Re: [SAtalk] mail with ONLY html

2003-01-14 Thread Jeremy Nixon
On Tue, Jan 14, 2003 at 12:00:41PM -0500, Ed Weinberg wrote: > I am surprised that email that just has html with no text does not score > higher. From '85 to 2002 I used an email client (Forte Agent) which did > not render HTML. I make the generalization that any email, with the > exception of n

Re: [SAtalk] a very smart spammer. (score only 1.6)

2003-01-07 Thread Jeremy Nixon
On Tue, Jan 07, 2003 at 04:03:23PM -0500, [EMAIL PROTECTED] wrote: > Check this message (scroll down until you see tag!) The copy of this spam that I got scored 7.7 against my filters. X-Spam-Status: Yes, hits=7.7 required=5.0 tests=CTYPE_JUST_HTML,HTML_PRE,MAILTO_LINK,ONE_PIXEL_IMG,

Re: [SAtalk] Goodbye

2003-01-07 Thread Jeremy Nixon
On Tue, Jan 07, 2003 at 12:06:13PM -0500, Rose, Bobby wrote: > I wish we could get more info from Justin or Craig to clear up > everything. Justin's last message did raise some concern with the > remark of "There's no closing of the source involved (except for their > own (Deersoft now NAI) propr

[SAtalk] DNSBL checks on Received headers

2003-01-06 Thread Jeremy Nixon
So this spam just sneaked into my inbox with 4.9 points. I hate that, it's the first one in days. Looking at it, it turns out that a bunch of bogus Received headers are fooling Spamassassin into quitting with the DNSBL checks before it gets to the real meat -- increasing num_check_received to 5 r

Re: [SAtalk] RBLS w/ known spam sources, Theo, and I'm starting to see the lig ht!

2003-01-04 Thread Jeremy Nixon
On Fri, Jan 03, 2003 at 02:58:09PM -0600, Rich Puhek wrote: > I found that I can't outright block .cn and .kr without some customers > getting very irritated at me. Even if I could, maintaining a whitelist > would be a PITA for entire countries (or, worse, for RBLS like > unconfirmed.ordb.org.)

Re: [SAtalk] X-Rot version

2002-12-28 Thread Jeremy Nixon
On Sat, Dec 28, 2002 at 02:18:09PM -0600, Mike Loiterman wrote: > Hrm...I'm wondering if sending the permission denied message is an > invitation for them to really lay it on me. In other words, they know > they've hit a valid address, but I'm refusing their crap. Maybe > they'll use my address

Re: [SAtalk] Meta tests

2002-12-26 Thread Jeremy Nixon
On Thu, Dec 26, 2002 at 11:56:29PM -0500, Theo Van Dinter wrote: > So in 2.50 now, naming doesn't matter now for meta meta dependencies; > the code will figure out what order to run the tests in, including > circular dependencies, and do the right thing. :) Way cool, thanks. -Jeremy --

Re: [SAtalk] Meta tests

2002-12-26 Thread Jeremy Nixon
On Thu, Dec 26, 2002 at 06:27:47PM -0500, Theo Van Dinter wrote: > Ok, I cleaned up the do_meta code a little bit and added in the > "strategic" sort. :) I first tried changing the line my @tests = keys %{$self->{conf}{meta_tests}}; to just sort the keys, but that explodes badly -- you pret

[SAtalk] Meta tests

2002-12-26 Thread Jeremy Nixon
So I'm having some difficulty grasping some stuff about "meta" rules. Maybe now that I've got >350 lines of local spamassassin config, it's time for me to delve into the source and join the devel list or something, but let's see if I can figure this out. I suspect my problem is related to the ord

Re: [SAtalk] Increase in low scoring spam?

2002-12-24 Thread Jeremy Nixon
On Tue, Dec 24, 2002 at 03:39:44PM -0500, Mike Burger wrote: > Check the footers...the end of their messages always have "High Speed > Media" or "HighSpeed Media" in them. And their domains always have > something like highspeed or hsm or h-s-m. > > But, if you're not getting slammed by HSM, c

Re: [SAtalk] Increase in low scoring spam?

2002-12-24 Thread Jeremy Nixon
On Mon, Dec 23, 2002 at 11:41:52PM -0500, Theo Van Dinter wrote: > Well, just so you know ... I took a random sampling from my corpus for > the hspeed folks... Which spams are these? I've got tens of thousands and I don't see anything which sticks out as "high speed media" or whatever... I do

[SAtalk] Received from first hop dialup

2002-12-19 Thread Jeremy Nixon
So I just received an email, and the spamassassin output says: SPAM: * 0.4 -- RBL: Received via a relay in relays.osirusoft.com SPAM: [RBL check: found 87.20.89.138.relays.osirusoft.com., type: 127.0.0.3] SPAM: * 0.6 -- RBL: DNSBL: sender ip address in in a dialup block SPAM: * 0.4 --