aside from being pleased - is to point out > that it appears the problem was either the old spambouncer headers, or > forgetting, wasn't (the latter being what I started out suspecting, > until I discovered the spambouncer header

Re: [SAtalk] Negative score for SAtalk messages

2003-11-19 Thread Robert Menschel
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hello Marc, Wednesday, November 19, 2003, 11:49:08 AM, you wrote: MS> I want to score messages from [SAtalk] with a negative score so MS> examples posted to the list won't be tagged as spam. ... MS> 2. Is there an alternate way to ensure SAtalk me

RE: [SAtalk] (no subject)

2003-11-19 Thread Matt Kettler
At 03:25 PM 11/19/2003, Robert Oslin wrote: My first post to this list. Hope I'm doing this right... I received a message with invisible fonts, yet the generic HTML_FONT_INVISIBLE rule wasn't hit. Was it because the body tag didn't specify a background font, therefore the text font color had nothi

[SAtalk] subject line not being tagged as spam

2003-11-19 Thread Michal Wellum
Hi all, I recently got around to installing spam assassin 2.60 and getitng it tunning. My config is a 2.2.16 kernel, with updated perl etc al. packages. My MTA is EXIM. I have added the exim config changes to internally handle the mail so I don't have to play with .procmailrc's as follows... #

[SAtalk] Strange error on new install

2003-11-19 Thread Jim Stickley
I am installing the latest version of SpamAssassin, 2.60 and ran the CPAN install procedure.  After which I ran the tests against the sample e-mail messages.  Here is the output from my tests.   What is the missing "get_uri_list", and  how do I get the missing function? [EMAIL PROTECTED] M

[SAtalk] Spam Message not nearly picked up by rules

2003-11-19 Thread erin o'brien
I am not a programmer, so I could not think of any "rule" to catch this one. I only hope that someone here can. I have gotten quite a few of these (at least two per day), and it's always from my forged email address from someone named wilfred or arthur. Thanks. Original Message -

Re: [SAtalk] run spamassassin from server, check outside pop3/imap account?

2003-11-19 Thread B-LUC Consulting
Jack Coates wrote: On Tue, 2003-11-18 at 14:11, J. Burton wrote: we have spamassassin running our mail server. i have a friend who is getting a pile of spam to his account at a different isp (the local telco). he wants to know if i can do anything about his spam i have some notion that we sho

RE: [SAtalk] [RD] second weeds set

2003-11-19 Thread jennifer
Hi Larry, I agree, it would be nice if there was a way to consolidate, and maybe there is, I just don’t know what the answer is. Actually, that's not true. I came up with a thought today (I just remembered) and I think I can scale them down some. I'll mess around and let you know if it works.

[SAtalk] confusing readme

2003-11-19 Thread Randy Bush
in the README, http://au2.spamassassin.org/full/2.6x/dist/README, it sez Learning Since SpamAssassin now includes a Bayesian learning filter (in version 2.50 on), it is worthwhile training SpamAssassin with your collection of non-spam and spam, if possible. This will

[SAtalk] FYI

2003-11-19 Thread Alex van den Bogaerdt
Spammers now send templates to use... how nice of them! Subject: Re: %RND_UC_CHAR[2-8], one madman there Body attached. 770925821296145303 Content-Type: text/html; Content-Transfer-Encoding: quoted-printable No more spam.We can help you!<= /p> http://%RANDOM_WORD:[EMAIL PROTECTED]/spam=

[SAtalk] Spam nets

2003-11-19 Thread Regis Wilson
Just thought I'd share. I don't have access to the rbls so I did a grep on two day's worth of spam IPs (received: line from mailserver). I have this: no. spam network 7849 24.0.0.0 6819 68.0.0.0 4723 66.0.0.0 4200 200.0.0.0 3139

[SAtalk] bayes works!

2003-11-19 Thread Bryan Hoover
Which I'm sure is no surprise to most. Just wanted to mention that I'd been trying to clean up a polluted ham corpus by using 'forget', but I continued to get poor results. Long story short, I cleaned up my ham, and removed both ham, and spam that had spambouncer headers - which I assume sa-learn

[SAtalk] Pyzor trouble

2003-11-19 Thread Mark
Has anyone else problems with Pyzor? I am getting these, all throughout the day, Pyzor: couldn't grok response "66.250.40.33:24441 TimeoutError: " I did a "/usr/local/bin/pyzor discover", but to no avail. And I do not have them blocked on the firewall either. Thanks, - Mark

RE: [SAtalk] [RD] second weeds set

2003-11-19 Thread Larry Gilson
Hey Jennifer, Just a quick note to let you know that I abondoned my effort to consolidate your rules. While they worked for the most part, the were not as effective as yours. I still don't like the lack of effeciency of multiple rules, the effectiveness can not be beat! Thanks, Larry > -O

RE: [SAtalk] (no subject)

2003-11-19 Thread Larry Gilson
You just missed a discussion about a custom rule. If you are not familiar with custom rules, I suggest some reading and examples: http://mywebpages.comcast.net/mkettler/sa/SA-rules-howto.txt http://www.merchantsoverseas.com/wwwroot/gorilla/sa_rules.htm http://www.exit0.us/ http://www.emtinc.ne

[SAtalk] [RD] second weeds set

2003-11-19 Thread jennifer
I added a second Weeds set. R. Menschel pointed out a FP in an email that he sent with a legitimate string of encoded text. If you would like to limit the set a bit, you can use the "weeds two" set. I have been testing it by running it in addition to the original set. This set will miss a few i

RE: [SAtalk] Tracking down thewizard.net forwarder

2003-11-19 Thread ian douglas
> >to 'pool.com' and/or 'thewizard.net' to solve the problem at the source? > > Yes. And without reply... I had to deal with this on a mailing list of thousands of users. My only recourse was to write a quick-n-dirty Perl script to run through the subscriber list and send everyone a very official

[SAtalk] Perl history (was: Re: Sanity checking new uri rules?)

2003-11-19 Thread David B Funk
On Wed, 19 Nov 2003, Chris Santerre wrote: > LOL, the only reason I recognise the name Larry Wall is because of Theo's > sigs! :) > I guess I need to go but that book and help support the man. > > --Chris Santerre Mumble Mumble, kids these days, no respect for their elders. OK, mandatory homewor

Re: [SAtalk] mysql spamc ignores the email in mailling list

2003-11-19 Thread Ryan Moore
That is a downside of alot of site-wide implementations. It is for that exact reason I went with using amavisd-new, as it doesn't have that problem. Amavisd-new will break the message into seperate parts proccesses each seperately I believe. While it doesn't have the ability built into amavisd

Re: [SAtalk] Tracking down thewizard.net forwarder

2003-11-19 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Charles Gregory writes: > >I ask again, particularly of the list maintainers, has anyone written mail >to 'pool.com' and/or 'thewizard.net' to solve the problem at the source? Yes. And without reply... - --j. -BEGIN PGP SIGNATURE- Version:

[SAtalk] sa-learn --force-expire error

2003-11-19 Thread Adam Denenberg
I am trying to run a force-expire and getting the following es when running with -D in sa-learn version 2.60 (perl 5.8 solaris 9) I get these non-stop until I Ctrl-D out of it... Use of uninitialized value in numeric gt (>) at /usr/local/lib/perl5/site_perl/5.8.0/Mail/SpamAssassin/UnixLocker.

RE: [SAtalk] Rule for naughty words containing dots?

2003-11-19 Thread Larry Gilson
> -Original Message- > From: Ralf Guenthner > Sent: Wednesday, November 19, 2003 12:08 PM > To: [EMAIL PROTECTED] > Subject: [SAtalk] Rule for naughty words containing dots? > > > Hi list > > Recently I've seen an increase in spam mails like the one below. > Using SA 2.60 with a spam th

RE: [SAtalk] AT&T PATENTS ANTI-ANTISPAM TECHNOLOGY

2003-11-19 Thread Scott Harris
-Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kai MacTane Sent: Wednesday, November 19, 2003 12:36 PM To: [EMAIL PROTECTED] Subject: Re: [SAtalk] AT&T PATENTS ANTI-ANTISPAM TECHNOLOGY At 11/19/03 10:42 AM , Steve Thomas wrote: >I read this on TheRegis

Re: [SAtalk] Negative score for SAtalk messages

2003-11-19 Thread Matt Beland
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Wednesday 19 November 2003 12:08 pm, Chris Thielen wrote: > To check if it was sent to the list I look for this header: > X-BeenThere: [EMAIL PROTECTED] This is the best header to check for: List-Id: Talk about SpamAssassin - -- Matt Beland [EM

Re: [SAtalk] AT&T PATENTS ANTI-ANTISPAM TECHNOLOGY

2003-11-19 Thread Kai MacTane
At 11/19/03 10:42 AM , Steve Thomas wrote: I read this on TheRegister.com yesterday. The only reasonal explaination is that they wanted to make sure that the concept was never put into practice and they never really intended to use the technique themselves. I hope... Well, the article does stat

Re: [SAtalk] Negative score for SAtalk messages

2003-11-19 Thread Matt Kettler
At 02:49 PM 11/19/2003, Marc Steuer wrote: I want to score messages from [SAtalk] with a negative score so examples posted to the list won't be tagged as spam. This is my first venture into regex and I've tried: header MY_SATALKSubject =~ /\[SAtalk\]\b/ describe MY_SATAL

RE: Re[2]: [SAtalk] Sanity checking new uri rules?

2003-11-19 Thread David B Funk
On Wed, 19 Nov 2003, Chris Santerre wrote: > Thanks, I got it now. I updated my evilrules last night, and they tested > great overnight! I shall post them shortly. This should speed them up > greatly for everyone! Would this help even more? > > /?:\bsomedomain\.com\b/i > > would the addition of th

[SAtalk] [OT][RD] Those Citibank and other s[c|p]ams

2003-11-19 Thread Mike Kuentz (2)
Good article about it. Looks like a good rule or two can be pulled out of the discussion. http://www.securityfocus.com/infocus/1745 Mike --- This SF.net email is sponsored by: SF.net Giveback Program. Does SourceForge.net help you be more pro

Re: [SAtalk] Tracking down thewizard.net forwarder

2003-11-19 Thread Charles Gregory
I ask again, particularly of the list maintainers, has anyone written mail to 'pool.com' and/or 'thewizard.net' to solve the problem at the source? - Charles On Wed, 19 Nov 2003, Ken Bass wrote: > For every submission I keep getting the below bounce / along with > advertisement. This is quite ir

Re: [SAtalk] Tracking down thewizard.net forwarder

2003-11-19 Thread Simon Byrnand
At 14:22 19/11/2003 -0500, Ken Bass wrote: For every submission I keep getting the below bounce / along with advertisement. This is quite ironic on a list dedicated to attacking spam. And very annoying. My own personal workaround has been to add that address to my SpamAssassin blacklist and I su

RE: [SAtalk] Negative score for SAtalk messages

2003-11-19 Thread Chris Santerre
Title: Negative score for SAtalk messages I don't even run them thru SA. I have procmail skip them out of the loop.   You rule looks fine to me! -Original Message-From: Marc Steuer [mailto:[EMAIL PROTECTED]Sent: Wednesday, November 19, 2003 2:49 PMTo: [EMAIL PROTECTED]Subje

RE: [SAtalk] Negative score for SAtalk messages

2003-11-19 Thread Chris Thielen
Oh. Silly me, I didn't respond to the original rule question. I made the same wrong assumption in my obfu rules generator. The problem with the original rule is the trailing word boundary marker: \b matches the space between "\w\W" or "\W\w" the "]" character is \W, so for that rule to match, t

[SAtalk] bug in the report reserved words list

2003-11-19 Thread Matt Cramer
It seems that the list of reserved words that map to variables when using the report command, such as _SUMMARY_, doesn't actually limit itself to only the list in the man page. Any string that ends and begins with an "_" will be parsed as a variable. It was driving me nuts trying to figure out why

Re: [SAtalk] subject line not being tagged as spam

2003-11-19 Thread Evan Platt
--On Wednesday, November 19, 2003 1:46 PM -0500 Michal Wellum <[EMAIL PROTECTED]> wrote: > Still no joy. The spam being found is not being tagged in the subject > line. Any help would be appreciated. How about the headers from one of the meesage, mainly the SA headers - X-Spam-Status, etc.?

RE: [SAtalk] (no subject)

2003-11-19 Thread Chris Santerre
that would be openrbl.org I opted for a Hot Chocolate after lunch. I should have went with the coffee :) > -Original Message- > From: Chris Santerre [mailto:[EMAIL PROTECTED] > Sent: Wednesday, November 19, 2003 3:07 PM > To: 'Michael H. Collins'; [EMAIL PROTECTED] > Subject: RE: [SAtal

RE: [SAtalk] (no subject)

2003-11-19 Thread Chris Santerre
The IP in the header: Received: from jp (w068.z064000153.lax-ca.dsl.cnc.net [64.0.153.68]) by bloomail.mybloo.com (Vircom SMTPRS 5.3.232) with SMTP id <[EMAIL PROTECTED]> for <[EMAIL PROTECTED]>; hits on opelrbl.org like a raped ape!! So I would say to you kind sir Reo, SATALK will never leave!

[SAtalk] bayes countering nigerian spam rules

2003-11-19 Thread Matt Cramer
Bayes has been working great. We use it site-wide here, with corpora of about 20K spams and hams. We used to get anywhere from 4-12 false positive reports per month, requiring whitelisting (we have about 6K email users). Now we get none, and I attribute that to Bayes. Nice job, SpamAss authors,

RE: [SAtalk] (no subject)

2003-11-19 Thread Robert Oslin
My first post to this list. Hope I'm doing this right... I received a message with invisible fonts, yet the generic HTML_FONT_INVISIBLE rule wasn't hit. Was it because the body tag didn't specify a background font, therefore the text font color had nothing to compare against? Copy of the spam be

Re: [SAtalk] subject line not being tagged as spam

2003-11-19 Thread Matt Kettler
At 01:46 PM 11/19/2003, Michal Wellum wrote: In 10_misc.cf under /usr/share/spamassassin So, I simply removed the hashes from a couple of lines as follows... Still no joy. The spam being found is not being tagged in the subject line. Any help would be appreciated. 1) I'd strongly advise t

Re: [SAtalk] Negative score for SAtalk messages

2003-11-19 Thread Chris Thielen
Hey Marc, I use procmail to send SAtalk to a separate IMAP folder (SpamAssassin-talk), bypassing SpamAssassin. Any email sent to my SATalk email address but not to the list is checked by spamassassin, then put in a yet another IMAP folder (SpamAssassin-talk/direct). To check if it was sent to th

Re: [SAtalk] AT&T PATENTS ANTI-ANTISPAM TECHNOLOGY

2003-11-19 Thread Charles Gregory
On Wed, 19 Nov 2003, Martin McWhorter wrote: > >filters." AT&T says it is re-evaluating the patent and has not decided how > >it will use the technology. > >SOURCE: News.com; AUTHOR: Paul Festa, CNET > >http://news.com.com/2100-1032_3-5108918.html > Here is a suggestion: Sue spammers that use techn

[SAtalk] Negative score for SAtalk messages

2003-11-19 Thread Marc Steuer
Title: Negative score for SAtalk messages Hi list members, I want to score messages from [SAtalk] with a negative score so examples posted to the list won't be tagged as spam.  This is my first venture into regex and I've tried: header MY_SATALK            Subject =~ /\[SAtalk\

RE: [SAtalk]

2003-11-19 Thread ian douglas
> describe MY_RBDY_INVSTXTMY: Invisible text color > rawbody MY_RBDY_INVSTXT/ color=("?\#?F[0-9A-F]"?|"?white"?).*>/i > scoreMY_RBDY_INVSTXT2.0 Just my $0.02, but I'd make it this: color=("?\#?F[0-9A-F]F[0-9A-F]F[0-9A-F]"?|"?white" .. spammers will use more than just the l

Re: [SAtalk] SA LIST PROBLEM? Quoted Printable problem?

2003-11-19 Thread Charles Gregory
On Wed, 19 Nov 2003, Nancy McGough wrote: > As an alternative, you could try reading the spamassassin mailing > list via the gmane.org NNTP server and see if the messages show > up correctly there. Actually, they show up correctly as soon as I start a reply, so there is no real problem reading the

[SAtalk] subject line not being tagged as spam

2003-11-19 Thread Michal Wellum
Hi all, I recently got around to installing spam assassin 2.60 and getitng it tunning. My config is a 2.2.16 kernel, with updated perl etc al. packages. My MTA is EXIM. I have added the exim config changes to internally handle the mail so I don't have to play with .procmailrc's as follows... #

[SAtalk] Tracking down thewizard.net forwarder

2003-11-19 Thread Ken Bass
For every submission I keep getting the below bounce / along with advertisement. This is quite ironic on a list dedicated to attacking spam. I have a suggestion. I'm not sure what admin capabilities the list administrators have using the sourceforge lists, but here is my advice: Modify your mail

Re: [SAtalk] AT&T PATENTS ANTI-ANTISPAM TECHNOLOGY

2003-11-19 Thread Steve Thomas
On Wed, Nov 19, 2003 at 10:12:51AM -0800, Harold Hallikainen is rumored to have said: > > AT&T PATENTS ANTI-ANTISPAM TECHNOLOGY > ... I read this on TheRegister.com yesterday. The only reasonal explaination is that they wanted to make sure that the concept was never put into practice and they ne

Re: [SAtalk] AT&T PATENTS ANTI-ANTISPAM TECHNOLOGY

2003-11-19 Thread Martin McWhorter
filters." AT&T says it is re-evaluating the patent and has not decided how it will use the technology. SOURCE: News.com; AUTHOR: Paul Festa, CNET http://news.com.com/2100-1032_3-5108918.html Here is a suggestion: Sue spammers that use technology to bypass filters for patent infringement. --

Re: [SAtalk] Bug in SA? Anyone else get messages like this?

2003-11-19 Thread scion+spamas
FWIW, I noticed some interesting Reply-to: addresses in these. That combined with a very reasonable looking From:, led me to believe they were trolls for "I'm so sorry" replies from folks trying to help the hapless email user who sent an empty email. That is, an attempt to validate that a human is

Re: [SAtalk] (no subject)

2003-11-19 Thread Michael H. Collins
No, You leave... Is this spam of some new form? Reo wrote: leave -- Michael H. Collins Admiral, Penguinista Navy It's us against them. Ride like you stole it! http://linuxlink.com --- This SF.net email is sponsored by: SF.net Giveback Progr

[SAtalk] AT&T PATENTS ANTI-ANTISPAM TECHNOLOGY

2003-11-19 Thread Harold Hallikainen
AT&T PATENTS ANTI-ANTISPAM TECHNOLOGY Critics ponder why AT&T would patent a technology that thwarts antispam filters. The technology operates as a "system and method for counteracting message filtering," according to its patent awarded on Nov 4. "Why is AT&T inventing and patenting a method for e

[SAtalk] (no subject)

2003-11-19 Thread Reo
leave

[SAtalk] Re: SA LIST PROBLEM? Quoted Printable problem?

2003-11-19 Thread Nancy McGough
On 19 Nov 2003 Charles Gregory ([EMAIL PROTECTED]) wrote: > On Tue, 18 Nov 2003, David B Funk wrote: > > Based upon the headers of your message, it looks like you're using pine > > v4.05. > > My apologies. I keep forgetting that my Pine is on an *ancient* Solaris > system, and not the reasonbly up-

[SAtalk] Razor problems

2003-11-19 Thread Ken Bass
Is there a way to determine if there is a problem with the servers razor uses (such as an announce list or network status). Do people find the razor (cloudmark) servers do not always accept spam reports? I've been getting Nov 19 12:19:47.329814 report[2920]: [ 5] Connecting to folly.cloudmark.c

[SAtalk] Evil Rules update!

2003-11-19 Thread Chris Santerre
Here is the latest on my SARE: www.merchantsoverseas.com/wwwroot/gorilla/evilrules12c.cf They should run faster now! They are now bound! Sorted by this hit file: www.merchantsoverseas.com/wwwroot/gorilla/evil2.txt *NOTE* I've kind of hurt future evilrules updates. I've implemented spamhaus.o

Re: [SAtalk] Sanity checking new uri rules?

2003-11-19 Thread adam
Replying to the whole thread, but I had to grab an actual message to reply to. ISTR some time ago talk about a RBL for hosts referenced inside emails, instead of just the sending ips. Seems like that would be ideal, especially if we go based on DNS name as well as ip address. So if we get a mess

[SAtalk] stop sa from creating new user dirs and user_prefs

2003-11-19 Thread Michael P. Varre
Hi all, im having a small issue with SA creating new user dirs and user prefs files.   Here is my startup /bin/spamd --daemonize --username=virtual --virtual-config-dir=/usr/local/virtual/%d/%l --nouser-config -s spamd -L -a && echo -n ' spamd'   I want it to run daemonized and to use p

[SAtalk] Rule for naughty words containing dots?

2003-11-19 Thread Ralf Guenthner
Hi list Recently I've seen an increase in spam mails like the one below. Using SA 2.60 with a spam threshold of 5 they are not tagged. Does anyone already have a rule for stuff like that? Thanks in advance Ralf G. psasi oosxa kmemjitw qsjvq ddblplv Just take V.l.A.G.R.A.X-DS about 15 minutes to

Re: [SAtalk] Need help with a simple custom rule

2003-11-19 Thread Evan Platt
--On Wednesday, November 19, 2003 5:22 PM +1100 Robert Davidson <[EMAIL PROTECTED]> wrote: > > Hi everyone, > > I set up a SpamAssassin system for a company but they alerted me to a > problem today. > > They have content filtering rules to stop people from abusing their > employees. Basicall

Re: [SAtalk] SA LIST PROBLEM? Quoted Printable problem?

2003-11-19 Thread Charles Gregory
On Tue, 18 Nov 2003, David B Funk wrote: > Based upon the headers of your message, it looks like you're using pine > v4.05. My apologies. I keep forgetting that my Pine is on an *ancient* Solaris system, and not the reasonbly up-to-date mail server. Unfortunately, the (expletive) thing is so heav

RE: [SAtalk] Need help with a simple custom rule

2003-11-19 Thread Chris Santerre
Create a negative scoring rule for word docs. *Note* we don't post negative rules to the net. HTH -Chris > -Original Message- > From: Robert Davidson [mailto:[EMAIL PROTECTED] > Sent: Wednesday, November 19, 2003 1:22 AM > To: [EMAIL PROTECTED] > Subject: [SAtalk] Need help with a simple

RE: Re[2]: [SAtalk] Sanity checking new uri rules?

2003-11-19 Thread Chris Santerre
> -Original Message- > From: David B Funk [mailto:[EMAIL PROTECTED] > Sent: Tuesday, November 18, 2003 11:57 PM > To: Chris Santerre > Cc: ML-spamassassin-talk > Subject: RE: Re[2]: [SAtalk] Sanity checking new uri rules? > > > On Tue, 18 Nov 2003, Chris Santerre wrote: > > > > > uri

RE: [SAtalk] Bug in SA? Anyone else get messages like this?

2003-11-19 Thread Chris Santerre
Somtimes, and this may NOT be one of those times, spammers will send an empty message. At first I thought this was just their stupidity. But then I thought about it longer. It could be an attempt to get a few negative AWL points. Just an idea to throw out there. --Chris "oops I top posted again!

[SAtalk] [OT] SAproxy no longer free edition?

2003-11-19 Thread Chris Santerre
I guess I missed something. When did SAproxy stop having a free edition? Does the demo expire after 15 days? I'm bummed there is no longer a free version for home users if this is so :( Chris Santerre System Admin and SA Custom Rules Emporium keeper http://www.merchantsoverseas.com/wwwroot/goril

Re: [SAtalk]

2003-11-19 Thread MIKE YRABEDRA
Thanks Larry ! on 11/19/03 9:51 AM, Larry Gilson at [EMAIL PROTECTED] wrote: >> Is this the proper way to do this? >> >> bodyWHITE_FONT /font color=\"#ff\"/i >> describeWHITE_FONT Uses White Font Tag >> score WHITE_FONT 5.000 > > > The body check will preprocess the

RE: [SAtalk]

2003-11-19 Thread Larry Gilson
Hey Mike, > -Original Message- > From: MIKE YRABEDRA > Sent: Wednesday, November 19, 2003 8:55 AM > To: SPAMASSASSIN > Subject: Re: [SAtalk] > > > on 11/17/03 3:13 PM, Michael Weber at [EMAIL PROTECTED] wrote: > > > I've had a rule filtering out that font color for several > > > mont

Re: [SAtalk]

2003-11-19 Thread Keith C. Ivey
Michael Weber <[EMAIL PROTECTED]> wrote: > I've had a rule filtering out that font color for several months > with no complaints. I tag it with the description "Spammers > favorite color" ;-) That should already be caught by HTML_FONT_INVISIBLE in SA 2.60, unless it's against a nonwhite backgro

Re: [SAtalk]

2003-11-19 Thread MIKE YRABEDRA
on 11/17/03 3:13 PM, Michael Weber at [EMAIL PROTECTED] wrote: > I've had a rule filtering out that font color for several months with no > complaints. I tag it with the description "Spammers favorite color" > ;-) Is this the proper way to do this? bodyWHITE_FONT /font color=\"#ff

Re: [SAtalk] mysql spamc ignores the email in mailling list

2003-11-19 Thread Matt Kettler
At 06:09 PM 11/19/03 +0800, Patrick T. Tsang wrote: From the maillog, I have checked that spamd has successfully filtered the mail at first. However, spamd only check email using the last email address found in the mailling list and check against the user-defined rules in Mysql. That is, it skips t

RE: [SAtalk] Re: URI database lookup feature (was Sanity checking new uri rules?)

2003-11-19 Thread Carl R. Friend
On Tue, 18 Nov 2003, Larry Gilson wrote: > Most of you guys can get over my head quickly. Read, learn, and exceed us. :-) > This sounds a lot like the squidGuard blacklist implementation. You start > with a base text file - one each for domains, urls, and regex. It is up to > each the a

[SAtalk] mysql spamc ignores the email in mailling list

2003-11-19 Thread Patrick T. Tsang
Hello, I am trying to put all user-defined rules in Mysql. It is working fine until I find a problem. >From the maillog, I have checked that spamd has successfully filtered the mail at first. However, spamd only check email using the last email address found in the mailling list and check against

Re: [SAtalk] why won't changing the display language work ???

2003-11-19 Thread Samuel Murez
Justin Mason wrote: > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA1 > > > "Samuel Murez" writes: >> Matt Kettler wrote: >>> At 01:12 AM 11/18/03 +0100, Samuel Murez wrote: Hello-- Could somebody please take just a minute to tell me how to do this ? It seems very

[SAtalk] Need help with a simple custom rule

2003-11-19 Thread Robert Davidson
Hi everyone, I set up a SpamAssassin system for a company but they alerted me to a problem today. They have content filtering rules to stop people from abusing their employees. Basically any e-mails with naughty words are given 50 points and are stuffed into quarantine. The below rule is cau