Hello Paul,
Wednesday, November 5, 2003, 10:15:17 AM, you wrote:
PH> Problem is paranoia about blocking legit mail (not so
PH> much on my part but my bosses).
Paul, my MTA blocked email returns messages like this:
550 5.7.1 SPAM Domain blocked - See
http://nospam.ourdomain.com/
The text on the
CORRECTION TO RULES:
Matt, I liked your rules and added them to my system and ran
a debug, and it reported the following error:
error> Bareword found where operator expected at rule
error> MY_USELESS_S, line 1, near "/<\/s>/I" (Missing
error> operator before I?) Failed to compile body
error> Spam
Hello Blake,
Wednesday, October 29, 2003, 6:53:41 AM, you wrote:
BTG> Also, any given email in my SPAM folder will only go
BTG> through sa-learn a maximum of 7 times. But this should
BTG> not matter. Question: Since once it's learned once,
BTG> sa-learn ignores it, right?
It depends on the size
Hello Blake,
Tuesday, October 28, 2003, 7:27:20 PM, you wrote:
BTG> I have two imap folders HAM and SPAM. SA 2.6 moves incoming spam as it
BTG> finds it into SPAM. I have a cron job that runs sa-learn ham/spam
BTG> nightly on these two folders.
BTG> 2 - I have a ton of emails in SPAM. Is
Hello Matt,
Thursday, October 16, 2003, 3:16:42 PM, you wrote:
MVG> Abigail, thank you for your suggestions.
MVG> The only files I have in the .spamassassin directory are
MVG> auto-whitelist
MVG> auto-whitelist.db
MVG> bayes_seen
MVG> bayes_toks
MVG> user_
Hello Matt,
Wednesday, October 15, 2003, 12:23:21 PM, you wrote:
MVG> Does the Bayesian filtering stop working if the
MVG> database becomes too lopsided?
It stops working if the database becomes corrupted, which
can happen in various ways. The first thing you should do is
look in your .spamassas
Hello German,
Friday, October 3, 2003, 8:11:15 AM, you wrote:
GS> Hi list, i have some questions about sa-learn.
GS> It is possible to run sa-learn while spamd is running?
GS> It is possible to run sa-learn --rebuild while spamd is running?
Yes.
-Abigail
---
Hello Mike,
Friday, October 3, 2003, 5:36:27 AM, you wrote:
MC> Out of curiosity, what is the highest scoring anyone has seen SA give a
MC> message? I had one come through at 37.54 the other day.
I regularly see messages over 40 - for example, yesterday's
log shows:
Subject: [Spam Score: 42.40
Hello Scott,
Tuesday, September 30, 2003, 12:58:44 PM, you wrote:
SR> Malte S. Stretz wrote:
>> kill -HUP should work with SpamAssassin 2.60 under Perl 5.6.1 and up. I
>> heard that it doesn't work for some people though. Just have a try.
SR> Let me clarify: When I made a change to `local.cf'
Hello John,
JS> Abigail,
JS> If a user puts this recipe into their .procmail file,
JS> where would the log entries be collected. (Sorry, but
JS> I'm a procmail newbie) Thanks for the recipe.
A log file is specified in the procmailrc file.
Here are some tutorials:
http://www.devshed.com/Server
Here's the issue:
System: Running SA 2.54, FreeBSD Unix, Berkeley DB 1.85
(Hash, version 2):
Problem: When bayes_toks grows to more than 5K, it becomes
corrupted during sa-learn and ultimately trashed or lost.
My solution: Set bayes_expiry_max_db_size to lower level to
force expiry, so that baye
Hello Stephen,
Tuesday, September 23, 2003, 3:09:51 PM, you wrote:
SR> h, i still don't understand why SA is not even looking at them
SR> though see's everything else?
Because the 150K attachment that comes with Swen is either
too big to be sent to SA (depending on how you have
configured
Hello Stephan,
Tuesday, September 23, 2003, 12:17:18 PM, you wrote:
SvH> with 'subject_tag *SPAM* (_HITS_)' in local.cf
SvH> i get the score in the subject
SvH> now with this spam result
SvH> X-Spam-Status: Yes, hits=5.8 required=5.0 tests=CLICK_BELOW,EXCUSE_10,
SvH>
Hello Mike,.
MK> For myself...I will make it so a single line of "PEN?S
MK> ENLARGEMENT" is enough to trigger as spam.
The value of SA is that it can be customized for individual
user needs, and that it is easy to change scoring, as well
as to write your own rules.
I also have some words and phr
Hello Mike,
Monday, September 22, 2003, 1:47:50 PM, you wrote:
MK> In response to my complaint of weak rules out of box:
Mike, the value of Spamassassin is its ability to weight
based on a combination of factors, rather than simply delete
email based on single words or phrases. Words that seem
s
Hello Mike,
Sunday, September 21, 2003, 11:14:58 PM, you wrote:
MS> We are using Sendmail under Linux and Apache 1.3.28. The path is
MS> /usr/sbin/sendmail.
Are you using procmail?
-Abigail
MS> -Original Message-
MS> From: Abigail Marshall [mailto:[EMAIL PROTECTED]
MS&g
Hello Mike,
Saturday, September 20, 2003, 6:31:39 PM, you wrote:
MS> Any tips on how to auto-delete spam based on score without deleting all
MS> spam?
MS> Criteria:
MS> Mark anything scoring 5 or above as Spam. (already doing that)
MS> Delete anything scoring 15 or above FROM THE SERVER. (how?)
Hello up,
Thursday, September 18, 2003, 7:07:05 PM, you wrote:
u3a> On Thu, 18 Sep 2003, Daniel Quinlan wrote:
>> up <[EMAIL PROTECTED]> writes:
>>
>> > This is perl, version 5.005_03 built for i386-freebsd
>> >
>> > Not sure which DB module is installed...perl -V doesn't say...I presume
>> >
u3a> On 18 Sep 2003, Daniel Quinlan wrote:
>>
>> Which Perl DB module and perl version are you both using?
u3a> This is perl, version 5.005_03 built for i386-freebsd
I'm using perl 5.6.1/i386-freebsd
-Abigail
---
This sf.net email is s
Hello up,
Thursday, September 18, 2003, 11:51:42 AM, you wrote:
u3a> The last time this happened, the only way I could get sa-learn to start
u3a> working again was to remove _journal, _msgcount, _seen and _toks, which
u3a> presumably wipes out all existing bayes data. Is there a better way?
Hello Jeff,
Thursday, September 18, 2003, 1:01:29 PM, you wrote:
JF> So what does the average person set for the threshold of largest message
JF> scanned by SA. Right now I'm at 32768 bytes. How large is it safe to
JF> go???
Depends on your system and volume of email.
Right now I've been run
Hello Mitch,
Thursday, September 18, 2003, 10:15:26 AM, you wrote:
MW> In my original post I'd asked if there was a way to whitelist or something -
MW> maybe consider this test authoritative if it succeeds - cut down on the
MW> effort - 80% of my mail is inter-client, about 20% outside - which is
Hello Jennifer,
Tuesday, September 16, 2003, 6:47:13 AM, you wrote:
JF> Is there a way with SA to generate a report every day (and email to
JF> admin - me) with what spam it stopped? I wasn't sure if SA had an
JF> option or if I had to use third party software.
Simply set up logging and then
Hello Kristian,
KK> There is need for a 100% automated reporting mechanism that
KK> integrates with _all_ ISPs, uses a documented standard protocol
KK> so that there can be a lot of independent implementations that
KK> are nonetheless interoperable, and that are part of the system
KK> management
Hello Kristian,
KK> My point was that there is no mechanism to propagate your
KK> findings back to the source, either to the owners of these
KK> machines or any of their upstream providers.
When I first spotted the problem IP's, I sent emails to the
abuse departments at the various ISP's alerting
KK> There is currently no mechanism at all
KK> that is part of the Internet which can lock out machines that
KK> are dangerous or detrimental to the functions of the network.
KK> There are no processes in place that identify users of infected
KK> systems and keep them off the network.
Actually, t
Hello David,
Friday, September 12, 2003, 11:04:28 AM, you wrote:
DBF> On Thu, 11 Sep 2003, Abigail Marshall wrote:
>>
>>
>> I don't know but I have the same problem. It seems to
>> happen when my bayes_toks file reaches about 5k.
>>
>> So far
Hello Steven,
Friday, September 12, 2003, 6:11:10 AM, you wrote:
SWO> that I can just add?
1. Spamassassin did a good job of stopping Sobig.F without
any extra rules, as it apparently ran afoul of other
recipes.
2. SobigF expired on September 10th. There may be a few
errant worms floating aroun
abmc> I am starting over, and need to "clear" or "untrain" the database of
abmc> whatever incorrect info it has in it, but the sa-learn man page doesn't seem
abmc> to have a specific option for clearing all information and starting over,
abmc> other than the expiration. Is "sa-learn --rebuild --for
Hello Carlo,
Thursday, September 11, 2003, 4:35:22 AM, you wrote:
CW> Ok, I re-learned most of it :/
CW> Does anyone have an idea why it can happen that
CW> this database loses its content?
I don't know but I have the same problem. It seems to
happen when my bayes_toks file reaches about 5k.
>> Can anyone explain why deleting the database seemed to fix it's
>> learning? Is it just a corrupt database or something I am liable to hit
>> again further down the track?
JM> It must have learned those Message-IDs before. It will not learn the same
JM> message ID twice.
OK, here's the deal.
Hello Pat,
Wednesday, September 3, 2003, 2:03:39 PM, you wrote:
PT> Ok - I've replace FormMail with NMS FormMail Version 3.09c1. It appears
PT> to run fine, but Spamassassin likes it even less. The old version gave
PT> me these errors:
Since you presumably only want the output from YOUR Formm
Hello myname,
Friday, August 22, 2003, 10:33:44 PM, you wrote:
m> Since I control the server where the mails are intitally received I
m> can just block these spammers at the gate. I will get a list of all
m> domains in the mail from , and create an Obviously spam domain list and
m> then block
Hello Paul,
Wednesday, August 20, 2003, 8:37:30 PM, you wrote:
PA> This has happened a few times: when a message is retrieved from the
PA> upstream POP server with a large attachment (100K), my local copy of SA
PA> takes 50 seconds or so to process it. I am using Procmail to filter
PA> deliver
Hello Daniel,
Wednesday, August 20, 2003, 9:09:09 AM, you wrote:
DK> I am looking for documentation on how to configure
DK> Spamassassin to delete all messages marked as spam
DK> instead of the header change. I spoke to the partners in
DK> company on the risk of doing this, however they have
DK>
YD> There are only 2
YD> places in the whole world that get denied at the MTA here and SBC is the
YD> only one of them that got there by spam. My feelings for them cannot be
YD> expressed without spilling blood. I'm going to shut up now before I
YD> start sounding like a raging nanae-ite :)
Why d
YD> if I really wanted it I would
YD> just subscribe abcdefghijklmnopqrstuvwxyz@ and have the spammer supply
YD> me with a free key in every message but I don't think that's quite fair
YD> play.
You are worried about "fair play" with spammers
The real irony is that you are worried about "fair
Saturday, August 2, 2003, 12:49:08 PM, you wrote:
FA> (I'm not sure if this subject has been discussed before, as i'm not
FA> following the list all the time)
FA> How about separating the rules from the SpamAssassin distribution
FA> itself, and offer them as a separate package? This would be simi
Hello John,
Friday, August 1, 2003, 7:34:57 AM, you wrote:
JB> Hi,
JB> I'm running Amavisd 20030616 and Spamassassin 2.55. The headers
JB> include the SA tests that were triggered but is there a way to include the
JB> score that was associated with each test to the header or log?
Yes.
Hello Ian,
Thursday, July 31, 2003, 2:55:29 PM, you wrote:
ID> Curious why SA would have default rules defined (CLICK_BELOW, AWL) that have a
ID> score of 0.00? Why bother with the overhead of these if the scores are 0?
ID> I've seen a few others come in with AWL at 0.00 and just ignored them b
Hello Rich,
Wednesday, July 30, 2003, 4:20:52 PM, you wrote:
RP> I've been pondering an idea for an improvement to SA. Would anyone else
RP> find the following to be useful:
RP> report_safe_attach_threshold -- set threshold above which a mail has to
RP> score to have report_safe level 1 appl
ID> When I run sa-learn on known spam/ham, I get output like this:
ID>
ID> ..
ID> Learned from 4 messages.
ID> And then it just hangs there, it never completes. No other output, nada.
ID> Any ideas
Hello Giles,
Tuesday, July 29, 2003, 4:07:58 PM, you wrote:
GC> sa-learn suddenly failingWhenever I run sa-learn now I get the message:
GC> Cannot open bayes_path $HOME/.spamassassin/bayes R/O:
GC> Cannot open bayes_path $HOME/.spamassassin/bayes R/W: File exists
Have you run sa-learn in debu
Hello Matt,
Friday, July 25, 2003, 8:53:28 AM, you wrote:
MK> How much memory does your system have?
MK> Bayes can be a pretty substantial memory hog..
I found out what the problem was - just thought I would
share it.
What happens is that I use procmail to catch spam from some
spam-trap addr
Hello Matt,
Friday, July 25, 2003, 8:53:28 AM, you wrote:
>I did run sa-learn --build (even
>>before I posted), and that didn't seem to do any good.
>>
MK> How much memory does your system have?
MK> Bayes can be a pretty substantial memory hog, particularly if your
MK> mailserver is limping
Hello Malte,
MSS> On Friday 25 July 2003 04:06 CET Abigail Marshall wrote:
>> My procmail.log is full of entries like this:
>> >[...]
>> > Cannot open bayes_path //.spamassassin/bayes R/W: File exists
>> > Cannot open bayes_path //.spamassassin/bay
Hello Matt,
Thursday, July 24, 2003, 8:20:58 PM, you wrote:
MK> Sounds like you need locking to keep there from being an infintite number
MK> of simultaneous instances of spamassassin.
MK> You should have something like this:
MK> :0fw: spamassassin.lock
MK> * < 256000
MK> | spamassassin
Matt
My procmail.log is full of entries like this:
> procmail: Rescue of unfiltered data succeeded
> Out of memory!
> procmail: Program failure (1) of "/usr/local/bin/spamassassin"
> procmail: Rescue of unfiltered data succeeded
> Out of memory!
> procmail: Program failure (1) of "/usr/local/bin/spamas
Hello Turgut,
Thursday, July 24, 2003, 5:31:37 AM, you wrote:
TK> Perhaps if the sender has a .BIZ domain that could be a rule?
I have one that I've been using for some time that activates
if the body contains a LINK to a .BIZ domain:
body BIZ_SITE /.*\.biz/i
score BIZ_SITE
YD> That will work, but if everyone starts doing it then spammers will start
YD> forging X-Spam-Status lines into their spam. The idea is good but that
YD> implementation is trivially defeated.
YD> To make it a little more spammer-resistant I would add version_tag
YD> something to local.cf and adj
SWO> I want a recipe for /etc/procmailrc which conditionally runs a message
SWO> through spamc *only* if it hasn't already been processed by SA. I want to
SWO> use the X-Spam-Status and/or the X-Spam-Flag headers.
OK, try this:
:0fw
* < 256000
* ! ^X-Spam-Status:
| spamc
(The exclamation poi
Steven,
Try putting the recipe that is in your personal .procmailrc
at the end of the main /etc/procmailrc - then the mail will
be sent to the $SUSPECT file BEFORE going to your individual
POP boxes.
-Abigail
Sunday, July 13, 2003, 3:41:50 PM, you wrote:
SWO> I have an account on my server for
Hello Matt,
Wednesday, July 9, 2003, 6:36:03 PM, you wrote:
>>
>> > 4.0 (Medium),
>>
>>Oww.
>>
>>These three settings are going to give you false positives galore.
MK> 4.0 isn't all that bad.. according to STATISTICS.txt 4.0 should give you
MK> 0.44% FP rate in v 2.54, which is a lot more tha
SB> Yes, SA does use a lot of memory - about 20MB, but the amount of memory
SB> doesn't really change based on the message size, which was why I was
SB> expressing surprise. It takes *longer* to scan a larger message, but
SB> compared to the static overhead of 18MB for the libraries and regex's t
>> both because it is inefficient and because
>>viruses often have very large binary attachments which can
>>cause SA to crash with an out of memory error, and let the
SB> Huh ? Never had that happen to me. I use the default max scanning size of
SB> 256KB with spamc/spamd and I've never had a pr
Hello William,
Tuesday, July 8, 2003, 11:44:00 PM, you wrote:
NW> What is a Wiki?
NW> Bill Nichols
See http://wiki.org/wiki.cgi?WhatIsWiki
---
This SF.Net email sponsored by: Parasoft
Error proof Web apps, automate testing & more.
Download
RM> If someone can come up with a good method of discussing/exchanging custom
RM> rules that won't seriously impact the value of this basic list, I have
RM> some resources available at menschel.net we can use for that purpose.
A Wiki is one of the easiest ways to set up space for
collaborative con
Hello Benjamin,
Tuesday, July 8, 2003, 2:58:52 PM, you wrote:
BT> This error message (the one I cut and pasted)
BT> was actually generated when I ran sa-learn --rebuild. But it seems to
BT> happen at other times, too.
BT> Cannot open bayes_path /home/spamc/.spamassassin/bayes R/W: File
GD> I'm trying to block all the annoying SoBig viruses - so I have the
GD> following:
GD> body SO_BIG_VIRUS /Please see the attached zip file for details\./
GD> score SO_BIG_VIRUS 6.0
GD> header SO_BIG_ATTACHMENT ALL =~ /your_details\.zip/
GD> score SO_BIG_ATTACHMENT 3.0
The title is actually in
Hello SpamAssassin,
Monday, July 7, 2003, 4:22:15 PM, you wrote:
S> Anyone have an idea of the Mail::SpamAssassin
S> memory requirements?
S> I realize it will vary depending on configuration /
S> options / rules / ... in use.
S> (SpamAssassin 2.55 on a per user install
S> through IMAPAssassi
Hello Mike,.
MV> Q1.
MV> Does a configuration exist (mailscanner, or such utilities) that would allow
MV> one to do a standard reject based on the hit score? Based on my existing
MV> setup, by the time the message goes through SA via spamc, it is already out of
MV> postfix. I assume that means t
Hello Doug,
DW> Thanks Abigail. I am working with procmail. I am new to procmail though. I
DW> found that when I try to set my re-directed spam to a file folder in
DW> /var/mail instead of my home directory, it doesn't work. What I wanted to
DW> do was write it to a file called spam that coul
Saturday, July 5, 2003, 10:36:15 AM, you wrote:
SA> Over the past several weeks, I've noticed an increasing amount of
SA> spam that is getting through SpamAssassin with scores in the 4.0-4.9
SA> range. This makes me wonder if perhaps some spammers have started to
SA> taylor their spams as follows
Hello Doug,
Saturday, July 5, 2003, 5:55:39 AM, you wrote:
DW> How can I get this to rewrite ALL subjects -- even those emails that do
DW> not get filtered out?
DW> I'd like all email subjects to contain this string -- at least for a while
DW> so I can get a handle on things.
You'll find a l
JM> What I'm wondering is if there is a way to have the
JM> Subject changed to states Probable Spam or some other meaningful
JM> indicator instead of the original subject.
John, in your local.cf file put the following:
rewrite_subject 1
subject_tag PROBABLE SPAM: (or write in whatever
>>
>> OK, I'm curious. How do you suggest this can be done using
>> MailMan 2.0.9? as far as I can see, there's no way to filter
>> out attachments.
>>
TH> Main menu, select 'content filtering',
TH> This mailman 2.1.(something) though.. Not sure if it's the same in 2.0.9.
Tony, that menu i
Hello Jim,
Friday, July 4, 2003, 5:38:36 AM, you wrote:
JF> On Fri, Jul 04, 2003 at 04:15:31AM -0700, Abigail Marshall wrote:
>> Actually, I think the spam-from-yourself routine is a trick
>> that is created by the sending software, so that everyone is
>> getting spam f
Hello Jim,
JF> Yes, I've also been getting spam addressed from myself.
Actually, I think the spam-from-yourself routine is a trick
that is created by the sending software, so that everyone is
getting spam from themselves -- so for those particular
spams, others are probably not getting that. S
BAS> Besides, comparing spam to viruses is a bit like apples and
BAS> fruitcakes. Only without the fruit or the cake.
Sobig.E. is a virus designed to create a backdoor trojan on
a system to send out SPAM. Get it? The particular virus that
this list is dissemminating 3 or 4 times a day to possibly
JM> OK, I'm curious. How do you suggest this can be done using MailMan 2.0.9?
JM> as far as I can see, there's no way to filter out attachments.
I use Mailman 2.0.13, so it's possible that it has a
feature that 2.0.9 doesn't - in which case they really ought
to upgrade, given the fact that Mailm
Hello Jason,
Thursday, July 3, 2003, 7:45:31 PM, you wrote:
JH> On Thu, Jul 03, 2003 at 10:29:47PM -0400, Shaun T. Erickson wrote:
>> So, no rant from me, but I *do* think the list admin (or the admin of
>> the system that hosts the list) should be making every attempt to block
>> virii from
BA> Sure, if the people who administer the list also administer the mail
BA> system upon which the list depends. For [SA-Talk], this is not the case.
I find that hard to believe. How did this list get set up?
For any list running on Mailman, a list administrator also
has direct access to the inter
>> You know the old saying, if you don't have something constructive to
>> say..
>>
BAS> ...whine about it on a list.
I'm hoping to maybe get the list administrator's attention,
since this is such an easy fix. I will be glad to tell the
list administrator exactly how to prevent this and othe
SB> Well I belong to a lot of mailing lists, and I'm not aware of any of them
SB> that have actual virus scanning and blocking facilities.
I RUN a lot of mailing lists, and EVERY SINGLE ONE OF THEM
has a mechanism to stop most viruses. The most sensible is
to disallow attachments, but if attachm
Hello Rick,
Thursday, July 3, 2003, 12:58:49 PM, you wrote:
RB> Don Krause wrote:
>> How can "PENIS" be offensive? It's a medically correct term.
>>
>> Just offer to turn off SA for those who are so easily offended. I'm sure
>> they'd prefer PENIS to the content of the actual mail.
RB> Yes,
This is really unacceptable.
There is NO reason that this virus can't be filtered from
this list - it is a simple regexp to get rid of it.
It makes no sense that people who develop software like
Spamassassin can't figure out how to stop a simple virus
that ALWAYS has the same line of text plus an
Hello Robert,
RM> Ah, but you see, I didn't test your message -- I tested an identical
RM> message that reached me here directly from the spammer
RM> The email I received here was both text and html. The HTML was
RM> effectively empty -- it had the following tags: html, head, title, /title
RM> (n
Hello Robert,
Wednesday, July 2, 2003, 6:16:03 PM, you wrote:
AM>> This spam had a 0 score, SA 2.54... wondering how it got
AM>> through - it is full of lots of words about weight loss and
AM>> all caps words like GUARANTEED, FREE - no HTML though, just
AM>> plain text:
RM> It scored 6.2 here,
>
Hello Ross,
Wednesday, July 2, 2003, 8:26:43 AM, you wrote:
RV> On Tue, Jul 01, 2003 at 09:51:24PM -0700, Abigail Marshall wrote:
>> Subject: Why are so many people losing weight on Atkins?
>> X-Spam-Status: No, hits=0.0 required=4.0
>> tests=none
>> v
Hello Jay,
Tuesday, July 1, 2003, 7:52:42 PM, you wrote:
>> qualify for. See http://www.geocities.com/kl3434us/ North
>> American Association of Unaccredited Colleges and
>> Univerisities (sic) [No, that's not a joke site - it's real]
JL> Actually, yes, it is a joke site. Not only are the ind
This spam had a 0 score, SA 2.54... wondering how it got
through - it is full of lots of words about weight loss and
all caps words like GUARANTEED, FREE - no HTML though, just
plain text:
Return-Path: <[EMAIL PROTECTED]>
Received: from b6.e-i1.com (b6.e-i1.com [63.251.54.86])
by [domain]
Hello Klaus,
I think what you have is culture clash - you are
encountering some things that are very common in the US, but
perhaps not so well known in Germany:
KH> # describe PREST_NON_ACCREDITED 'Prestigious Non-Accredited Universities'
KH> "Prestigious" and "non-accredited" don't seem to fi
It seems to me that SA comes with language options that will
print test descriptions in languages other than English,
i.e., you can opt to have the test that is giving offense
here described as "Spiega come aumentare le dimensi
oni del proprio pene" - I would assume by choosing
appropriate language
Hello Martin,
>> I am using a very simple and standard FormMail form on my website and
>> forms sent to me from my own web site are getting marked as spam!
>>
Look at the headers of the feedback form; since it comes from your
own site it will probably have the site user ID and/or IP in
one of th
>> This seems like it is about to become an accidental denial of service
GD> attack
>> on this mailing list. Might be a good idea to find a way of preventing
GD> this
>> before people who don't like SA catch on...
>>
Pretty easy, actually.
The list manager should
1. Upgrade Mailman. (they are ru
RP> I'm willing to bet that it's probably still within the court system, and
RP> within mostly one state on top of that. ;-)
Florida? (Just hazarding a guess)
RP> Just proving these losers are
RP> exploiting open proxies the world over is the very difficult part.
RP> Depending on how your ch
Hello David,
Monday, June 23, 2003, 9:16:52 PM, you wrote:
DC> Technically speaking you could go after the
DC> spammer/spamvertized site for identity theft and
DC> defamation of character. In fact I wouldn't hesitate,
DC> you have nothing to loose.
Er, the ones that keep doing this to us seem to
HH> Not SA, but you people are my spam experts...
HH> I'm getting a BUNCH of bounces where someone has used a return address
HH> that returns to me. This address is commonly used by spammers (it's an
HH> invalid address here, but I get all the mail with invalid usernames). The
HH> mail is promotin
I need help figuring something out.
I'm managing email on a server in an inhouse, company
environment. Many users on system, but all are using the
system for company business, so basically we will have very
similar spam vs. ham issues.
I was frustrated because the autolearn Bayes files seemed to
>> > >
>> > > http://www.spamhaus.org/sbl/
>> > >>From my own experience above and their own description on this site, it
>> > > sounds like the SBL is fairly safe and not abusive like other DNSBL's in
>> > > the past have been accused of. Would anyone else agree that the SBL is
>> > > generally s
Hello Daniel,
Wednesday, June 18, 2003, 11:17:06 PM, you wrote:
DQ> Well, the rule (renamed in 2.60-cvs) does false positive about 0.03% of
DQ> the time:
Thanks for the detailed explanation. I think the nice thing
about SA is that it is user customizable - a false positive
rate of more than 0.
Hello Robin,
RW> Indeed. From now on such messages have a one-way ticket to
RW> the spam pit:
RW> score BASE64-ENC-TEXT 100.0
Hmm, given Alain's comments, it might be better to simply
assign a score close to the default spam thresshold for your
system, for reasons I will detail below.
RW>
AF> On Thu, Jun 19, 2003 at 01:54:26PM +1000, Robin Whittle
AF> wrote:
>> Thanks for this Abigail:
>>
>> > I have yet to see a
>> > *valid* email that is Base-64 encoded.
>>
AF> Lucky you. I see quite a few. The crappy e-mail client "Incredimail"
AF> that is unfortunately quite popular likes t
RW> Does this mean that SpamAssassin is blind to the contents of base-64
RW> encoded HTML?
Apparently so; but it does correctly identify the email as
being base-64 encoded. I would simply recommend that you
raise the score in the local.cf file for the SA test
BASE64_ENC_TEXT to near or above your
>> [EMAIL PROTECTED] wrote:
>>
>>> 2) Can anyone run the spam below against a vanilla ruleset, 2.5[45]
>>> and/or 2.6, and let me know if this spam should have been caught under
>>> 2.54?
>>
Bob,
The reason the spam in your case bypassed SA but got caught
when you had others run it is here:
> X-
>> [EMAIL PROTECTED] wrote:
>>
>>> 1) SA Developers: PLEASE provide some method whereby end-users like me
>>> can implement header, body, and uri rules in user_prefs.
You can implement rules by adding them to the local.cf file;
here's an example of a ruleset for body:
body BODY_PLING /\!
96 matches
Mail list logo
