Re: [SAtalk] how to change the bayes auto_learn threshold to zero

At Wed Jan 28 23:01:48 2004, Brett Dikeman wrote: > > Martin Radford wrote: > > > It might be because you get the occasional false positive that you > > want to avoid (but all the rest come under your threshold). You > > probably would want these autolearned as ham. &

Re: [SAtalk] Bayes scoring

rent version is 2.63. > However, when an email is scored with BAYES_99 it is only get a 3.0 from In 2.6x, BAYES_99 scores 5.4. Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTED] | men just upload their important stuff -o) Registered Linux u

Re: [SAtalk] how to change the bayes auto_learn threshold to zero or above?

hese messages, and give them a negative score. These *will* cause Bayes to pick the messages up, as long as it takes them below the autolearn-as-ham threshold. Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTED] | men just upload their important stuf

Re: [SAtalk] help please....cant stop them at all.

At Fri Jan 23 21:30:58 2004, Martin Radford wrote: Five days to reach the list! I hoped SF would have cleared the backlog sooner than that! > This seems to be a signature with these mails, but I haven't put > together a rule for them yet. The following *might* work: > > hea

Re: [SAtalk] sa-learn & spamassassin question

t I've had to add specific rules to catch it. Once you've trained Bayes with a couple of these (assuming you're using Bayes, that is), it shouldn't have any problems with it. Check the list archives for my mail of 23rd Jan, in the thread "Re: [SAtalk] help

Re: [SAtalk] help please....cant stop them at all.

scores 0 (less than the 0.1 which stops auto-learning as ham). For example, just adding "pcodruts" and "aavilable" with a score of 0.1 each would make sure this probably wouldn't be learnt as ham. Martin -- Martin Radford | "Only wimps use tape backup

Re: [SAtalk] too much spam...

ssage scored 3.422 when it hit a rule scoring 5.0. The answer (for the benefit of the OP) is that the message hit BAYES_00, which gave -4.9 points. Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTED] | men just upload their important stuff -o)

Re: [SAtalk] Help: How to add files of tests?

= big_evil.cf ? "local" settings go in the /etc/mail/spamassassin directory. All files with names ending in ".cf" in that directory are read. See http://wiki.spamassassin.org/w/WhereDoLocalSettingsGo Martin -- Martin Radford | "Only wimps use tape backup

Re: Re[4]: [SAtalk] Set up

x27;m pretty sure that the "autolearn=" is always present, irrespective of whether or not Bayes is actually available. Obviously, if autolearn=ham or autolearn=spam, then Bayes *is* available. But you can't tell anything from autolearn=no. Martin -- Martin Radford | &q

Re: [WL] [SAtalk] Yikes.. rules_du_jour

est sent, awaiting response... 200 OK The clue is the "200 OK" message. If If-Modified-Since was being employed, the return code would have been "304 Not Modified". The overhead of this probably doesn't matter on this scale, though. Martin -- Martin Radford

Re: [WL] [SAtalk] Yikes.. rules_du_jour

straightforward way to avoid repeated downloads of a file that hasn't changed, by sending If-Modified-Since requests. Unfortunately wget doesn't yet support this, though it is mentioned in its TODO file. (This is with wget 1.9.1, which is the current version.) Perhaps there's a Perl module

Re: [SAtalk] Re: Filter rule f. invalid HTML tags?

ey appear regularly in ham, the rule You'll probably find that this isn't text/html. It looks more like text/enriched, which is defined in RFC1896. (text/enriched was based on the older "text/richtext", defined in RFC1341.) Martin -- Martin Radford | "On

Re: Re[2]: [SAtalk] what can we do with those spam mails

#x27;ve already modified the repeat counts for number of digits in L_MIME_BOUND_MANY_DIG, since it's not constant: header L_MIME_BOUND_MANY_DIGContent-Type =~ /boundary=\"\d{15,}\"/ changed from \d{19,} to \d{15,} Martin -- Martin Radford | "Only wimps use tape back

Re: [SAtalk] what can we do with those spam mails

score L_TITLE_MESSAGE 1.0 rawbody L_CONVERTED m{} describe L_CONVERTED Converted from text/plain score L_CONVERTED 1.0 Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTED] | men just upload their impor

Re: [SAtalk] Spam Assassin and Outlook Exchange Server

SA a different stage in the mail processing. Perhaps look at using MailScanner (www.mailscanner.info), which will enable you to integrate virus scanning at the same time. Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTED] | men jus

Re: [SAtalk] spam assassin - tru64 unix

quot;-m" value -- if it's set too low you run the risk of having a mail backlog build up with the result that mail gets delayed. Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTED] | men just upload their important stuff -o) Registered

Re: [SAtalk] Image-ONLY e-mails not filtered?

.0 for that particular rule, 1.0 for DATE_MISSING, and 1.9 for FROM_NO_LOWER (since we don't know whether or not those two hit on the original message which we haven't seen), the 7.5 total comes down to 3.6, which isn't going to get tagged as ham by a default SA install. Martin --

Re: [SAtalk] Ack...razor2 error =(

linux/IO/Socket.pm line 108, > line 358. > > Anyone seen this? http://wiki.spamassassin.org/w/RazorInsecureDependency Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTED] | men just upload their important stuff -o) Registered Linux use

Re: [SAtalk] FP with backhair

ext/plain. A text attachment should be text/plain, and hence I'd expect it to get scanned by SA. Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTED] | men just upload their important stuff -o) Registered Linux user #9257 | on ftp and l

Re: [SAtalk] FP on MY_HTTP_ODD_PORT

; However it is clearly not a non-standard port. SA is not distributed with any rules with that name, and the "MY_" prefix suggests that it's a local configuration. SA does have a WEIRD_PORT rule, which checks explicitly for :80, :443, and :8080 and isn't triggered if those

Re: [SAtalk] Trying to filter the blue pills beginning with V

hex equivalent (though this was to catch lower-case i with an acute accent in the word "penis"): body L_OBFU_PENIS /\b[Pp]en\xEDs\b/ You may need to play with the "od" command to find out what the hex (or octal) values are that you need. The examples you give

Re: [SAtalk] Is sa-learn supposed to take over 2 hours?

particularly on slower machines. It also depends on how many messages are in the mailbox. Is /var/spool/mail/cleveland really a directory, not an mbox file? Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTED] | men just upload their important stuff

Re: [SAtalk] False positive on MAILTO_TO_SPAM_ADDR

Email: > [EMAIL PROTECTED]" - NOTE this is NOT a link - just plain text. > > Is this a problem with the rule? Or with my understanding of it. SpamAssassin internally converts email addresses into mailto:s, as far as I can tell. The code is in PerMsgStatus.pm. Martin -- Martin R

Re: [SAtalk] Resource conservation

!^Subject: .*SAtalk * !^Subject: .*Razor-users | spamc The overhead of procmail is very much lower than the overhead of spamassassin or spamc/spamd. Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTED] | men just upload their important stuff -o) Register

Re: [SAtalk] Auto-learn bug

ham. To be honest, though, I can't think of any way round this, short of re-introducing the negative-scoring rules of early 2.5x which spammers will then proceed to abuse (as they did with 2.5x) :-( Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTED]

Re: [SAtalk] New siting: text after /HTML

acklash > pursuit monitory breakup isothermal gastrointestinal anarch dockside embouchure pogo > brilliant heigh banach antithetic patch attrition attainder hepburn crucify garry > fringe pulpit convene contrabass gnat deliquesce crime compendia evocable experiment > eclogue desi

Re: [SAtalk] [RD] Chickenpox Update

st line of the body when SA does its body checks. Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTED] | men just upload their important stuff -o) Registered Linux user #9257 | on ftp and let the rest of the world /\\ - see http://counter.

Re: [SAtalk] user vs local prefs

bvious guesses > as to how SA might be working. If they are not correct then the > proper statements and explanations really need to be added to the > documentation. Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTED] | men just upload thei

Re: [SAtalk] new razor issue

s/Razor2/Client/Config.p > m line 414, line 1. > > Anyone else noticed this? Is it a real problem?? http://wiki.spamassassin.org/w/RazorInsecureDependency Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTED] | men just upload their im

Re: [SAtalk] user vs local prefs

to use Bayesian learning -- it's not available at my workplace, for example. In many environments, I'd argue that users are not sufficiently sophisticated to use Bayes properly (i.e. by doing their own training and/or by correcting erroneous auto-learning), with the end

Re: [SAtalk] user vs local prefs

at you haven't got appropriate database support available on your system (you need the Perl DB_File module). Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTED] | men just upload their important stuff -o) Registered Linux user #9257 | on

Re: [SAtalk] user vs local prefs

oking for the BAYES_xx entries in the report that SpamAssassin adds. Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTED] | men just upload their important stuff -o) Registered Linux user #9257 | on ftp and let the rest of the world /\\ - see htt

Re: [SAtalk] points in header are different from points in report

mail takes through a system, but it's possible that other people on the list might know. Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTED] | men just upload their important stuff -o) Registered Linux user #9257 | on ftp and let the rest of

Re: [SAtalk] points in header are different from points in report

you've seen). For example, obvious issues here will be: > * 1.3 -- trail of Received: headers seems to be forged > * 0.5 -- Message has X-MSMail-Priority, but no X-MimeOLE > * 3.5 -- Forged mail pretending to be from The Bat! > * 0.6 -- Message looks like Outlook, but isn't M

Re: [SAtalk] Re: Having trouble coding a local rule

ike. Summary: with spam, trust nothing. Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTED] | men just upload their important stuff -o) Registered Linux user #9257 | on ftp and let the rest of the world /\\ - see http://counte

Re: [SAtalk] remove markup question and bayes question

ber of both ham and spam (but you can easily have more than twice as many ham as spam or vice-versa and still have Bayes work well). Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTED] | men just upload their important stuff -o) Registered Linux us

Re: [SAtalk] False positives

istaken) opinion of us. Others have taken a more sensible approach by *politely* pointing out his errors and being helpful. Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTED] | men just upload their important stuff -o) Registered Linux u

Re: [SAtalk] Some spam getting very low scores despite consistently using sa-learn

e the text/plain part is bigger than the text/html part (based on the assumption that where the two parts are substantively the same, the html part will be larger due to its markup). Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTED]

Re: [SAtalk] Ebay spoof?

OrgName:eBay, Inc OrgID: EBAY Address:2145 Hamilton Ave City: San Jose StateProv: CA PostalCode: 95008 Country:US NetRange: 66.135.192.0 - 66.135.223.255 CIDR: 66.135.192.0/19 Martin -- Martin Radford | "Only wimps use tape backup: _real_

Re: [SAtalk] user_prefs and many custom rules sets

an I drop > them into ~/.spamassassin as I would with the system-wide > /etc/mail/spamassassin? The only configuration file that is read in ~/.spamassassin is user_prefs. Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTED] | men just upload thei

Re: [SAtalk] How to include rules such as bigevil

t you seriously consider it. Even moving to 128MB will make a signicant difference. Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTED] | men just upload their important stuff -o) Registered Linux user #9257 | on ftp and let the rest of the world

Re: [SAtalk] replacing .cf files

rk. You can however add regexp-rules and scores, which you'll see discussed regularly on this list. Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTED] | men just upload their important stuff -o) Registered Linux user #9257 | on ftp and let

Re: [SAtalk] Provider issue

of spam for my contributions to SA's mass-checks). Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTED] | men just upload their important stuff -o) Registered Linux user #9257 | on ftp and let the rest of the world /\\ - see http://c

Re: [SAtalk] daily / weekly reports

At Thu Dec 18 12:03:19 2003, Martin, Jeremy wrote: > > By the way, I changed it a bit at the bottom to use html tables to > make it a bit more readable. Thought I'd post what I came up with > here in case anyone wanted to try it out. > > I'm using a little shell script as follows to save the outp

Re: [SAtalk] Clever spam (first of many, I'm afraid...)

x27;s Razor, pyzor, DCC to cope with. Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTED] | men just upload their important stuff -o) Registered Linux user #9257 | on ftp and let the rest of the world /\\ - see http://counter.l

Re: [SAtalk] This is an ebay phish right?

161-151-54.dsl.telesp.net.br > But, based only on the fact that this message came from > 12-229-8-208.client.attbi.com, and claims to be an ebay message, it's most > definitely a fraud. ebay does NOT send official notices directly from a > machine on a home-user at&t broadba

Re: [SAtalk] Preserving Mail Format

a similar (but not identical effect). Try running "spamassassin --lint" to see if it complains about any of the configuration settings. Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTED] | men just upload their important stuff -o) Registered L

Re: [SAtalk] sa-learn question (was: Eeek! Bayes expired itself out of existance!)

message. > Also, what is shown in the SA headers when bayesian classification > contirbutes tot he score of a message? The X-Spam-Status header will include BAYES_xx in the tests= section, where the "xx" indicates the "level" it has been scored at (e.g. BAYES_00,

Re: [SAtalk] OT Help: Mail form CGI script?

systems are > starting to reject the message (too many recipients). > > Any suggestions? Use bcc instead? Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTED] | men just upload their important stuff -o) Registered Linux user #92

Re: [SAtalk] Weird Word patch

27;t. Similarly, you could write a rule that penalised users who didn't follow the convention of leaving two spaces after a full stop. But I understand that some versions of typed English leave only one space. Martin -- Martin Radford | "Only wimps use tape backup: _rea

Re: [SAtalk] Is sa-learn learning?

e as an update from RedHat). > A general comment: sure would be nice if there were a FAQ for newbies > (like me) which would guide us through the installation/operation of > spamassassin. The requirement for DB_File to be installed to use Bayes is documented in the INSTALL file in the SA

Re: [SAtalk] Re: New spammer trick (HTML tables)?

At Sat Dec 6 23:21:54 2003, Scott A Crosby wrote: > > On Sat, 6 Dec 2003 22:04:15 + (GMT), Martin Radford <[EMAIL PROTECTED]> writes: > > > Hi all, > > > > I don't know how new this trick is, but I've not seen it before -- the > > spa

[SAtalk] New spammer trick (HTML tables)?

t; > href="http://www.e-buy-net.com/hgh/index.php?pid=evaph3839";>Folllow color=#ff0005>this linnk for more info! > > > Check out our discuont intenret specails, and get yuor FRREE boottles > of H GgH todaay! > > > > Martin -- Martin Rad

Re: [SAtalk] Sa-learn process

> Sounds reasonable to me. As long as you're *sure* non of those messages are mis-classified ham (though the higher the message is in that range, the more certain the OP can be that they were spam). Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAI

Re: [SAtalk] SA-Learn

learn with There's a reference to needing "several thousand of each [ham and spam]" in the sa-learn man page. This is an "OAQ" (occasionally asked question); the man page describes an ideal world (though in an ideal world one would not receive thousands of spams that one

Re: [SAtalk] .procmailrc

tray carriage-return character at the end of the "* ^X-Spam-Flag: YES" line. If you do, remove it, and things might start working correctly. Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTED] | men just upload their important stuff -o)

Re: [SAtalk] Another Procmail question

ggested you go elsewhere. The same would happen here if you started posting questions about some other anti-spam software (except we might be more polite than if this were usenet :-) Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTED] | men just

Re: [SAtalk] Run Away SA...

until the peak passes, but your server will continue accepting mail. Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTED] | men just upload their important stuff -o) Registered Linux user #9257 | on ftp and let the rest of the world /\\

Re: [SAtalk] An Open Letter to the SA-talk forum

r > i386-linux.) I've got SA 2.60 running just fine on my Red Hat 6.1 box with the version of Perl that came with it (5.005). The SA developers have stated that SA 2.6x will be the last versions they will support on Perl 5.005; future versions will require Perl 5.61. Ma

Re: [SAtalk] bayes

pam. If you say you've learned a few hundred spam, something has gone wrong, but I couldn't say what. Try deleting your Bayes database and start again. Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTED] | men just upload their important stu

Re: [SAtalk] Score

> > Is there a simple explanation for this? Yes, and it's even in the FAQ. http://spamassassin.taint.org/faq/index.cgi?req=show&file=faq04.017.htp > Is there a better way, e.g. does SA set an exit code with the hit value in? I don't believe so. Martin -- Martin Radford

Re: Re[2]: [SAtalk] What is marked as spam

then I believe Bayes is turned on. I'm pretty sure the "autolearn=" bit is there irrespective of whether or not Bayes is on. Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTED] | men just upload their important stuff -o) Registe

Re: [SAtalk] Really bad Infoworld article

at least have been told that using a package 10 months old and a couple of major revisions (2.4x -> 2.5x -> 2.6x) out of date was not a good idea. Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTED] | men just upload their important stuff -

Re: [SAtalk] header x-spam-status problem

sage came from RBL rules, and of course those won't be hit the second time around. Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTED] | men just upload their important stuff -o) Registered Linux user #9257 | on ftp and let the rest of t

Re: [SAtalk] SA-Learn. Clarification question.

Anomy. I'd say that you'll need to use the messages in whatever format Bayes originally learned them. Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTED] | men just upload their important stuff -o) Registered Linux user #9257 | o

Re: [SAtalk] SA-Learn. Clarification question.

ivate for > testing e.g. false negatives before enough false positives have been > learned? Bayes won't start working until it has learned 200 hams and 200 spams. Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTED] | men just uploa

Re: [SAtalk] Salutation in subject

At Sat Nov 15 10:12:56 2003, Kenneth Porter wrote: > > --On Friday, November 14, 2003 11:16 PM + Martin Radford > <[EMAIL PROTECTED]> wrote: > > > I don't think I've ever received legitimate mail like that, but I've > > certainly sent legitimate

Re: [SAtalk] Salutation in subject

do this? I don't think I've ever received legitimate mail like that, but I've certainly sent legitimate mail with the user's username in the subject line. This was some years ago, and I don't think I'd do that nowadays. Martin -- Martin Radford | "

Re: [SAtalk] more spam since installing 2.60

ng four to five times as much spam as I did even a few months ago. I don't know whether this is spammers' retribution for my contributions to this list, or just a general increase in the level of spam. Martin -- Martin Radford | "Only wimps use tape backup: _real_

Re: [SAtalk] CPU Usage while sa-learning?

nds if they can't get the lock, but if your server is busy enough, you may well get several processes waiting. Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTED] | men just upload their important stuff -o) Registered Linux user #9257 |

Re: [SAtalk] Spamassassin and Exim [RESOLVED]

hat you're running 2.31 or earlier; 2.31 is already over 18 months old! Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTED] | men just upload their important stuff -o) Registered Linux user #9257 | on ftp and let the rest of the world

Re: [SAtalk] Rule Emporium Update!

in ==> or => or just > depending on the length of the string. Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTED] | men just upload their important stuff -o) Registered Linux user #9257 | on ftp and let the rest of the world /\\ - see htt

Re: [SAtalk] Can you customize the body of a spam message

nge 10_misc.cf -- change /etc/mail/spamassassin/local.cf so you don't lose the changes when you upgrade. Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTED] | men just upload their important stuff -o) Registered Linux user #9257 | on ftp a

Re: [SAtalk] tests not updated on the SA website?

t lower the Outlook related tests' scores, but that would > let a lot of spam through. That would fix the problem in the short term. Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTED] | men just upload their important stuff -o)

Re: [SAtalk] [RD] Meta rules vs. SA version

g a > spamassassin -D --lint. The '+' is throwing it off. > > I wonder if that feature is 2.60 dependant? That syntax was in use in 2.50, for (at least) the Nigerian rules. It isn't present in 2.44. Martin -- Martin Radford | "Only wimps use

Re: [SAtalk] Auto-Learn

it (on the basis that you're a human and know whether a message is ham or spam), while the auto-learning is much more conservative to avoid learning spammy-looking ham in error. Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTED] | men just upload

Re: [SAtalk] [RD] Open source is Naughty!!!

ing to the middle regex to match the strings > you're interested in? There has been a lot of spam which matches this pattern: /\b[Pp]en\xEDs\b/ \xED is a letter "i" with an acute accent, IIRC. Martin -- Martin Radford | "Only wimps use tape backup: _re

Re: [SAtalk] Auto-Learn

indicates that this particular message was not learned from, not that autolearning as a whole is switched off. Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTED] | men just upload their important stuff -o) Registered Linux user #9257 | on ftp an

Re: [SAtalk] Disable FORGED_MUA_IMS tests

n scans the new message. The new message does not have spammy headers and hence gets a lower score. I'm puzzled as to how both got the FORGED_MUA_IMS, though, if the encapsulation did happen. Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTE

Re: [SAtalk] 0 messages

t 70% filtering). Am I doing > > > something wrong? What is suppose to happen? > > > > Try these couple of things. > > > > a) run it with the debug flag -d > > > > sa-learn -D --spam --mbox spam > > Martin -- Martin Radford |

Re: [SAtalk] symbols and punctuation in subject

any particular test. > > I looked at the list of tests and didnt see anything that addressed it. What if > there were a test that looked for somewhat unusual symbols and characters like > > | ` ~ * ^ [ > > and so on, with a higher incidence of any one of these earning more p

Re: [SAtalk] Disable FORGED_MUA_IMS tests

y this? > I tried putting > forged_mua_ims 0 > in /etc/mail/spamassassin/local.cf but no luck. > Would I be able to put something like: > score forged_mua_ims 0 > in the local.cf file? Yes, but you must remember that SA is case-sensitive. score FORGED_MUA_IMS 0 shou

Re: [SAtalk] Error in mail logs relating to SPAMD

assassin under the > SPAMDOPTIONS"-d -c -a -m5 -H" > adding the -u=spamd option gives errors saying I'm pretty sure you need to add -u spamd (i.e. no '='). I would guess that -u=spamd would cause SA to try to use the username "=spamd". Martin --

Re: [SAtalk] Whitelist / Rule Question...

username" mail, or someone I know who simply didn't bother to capitalise my first name. Of course, if the first part of my address was "mr1267", Hello, mr1267 would stand out as being spammy. So the effectivemess of "hello, username" rules depends on the format o

Re: [SAtalk] need help sizing a dedicated server

ce being a close #2. I'd think it's not necessarily "more drive space" but perhaps "faster disks" and "more disks" to keep throughput high and disk contention low. Martin -- Martin Radford | "Only wimps use tape backup: _real_ [

Re: [SAtalk] Building SA 2.60, errors

out of the codebase for 2.70. Given that none of the developers use 5.005 regularly (the reason why we currently get so many minor bugs that hit 5.005 users), it seems unlikely that that SA 2.70 will work under 5.005 even if the current compatibility code isn't removed by then. Martin -- Martin

Re: [SAtalk] [OT] What is next step?

27;t think sending mail to apnic.net about spammers is likely to be productive -- they just allocate address space to ISPs. Ditto for RIPE, ARIN, and LACNIC. Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTED] | men just upload their important

Re: [SAtalk] Re: Swap Space

tup if the user didn't specify a -m value on the startup command-line. One might also imagine spamd doing some OS-dependent checks to guess at what might be a reasonable default -m value, but I think that's going a bit far :-) Thoughts, flames? Martin -- Martin Radford

Re: [SAtalk] X-Transfer-number and X-Transfer-stamp ?

ed in those standards. > 2) Worth coding rules for? There have been a few reports on this list of spam appearing with these headers in place. I would guess it would be worth adding rules for this -- I've never seen these headers in legitimate mail. Martin -- Martin Radford |

Re: [SAtalk] strange behavior of Bayesian analyzer in SA 2.6

this when I first upgraded to one of the pre-releases of 2.60. The developers said that this was due to changing the method of calculating the Bayes score. The newer code is much more likely to cluster around 0, 0.5, and 1. I have seen a few messages outside those cluster areas, but not too

[SAtalk] Possible rule - excessive punctuation in subject

I suspect this would work better as an eval rule, but I'm not confident enough to try to write one. Any comments on whether this is a reasonable approach? I'll bugzilla this tomorrow. Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTED]

Re: [SAtalk] Bayes not working.. On System Wide SA

output a '.' to the screen for each message processed. Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTED] | men just upload their important stuff -o) Registered Linux user #9257 | on ftp and let the rest of the world

Re: [SAtalk] HTML character entities

> SA 2.55, Razor 2 The rule itself is present in the current version of SA -- 2.60. I don't know why it doesn't appear in the list of tests on the website, though. Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTED] | men just upl

Re: [SAtalk] Problems sending to list

message probably contained the regular expression that was matched, but going on previous reports, it was probably the name of a blue diamond-shaped pill used to treat impotence. The V-drug. Rhymes with "Niagara". Martin -- Martin Radford | "Only wimps use tape backup

Re: [SAtalk] Forged mail pretending to be from MS

Outlook 11. That would mean that the check would still work for checking mail apparently sent by Outlook <=11. Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTED] | men just upload their important stuff -o) Registered Linux

Re: [SAtalk] Sa-learn not learning

ned from 0 message(s) (1 message(s) examined). You don't give much to go on here. What format are the messages in? Is it a single message? A firectory full of messages? An mbox format file? What command-line are you using? Martin -- Martin Radford | "Only wim

Re: [SAtalk] lots of false positives in 2.60

t gives spammers something to abuse, and I'd expect that's why they've mostly vanished in 2.60. There was a lot of abuse of negative-scoring rules in 2.5x (x<=3). Options - whitelist these mailing lists, or write your own rules to give a negative score to them to compensate in

Re: [SAtalk] lots of false positives in 2.60

normal? is it safe to use all of the rules from the 2.55 > distribution while running 2.60? No. The rules go with the release. You may well find that it simply doesn't work. Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTED] | men just

Re: [SAtalk] Why is auto-learn set to no?

as spam, and only the most hammy-looking messages get learned as ham. There's a wide range where SpamAssassin plays it safe and doesn't learn, rather than possibly making a mistake. Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTED] |

Re: [SAtalk] Why is auto-learn set to no?

high enough. It doesn't mean autolearning is disabled. Interesting point. Perhaps instead of "autolearn=", it should read: autolearnt=ham/spam/no or autolearned=ham/spam/no (depending on spelling preference :-) Martin -- Martin Radford | "Only wimp

  1   2   3   >