Re: [SAtalk] stats

--On Thursday, January 29, 2004 12:44 PM -0600 Bob Apthorpe <[EMAIL PROTECTED]> wrote: > http://svn.apache.org/viewcvs.cgi/incubator/spamassassin/trunk/tools/?root=A > pache-SVN Just tried this out on Fedora Core 1 with SA 2.63 and I had to use "--start yesterday" to get output. Otherwise I see t

Re: [SAtalk] Help! (Dumb noob questions about upgrading and other stuff)

--On Friday, January 23, 2004 10:18 AM -0800 JR <[EMAIL PROTECTED]> wrote: But now I'm faced with the daunting task of upgrading (via CPAN on RH 7.2, and I don't know squat about CPAN) from 2.55. 7.2 has been end-of-lifed, so you might think about starting from scratch. I'd suggest getting a spa

Re: [SAtalk] mail aliases and SA-learn

--On Thursday, January 22, 2004 6:17 PM -0600 Kenneth Andresen <[EMAIL PROTECTED]> wrote: That the mail box users are going to /dev/null have been a practice from the server administrators before me. I don't know the original reason for why /dev/null was selected, however I can surely change it i

Re: [SAtalk] Sendmail and spamassassin

--On Friday, January 23, 2004 12:01 PM +0200 Extech <[EMAIL PROTECTED]> wrote: Can anyone please direct me to a How to... Document on installing spamassassin with sendmail. Two approaches, depending on whether sendmail is on a gateway. You can run SA from your delivery agent, such as procmail, j

Re: [SAtalk] mail aliases and SA-learn

--On Thursday, January 22, 2004 11:56 AM -0600 Kenneth Andresen <[EMAIL PROTECTED]> wrote: > 1) The server has been configured in such a way that mail users shell to > /dev/null Just curious why you do that instead of using /bin/false or /sbin/nologin?

Re: [SAtalk] SpamAssassin 2.62 is released!

--On Monday, January 19, 2004 11:07 AM -0600 Bob Apthorpe <[EMAIL PROTECTED]> wrote: > rpm -ta SOURCES/Mail-SpamAssassin-2.62.tar.gz That should be rpmbuild, not rpm. In later versions of rpm the installer no longer automagically calls the builder, and you have to invoke it directly. You can als

Re: [SAtalk] Re: Ann: "Rules De Jour": An automated way to keep up with the latest rulesets

--On Saturday, January 17, 2004 3:54 PM -0600 Scott A Crosby <[EMAIL PROTECTED]> wrote: NTP taught this lesson of this mistake. Systems getting hundreds of queries a minute that haven't run NTP in 13 years. And the linksys DDOS attack on UWisc. Proper use of DNS should deal with this. The supplie

Re: [SAtalk] Acronym Update

--On Friday, January 16, 2004 12:13 PM -0600 Carl Chipman <[EMAIL PROTECTED]> wrote: > LART > UBE/UCE Try http://www.jargon.org/ for LART. (It's a wonderful and fun site, hence I won't spoil it for you.) UBE/UCE is unsolicited bulk/commercial email. --

Re: [SAtalk] [OT and long] Port Blocking (was: Spamwriter).

--On Wednesday, January 14, 2004 9:03 PM -0500 Rubin Bennett <[EMAIL PROTECTED]> wrote: If ISP's started blocking port 25 outbound except to their servers, I would then be forced to change my config every time I move my system. Where's that port 25 going to? Ideally for mobile users you use the

Re: [SAtalk] New Ruleset Available!!! TRIPWIRE! You don't want to miss this o ne!

--On Tuesday, January 13, 2004 4:08 PM -0500 Chris Santerre <[EMAIL PROTECTED]> wrote: > Tripwire has taken OBFU to the next level! It searches for 3 > characters that shouldn't be together. This is based on the English > language. This description should probably be in the comment at the t

Re: [SAtalk] Re: New HTML spam body obfuscation.

--On Tuesday, January 13, 2004 6:20 PM -0600 Scott A Crosby <[EMAIL PROTECTED]> wrote: > The only other option is to run a javascript interpreter, because > there are a near-infinite number of ways javascript could be used to > create text. There's also the halting problem issue. Any active mater

RE: [WL] [SAtalk] How to count pattern matches?

--On Tuesday, January 13, 2004 11:12 AM -0600 Bob Apthorpe <[EMAIL PROTECTED]> wrote: > Since scores are generated by the GA based on the accuracy and frequency > of rules being triggered, how do you accurately set scores for rules that > generate a score dynamically? Good point. Does it help any

Re: [SAtalk] filter suggestions

--On Monday, January 12, 2004 10:35 PM -0600 Brian McGroarty <[EMAIL PROTECTED]> wrote: > I'm getting a TON of mail with a bunch of random uncommon-but-real > words to thwart Bayesian filtering, combined with a single picture > link. Spamassassin is giving these only about one point apiece. Check

Re: [SAtalk] Re: dictionary words in ascii part of mime

--On Friday, January 09, 2004 1:53 AM -0700 Bob Proulx <[EMAIL PROTECTED]> wrote: For me personally SA is still tagging the spam at a very good rate. I am only seeing these types of spams in my caughtspam folder. I'm seeing them in my Inbox, with BAYES_00 overriding other rules that would easil

Re: [SAtalk] Any rule to catch this spam?

--On Wednesday, January 07, 2004 11:38 AM -0600 [EMAIL PROTECTED] wrote: > Attached is a spam that seems to sneak by us all of the time. Anyone > know of a good rule to catch this? X-Spam-Status: No, hits=5.9 required=6.0 tests=BAYES_50,BigEvilList_191, HTML_MESSAGE,NORMAL_HTTP_TO_IP,RCVD

RE: [SAtalk] Re: SPF Support in SA?

--On Wednesday, January 07, 2004 11:04 AM -0600 Philip Tucker <[EMAIL PROTECTED]> wrote: > How would SPF address this kind of message? It's my understanding that a > DNS query would be sent to yahoo.com, which would respond with its outgoing > SMTP IP addresses - not containing HotJobs' IP - and

Re: [SAtalk] Those Re: Bunch of capital letters messages

I'm using this set of rules posted to the list last month. Drop this in /etc/mail/spamassassin as rnd_uc_char.cf. # $Id: rnd_uc_char.cf,v 1.2 2003/12/19 20:08:50 bjn Exp $ # SpamAssassin RND_UC_CHAR pattern # # Thanks to "Christopher X. Candreva" # http://marc.theaimsgroup.com/?l=spamassassin-ta

Re: [SAtalk] dictionary words in ascii part of mime

--On Monday, January 05, 2004 12:58 PM -0600 Alex Stade <[EMAIL PROTECTED]> wrote: > I'm new to this list, so please forgive me if my behavior is inappropriate > in asking this question or if it has already been asked before. No prob, that's normal. There are several active bugzilla entries on t

Re: [SAtalk] New rule? Based on domain registry

--On Monday, January 05, 2004 12:22 AM +0100 Patrick Steiner <[EMAIL PROTECTED]> wrote: I think its no possible to filter mails bye its whois entry. you can only filter some text that it be in the message or in the header from the mail. if you want to do that you must write a litte separete proga

Re: [SAtalk] Re: Re: Subject contains username

--On Saturday, January 03, 2004 11:52 AM -0700 Bob Proulx <[EMAIL PROTECTED]> wrote: Subject: Bug 08378 was submitted by Bob Proulx Subject: Bob is out Friday/Monday Subject: TWiki - Registration for BobProulx Subject: Bob's Task List -- December 2003 Ah, so the main source of FP's is aut

Re: [SAtalk] New sighting: text after /HTML

--On Thursday, January 01, 2004 12:53 PM + Martin Radford <[EMAIL PROTECTED]> wrote: I'm glad you've posted this message -- I got one pretty much identical. However, what I noticed was the number of different ways the spammer spelled "Generic", "Super", "V-drug", "Cialis" to get past filters

Re: [SAtalk] Re: Subject contains username

--On Friday, January 02, 2004 11:50 AM -0500 Theo Van Dinter <[EMAIL PROTECTED]> wrote: It's the only version that didn't cause a ton of false positives. For instance, assume someone uses their first name as their username: [EMAIL PROTECTED] They'll get legitimate mails like "please update this

Re: [SAtalk] New sighting: text after /HTML

Another indicator is the presence of http://www.wbegeds.com/ in the HTML portion. Something for inclusion in the BigEvil list, I guess. --- This SF.net email is sponsored by: IBM Linux Tutorials. Become an expert in LINUX or just sharpen your sk

[SAtalk] New siting: text after /HTML

I'm attaching a sample of something that on first inspection looks like a variant of the RND_UC_CHAR spam. The HTML part is different, but most interesting is all the Bayes poison after the tag in the HTML part. This seems like it should be easy to check for. What rule would one use to count t

Re: [SAtalk] Bigevil 2.05m updated + question for devs

--On Monday, December 29, 2003 3:12 PM -0500 Chris Santerre <[EMAIL PROTECTED]> wrote: Greetings I hope everyone had a great holiday. I've updated Bigevil to version 2.05m. I've been tweaking the rules as I add more. So this update is actually smaller in size with more evil domains! Yeah! BigEvil

Re: [SAtalk] Bigevil update 2.05k

For BigEvil_191, add 53x.com. Looks like the RND_UC_CHAR ratware is now using this variant for its images. --- This SF.net email is sponsored by: IBM Linux Tutorials. Become an expert in LINUX or just sharpen your skills. Sign up for IBM's

RE: [SAtalk] Ruleset for RND UC CHAR spam

Another pattern I notice is that the plain text part always has 3 lines of random words, all lower case, no punctuation except apostrophe in the contractions. Some have a blank line (one space) before the 3 lines of text. Maybe we could add a low-valued body rule for that pattern? The HTML part

Re: [SAtalk] user_prefs and many custom rules sets

--On Thursday, December 25, 2003 7:01 PM -0800 Douglas Kirkland <[EMAIL PROTECTED]> wrote: My understanding is that put the bigevil rule set into user_prefs will not work. The only way I know how to test the rule set is to setup a test server and try it. The rule set will have to be put the s

Re: [SAtalk] user_prefs and many custom rules sets

--On Thursday, December 25, 2003 9:41 PM + Martin Radford <[EMAIL PROTECTED]> wrote: The only configuration file that is read in ~/.spamassassin is user_prefs. Is there some directive one can put in user_prefs to "include" another file, so that I don't need to dump all the different rule set

[SAtalk] user_prefs and many custom rules sets

I'd like to try some of the custom rules sets such as bigevil but not commit them to /etc/mail/spamassassin until I've tested them personally. Must I copy all the files into ~/.spamassassin/user_prefs, or can I drop them into ~/.spamassassin as I would with the system-wide /etc/mail/spamassassi

[SAtalk] mPOP Web-Mail 2.19: ratware?

I'm seeing a lot of spam with this as the X-Mailer. Is this a real program or ratware? --- This SF.net email is sponsored by: IBM Linux Tutorials. Become an expert in LINUX or just sharpen your skills. Sign up for IBM's Free Linux Tutorials. L

Re: [SAtalk] SA & Ximian Evolution 1.4

--On Friday, December 12, 2003 1:31 PM -0500 Rubin Bennett <[EMAIL PROTECTED]> wrote: Now I have *no* rules in my Evolution filters, and a simple .procmailrc in my home directory that grabs all the X-Spam-Status: Yes marked mails and dumps them into my "Junk" IMAP folder. After getting frustrated

Re: [SAtalk] build problem with spamassassin-2.61-1.src.rpm

--On Wednesday, December 10, 2003 7:22 AM -0500 Tayfun Can <[EMAIL PROTECTED]> wrote: I'm trying to build SpamAssassin from the source RPM as suggested. However, when I execute $ rpmbuild --rebuild spamassassin-2.61-1.src.rpm It fails with Checking for unpackaged file(s): /usr/lib/rpm/check-fil

Re: [SAtalk] SpamAssassin 2.61 released!

--On Tuesday, December 09, 2003 11:12 AM -0500 Charles Gregory <[EMAIL PROTECTED]> wrote: > 1) Will RPM's be out soon? Easy enough to make from the tarball: rpmbuild -ta xx.tar.gz This works for any tarball package that includes a specfile.

Re: [SAtalk] What is this? Bayes poison?

--On Friday, December 05, 2003 12:54 AM -0600 David B Funk <[EMAIL PROTECTED]> wrote: > Note that message was MIME "multipart/alternative", but yet I saw only > the part that was obvious Bayes poison. Is it possible that your > MIME 'sanitizer' removed the spam 'payload' component? > (Or it's just

[SAtalk] What is this? Bayes poison?

I'm getting a bunch of these. Are these just intended to poison Bayes DB's? What's the sender's objective? Forwarded Message Return-Path: <[EMAIL PROTECTED]> Received: from 212.199.108.10.forward.012.net.il (212.199.108.10.forward.012.net.il [212.199.108.10]) by s

Re: [SAtalk] Disable a User who does not want SA

--On Monday, December 01, 2003 3:55 PM -0600 Rich Puhek <[EMAIL PROTECTED]> wrote: > Here's the nospam.pl script: Why not use grep? > * ! ? /usr/local/bin/nospam.pl $LOGNAME (Untested code) * ! ? grep -q ^$LOGNAME$ /etc/spamassassin/exempt Or you could use the magic file approach: test -f /h

Re: [SAtalk] Re: An Open Letter to the SA-talk forum

--On Tuesday, December 02, 2003 10:57 AM +0900 alan premselaar <[EMAIL PROTECTED]> wrote: > vi ~/.procmail (and add appropriate config lines to call spamassassin or > spamc) > chkconfig spamd on > service spamd start Instead of chkconfig, one could also use ntsysv (console graphics) or tksysv (X

Re: [SAtalk] Disable a User who does not want SA

--On Monday, December 01, 2003 8:25 PM + Obantec Support <[EMAIL PROTECTED]> wrote: > Procmailrc is handling spam for all users and creates > ~/.spamassassin/user_prefs ok. > > Now 1 customer has decided he does not like spam filtered emails (cannot > please all). Just checked "man procmailr

RE: [SAtalk] Re: An Open Letter to the SA-talk forum

BTW, Logan, can you say (on the list, use "reply all") why it took an hour to install SA? I can imagine it taking me that long only because I'm very careful and look at the installation scripts to make sure nothing will break my existing setup. That option of course doesn't exist with closed so

Re: [SAtalk] An Open Letter to the SA-talk forum

--On Tuesday, November 25, 2003 7:44 AM -0500 Satya <[EMAIL PROTECTED]> wrote: Unfortunately, I haven't read the original article (I was hanging out on /. yesterday and picked up some bad habits). For those who missed the link: 5 produ

RE: [SAtalk] An Open Letter to the SA-talk forum

--On Tuesday, November 25, 2003 5:55 PM +0100 [EMAIL PROTECTED] wrote: perl -MCPAN -e shell install /Mail:SpamAssassin/ Equivalent RPM: rpmbuild -ta \ http://useast.spamassassin.org/released/Mail-SpamAssassin-2.60.tar.gz rpm -Uvh spamassassin-tools-2.60-1.i386.rpm spamassassin-2.60-1.i386.rpm \

Re: [SAtalk] An Open Letter to the SA-talk forum

--On Tuesday, November 25, 2003 2:38 PM -0500 Frederick M Avolio <[EMAIL PROTECTED]> wrote: Well, I will try your RPM for 2.60. Looks like I need 3 RPM files -- spamassassin-tools-2.60-1.i386.rpm, spamassassin-2.60-1.i386.rpm, and perl-Mail-SpamAssassin-2.60-1.i386.rpm. Correct, and true for Theo

Re: [SAtalk] What level to delete at?

--On Tuesday, November 25, 2003 4:29 PM +1300 Simon Byrnand <[EMAIL PROTECTED]> wrote: I'd say most people probably don't delete automatically at all, but rather file spam to a spam folder. My own personal settings at the moment are that <7 I do nothing, between 7 and 15 it goes into my spam fold

[SAtalk] No end-user SA configuration (was: Your infoworld Article)

--On Monday, November 24, 2003 11:46 AM -0800 Evan Platt <[EMAIL PROTECTED]> wrote: [quoting Logan's article] 7. "The whitelist is not difficult to add to, but there is no mechanism for end-users to add to the whitelist or to automatically notify the administrator to add senders." I was amazed at

Re: [SAtalk] RE: Re[2]: http://www.infoworld.com/article/03/11/14/45FEspam_1.html?s=tc

--On Sunday, November 23, 2003 4:19 PM -0800 Logan Harbaugh <[EMAIL PROTECTED]> wrote: The article as I originally wrote it wasn't intended to be anti-SpamAssassin, but I'd still have to say that even if the performance at catching spam and false positives were comparable to the other packages, i

Re: [SAtalk] Really bad Infoworld article

--On Sunday, November 23, 2003 8:35 AM -0500 Fred <[EMAIL PROTECTED]> wrote: I gave this guy a piece of my mind! Care to cc a copy to the SA list? Hopefully you don't mean that you were antagonistic. Too many open source advocates sound like the crazy aunt in the attic, which alienates the corpo

[SAtalk] SA in the news: Reason, November issue

I reported this article last month when the magazine was on the stands. Now that the next issue is out, the contents of the previous issue are available online to read. --- This SF.net email is spons

Re: [SAtalk] Mailinglist-letter marked as spam every time

--On Tuesday, November 18, 2003 1:52 PM +0100 Martin Lyberg <[EMAIL PROTECTED]> wrote: > X-Spam-Report: > * 0.3 NO_REAL_NAME From: does not include a real name > * 0.2 PLING_QUERY Subject has exclamation mark and question mark > * 2.7 SUBJ_ILLEGAL_CHARS Subject contains too m

Re: [SAtalk] dnsbl and fake helo functions

--On Saturday, November 15, 2003 4:44 AM -0600 David B Funk <[EMAIL PROTECTED]> wrote: You say "MIMEDefang milter" which I take to indicate that you're using sendmail as your MTA. Sendmail has a built-in ability to use DNSBL and access databases to enable spam control based upon hostname & IP add

Re: [SAtalk] Salutation in subject

--On Friday, November 14, 2003 11:16 PM + Martin Radford <[EMAIL PROTECTED]> wrote: I don't think I've ever received legitimate mail like that, but I've certainly sent legitimate mail with the user's username in the subject line. This was some years ago, and I don't think I'd do that nowaday

Re: [SAtalk] Salutation in subject

--On Wednesday, November 12, 2003 2:43 AM -0800 Kenneth Porter <[EMAIL PROTECTED]> wrote: > Are there any rules to catch the salutation-in-subject pattern? > > This looks like something requiring an eval rule. It would check if the > subject starts with "name,", where

[SAtalk] SecuritySage spam filters and Postfix/SpamAssassin integration

--On Friday, November 07, 2003 12:42 AM -0500 Larry Gilson <[EMAIL PROTECTED]> wrote: You might want to look at SecuritySage for some configuration details. http://www.securitysage.com/guides/postfix_uce.html I just got some mail bounced by an ISP using this setup and after reviewing the detail

[SAtalk] Salutation in subject

Are there any rules to catch the salutation-in-subject pattern? This looks like something requiring an eval rule. It would check if the subject starts with "name,", where "name" is the first word in the To header. For instance, I get a lot of false negatives with "Kenneth," at the beginning of the

Re: [SAtalk] FROM_AND_TO_SAME Rule does not seem to work

--On Sunday, November 09, 2003 12:01 AM + Derek Jennings <[EMAIL PROTECTED]> wrote: These trigger the AWL test and come in with a low score, and are not detected by the FROM_AND_TO_SAME test which ought to find them. That test looks like it compares the entire From and To line, not just the

Re: [SAtalk] random localpart in "TO" address

--On Tuesday, November 11, 2003 9:18 AM +0200 Thomas Kinghorn <[EMAIL PROTECTED]> wrote: Does anyone know of a way to block mail sent to an invalid, random localpart. E,G. [EMAIL PROTECTED] [EMAIL PROTECTED] We are getting a lot of mails with "TO" addresses like the ones above. I know how to sto

RE: [SAtalk] New Obfuscation Technique?

--On Monday, November 10, 2003 8:20 PM -0500 Matt Kettler <[EMAIL PROTECTED]> wrote: It did however use a trick to avoid the standard FROM_AND_TO_SAME so your rule can help out by adding some score.. However, 104.1 is a bit excessive, since there's no white list to over-ride. (Bret is smart and d

[SAtalk] "Curn"?!

This seems to be the new favorite porn euphemism of spammers. (Often with a dot or other punctuation in the middle.) What's needed to get SA to start recognizing it as a synonym for "cum"? --- This SF.Net email sponsored by: ApacheCon 2003, 16-

Re: [SAtalk] a web-of-trust for antispam

--On Sunday, November 09, 2003 6:23 PM -0800 Justin Mason <[EMAIL PROTECTED]> wrote: Recently, there's been some work on getting a rudimentary web of trust up and running for antispam -- fundamentally, for whitelisting mail servers. More details at: http://www.web-o-trust.org/ Sounds interesti

Re: [SAtalk] Standard Spamd Deamon

--On Saturday, November 01, 2003 11:40 AM -0600 Masoud Pajoh <[EMAIL PROTECTED]> wrote: After a lot fulling with rpm's, at last I installed the latest Perl and then SA using CPAN. It would be useful to know what went wrong with the RPM's so either they can be fixed or the instructions can be im

[SAtalk] SA in the news: Reason

The November issue of Reason (http://www.reason.com/) has an article by Wendy Grossman (http://www.pelicancrossing.net/) on spam that mentions SA quite favorably. The article should appear on the Reason website once the December issue is released. -

Re: [SAtalk] using spamd/spamc to reject SMTP connection

--On Friday, October 31, 2003 3:27 PM -0600 Bob Apthorpe <[EMAIL PROTECTED]> wrote: > You could track the IP addresses of systems sending you spam from your > mail logs, drop those into a sendmail access list, then reject (5xx) or > tempfail (4xx) those systems for an hour or so, and reject more >

[SAtalk] tok_put atime uninitialized

I've seen several reports of this on the list but no resolution yet. Any clues, anyone? Here's a typical log line: spamd[6718]: Argument "" isn't numeric in numeric lt (<) at /usr/lib/perl5/site_perl/5.6.1/Mail/SpamAssassin/BayesStore.pm line 1245, line 24. Looking at BayesStore, it appears tha

[SAtalk] Bugzilla #2561 (uninitialized value in BayesStore.pm)

I was going to append a comment to the bugzilla but it reported an internal error, so I'll post the comment here before I lose it: I ran into the same thing, and ended up putting a dbg statement above the line in question to see what was going on. Looks like oldmagic was getting a corrupt value f

Re: [SAtalk] stats script, by (fairly) popular demand

--On Thursday, October 30, 2003 2:26 PM -0600 'mikea' <[EMAIL PROTECTED]> wrote: > my $s = grep /is spam/, @wholefile; # spam This doesn't work with my copy of SA, which is using spamc/spamd. Instead of "is spam", I get "identified spam". --

Re: [SAtalk] [OT] What is next step?

--On Monday, October 20, 2003 5:19 PM -0400 Roger Merchberger <[EMAIL PROTECTED]> wrote: Get rid of SMTP. Create an entirely new protocol on an entirely new port, and have it *trusted* every step of the way. Even if we had to licence its use [gawd, I'd hate that!] with abuse of this new protocol

Re: [SAtalk] Spamassassin updates

--On Friday, October 17, 2003 8:48 AM -0400 Chris <[EMAIL PROTECTED]> wrote: perl-Mail-SpamAssassin-2.60-1.i386.rpm spamassassin-tools-2.60-1.i386.rpm spamassassin-2.60-1.i386.rpm What does perl-Mai do? I assume all three need to be installed? SA is essentially a suite of Perl modules, with dr

Re: [SAtalk] CPAN or RPM's?

ro definition (says where the build will take place, instead of root's /usr/source/redhat), downloading the SA SRPM, and issuing "rpmbuild --rebuild .src.rpm" to recreate the binary RPM. Then su and install the binary RPM. I have this in my buildmeister's .rpmmacros: %_topd

Re: [SAtalk] Spamassassin updates

--On Thursday, October 16, 2003 7:40 PM -0400 Terry Milnes <[EMAIL PROTECTED]> wrote: > You're gonna have to excuse my ignorance here but I have to wonder how this > is done, presently for apache I do a pre configure then do the openssl, ssl > mod and perl mod, then pass 15 parameters onto the con

RE: [SAtalk] Off Topic BUT packages vs source

--On Thursday, October 16, 2003 1:53 PM -0500 Bill Polhemus <[EMAIL PROTECTED]> wrote: > However, I have never attempted to build SRPMS myself. Is this difficult to > do? A spec file (used to guide building an SRPM into an RPM) is just a text file with an RPM DB entry (eg. name, version, descript

RE: [SAtalk] Spamassassin updates

--On Thursday, October 16, 2003 2:25 PM -0400 Larry Gilson <[EMAIL PROTECTED]> wrote: > Regardless, issuing an 'rpm --rebuild' on the > RPMS is building from source and installing the resulting binary RPM is > installing from a source that was made on the target machine. If the original author wa

Re: [SAtalk] CPAN or RPM's?

--On Wednesday, October 15, 2003 10:37 AM -0400 Chris <[EMAIL PROTECTED]> wrote: > Now as I look more closely at CPAN I now see it's a perl replacement (or at > least I think it is) for the RPM method. Bearing in mind the comments on > whether or not RH will release another non-commerical version,

Re: [SAtalk] Spamassassin updates

--On Wednesday, October 15, 2003 3:50 PM -0400 Charles Gregory <[EMAIL PROTECTED]> wrote: > The docs say that 'local.cf' will not be affected by updates - it's the > "safe" place to put your local rules. Those error messages would seem to > suggest that is not quite true. That depends on how your

[SAtalk] Upgrade your SA! (was: image only porn)

--On Monday, October 13, 2003 6:04 PM -0400 "Carl R. Friend" <[EMAIL PROTECTED]> wrote: >Do. 2.60 fixes quite a few things, shuts down now-long-gone > RBLs, improves scoring, and (even though I was originally a > skeptic) performs well enough (sans Bayes). And like anti-virus software, anti-

Re: [SAtalk] [RD] Evil rules HUGE update!

--On Thursday, October 09, 2003 11:07 PM -0400 Matt Kettler <[EMAIL PROTECTED]> wrote: Yep, putting add-on rules in /etc/mail/spamassassin is a great place.. SA will automatically read every config file in that directory, not just local.cf. If you use spamd, restart it, just as you would if you e

[SAtalk] Spam-Fighter Humor: The Don't-Pay-For-Placement Search Engine

--- This SF.net email is sponsored by: SF.net Giveback Program. SourceForge.net hosts over 70,000 Open Source Projects. See the people who have HELPED US provide better ser

Re: [SAtalk] Spam: The Screwfly Solution

--On Monday, October 06, 2003 11:54 AM -0700 Mike Van Pelt <[EMAIL PROTECTED]> wrote: > Speaking of nasty little parasites, imagine a 419 spammer. > He gets 100,000 "bites" to his spam. Wow, he must have hit > the jackpot! Except... no. 99,999 of them are fake, > computer-generated "leads", whi

Re: [SAtalk] options for spamassassin

--On Thursday, October 02, 2003 3:49 PM -0700 Jill U'Ren <[EMAIL PROTECTED]> wrote: > The institution where I work is currently running SpamAssassin on a Red Hat > 7.2 box. I'm using MIMEDefang (a milter) on my 7.2 systems. There's a "recipe" on the MD website explaining how to discard high-scori

Re: [SAtalk] Who is spamming me - a bit of statistics

--On Saturday, September 27, 2003 7:07 PM -0500 Frank Pineau <[EMAIL PROTECTED]> wrote: I wouldn't wanna run my MTA via inet (or xinet). It would make more sense to use the script to generate an iptables rule (or whatever firewall you use). I'm not sure but can't sendmail be built with the tcpwr

Re: [SAtalk] Sa-learn not learning

--On Saturday, September 27, 2003 10:50 PM +1000 Trevor Rhodes <[EMAIL PROTECTED]> wrote: From which I assume I need this DB_File thingy. So I then do the following which I hope is right, and then I get this... Note that Red Hat supplies this in RPM form, as the perl-DB_File package. Many Perl

Re: [SAtalk] SPAM, BLOCK: Death of monkeys.com DNSbl (fwd)

--On Wednesday, September 24, 2003 11:12 PM -0700 Justin Mason <[EMAIL PROTECTED]> wrote: Yeah -- a GPG-signed, private NNTP network would work great. Just needs someone to code it all up ;) Jesting aside, you could start a new newsgroup for this purpose, with people posting the data to the new

Re: [SAtalk] SPAM, BLOCK: Death of monkeys.com DNSbl (fwd)

--On Wednesday, September 24, 2003 11:13 PM +0100 Daniel Bird <[EMAIL PROTECTED]> wrote: > A P2P DNSBL? interesting. I've also thought about this a little since the > death of Monkeys but also have no idea about how this would be implimented, > but certainly the model of something like direct conn

Re: [SAtalk] SPAM, BLOCK: Death of monkeys.com DNSbl (fwd)

--On Tuesday, September 23, 2003 3:07 PM -0500 Bob Apthorpe <[EMAIL PROTECTED]> wrote: > First Osirusoft, now monkeys.com. Which DNSBL is next? When do the > crosshairs move to SpamAssassin? Why are these systems not available through lots of secondaries, with a long expire time, so a DDoS can't

Re: [SAtalk] SpamAssassin 2.60 released!!

--On Monday, September 22, 2003 10:33 PM -0400 Theo Van Dinter <[EMAIL PROTECTED]> wrote: > http://SpamAssassin.org/released/Mail-SpamAssassin-2.60.tar.gz > http://SpamAssassin.org/released/Mail-SpamAssassin-2.60.tar.bz2 Not sure what you might do to fix this, but "rpmbuild -ta" with the bz2

RE: [SAtalk] All these Microsoft patch spams

--On Monday, September 22, 2003 10:15 PM -0400 Larry Gilson <[EMAIL PROTECTED]> wrote: > This is interesting. In 99% of my messages, the subject is capitalized but > the From/To are not. I see the same, but my distribution ratio would be the reverse of that. Maybe we have two variants of the wor

Re: [SAtalk] Spamd domain sockets implementation

--On Tuesday, September 23, 2003 6:48 AM + Jim <[EMAIL PROTECTED]> wrote: > spamd --socketpath=/path/to/socket/file > > spamc -U /path/to/socket/file If this is the recommended configuration, then I would suggest that 2.61 change the spec file to make use of this in RPM-based installations.

Re: [SAtalk] All these Microsoft patch spams

--On Sunday, September 21, 2003 10:31 PM -0400 Matt Kettler <[EMAIL PROTECTED]> wrote: > However, you could write a custom rule or two to pick these off. > > A body rule something like this should do: > > body LOCAL_SVEN_WORM /\bThis is the latest version of security update\b/ > score LOCAL_SVEN

Re: [SAtalk] New virus posing as Microsoft

--On Saturday, September 20, 2003 11:37 AM -0400 "Steven W. Orr" <[EMAIL PROTECTED]> wrote: By using spamass-milter you have the option of rejecting the message before reception completes. This way, the spammer knows that you have rejected his message and that you have not received it. Nope, he p

Re: [SAtalk] SA and tagging/removing

--On Wednesday, September 17, 2003 1:56 PM +0200 [EMAIL PROTECTED] wrote: > Why SA itself cannot delete??? It would be easy for programming, or not? Patches welcome. Note that SA isn't just one program, but a suite of tools. --- This sf.net

[SAtalk] Setting contact when building RPM

When building the RPM from the tarball, how do I set the CONTACT_ADDRESS? I suppose ideally the spec file should allow one to pass in a %define on the rpmbuild command line to set that. --- This sf.net email is sponsored by:ThinkGeek Welcome to

Re: [SAtalk] Re: [SA-Announce] SpamAssassin 2.60 rc4 released

--On Friday, September 12, 2003 12:07 PM -0600 Lucas Albers <[EMAIL PROTECTED]> wrote: Could someone post an updated redhat spec file for rc4? ln -s Mail-SpamAssassin-2.60-rc4.tar.gz Mail-SpamAssassin-2.60.tar.gz rpmbuild -ta Mail-SpamAssassin-2.60.tar.gz (The spec file in the tarball isn't expe

Re: [SAtalk] Fitz, an add-on to Spamassassin (fwd)

Forwarding this back to the list, as I think the technical details would be of general interest. Forwarded Message Date: Tuesday, September 09, 2003 9:57 AM +0200 From: Thorsten Sick <[EMAIL PROTECTED]> To: Kenneth Porter <[EMAIL PROTECTED]> Subject: Re: [

Re: [SAtalk] Fitz, an add-on to Spamassassin

--On Sunday, September 07, 2003 7:46 PM +0200 Thorsten Sick <[EMAIL PROTECTED]> wrote: > - The results of the AI alone are as good as Spamassassin's results. > Combined it is therefor better. What would make the combined result better? What does Fitz do different from SA? -

RE: [SAtalk] RH 9.0 issues

--On Saturday, September 06, 2003 11:49 PM -0500 Bill Polhemus <[EMAIL PROTECTED]> wrote: > The RPMs are good, but sometimes I just don't have the patience to wait till > someone comes out with them (and I don't the inclination to learn how to > make SRPMs myself). > > I like compiling from Sourc

Re: [SAtalk] I want SA to handle mailinglists. Need some creativity here.

--On Sunday, September 07, 2003 1:40 PM -0400 "Steven W. Orr" <[EMAIL PROTECTED]> wrote: > You're right. It's hooked up via aliases in the aliases file. I happen to > be using Majordomo2. But my understanding is that *all* mailinglist > managers use the aliases file as the hook. I will ask the m

RE: [SAtalk] redhat 8 rpm packages missing some files?

--On Saturday, September 06, 2003 11:51 PM -0500 Bill Polhemus <[EMAIL PROTECTED]> wrote: > Do what I did: Compile from the tarball sources. It's not that tough (can't > be if even I can do it). Note that for RPM users, the SRPM is essentially the same as the tarball, but provides the distro-spec

[SAtalk] Address in subject line

I see a lot of spam in which the first token on the subject line is something like "ken," or "shiva,", and I've never seen ham that does that. Are there any rules in 2.60 to catch that pattern, in which a token from the recipient address shows up as a greeting in the subject line? -

Re: [SAtalk] Re: heads-up: 2.60 will drop support for bayes dbs innon-DB_File formats

--On Thursday, August 28, 2003 11:14 AM -0500 Joe Breu <[EMAIL PROTECTED]> wrote: > Perl module. It can be found on CPAN (install DB_File). For RPM-based systems, choose one of these: --

Re: [SAtalk] Re: [SA-Announce] SpamAssassin 2.60-rc2 released!

--On Tuesday, August 26, 2003 11:42 PM -0400 Theo Van Dinter <[EMAIL PROTECTED]> wrote: No, this is a GDBM issue. There's a bug already open for it, and we're discussing what to do about it. Basically GDBM is stupid and doesn't allow control chars in the token keys. Which kind of sucks. ;) Wha

[SAtalk] FBI fraud reporting site

Just saw this on the DShield list: --- This SF.Net email sponsored by: Free pre-built ASP.NET sites including Data Reports, E-commerce, Portals, and Forums are available now. Do

  1   2   >