[SAtalk] REMINDER: SpamAssassin-Talk LIST HAS MOVED

2004-02-02 Thread Justin Mason
[THIS LIST HAS MOVED! see http://useast.spamassassin.org/lists.html .] (A couple of people seem to have missed the first posting, so here's a reminder.) Please note that, as reported in my posting last week, the <[EMAIL PROTECTED]> list is no longer active. See http://www.spamassassin.org/lists

Re: [SAtalk] FP for FAKE_HELO_YAHOO ?

2004-01-31 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Pedro Sam writes: >Hi all, > >I received the following mail from a yahoo web mail user, but the >FAKE_HELO_YAHOO keeps on hitting. Is this a false positive? The problem is this: > Received: from 216.136.128.122 (HELO web10409.mail.yahoo.com) (216.

[SAtalk] moving sa-talk to apache?

2004-01-31 Thread Justin Mason
Folks -- given the *massive* numbers of issues with this list in its current home, I suggest we may be better off moving it to Apache.org sooner rather than later. Currently, our status in Apache is that we are in the Incubator there, which means that the list has an @incubator.apache.org suffix,

Re: [SAtalk] Can someone explain this?

2004-01-31 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Evan Platt writes: >> It met the required hit total (exactly) to be classified as spam. > >I think we need a FAQ entry for this - this is covered QUITE often. we have one. people don't read it ;) - --j. -BEGIN PGP SIGNATURE- Version: GnuPG

Re: [SAtalk] Rules to flag these stupid virus warnings?

2004-01-27 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Mike Batchelor writes: >I am about ready to just open the message body with MIMEDefang and whack >anything that mentions "InterScan" with extreme prejudice (like, forward it >to InterScan's Postmaster, until they forcibly distribute a patch to all

Re: [SAtalk] expand_regex: a tool for debugging regex rules

2004-01-27 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Gary Funck writes: > Attached is a perl script, expand_regex.pl, which will accept an SA > rules file on standard input and will by default output the expansions > of those rules, taking into account regex factoring due to parentheses. > When invoked

Re: [SAtalk] stats

2004-01-26 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 AltGrendel writes: >On Fri, 2004-01-23 at 00:14, Bob Apthorpe wrote: >> Hi, >> >> On Thu, 22 Jan 2004 15:12:06 -0600 Wagner One <[EMAIL PROTECTED]> wrote: >> >> > On 1/22/2004 1:15 PM, Bob Apthorpe wrote: >> > >> > > Note: I think this my hacked-up

Re: [SAtalk] Making SA on Windows with Perl 5.8.2

2004-01-23 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 "Bret Miller" writes: >> While I haven't done what you are looking for, I'd be >> most interested in any info you get off-list. I am getting >> ready to embark on this same process for a customer and would >> love to have the dirty insight be

Re: [SAtalk] trusted_networks being ignored at times?

2004-01-21 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Will McCutcheon writes: >I am running SpamAssassin 2.61 with Sendmail 8.12.8 using Procmail 3.22. > >I have a mail server running on a cable modem whose IP is a dynamic >pool, so I of course am blacklisted in several RBL's. I am a good boy, >so I h

Re: [SAtalk] RFC822ness of a message

2004-01-21 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Rick Macdougall writes: >Steven Manross wrote: > >> I use a tool called "Outlook Redemption" (http://www.dimastr.com/Redemption ) to: >> -save an Outlook message as an RFC822 file >> -then run that file through SA, >> -then reimport that message

Re: [SAtalk] Bayes mis-learning problem

2004-01-20 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Arpi writes: >Hi, > >> On Mon, Jan 19, 2004 at 03:21:06PM -0500, Larry Gilson wrote: >> > http://useast.spamassassin.org/doc/Mail_SpamAssassin_Conf.html#learning%20op >> > tions >> > >> > bayes_ignore_header header_name >> >> ::bangs head on wall::

Re: [SAtalk] Bayes mis-learning problem

2004-01-19 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Larry Gilson writes: > > In a broader sense though, shouldn't fields like To: be excluded by > > default? It seems like if I receive more than 50% spam, this is a > > receipe for disaster. Of course, some spam won't have a valid To: > > field, but i

Re: [SAtalk] Bayes.

2004-01-14 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Chris Petersen writes: >> See 'man sa-learn' or use >> http://www.spamassassin.org/doc/sa-learn.html >> http://wiki.spamassassin.org/w/BayesInSpamAssassin > >This doesn't say much about HOW it's used in SA, though. For instance, >does SA bayes score

Re: [SAtalk] FP with backhair

2004-01-14 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Matt Kettler writes: > At 01:44 PM 1/14/2004, Gary Funck wrote: > >I'd asked this before (with no answer on the 'dev' list), > > Not surprising.. unless it's part of active development work ie: discussion > of methods to fix a bug, coding, test resu

Re: [SAtalk] improving spamassassin (mass-check question)

2004-01-14 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 PieterB writes: >http://au.spamassassin.org/hacking.html lists how to submit >mass-check results. I have a couple of questions: > >* The CORPUS_POLICY lists that you should use hand-verified spam/ham > tiles, but the CORPUS_SUBMIT lists that you shou

Re: [RulesEmporium] RE: [SAtalk] New HTML spam body obfuscation.

2004-01-14 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 "Chris Thielen" writes: >Top top post :) > >Download the sa tarball. In the masses directory is a script called mass-check. >Read the top of the script for the little bit of documentation that exists. There's a little more on the Wiki nowadays, to

Re: Limitation in SA (Re: [SAtalk] Obfusticated URI?)

2004-01-13 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 David B Funk writes: >On Mon, 12 Jan 2004, Larry Starr wrote: > >> Just noticed a message with an encoded URL, that misses, the "BIZ_TLD" rule, >> etc. >> >> The message body contains: >> http://gf=2eclearmath=2ebiz/jsimp/index=2ehtml";>> face=3d"aria

[SAtalk] Habeas responds to forgeries (fwd)

2004-01-13 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 fyi, - --j. - --- Forwarded Message Date:Mon, 12 Jan 2004 22:12:11 -0500 Subject: Habeas responds to forgeries: Please feel free to re-post this as you feel necessary. It will be going out to many channels soon. Tara Natanson Manager

Re: [SAtalk] filter suggestions

2004-01-13 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Matt Kettler writes: >At 10:35 PM 1/12/04 -0600, Brian McGroarty wrote: >>What's the proper way to suggest a new filter to the SA developers? >> >>I'm getting a TON of mail with a bunch of random uncommon-but-real >>words to thwart Bayesian filtering,

Re: [SAtalk] OT: forged habeus mark

2004-01-12 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Robin Lynn Frank writes: >On Monday 12 January 2004 17:31, Bob Proulx wrote: >> Chuck Peters wrote: >> > Can someone explain why HABEAS_SWE -8.0 was allowed to happen? >> >> Robin Lynn Frank wrote: >> > Shorter answer. Habeus rule is outahere. >> >>

Re: [SAtalk] Duplicate Emails

2004-01-12 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Robert Menschel writes: > I'm trying to make sure my corpus is as clean as possible, eliminating > all duplicates. > > I tried to use the masses/corpora/uniq-mailbox program for this, and had > problems which I've documented in bugzilla report 2920.

Re: [SAtalk] habeus

2004-01-12 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Gary Smith writes: >Updated :) (+0.1) > >Sorry www.habeas.com but if you were doing what you advertised and suing these >suckers or lobbying congress for tougher (or actual) laws then I'd give you a -30... >Try again next year. hmm. From what I'v

Re: [WL] Re: [SAtalk] Phony Habeas mark on spam...I knew it was just a matter of time

2004-01-12 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Theo Van Dinter writes: >On Mon, Jan 12, 2004 at 11:26:46AM -0500, Jack Gostl wrote: >> I sometimes wonder if the whole system wouldn't be smaller and stabler if >> it were entirely Bayes based. > >Well, sure it would be. But frankly, if you want Bay

[SAtalk] adding rules to the core set: need a volunteer!

2004-01-09 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Chris Santerre writes: >> Maybe you should setup CSV and start a dev team? >> (I'd help if I could but I suck at regex) > >I had thought about it. Once I finish tweaking the regex, then it is only a >matter of adding/removing domains. No great regex k

Re: Re[2]: [SAtalk] Simple newbie question

2004-01-09 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Chris Santerre writes: > > -Original Message- > > From: Robert Menschel [mailto:[EMAIL PROTECTED] > > Sent: Thursday, January 08, 2004 10:40 PM > > To: Steve Thomas > > Cc: John Fleming; [EMAIL PROTECTED] > > Subject: Re[2]: [SAtalk] Simple ne

Re: [SAtalk] Trouble with whitelist_from_rcvd

2004-01-09 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Brett Simpson writes: >On Friday 09 January 2004 11:37 am, Brett Simpson wrote: >> Here's what I have in my user_prefs... >> trusted_networks 207.156.7. >> whitelist_from_rcvd [EMAIL PROTECTED] >> ns2b.hillsboroughcounty.org > >I found that if I set t

Re: [SAtalk] Losing the war against spammers

2004-01-08 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Genchev, Sergei writes: > >Yes, but the bayes portion isn't working. Why? Because when SA runs, it > >runs with the privileges of the user whose mail is being scanned. I > >believe bayes would require that SA (spamc) is run under a specific > >user, n

Re: [SAtalk] RCVD_IN_DYNABLOCK,RCVD_IN_SORBS in 2.61 when sending myself a test message?

2004-01-07 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 "Mitch (WebCob)" writes: >Sorry for the duplicate if this did make it through the first time - I >didn't see my echo, or any feedback, so I thought I'd send again. > >I'm playing with a way to skip spamc altogether for local users (the third >case bel

Re: [SAtalk] Re: SPF Support in SA?

2004-01-07 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Philip Tucker writes: > I have a couple questions about SPF and its usage in SpamAssassin. > > 1) Would SPF obselete the FORGED_*_RCVD rules? Not just yet, anyway. They work quite well for the most part ;) > 2) How does SPF deal with senders who a

Re: [SAtalk] Re: Spell Checking the Subject Header (RESULTS)

2004-01-06 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Scott A Crosby writes: >On Tue, 30 Dec 2003 13:48:17 -0600, "Dallas L. Engelken" <[EMAIL PROTECTED]> writes: > > >> >> # SUBJ_SPELLING_00 -- 2283s/1850h of 10971 corpus, 2003-12-30 >> # >> #

Re: [SAtalk] Integrating additional spam filters into SpamAssassin

2004-01-03 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Jonas Eckerman writes: >An alternative but also more complex way could be that user extensions need two >functions. Like this: > >sub register_sa_user_function { #allways has this name, there has to be a separate >file for each user extension >

Re: [SAtalk] Re: mass-check and hit-frequencies help needed

2004-01-03 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Robert Menschel writes: >That tells me that either parse-rules-for-masses isn't finding the rules >file, or is finding it and not reading it. > >Digging into parse-rules-for-masses, it uses >> sub readrules { >> foreach my $indir (@_) { >> my @f

Re: [SAtalk] memory leaking spamd procs (PS)

2004-01-03 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 [EMAIL PROTECTED] writes: >We are alive again so... > Spamassassin v2.60 > Perl v5.6.1 John -- try SpamAssassin 2.61, it could be that there's a very large bayes db there that's being expired -- in versions before 2.61, this was implemented inef

Re: [SAtalk] SPF Support in SA?

2004-01-03 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Bill Landry writes: > - Original Message - > From: "Theo Van Dinter" <[EMAIL PROTECTED]> > > > On Sat, Dec 20, 2003 at 11:49:37AM -0800, Bill Landry wrote: > > > I was wondering if the SA developers are considering adding support > > for > >

[SAtalk] SpamAssassin wins twice in OSDir.com's 2003 Editor's Choice Awards in Open Source (fwd)

2003-12-19 Thread Justin Mason
http://osdir.com/Article198.phtml Editor's Choice for Best Application (Top 5 environments): Email: SpamAssassin (Double Winner) SpamAssassin keeps keeps me out of Anger Managent classes. If you are not running SpamAssassin get thee to SpamAssassin.org. Now. If you need your friendly n

Re: [SAtalk] Mailing lists and compliance verbage

2003-12-19 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Scott Harris writes: > Also, what are the potential future ramifications for SA as more and more > legit mailing list emailers start adding such verbage to demonstrate their > legitimacy? They might want to look up the law; S1618 was never passed.

Re: the problem with SA RE: [SAtalk] OT: Spam: Behind the scenes

2003-12-19 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Covington, Chris writes: > Unfortunately the problem with SpamAssassin is that all the spam we > should be complaining to ISPs about we are simply silently accepting and > ignoring (perhaps reporting to DCC, Pyzor, Razor and Bayes...) and > /dev/null,

Re: [SAtalk] unix dgram message

2003-12-17 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Mark Wendt (Contractor) writes: > I recently upgraded from 2.55 to 2.61, and upon starting spamd, I get this > message: unix dgram connect: Socket operation on non-socket at > /usr/local/bin/spamd line 282. I'm running Solaris 8 on the server, late

[SAtalk] [Asrg] 0. General - SpamAssasin deployed on IETF servers (fwd)

2003-12-16 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - --- Forwarded Message Date:Tue, 16 Dec 2003 20:37:32 -0500 From:Yakov Shafranovich <[EMAIL PROTECTED]> To: ASRG <[EMAIL PROTECTED]> Subject: [Asrg] 0. General - SpamAssasin deployed on IETF servers As of Monday, 12/15, IETF has de

Re: [SAtalk] Here's how I got dccifd to run. Suggest add to INSTALL

2003-12-16 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 "Smart,Dan" writes: >I suggest that instructions to get dccifd running should be included in >INSTALL... Dan, any chance you could add a page to the wiki? http://wiki.SpamAssassin.org/ - --j. >Compile the dcc as directed in INSTALL doc. >Get dccpro

Re: [SAdev] Re: [SAtalk] MySQL not working? No indication of error when running spamd -D

2003-12-16 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Michael Parker writes: >I'd love to see some sort of more generalized SQL interface that can >be used by many different "subsystems" can use for their data >storage. For instance, the hashcash stuff Justin just added. It uses >a DB_File to store the

Re: [SAtalk] MySQL not working? No indication of error when running spamd -D

2003-12-15 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Jeremy Zawodny writes: >On Mon, Dec 15, 2003 at 03:00:19PM -0800, Justin Mason wrote: >> Mitch (WebCob) writes: >> > Not sure if I should be posting this here or sending to jengland... I >> > already did that though... &

Re: [SAtalk] MySQL not working? No indication of error when running spamd -D

2003-12-15 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Mitch (WebCob) writes: > Not sure if I should be posting this here or sending to jengland... I > already did that though... > > Thanks in advance for looking at this... There's definitely a lot of odd stuff in the SQL code, and we need someone who w

Re: [SAtalk] SpamAssassin 2.61 released!

2003-12-12 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 "Mike Vanecek" writes: >On Fri, 12 Dec 2003 14:30:09 -0800, Justin Mason wrote > >[snip] > >> >http://bugzilla.spamassassin.org/show_bug.cgi?id=2569 >> >> Missed that one; I've just set it to be fix

Re: [SAtalk] SpamAssassin 2.61 released!

2003-12-12 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Vivek Khera writes: >Great news... > >Any idea on how a rather nasty bug can be addressed before the next >release? I had hoped it would be addressed in 2.61 (I've been away >from the list for a while so I didn't see the pre-announcements). It >appa

Re: [SAtalk] Mass-check corpus cleanup using included scripts. How??

2003-12-12 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Smart,Dan writes: > I'm trying to do the mass-check corpus cleanup using the method in > CORPUS_SUBMIT file. My hard-sorted spams and hams are stored in MBOXs. > > I'm assuming that the scripts: mass-check-results-to-mbox, mboxget, and > extract-mes

Re: [SAtalk] Need a rule for IE Exploit

2003-12-11 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Ivar Snaaijer writes: >Fred wrote: > >>Hello, >>I am out the door on my way to work but we need a rule for a new IE exploit >>just released, >>Visit this page, the exploit is harmless but to the spoofer, it's man's best >>friend. >> >>http://www.zapth

Re: [SAtalk] 2.61 and DYNABLOCK, issues still?

2003-12-11 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Rob Mangiafico writes: >> >Email thru our server from home PC: >> >--- >> >Received: from fico (ct-nrwch-cuda1-xxx.nwchct.adelphia.net >> >[68.170.14x.4x]) >> > by lexiconn.serverhost.net (8.11.6/8.11.6) with ESMTP id >> >hBB0Wcp23535 >> >

Re: [SAtalk] META: Does spamassassin-talk have a working mail archive?

2003-12-11 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Bob Apthorpe writes: >Hi, > >After spending tireless minutes directing people to the SA-Talk >archives[1], I can't seem to get at them. Does >http://sourceforge.net/mailarchive/forum.php?forum=spamassassin-talk >work, and if not, is there a better pla

Re: [SAtalk] sa-learn ... R/W: tie failed!

2003-12-10 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 AthlonRob writes: > Hello list- > > I've been using SA for a while, including the bayes stuff, training it > with sa-learn every few weeks on the latest spam samples and ham I > happen to have received. > > I just did... a root oops. > > I was runn

Re: [SAtalk] A question abouting teaching Spamassain

2003-12-10 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Matt Kettler writes: >At 06:48 PM 12/10/2003, stan wrote: >>Did I do wrong by teaching it with lots of _good_ messages? Should I reset >>it to the base rules, and start over? BTW how can I do that? > >Idealisticaly you want to train it with something

Re: [SAtalk] rule match counting

2003-12-10 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Matt Kettler writes: >At 10:09 AM 12/10/03 -0500, Stephen M. Przepiora wrote: > >>Hello, I have constructed a huge list of rules and wish to detect how good >>they are. Is there a way to log the count of rule matches somewhere? > >if you've got a spa

Re: [SAtalk] rule match counting

2003-12-10 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Stephen M. Przepiora writes: > Hello, I have constructed a huge list of rules and wish to detect how > good they are. Is there a way to log the count of rule matches somewhere? Hi -- about time I documented this properly; should be helpful for the

Re: [SAtalk] Training SA

2003-12-10 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Matt Kettler writes: >and then the Bayes FAQ in the Wiki: >http://wiki.spamassassin.org/w/BayesFaq >in particular: >http://wiki.spamassassin.org/w/SiteWideBayesFeedback >and: >http://wiki.spamassassin.org/w/UsingAnAccountForLearning Oh yeah, forgot t

Re: [SAtalk] Re: SpamAssassin 2.61 released!

2003-12-09 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Rob Mangiafico writes: >> Summary of major changes since 2.60 >> --- >> - updated to reflect new Dynablock DNSBL location > >Does 2.61 also fix the bugs and problems with DYNABLOCK and NJABL hitting >false positives

[SAtalk] SpamAssassin 2.61 released!

2003-12-09 Thread Justin Mason
Downloading --- Pick it up from: http://SpamAssassin.org/released/Mail-SpamAssassin-2.61.tar.gz http://SpamAssassin.org/released/Mail-SpamAssassin-2.61.tar.bz2 http://SpamAssassin.org/released/Mail-SpamAssassin-2.61.zip md5sum: 6521ad3e6ed5a2eba35476c43c1697b7 Mail-SpamAssassin-

Re: [SAtalk] (no subject)

2003-12-08 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Theo Van Dinter writes: > On Mon, Dec 08, 2003 at 01:11:06PM -0600, [EMAIL PROTECTED] wrote: > > I'd like to back up the journal periodicly to disk. Right now I have > > There's really no point to that. Just sync the journal to the DB. > > > searc

Re: [SAtalk] Delete mail with a score above n

2003-12-08 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Rich Puhek writes: >Bob Apthorpe wrote: >> On Thu, 04 Dec 2003 10:59:13 -0800 Mike D <[EMAIL PROTECTED]> wrote: >> >> >>>Does anyone know how to config spamassassin to delete messages with a score >>>above a certain threshold? >> >> >> This questi

Re: [SAtalk] Re: New spammer trick (HTML tables)?

2003-12-08 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Scott A Crosby writes: >On 08 Dec 2003 11:00:22 +0200, [EMAIL PROTECTED] writes: > >> On 06 Dec 2003 17:21:54 -0600, Scott A Crosby <[EMAIL PROTECTED]> >> posted to spamassassin-talk: > >> It would be good to have a rule to match the general pattern.

Re: [SAtalk] Being BigEvil inspired...

2003-12-05 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Larry Rosenman writes: >>> one word: rawbody >>> >>> LER >> >> OUCH! That makes a lot of sense. Hmmm.Should I change bigevil to >> URI??? >Dunno, I'd ask for some SA-Developers opinions. Yes. URI will be more efficient, too. - --j. -BE

[SAtalk] Re: [SAdev] Spamassassin problems with Outlook 2003

2003-12-04 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 BJ Quinn writes: > "Bugzilla Bug 2538, address problems with Outlook forgery rules" (email > coming from Outlook 2003 was getting tagged as spam because of its > reliance on the SMTP server to create the message-ID headers, therefore > shipping out em

Re: [SAtalk] Long spam times

2003-12-04 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 [EMAIL PROTECTED] writes: >OK, after running spamd -D I see this in the output. Is this a DNS issue >on my part or something not configured correctly. DNS is working >correctly in other parts of the tests, but seems the RBL's are timing >out. That's

Re: [SAtalk] Bayes Expiry limits and Journal size

2003-12-03 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Theo Van Dinter writes: >The expiry should, theoretically, not take a lot of memory since it >really only needs to have 1 token in memory at a time while it copies >between database files. An expiry forces a journal sync though, so an >expiry run wil

Re: [SAtalk] Bayes problems

2003-12-02 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Jack Gostl writes: > >I need some help here guys. > >I have updated my Db to BerkeleyDB.4.2, I have reinstalled DB_file from >CPAN, then I wiped out my Bayes databases and started to rebuild from my >spam corpus. > >When I run db_verify I still get th

[SAtalk] Re: hit-frequencies (was: Ideas/RD)

2003-12-01 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Robert Menschel writes: >Hello Justin, > >Monday, December 1, 2003, 10:19:32 AM, you wrote: > >JM> Robert, BTW -- > >JM> were you saying previously that you couldn't get hit-frequencies >JM> working? Could you remind me what was up there? I might be

Re: [SAtalk] RE: [RD] Ideas

2003-12-01 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Larry Gilson writes: >Hi Bob, > >Sorry for the long delay in my response. I have taken a little break. >Thanks for running the rules through masscheck against your corpus. I have >no where near the corpus that you do and find the testing methodology

Re: [SAtalk] Idea for spamassassin

2003-11-26 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Nichols, William writes: > I attended a seminar yesterday about spam. One of the idea that was > pitched as being in a product was training the inbound spam detecting on > the patterns of outbound mail. > > They talked about their filters looking a

Re: [SAtalk] Re: Resolving and hat-checking spamvertised URLs...

2003-11-26 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 "Florian L. Klein" writes: >Chris Thielen wrote: >> >> I just wanted to share my success using your hosted_in rbl rules. So far, >> it's hit about 2 spam per day on my primary email account. One of those >> would have been a false negative, had it n

Re: [SAtalk] Re: An Open Letter to the SA-talk forum

2003-11-25 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Dan Wilder writes: >On Tue, Nov 25, 2003 at 06:04:13PM -0600, Scott A Crosby wrote: >> To everyone here, give the guy a break. > >Hear, hear! > >It's all too easy to make a mistake in print. Give Logan >some slack for being professional enough to st

Re: Re[2]: [SAtalk] Ideas

2003-11-25 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Robert Menschel writes: >-BEGIN PGP SIGNED MESSAGE- >Hash: SHA1 > >Hello Steve, > >Tuesday, November 25, 2003, 10:40:09 AM, you wrote: > >ST> I noticed that this guy's using our domain name as the argument to >ST> the HELO command during the S

Re: [SAtalk] Spamassassin hogging 100% CPU time

2003-11-25 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Dan Bongert writes: >We just rolled out SpamAssassin 2.60 as a spam filtering option to our >users (after using it on IT staff guinea pigs for about a month), and only >have about 20 people using it so far out of a possible 800 or so. In theory, >the

Re: [SAtalk] bayes over NFS locking

2003-11-24 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Adam Denenberg writes: >Hey, > > How are people handling the locking issues with Bayes over NFS on a >high traffic mail server? Currently i have "bayes_learn_to_journal 1 >" turned on, but an sa-learn --rebuild seems to be taking quite some >time (i

Re: [SAtalk] bayes over NFS locking

2003-11-24 Thread Justin Mason
9924 Out of memory! > >thanks >adam > >On Mon, 2003-11-24 at 15:25, Justin Mason wrote: >> -BEGIN PGP SIGNED MESSAGE- >> Hash: SHA1 >> >> >> Adam Denenberg writes: >> >Hey, >> > >> > How are people handling the locking issu

[SAtalk] SpamAssassin wiki

2003-11-22 Thread Justin Mason
Hi folks -- After some dithering about which software to use, we've taken the plunge; here's the SpamAssassin Wiki: http://wiki.spamassassin.org/ The main idea of it right now is to replace the FAQ; this provides a better way to create a publically-editable hypertext, and it's easier to

Re: [SAtalk] Character Set Spam....

2003-11-21 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Charles Gregory writes: >Hello! > >I've been playing with the 'locales' settings, and they work quite well >where a message has been properly formatted with 'charset' headers, but >here's a message whose only visible clue is the use of 'windows-1251'

[SAtalk] finally

2003-11-20 Thread Justin Mason
[EMAIL PROTECTED] has been unsubscribed. (I eventually wrote an LWP crawler to download each of the 87 chunks of the address list from sf.net so I could grep them ;) --j. --- This SF.net email is sponsored by: SF.net Giveback Program. Does So

Re: [SAtalk] Tracking down thewizard.net forwarder

2003-11-19 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Charles Gregory writes: > >I ask again, particularly of the list maintainers, has anyone written mail >to 'pool.com' and/or 'thewizard.net' to solve the problem at the source? Yes. And without reply... - --j. -BEGIN PGP SIGNATURE- Version:

Re: [SAtalk] Asian spam rules

2003-11-18 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 [EMAIL PROTECTED] writes: > >Can someone point me to some good rules to catch most Chinese, Korean, etc >spam? We're talking non-ASCII characters, which show up in most mailers >here as a bunch of question marks... Setting ok_locales should help...

Re: [SAtalk] why won't changing the display language work ???

2003-11-18 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 "Samuel Murez" writes: >Matt Kettler wrote: >> At 01:12 AM 11/18/03 +0100, Samuel Murez wrote: >>> Hello-- >>> >>> Could somebody please take just a minute to tell me how to do this ? >>> >>> It seems very simple but I've tried many solutions and noth

Re: [SAtalk] Bug in SA? Anyone else get messages like this?

2003-11-18 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 David A. Roth writes: > I sometimes get a blank message and the entire contents is something > like I got today: > > From Tue Nov 18 13:48:10 2003 > X-UIDL: (RO"!dA&"!nL3"!4bA"! > > I admit I don't know what a X-UIDL is or how to determine the me

Re: [SAtalk] rc.* scripts

2003-11-18 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 "Luka Z. Gerzic" writes: > >hi there spamhaters :) >i just have quick note for spamd startup scripts. All scripts >for latest 2.60 (dunno about < 2.60) have exit 0 at the end of >script. This can produce some confusion if script is started >from anoth

Re: Re[2]: [SAtalk] Sanity checking new uri rules?

2003-11-17 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Robert Menschel writes: >What I have been able to measure is the time needed for a mass check. >When I run mass-check against my now 50k corpus (that's 50k email >messages), it takes 15-16 minutes to run for a single rule. Adding a >small number of ru

Re: [SAtalk] whitelist_from_rcvd

2003-11-17 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 David B Funk writes: >whitelist_from_rcvd needs appropriate values for the trusted_networks >parameter before it works. >Given that you have a firewall configuration with internal/exteral >addresses on that SA box, it might be confused when trying to

Re: [SAtalk] Sanity checking new uri rules?

2003-11-17 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 BTW, given that a URI DB cannot use regular expressions, or patterns, would this really be useful? Basically with a DB you only gain efficiency when looking up exact strings. So for this to be useful against URIs, you'd have to pick out *just* the d

Re: [SAtalk] autolearn ham ?!

2003-11-17 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Michael V. Sokolov writes: > >I've noticed message with such headers: > >X-Spam-Flag: YES >X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on antispam >X-Spam-Level: ** >X-Spam-Status: Yes, hits=6.0 required=5.0 tests=BAYES_99 aut

Re: [SAtalk] RE: Chunks of legit text fooling Bayes

2003-11-17 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 >> I'm getting an increasing number of messages, probably from the >> same idiot, with just huge paragraphs of current news or giberish >> tacked on to the end of the message. It's obviously fooling bayes, >> but is there anything we can do about thi

Re: [SAtalk] bug with AWL in 2.60?

2003-11-15 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Rob Mangiafico writes: >Before I submit a bug, I wanted to see if this was a known issue in 2.60. Yep, it is -- and there's a patch if you don't feel like waiting for 2.61 ;) http://bugzilla.spamassassin.org/show_bug.cgi?id=2734 - --j. -BEGIN

Re: [SAtalk] Bayes Expiry limits and Journal size

2003-11-14 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Smart,Dan writes: > I'm running Bayes site wide with about 45,000 messages per day. Is there > any harm in increasing the bayes_expiry_max_db_size and > bayes_journal_max_size limits? > > If it's ok to make bigger, what is the maximum before someth

Re: [SAtalk] scoring system and values...

2003-11-13 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Chris Santerre writes: >I've had conversations with legit mass emailers that have to fight getting >there legit opt-in only email to customers, because of antispam software. >I've been wanting to write a guide to legit emailers on how to make there >e

Re: [SAtalk] OT: Administrivia: List mom, please disable the bouncing thewizard.net subscriber.

2003-11-12 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Bob Apthorpe writes: > Hi, > > Can one of the mailing list Powers That Be disable whichever subscriber is > routing mail to thewizard.net? I'm tired of pool.com's useless autoack > ads, especially due to a suspicious piece of their URL (below.) I'd

Re: [SAtalk] Razor/SA integration

2003-11-10 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Ken Bass writes: >So I guess my original question turns into a request, can spamassassin be >changed so that '-r' option accepts an mbox file and it iterates over the >messages to submit them. Or could sa-learn be changed so that it becomes the >top l

[SAtalk] Panix dynablock issue

2003-11-10 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Bob Rosenberg writes: >I have been informed that all my mail is being flagged by >Spamassassin (as shown below with a message I sent out). > >>X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on >> mailspool2.panix.com >>X-Spam-S

Re: [SAtalk] Re: scoring system and values...

2003-11-09 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Lukreme writes: >Now, for your purposes, subjects with [word blacklisted by stupid list >server] might be exclusively spam. They might not be exclusively spam >for others. That's why you can override any score in your own cf file. > If you want

[SAtalk] a web-of-trust for antispam

2003-11-09 Thread Justin Mason
Folks -- Recently, there's been some work on getting a rudimentary web of trust up and running for antispam -- fundamentally, for whitelisting mail servers. More details at: http://www.web-o-trust.org/ --j. --- This SF.Net email sponsored

Re: [SAtalk] Changed spammer technique ?

2003-11-09 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Brian Ipsen writes: > The spammer uses my own email address as sender to try to inject spam into > my system - in combination with TMDA this just causes the confirmation > request be bounced/ /dev/null'ed - and I won't the the message anyway... > > I

Re: [SAtalk] Stupid API question

2003-11-07 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Carl R. Friend writes: >Greetings Assassins! > >I've got a silly question that can be answered with a simple "Yes" > or "No" (or a "go sod off you stupid git", although I hope it won't > come to _that_). > >Is it possible for an eval() t

Re: [SAtalk] scoring system and values...

2003-11-07 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Chris Thielen writes: >I'm not criticizing your viewpoint, but with a little tweaking, SA really >"works for me"! Yeah -- and that's the important thing. It's really very easy to train the Bayes stuff, in particular. The aim is to: - work well f

Re: [SAtalk] connecting IP address header

2003-11-07 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Philip Tucker writes: > What's the best way to add a MIME header for the connecting IP address > such that SpamAssassin can access it (we have a system where the > received header is not added until after SpamAssassin sees the message)? > It looks lik

Re: [SAtalk] bayes_toks problem

2003-11-07 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Petre Bandac writes: > hello > > after using several times sa-learn ( I guess it learned by hand less than 50 > spam messages), I found spamassassing running for a very long time for a > single mail scan (cca 15 minutes). > > when I saw the size o

Re: [SAtalk] Re: 'random' character sets

2003-11-07 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Chris Santerre writes: >You know, the answer to this, is the answer to many questions. The solution >is the much needed accumulator eval. Yes you can get some FPs on 3-5 >consonants. But what if you set this rule to only hit if 4+ hits were found >of

  1   2   3   4   5   6   7   8   >