RE: [SAtalk] test

ing in the archive at gmane.org so who knows. If y'all are in the eastern US, enjoy the snow... cheers, Colin Colin A. Bartlett Kinetic Web Solutions www.kineticweb.biz --- The SF.Net email is sponsored by EclipseCon 2004 Premiere Conference

RE: [SAtalk] Re: Meta-tripwire idea

ably should ask this on an Outlook list. If such a thing even exists... cheers, Colin Colin A. Bartlett Kinetic Web Solutions www.kineticweb.biz --- The SF.Net email is sponsored by EclipseCon 2004 Premiere Conference on Open Tools Developme

RE: [SAtalk] whitelist problems

This is a top post. Sue me. Just to point out the obvious, did you restart spamd or mimedefang after adding the lines to your CF file? BTW, in my experience, 2 points is way to low to be considered spam. But YMMV of course. cheers, Colin Colin A. Bartlett Kinetic Web Solutions

RE: [SAtalk] Re: Meta-tripwire idea

ably should ask this on an Outlook list. If such a thing even exists... cheers, Colin Colin A. Bartlett Kinetic Web Solutions www.kineticweb.biz --- The SF.Net email is sponsored by EclipseCon 2004 Premiere Conference on Open Tools Developme

RE: [SAtalk] New Ruleset Available!!! TRIPWIRE! You don't want to miss this o ne!

NK YOU! I'll keep an eye out for FPs but these look pretty stable. cheers, Colin Colin A. Bartlett Kinetic Web Solutions www.kineticweb.biz --- This SF.net email is sponsored by: Perforce Software. Perforce is the Fast Software Con

RE: [SAtalk] ... SA 2.61 eats mails ...

n. :) I was at first flabbergasted when I read Kai's response. Then, of course, not everyone's English is up to the same caliber as ours. That may or may not be the case here, but we should always keep in mind that some folks may not know the best wording and may not realize what "

RE: [SAtalk] AWL casuing false positives

Matt Kettler Sent: Friday, December 12, 2003 11:16 AM > At 10:10 AM 12/12/2003, Colin A. Bartlett wrote: > >I have found that AWL works quite well and I keep it enabled. The only time > >that it is a pain is if I send myself or someone else a test using GTUBE. > >That f'

RE: [SAtalk] AWL casuing false positives

f's up the AWL until I send a few hams. There's a way to remove the sender from the AWL but I could never be bothered. As to how to turn it off, check the docs. cheers, Colin Colin A. Bartlett Kinetic Web Solutions www.kineticweb.biz ---

RE: [SAtalk] BIG HUGE EVIL RULE NEWS!!!!

It could just be a few people in the inner circle here. cheers, Colin Colin A. Bartlett Kinetic Web Solutions www.kineticweb.biz --- This SF.net email is sponsored by OSDN's Audience Survey. Help shape OSDN's sites and tell us what

RE: [SAtalk] BIG HUGE EVIL RULE NEWS!!!!

#x27; server brought to its knees. I could of course host a mirror. cheers, Colin Colin A. Bartlett Kinetic Web Solutions www.kineticweb.biz --- This SF.net email is sponsored by OSDN's Audience Survey. Help shape OSDN's sites and tel

RE: [SAtalk] user rules in Mysql

was done playing because I read in the docs someplace that this slows down processing. cheers, Colin Colin A. Bartlett Kinetic Web Solutions www.kineticweb.biz --- This SF. Net email is sponsored by: GoToMyPC GoToMyPC is the fast, easy and sec

RE: [SAtalk] Spam forward

he spamcorpus. much obliged, Colin Colin A. Bartlett Kinetic Web Solutions www.kineticweb.biz --- This SF.Net email sponsored by: ApacheCon 2003, 16-19 November in Las Vegas. Learn firsthand the latest developments in Apache, PHP, Perl, XML

RE: [SAtalk] Attachments

e wide config. Then just score it something higher on the individual users config file. Crew, am I wrong here? cheers, Colin Colin A. Bartlett Kinetic Web Solutions www.kineticweb.biz --- This SF.Net email sponsored by: ApacheCon 2003, 16-19

RE: [SAtalk] Detailed Scores in Header

_ version=_VERSION_ would add the scores, according to the documentation. I'm just guessing here, BTW. Just took a quick glance at the docs to this is what I deduced. Give it a shot. See, I was nice. I didn't even tell you to RTFM. :) cheers, Colin Colin A.

RE: [SAtalk] Is punctuation really needed? (fwd)

my desk? I cu!NT server > died today. I have a client who can NEVER seem to get spacing down. I don't know if he can't type well or what but he always misses spaces after sentences, never uses the right punctuation, etc. Much like this example above. I can see a rule like this re

RE: [SAtalk] Automatic Unsubscribe

bscribing in general really does land you on spam lists. cheers, Colin Colin A. Bartlett Kinetic Web Solutions www.kineticweb.biz --- This SF.Net email sponsored by: ApacheCon 2003, 16-19 November in Las Vegas. Learn firsthand the latest develop

RE: [SAtalk] Delete spam mails

itrate/i describe SILDENAFIL_CITRATE Metions blue pill chemical name score SILDENAFIL_CITRATE 3.91 cheers, Colin Colin A. Bartlett Kinetic Web Solutions www.kineticweb.biz --- This SF.Net email sponsored by: ApacheCon 2003, 16-1

RE: [SAtalk] [RD] spam sentences

or change your rules manually for 100% accuracy. cheers, Colin Colin A. Bartlett Kinetic Web Solutions www.kineticweb.biz --- This SF.Net email sponsored by: ApacheCon 2003, 16-19 November in Las Vegas. Learn firsthand the latest development

RE: [SAtalk] Is punctuation really needed? (fwd)

eers, Colin Colin A. Bartlett Kinetic Web Solutions www.kineticweb.biz spamsentence.cf Description: Binary data

RE: [SAtalk] Automatic Unsubscribe

Colin A. Bartlett Sent: Tuesday, October 14, 2003 2:06 PM > I was curious as to how many spams actually had unsub links. So I flipped > through my last 40 SA flagged messages. I setup a honeypot address and it's > the only address I submitted to any of the unsub pages. Here is the

RE: [SAtalk] Multiple spaces on subject line (4+)

t; > "Re: Hydrocodoneb2cbr333" Yes, it's called SUBJ_HAS_SPACES. See http://www.spamassassin.org/tests.html. cheers, Colin Colin A. Bartlett Kinetic Web Solutions www.kineticweb.biz --- This SF.net email is sponsored by:

RE: [SAtalk] OT : Antivirus ?

ommand line with procmail should work fine. cheers, Colin Colin A. Bartlett Kinetic Web Solutions www.kineticweb.biz --- This SF.net email is sponsored by: SF.net Giveback Program. Does SourceForge.net help you be more productive? Does it help

RE: [SAtalk] ok to filter on this?

to a web version in case it's important that they see the emails. Although the wording is custom, the concept is the same. This is all legitimate mail so I'd hate to see a rule going around that filtered mail with this concept. cheers, Colin Colin A. Bartlett Kineti

RE: [SAtalk] Offsetting rules?

A-1.0 I've never done this myself but if I RTFM properly this seems to be the way to do what you want. I'm not sure that I'd reccomend this though. I get tons of legitimate real spam that hits both of those tests. cheers, Colin Colin A. Bartlett

RE: [SAtalk] Rule Emporium Update!

interested in what others thoughts are on this and I'll submit the rules to Chris for possible Emporium inclusion. cheers, Colin Colin A. Bartlett Kinetic Web Solutions www.kineticweb.biz --- This SF.net email is sponsored by: SF.net Giv

[SAtalk] [RD] spam sentences

han welcomed. I don't even know if I escaped the right characters. cheers, Colin Colin A. Bartlett Kinetic Web Solutions www.kineticweb.biz spamsentence.cf Description: Binary data

RE: [SAtalk] SA threshold.. how high?

just fine for me and since I get more spam and ham than any of my users I'm guessing it works fine for them too. No one has complained. That being said, my users can see their average spam score from our web interface and mine is actually 20. cheers, Colin Colin A. Bartlett Kineti

RE: [SAtalk] [RD] excessive table tags

rough as a FN. So I just increased the scores of your rules and that should do the trick. THANKS! cheers, Colin Colin A. Bartlett Kinetic Web Solutions www.kineticweb.biz --- This SF.net email is sponsored by: SF.net Giveback Program. Does Sou

RE: [SAtalk] Rule Emporium Update!

so I just commented it out on my local evilrules.cf file. cheers, Colin Colin A. Bartlett Kinetic Web Solutions www.kineticweb.biz --- This SF.net email is sponsored by: SF.net Giveback Program. Does SourceForge.net help you be more producti

RE: [SAtalk] Rule Emporium Update!

eat for me in the past few days to catch a handful of messages that would have slipped through otherwise. YMMV but enjoy. And by all means: I know about this much || about regex so all suggestions are MORE than welcomed. I don't even know if I escaped the right characters. cheers, Colin Col

[SAtalk] [RD] excessive table tags

ke these often? cheers, Colin Colin A. Bartlett Kinetic Web Solutions www.kineticweb.biz --- Begin Message --- As diswitbeeFor* R* E* R* L* I* R* S* I* T seecovhoun rgetedunhaemoowempresttrencrurn n oeryt depo agce nceve r boveorengteas ba n N thietrteingbod sewriloo sl hahene eck  BC,at ing

RE: [SAtalk] [RD] excessive table tags

compound / additive rules. That would really be great for rules like this. cheers, Colin Colin A. Bartlett Kinetic Web Solutions www.kineticweb.biz --- This SF.net email is sponsored by: SF.net Giveback Program. Does SourceForge.net help you be mo

RE: [SAtalk] Would this be the best way to turn off AWL?

n.org/doc/Mail_SpamAssassin_Conf.html Just set use_auto_whitelist to 0 in your /etc/mail/spamassassin/local.cf file. cheers, Colin Colin A. Bartlett Kinetic Web Solutions www.kineticweb.biz --- This SF.net email is sponsored by: SF.net Givebac

RE: [SAtalk] Avoid Double check

simple procmail recipe that checked for the presence of "X-Spam-Status" and if it wasn't there, passed it to SA. cheers, Colin Colin A. Bartlett Kinetic Web Solutions www.kineticweb.biz --- This SF.net email is sponsored by: SF.net G

RE: [SAtalk] tests not updated on the SA website?

g to do would be to navigate to your /usr/share/spamassassin directory and type: cat *.cf | grep OUTLOOK That should give you a list of all tests / config options that have OUTLOOK in them. And of course it's specific to your version because it's on your box. cheers, Colin C

RE: [SAtalk] HELP !!!! spamd using too much CPU !!

swap. Worked like a charm for me. cheers, Colin Colin A. Bartlett Kinetic Web Solutions www.kineticweb.biz --- This SF.net email is sponsored by: SF.net Giveback Program. Does SourceForge.net help you be more productive? Does it help you

RE: [SAtalk] Significant increase in spam lately

the last six weeks. cheers, Colin Colin A. Bartlett Kinetic Web Solutions www.kineticweb.biz --- This SF.net email is sponsored by: SF.net Giveback Program. Does SourceForge.net help you be more productive? Does it help you create better c

[SAtalk] outlook corpus?

my 16,000 spams as they are pretty varied, hand verified, and would be great for testing. cheers, Colin Colin A. Bartlett Kinetic Web Solutions www.kineticweb.biz --- This SF.net email is sponsored by: SF.net Giveback Program. Does SourceForge.

RE: [SAtalk] Duplicate postings. (clarification)

have been receiving many many duplicate posts. Seems to be a sf.net issue. A dozen people responded to me off-list that they too have the same problem. I would guess you are just seeing this, too? Maybe unrelated but I didn't know if you saw my post last week. cheers, Colin Colin A. Bartle

RE: [SAtalk] SpamAss is tagging my own emails

't Yahoo.com. If it's possible to change, you could set the 'from' address of each order to a static address. Say [EMAIL PROTECTED] Then use a whitelist_from preference so that no emails from [EMAIL PROTECTED] are ever tagged as spam. c

[SAtalk] [OT] duplicate messages

Not complaining just inquiring. cheers, Colin Colin A. Bartlett Kinetic Web Solutions www.kineticweb.biz --- This SF.net email is sponsored by: The SF.net Donation Program. Do you like what SourceForge.net is doing for the Open Source Community?

RE: [SAtalk] IP Blocks to kill at the firewall?

llsouth.net ([205.152.59.61]) by sc8-sf-mx1.sourceforge.net with esmtp (Exim 4.22) Fri, 24 Oct 2003 01:12:49 -0700 Weird. Different mailservers at bellsouth.net keep sending the same message? cheers, Colin Colin A. Bartlett Kinetic Web Solutions www.kin

RE: [SAtalk] [RD] yahoo redirect

this change would do the trick? Thanks. cheers, Colin Colin A. Bartlett Kinetic Web Solutions www.kineticweb.biz --- This SF.net email is sponsored by: The SF.net Donation Program. Do you like what SourceForge.net is doing for the Open Sourc

RE: [SAtalk] [RD] yahoo redirect

Patrick Morris Sent: Thursday, October 23, 2003 10:15 AM > Unless I'm reading this regex incorrectly: > /^https?\:\/\/rd\.yahoo\.com\/(?:[0-9]{4,}|partner\b|dir\b)/i > it's pretty specific about looking for "http[s]://rd.yahoo.com". Thanks. I wasn't sure of where to look for the regex for the rul

[SAtalk] yahoo redirect

matched: BAYES_44 HTML_FONT_INVISIBLE HTML_IMAGE_ONLY_02 HTML_MESSAGE MIME_HTML_ONLY MSGID_FROM_MTA_HEADER RCVD_IN_RFCI cheers, Colin Colin A. Bartlett Kinetic Web Solutions www.kineticweb.biz --- This SF.net email is sponsored by OSDN d

RE: [SAtalk] custom rules >> local.cf

Colin Colin A. Bartlett Kinetic Web Solutions www.kineticweb.biz --- This SF.net email is sponsored by OSDN developer relations Here's your chance to show off your extensive product knowledge We want to know what you know. Tell us and you ha

RE: [SAtalk] [OT] What is next step?

are some that don't mind sifting through their snail mail and determining for themselves what's junk and what's not. And they should be free to do so. Sometimes I prefer this free-market approach; other times, I just want to blow every spammer to tiny bits. cheers, Col

RE: [SAtalk] discarding mail

NSTALL You will need to your something like Procmail to decide what to do with the message. You can create a .procmailrc file in each users home directory that has the code at the bottom of the above howto. To delete emails, just replace $HOME/IMAP-$COMPANY/SPAM with /dev/null cheers, Col

RE: [SAtalk] slow list

ormance, right? cheers, Colin Colin A. Bartlett Kinetic Web Solutions www.kineticweb.biz --- This SF.net email sponsored by: Enterprise Linux Forum Conference & Expo The Event For Linux Datacenter Solutions & Strategies in The Enterprise

[SAtalk] slow list

redundant info. Anyone else have this problem or just sf.net just not like me? cheers, Colin Colin A. Bartlett Kinetic Web Solutions www.kineticweb.biz --- This SF.net email sponsored by: Enterprise Linux Forum Conference & Expo The Event For L

RE: [SAtalk] LOTS of mail being tagged wrong

g of each? cheers, Colin Colin A. Bartlett Kinetic Web Solutions www.kineticweb.biz --- This SF.net email sponsored by: Enterprise Linux Forum Conference & Expo The Event For Linux Datacenter Solutions & Strategies in The Enterprise Linux in

RE: [SAtalk] adding SPAM hits score to headers

sassin_Conf.html Add a line to local.cf file that says: subject_tag **SPAM** _HITS_ cheers, Colin Colin A. Bartlett Kinetic Web Solutions www.kineticweb.biz --- This SF.net email is sponsored by: SF.net Giveback Program. SourceForge.net hosts over 7

RE: [SAtalk] LOTS of mail being tagged wrong

. I would be better to have a well-trained Bayes and good scores rather than just high thresholds. cheers, Colin Colin A. Bartlett Kinetic Web Solutions www.kineticweb.biz --- This SF.net email is sponsored by: SF.net Giveback Program. Sou

RE: [SAtalk] Automatic Unsubscribe

as spam. In addition, many "unsubscribe" links are email-based opt-outs, which don't work for me. Since I give out a different email address to practically everyone, the auto-response wouldn't know which of my email addresses to send from. The idea's good, I just doubt it w

RE: [SAtalk] Popcorn, Backhair, and Weeds

know if I really need them anyway. My Bayes is working so well I very very very rarely get any false negatives as it is. But your rules just help boost the score a bit which will allow some of my users to change their thresholds up to eliminate false positives. Again, thanks. cheers, Colin Col

RE: [SAtalk] Too many rules?

f bandwidth. I would be glad to mirror. cheers, Colin Colin A. Bartlett Kinetic Web Solutions www.kineticweb.biz --- This SF.net email is sponsored by: SF.net Giveback Program. SourceForge.net hosts over 70,000 Open Source Projects. See the p

RE: [SAtalk] Automatic Unsubscribe

k about 10 minutes to go through about 40. cheers, Colin Colin A. Bartlett Kinetic Web Solutions www.kineticweb.biz --- This SF.net email is sponsored by: SF.net Giveback Program. SourceForge.net hosts over 70,000 Open Source Projects. Se

RE: [SAtalk] reporting the spam 'hosts"

on the image hosts, do you think that spammers will then just start to embed the images within their email? Certainly the bandwidth requirements become more costly then, but it doesn't seem like that would be a hard thing to do. Anyone know why spammers don't seem to do this much as i

RE: [SAtalk] Automatic Unsubscribe

ub Link: 8 I'll monitor the honeypot address and see where it goes. I too am curious. cheers, Colin Colin A. Bartlett Kinetic Web Solutions www.kineticweb.biz --- This SF.net email is sponsored by: SF.net Giveback Program. SourceForge.

RE: [SAtalk] Automatic Unsubscribe

as spam. In addition, many "unsubscribe" links are email-based opt-outs, which don't work for me. Since I give out a different email address to practically everyone, the auto-response wouldn't know which of my email addresses to send from. The idea's good, I just doubt it w

RE: [SAtalk] bad day

Jack Gostl Sent: Sunday, October 12, 2003 11:38 PM: > We run around 50%. And that's by count. With the MS worms flying in we > have noticably more spam by volume than real mail. Some quick queries of my spam stats log database say we're at over 75%. Landy and Jack you are lucky. I'm sure there ar

RE: [SAtalk] bad day

Colin A. Bartlett Kinetic Web Solutions office: 610-831-9030 x51 mobile: 215-292-2193 home: 215-292-2616 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Jack Gostl Sent: Sunday, October 12, 2003 11:38 PM To: landy Cc: SA Subject: Re: [SAtalk] bad day

RE: [SAtalk] bad day

he best because I can query the DB in any way I like to like. cheers, Colin Colin A. Bartlett Kinetic Web Solutions www.kineticweb.biz --- This SF.net email is sponsored by: SF.net Giveback Program. SourceForge.net hosts over 70,000 Open Source P

RE: [SAtalk] bad day

there are some among us who have even higher rates. My highest user gets 87% spam to his account. We have a web interface that has a graph with stats and such for each user. Right now mine says 82% spam, 252 avg per day. cheers, Colin Colin A. Bartlett Kinetic Web Solutio

RE: [SAtalk] bad day

nse -- an expense that many of my customers have been willing to take on. cheers, Colin Colin A. Bartlett Kinetic Web Solutions www.kineticweb.biz --- This SF.net email is sponsored by: SF.net Giveback Program. SourceForge.net hosts over 70

RE: [SAtalk] Using only one RBL

rit. Just a word of caution. cheers, Colin Colin A. Bartlett Kinetic Web Solutions www.kineticweb.biz --- This SF.net email is sponsored by: SF.net Giveback Program. SourceForge.net hosts over 70,000 Open Source Projects. See the people who ha

RE: [SAtalk] How does a message like this get through?

I don't think there is a test that specifically looks for those words with the parentheses. You might have to write your own test. Of course, if your running Bayes, these kinds of words are picked up as spamish by Bayes over time. cheers, Colin Colin A. Bartlett Kinetic Web Solu

RE: [SAtalk] How does a message like this get through?

I don't think there is a test that specifically looks for those words with the parentheses. You might have to write your own test. Of course, if your running Bayes, these kinds of words are picked up as spamish by Bayes over time. cheers, Colin Colin A. Bartlett Kinetic Web Solu

RE: [SAtalk] Question about whitelist NOT AWL

will be overwritten when you upgrade so it's best to operate out of /etc/mail/spamassassin. cheers, Colin Colin A. Bartlett Kinetic Web Solutions www.kineticweb.biz -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Stephen Bradley Sent: Wednesday, Octob

RE: [SAtalk] Question about whitelist NOT AWL

that will help or maybe you can paste the output here. cheers, Colin Colin A. Bartlett Kinetic Web Solutions www.kineticweb.biz -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Stephen Bradley Sent: Wednesday, October 08, 2003 5:46 PM To: '[EMAIL PROTECTE

RE: [SAtalk] Question about whitelist NOT AWL

will be overwritten when you upgrade so it's best to operate out of /etc/mail/spamassassin. cheers, Colin Colin A. Bartlett Kinetic Web Solutions www.kineticweb.biz -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Stephen Bradley Sent: Wednesday, Octob

RE: [SAtalk] SA's recently slowed down for me!

5-10 secs and it worked fine. But, as the previous reply mentioned, the problem is probably Orbs and Osirusoft which both don't existing and are timing out after 30 seconds. Disabling those would get the job done too. Hope that helps. cheers, Colin Colin A. Bartlett Kinetic We

[SAtalk] user_prefs delete option

ns or comments, they are welcomed. cheers, Colin Colin A. Bartlett Kinetic Web Solutions www.kineticweb.biz --- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.c

[SAtalk] RE: blacklist_to

me to it? Sorry for the ignorance. cheers, Colin Colin A. Bartlett Kinetic Web Solutions www.kineticweb.biz -Original Message- From: Colin A. Bartlett [mailto:[EMAIL PROTECTED] Sent: Wednesday, October 01, 2003 1:26 PM To: [EMAIL PROTECTED] Subject: blacklist_to Hello All, Been using

[SAtalk] blacklist_to

have. I would like if they (or I) could simply create a blacklist_to entry so that any email to the spammy address could have a huge score imposed upon it. Any idea why this feature doesn't exist? Any one else have the need? Any home-made work arounds? cheers, Colin Colin A. Bartlett K