RE: [SAtalk] a very ugly spam trick

2003-03-26 Thread Michael Moncur
on header checks and network tests. SpamAssassin can ignore most HTML tricks like this, although I'm a bit surprised this message didn't match one of the 'obscuring comment' rules. -- Michael Moncur mgm at starlingtech.com http://www.starlingtech.com/ "Early mo

RE: [SAtalk] Attachments vs the 2.4 way of doing it

2003-03-21 Thread Michael Moncur
- presumably when the 'nospam' is stripped it creates an invalid address, but real users can still reply. I get a few spam to that address, but not nearly as many as other addresses that have been posted to newsgroups. -- Michael Moncur mgm at starlingtech.com http://www.starlingte

RE: [SAtalk] 'ADV:' spam

2003-03-04 Thread Michael Moncur
something wrong in someone's corpus? It would seem like "ADV:" would only match spam. Looking at the rules, neither requires the colon. Maybe a rule that checked for ADV: or [ADV] would get a higher score? -- Michael Moncur mgm at starlingtech.com http://www.starlingtech.com/ &q

RE: [SAtalk] FormMail.pl spam

2003-01-14 Thread Michael Moncur
Ed Weinberg wrote: > I am surprised that SA does not recognize spam sent by FormMail.pl. The BUGGY_CGI rule catches that, it's been in SA for a long time. It must work (in conjunction with other rules) because I haven't had a formmail spam slip through in at least 6 months. -- M

RE: [SAtalk] mail with ONLY html

2003-01-14 Thread Michael Moncur
s are trying to work best for all users. -- Michael Moncur mgm at starlingtech.com http://www.starlingtech.com/ "Every crowd has a silver lining." --Phineas Taylor Barnum --- This SF.NET email is sponsored by: FREE SSL Guide from Th

RE: [SAtalk] SA + razor + pyzor working together

2003-01-11 Thread Michael Moncur
Razor function but Pyzor breaks. I'm using -H /home/spam, and since /home/spam is the home for both Razor2 and Pyzor, that may be why mine works and yours doesn't. I just double-checked, and checking and reporting work fine with Razor2, Pyzor, and DCC. -- Michael Mo

RE: [SAtalk] ok_locales xx

2003-01-11 Thread Michael Moncur
gered. > And, yes, I was also confused by the wording in that man page. Me too. I could still be wrong. -- Michael Moncur mgm at starlingtech.com http://www.starlingtech.com/ "The future is much like the present, only longer." --Dan Quisenberry --

RE: [SAtalk] ok_locales xx

2003-01-11 Thread Michael Moncur
add points for anything non-English ok_languages en fr -- add points for anything but English or French ok_languages all-- turn off language checking The rule UNDESIRED_LANGUAGE_BODY is used to add points to messages for this one. Its score is 3.97 by default in 2.43. -- Michael Mo

RE: [SAtalk] re: Hispeedmedia: spam with images as content

2003-01-08 Thread Michael Moncur
r-Version =~ /v / describe MGM_DAILY_Mmgm: frequent spam header score MGM_DAILY_M 3.0 -- Michael Moncur mgm at starlingtech.com http://www.starlingtech.com/ "2 is not equal to 3, not even for large values of 2." --Grabel's Law -

RE: [SAtalk] spamassassin v. snortmonster's sniffer

2002-12-31 Thread Michael Moncur
sin test, but I think SA with Bayes and Razor would be far more useful. -- Michael Moncur mgm at starlingtech.com http://www.starlingtech.com/ "All that is human must retrograde if it does not advance." --Edward Gibbon --- This sf.

RE: [SAtalk] hits vs. points

2002-12-30 Thread Michael Moncur
that matches five or more rules is marked spam, and it's really far more sophisticated than that. -- Michael Moncur mgm at starlingtech.com http://www.starlingtech.com/ "I'm going to memorize your name and throw my head away." --Oscar Levant

RE: [SAtalk] Increase in low scoring spam?

2002-12-23 Thread Michael Moncur
e improved HTML percentage tests) catch them. BTW, I think a threshold of 3.0 is a bad idea. But that's just me. I keep mine at 7.0 and I've still had a false positive or two. (caused by RBLs) -- Michael Moncur mgm at starlingtech.com http://www.starlingtech.com/ "Time sneaks up

RE: [SAtalk] Doh: false positive *SPAM* Majordomo results (fwd)

2002-12-13 Thread Michael Moncur
y message on the list! Trust me, list admins love this. After using a Web spamtrap for a couple of months I found all sorts of innocent mailing lists piling up in the 'spam' corpus. So I dropped that one and now only use old addresses and never-used addresses (spammers love to guess) as

RE: [SAtalk] Re: OT: No tag? (was: sql support)

2002-12-13 Thread Michael Moncur
ad-Topic - otherwise this is a hole big enough for a spammer to drive a truck through... -- Michael Moncur mgm at starlingtech.com http://www.starlingtech.com/ "Everything you can imagine is real." --Pablo Picasso --- This sf.net ema

RE: [SAtalk] Unable to mail SpamAssassin.Org

2002-12-11 Thread Michael Moncur
> FWIW, there are no addresses at SpamAssassin.org worth mailing. > Everyone lives elsewhere ;) The "FAQ Owner" link on the FAQ page goes to [EMAIL PROTECTED] - perhaps it shouldn't? -- Michael Moncur mgm at starlingtech.com http://www.starlingtech.com/ "If the P

RE: [SAtalk] 2.50CVS false positives

2002-12-06 Thread Michael Moncur
SPAM: * 0.0 -- BODY: T_HTML_P1_80_100 SPAM: * 0.0 -- BODY: T_HTML_TAG_EXISTS_CENTER SPAM: * 0.0 -- BODY: T_HTML_SHOUTING1 SPAM: * 0.0 -- BODY: T_HTML_WIN_FOCUS SPAM: * 0.0 -- BODY: T_HTML_CONSEC_IMGS04 SPAM: * 0.0 -- BODY: T_HTML_NUM_IMGS07 SPAM: * 2.7 -- Listed in DCC, see http:/

[SAtalk] Updated DailyPromotions / HSM rules

2002-12-05 Thread Michael Moncur
-Mailer-Version =~ /v / describe MGM_DAILY_Mmgm: frequent spam header score MGM_DAILY_M 3.0 uri MGM_HSM /hsmedia/i describe MGM_HSMmgm: Hi-Speed Media: frequent spammer score MGM_HSM 1.5 -- Michael Moncur mgm at starlingtech.com http://www.starlingtech.com

RE: [SAtalk] 2.50CVS false positives

2002-12-05 Thread Michael Moncur
SpamAssassin results -- Michael Moncur mgm at starlingtech.com http://www.starlingtech.com/ "Women who seek to be equal with men lack ambition." --Timothy Leary --- This sf.net email is sponsored by:ThinkGeek Welcome to geek heave

RE: [SAtalk] 2.43 - too many false negatives

2002-12-05 Thread Michael Moncur
; Subject: E-mail to Groups? Download ZIM FastFeedback Now to Coordinate E-mail Responses -- Michael Moncur mgm at starlingtech.com http://www.starlingtech.com/ "Fashion is something that goes in one year and out the other." --Unknown

RE: [SAtalk] 2.43 - too many false negatives

2002-12-05 Thread Michael Moncur
core MGM_DAILY_M 3.0 body MGM_DISC /To discontinue the receipt of emails/i describe MGM_DISC mgm: Discontinue receipt of emails score MGM_DISC 2.5 -- Michael Moncur mgm at starlingtech.com http://www.starlingtech.com/ "It is impossible to defeat an ignoran

RE: [SAtalk] Question on the list of tests

2002-11-27 Thread Michael Moncur
cc-tree/dcc.html DCC_CHECK 2.660 Listed in Pyzor, see http://pyzor.sf.net/ PYZOR_CHECK 2.500 -- Michael Moncur mgm at starlingtech.com http://www.starlingtech.com/ "All science is either physics or stamp collecting." --E. Rutherford --

[SAtalk] Bayes and SpamAssassin markup?

2002-11-23 Thread Michael Moncur
ed to remove it from my test corpora? I know there were some recent changes in this regard but don't know where things ended up. (Hoping I don't need to run spamassassin -d over 5000 messages, it takes forever.) Thanks! -- Michael Moncur mgm at starlingtech.com http://www.starlingtech.c

RE: [SAtalk] Is to identify yourself by return email necessary in the future?

2002-11-22 Thread Michael Moncur
a major annoyance. I'm aware that whitelist systems are the only way to truly dump 100% of spam, but SA+Razor2 comes so close to eliminating my spam problem entirely that it's not worth making everyone who wants to email me jump through hoops. -- Michael Moncur mgm at starlingtech.com ht

RE: [SAtalk] Is to identify yourself by return email necessary in the future?

2002-11-22 Thread Michael Moncur
mail-spidering software used by spammers won't see them. The method I use is to have email forms on my Web sites, these send mail directly to me and are invulnerable to spammers. Passwords might be a good compromise if you do lots of posting to USENET, though. -- Michael Moncur mgm at starlingt

RE: [SAtalk] Is to identify yourself by return email necessary in the future?

2002-11-21 Thread Michael Moncur
hing scoring 5 to 10). The trouble with that is that SpamAssassin works so well, I've only had about 5 false positives in the last two months, and all of them were automated emails that wouldn't have made it through TMDA anyway... -- Michael Moncur mgm at starlingtech.com http://www.star

RE: [SAtalk] Bayesian attack

2002-11-20 Thread Michael Moncur
Kall us now to find out the sekrit to mass emial marketting techniques that will maek you hundredds of dolars in the first two moths! If they do defeat the filter that way, though, we've achieved our goal of making the spammers look (even more) like complete idiots. -- Michael Moncur mgm at starling

RE: [SAtalk] false positive

2002-11-07 Thread Michael Moncur
I tried to get this to happen and it didn't set off that rule. Try posting a bug to bugzilla.spamassassin.org and attaching the entire message (as an attachment, not cut and paste) -- Michael Moncur mgm at starlingtech.com http://www.starlingtech.com/ "Confusion is always the m

RE: [SAtalk] DCC Or Razor2?

2002-11-06 Thread Michael Moncur
am is tagged by one of them. -- Michael Moncur mgm at starlingtech.com http://www.starlingtech.com/ "I do not fear computers. I fear the lack of them." --Isaac Asimov --- This sf.net email is sponsored by: See the NEW Palm Tungsten T hand

RE: [SAtalk] Well written spam advertising how to spam

2002-11-05 Thread Michael Moncur
an address and send mail to that forever. (Just finished auditing my email logs for new spamtrap addresses. Addresses that have never existed for legitimate mail but still receive regular spam include webmaster@domain, sysop@domain, e@domain, jobs@domain, hostmaster@domain, sales@domain, [EMAIL PROTEC

RE: [SAtalk] You have a secret admirer

2002-10-30 Thread Michael Moncur
hether someone actually entered SAtalk as "someone they admire." (I tried to log in as SAtalk to find out who admires us, but someone has already registered that address and I couldn't guess the password.) -- Michael Moncur mgm at

RE: [SAtalk] AWL broken in 2.43?

2002-10-28 Thread Michael Moncur
g their spam and reporting false positives. Since users are hopefully going to be reporting messages as spam or nonspam for Bayesian purposes anyway, it would be pretty easy to hook this up to the AWL. -- Michael Moncur mgm at starlingtech.com http://www.starlingtech.com/ &

RE: [SAtalk] Understanding the Spam Phrase Scores

2002-10-25 Thread Michael Moncur
at score to set for a new phrase? The scores were calculated by a program that scans through a spam corpus looking for phrases. I don't think there's a non-spam component, which is why "from our" has a high score, among others. I don't think it's meant for adding ph

RE: [SAtalk] Generating Statistics (new graph enclosed)

2002-10-24 Thread Michael Moncur
eep them because SA takes care of 99% of the problem. I cringe every time someone says "what's the big deal, just press Delete." Try that when you have 15X as much spam as real email... -- Michael Moncur mgm at starlingtech.com http://www.starl

RE: [SAtalk] MS Outlook gets weirder with 2002

2002-10-24 Thread Michael Moncur
hould add .78 points to every single nonspam message, I have set the score for this rule to zero on my system. -- Michael Moncur mgm at starlingtech.com http://www.starlingtech.com/ "Every crowd has a silver lining." --Phineas Taylor Barnum

RE: [SAtalk] a couple of newbie questions

2002-10-23 Thread Michael Moncur
-report feature for quite some time. (was it 2.30 that changed this?) The developers agree with you. -- Michael Moncur mgm at starlingtech.com http://www.starlingtech.com/ "Pity the meek, for they shall inherit the earth." --Don Marquis --

RE: [SAtalk] AWL problem ...

2002-10-22 Thread Michael Moncur
ng the SA lists for some reason) -- Michael Moncur mgm at starlingtech.com http://www.starlingtech.com/ "Spare no expense to save money on this one." --Samuel Goldwyn --- This sf.net emial is sponsored by: Influence the futu

RE: [SAtalk] English version of the "Tests Performed"?

2002-10-22 Thread Michael Moncur
d 20_head_tests.cf. There's an online copy of this if you haven't downloaded SpamAssassin: http://www.spamassassin.org/dist/rules/ -- Michael Moncur mgm at starlingtech.com http://www.starlingtech.com/ "The covers of this book are too far apart." --Ambrose Bierce -

RE: [SAtalk] Consistency between releases

2002-10-17 Thread Michael Moncur
positive. I then move the valid spam to my spam corpus. 20+: "definitely spam" - dumps into a mailbox file on the server where I scan through it every couple of weeks just in case, then add it to my spam corpus. (In about 4 months using this system, I haven't yet had a 20+ false po

RE: [SAtalk] Consistency between releases

2002-10-16 Thread Michael Moncur
e a probably-spam threshold of 7 and a definitely-spam threshold of 20) -- Michael Moncur mgm at starlingtech.com http://www.starlingtech.com/ "It is easier to forgive an enemy than to forgive a friend." --William Blake --- This sf.net em

RE: [SAtalk] Re: AWL bug in 2.42?

2002-10-08 Thread Michael Moncur
10 had a negative AWL adjustment. > I'll check in the reversion now... I guess this means we'll need to > do a 2.43 soonish. This does seem to be causing some confusion. -- Michael Moncur mgm at starlingtech.com http://www.starlingtech.com/ &qu

RE: [SAtalk] Re: AWL bug in 2.42?

2002-10-07 Thread Michael Moncur
e who sends more than x messages must not be a spammer? That's far from true in my experience. I often get 5-10 copies of the same spam from the same sender address. Not to mention the fact that this is a very easy way for spammers to whitelist themselves, just by doing what they do bes

RE: [SAtalk] ok_locales question

2002-10-05 Thread Michael Moncur
I can submit a patch for the docs if nobody else does. -- Michael Moncur mgm at starlingtech.com http://www.starlingtech.com/ "Famous remarks are very seldom quoted correctly." --Simeon Strunsky --- This sf.net email is sponsored b

RE: [SAtalk] ok_locales question

2002-10-05 Thread Michael Moncur
uot;all") > I think the following is correct: > > ok_locales en # Disable all of ja, ko, ru, th, zh > ok_locales all # Allow all of ja, ko, ru, th, zh > ok_locales ja ko # Allow standard english locales, disable ru, th, zh That makes sense. -- Michael Moncur mgm at s

RE: [SAtalk] ok_locales question

2002-10-05 Thread Michael Moncur
> ok_languages en > > It must be listed, that's where I got it ;-) That's nice, but I was talking about ok_locales. Completely different thing. Anyone know whether "en" is valid for ok_locales? I thought it was at one time. -- Michael Moncur

[SAtalk] ok_locales question

2002-10-05 Thread Michael Moncur
marked as possibly > being spam in a foreign language. -- Michael Moncur mgm at starlingtech.com http://www.starlingtech.com/ "Students achieving Oneness will move on to Twoness." --Woody Allen --- This sf.net email is s

RE: [SAtalk] New breed of SPAM?

2002-10-02 Thread Michael Moncur
looks for an IMG tag and not much else might be good too. -- Michael Moncur mgm at starlingtech.com http://www.starlingtech.com/ "No human thing is of serious importance." --Plato --- This sf.net email is spo

RE: [SAtalk] Some spam values

2002-09-27 Thread Michael Moncur
; The point is, these are the ones that were negative in the stock > scores that really seem like they should be positive. These are virtually all fixed in the new scores, and using those will get you much better results than making up your own scores. Wait for the 2.42 release in a few da

RE: [SAtalk] Osirusoft - trustworthy?

2002-09-26 Thread Michael Moncur
om zone that only lists SPEWS, we could use that in a meta rule. -- Michael Moncur mgm at starlingtech.com http://www.starlingtech.com/ "It is better to be quotable than to be honest." --Tom Stoppard --- This sf.net email is sponso

RE: [SAtalk] Outlook Configuration

2002-09-26 Thread Michael Moncur
X-Spam-Flag header. I had the best results detecting "X-Spam-Level: *" (or your preferred number of stars). I finally just used procmail to send the spam to a different POP mailbox and let Outlook filter based on the account it came in on. Probably not an option for everyone. :) -- M

RE: [SAtalk] Graphics-only spam?

2002-07-24 Thread Michael Moncur
now would be to make it a rawbody test and strip the tags myself. -- michael moncur mgm at starlingtech.com http://www.starlingtech.com/ "Nobody can be exactly like me. Even I have trouble doing it." -- Tallulah Bankhead

RE: [SAtalk] faked `From: whatever@amazon.com'

2002-07-14 Thread Michael Moncur
mazon and registered for lots of things at Yahoo. I get 2-300 spams a week and not a single one has EVER been from any of those companies. Nonetheless, I'm currently unwhitelisting Amazon and eBay because spammers frequently fake their 'from' addresses using these two. -- michael mon

[SAtalk] The Spamming Bureau

2002-07-13 Thread Michael Moncur
am. Yeah, right. -- michael moncur mgm at starlingtech.com http://www.starlingtech.com/ "Everywhere is walking distance if you have the time."-- Stephen Wright --- This sf.net email is sponsored by:ThinkGeek Wel

RE: [SAtalk] Re: RBL for URLs, E-Mail Addresses, Phone Numbers, etc.?

2002-07-11 Thread Michael Moncur
;t be a problem from a SpamAssassin perspective - the score would be under 5 - but I'm worried that if you do set up an RBL for things like this, some misguided ISPs will start using it to dump email wholesale... As happens with every other RBL. Maybe this would be better as a DCC-type system

RE: [SAtalk] spam high scores

2002-07-10 Thread Michael Moncur
> It's a few bits of perl I threw together. I didn't make it public mostly > because I just didn't get around to it. ;) Thanks! I'll have to play around with that. Now I just wish there was some way to report messages from Outlook without losing 90% of the headers.

RE: [SAtalk] Spamassassin whitelist configuration...

2002-07-09 Thread Michael Moncur
e easily using procmail or your local equivalent. -- michael moncur mgm at starlingtech.com http://www.starlingtech.com/ "It was a book to kill time for those who like it better dead." -- Dame Rose Macaulay --- This sf.

RE: [SAtalk] SpamAssassin is not checking against razor

2002-07-09 Thread Michael Moncur
> mysql> select COUNT(*) from reported where date > '2002-06-26 > 00:00:00' and rules like > '%RAZOR_CHECK%'; Hey, cool. How did your reported spam end up in MySQL? Any chance you can share the script that's doing that? -- michael moncur mgm at starli

RE: [SAtalk] Re: spam high scores

2002-07-09 Thread Michael Moncur
L: Received via a relay in orbs.dorkslayers.com [RBL check: found 157.90.38.194.orbs.dorkslayers.com.] * 2.0 -- RBL: Received via a relay in relays.osirusoft.com [RBL check: found 1.191.99.210.relays.osirusoft.com.] * -2.0 -- RBL: Do not double penalize for being an open relay on O

RE: [SAtalk] INVESTMENT ASSISTANCE

2002-07-06 Thread Michael Moncur
all_spam_to, in fact, because whitelist_to isn't enough for some of the messages that discuss spam. If spam to this list actually became a problem I suppose I'd have to do something else. -- michael moncur mgm at starlingtech.com http://www.starlingtech.com/ "Nothing is said

RE: [SAtalk] Re: how do you tell what's a reply to your own outgoing mail?

2002-07-04 Thread Michael Moncur
the mailing lists I subscribe to, but we shouldn't expect most users to bother with things like that. Of course, having negative rules for common mailing list software / systems would accomplish the same thing. (Not hugely negative, just enough to claw back a few points.) -- michael moncur

RE: [SAtalk] Re: how do you tell what's a reply to your own outgoing mail?

2002-07-04 Thread Michael Moncur
's email. The only challenge is finding a way to say things like "you're receiving this message because you subscribed to our mailing list" and "follow the link below to unsubscribe" without triggering SA. Just another way spammers make it difficult for those of us s

[SAtalk] RE: Spam Assassin and Free Speech Issues

2002-07-03 Thread Michael Moncur
mail and participate in the mass-check process next time. If the GA had a few of your non-spam mails that mention "viagra" in mind, it wouldn't give the rule such a high score. As for "incest", it's a word that appears in many discussions of a serious topic, a few of

RE: [SAtalk] How to produce return codes...

2002-07-02 Thread Michael Moncur
to spamtraps. All of them had been bouncing for the last year or so. A few days later, I have 164 spam messages collected from those addresses. Bouncing addresses don't seem to be of any concern to the spammers. Considering that most of them don't even include a valid return address, thi

RE: [SAtalk] DCC reporting busted

2002-06-28 Thread Michael Moncur
ported to DCC. -- michael moncur mgm at starlingtech.com http://www.starlingtech.com/ "When ideas fail, words come in very handy."-- Goethe --- This sf.net email is sponsored by:ThinkGeek Caffeinated soap.

RE: [SAtalk] SPAM: notes regarding netware 2.x,3.x.4.x (fwd)

2002-06-27 Thread Michael Moncur
bly don't have, but that doesn't make it spam. I get a couple of those every month but I wouldn't call them spam. -- michael moncur mgm at starlingtech.com http://www.starlingtech.com/ "Women who seek to be equal with men lack ambition." -- Timothy Leary --

[SAtalk] Evaluation of 2.30 GA scores

2002-06-15 Thread Michael Moncur
score X_AUTH_WARNING -0.703 score X_ESMTP-1.662 score X_MSMAIL_PRIORITY_HIGH -0.886 score X_NOT_PRESENT -1.920 score MAILTO_TO_REMOVE -1.669 All in all, I believe the GA is really smarter than I am this time. :) -- mic

RE: [SAtalk] Cyrillic encoding raises the spam level to 3.8

2002-06-13 Thread Michael Moncur
F_8BITS rule for 8-bit subjects. People can score it however they want. The unexpected thing is that every 8-bit subject also matches the SUBJ_ALL_CAPS rule, which it shouldn't. -- michael moncur mgm at starlingtech.com http://www.starlingtech.com/ "My one regret in life is that I am not

RE: [SAtalk] Cyrillic encoding raises the spam level to 3.8

2002-06-13 Thread Michael Moncur
a larger score than it deserves. The SUBJ_ALL_CAPS test should probably ignore 8-bit characters. -- michael moncur mgm at starlingtech.com http://www.starlingtech.com/ "If we don't change direction soon, we'll end up where we're going."

RE: [SAtalk] RE: Broken Bugzilla links? - RE: [SAdev] [Bug 436]

2002-06-12 Thread Michael Moncur
he last line looks for = followed by two digits and replaces it with just the two digits. This is the only thing I see after the tag that has any remote link with the bug I was seeing... -- michael moncur mgm at starlingtech.com http://www.starlingtech.com/ "If we don't change directio

RE: [SAtalk] RE: Broken Bugzilla links? - RE: [SAdev] [Bug 436]

2002-06-12 Thread Michael Moncur
nd let it update) may have a problem, but 2.30 looks OK. Weird. -- michael moncur mgm at starlingtech.com http://www.starlingtech.com/ "If we don't change direction soon, we'll end up where we're going." -- Professor Irwin Corey

RE: [SAtalk] RE: Broken Bugzilla links? - RE: [SAdev] [Bug 436]

2002-06-12 Thread Michael Moncur
d new one. Can someone with the latest 2.21CVS try it? -- michael moncur mgm at starlingtech.com http://www.starlingtech.com/ "If we don't change direction soon, we'll end up where we're going."

[SAtalk] RE: Broken Bugzilla links? - RE: [SAdev] [Bug 436] Score on spam exceeded maximum and went negative

2002-06-12 Thread Michael Moncur
> On Wed, Jun 12, 2002 at 03:45:48PM -0600, Michael Moncur wrote: > > > http://www.hughes-family.org/bugzilla/show_bug.cgi?id436 > > > > What happened to the = sign in id436? This has been happening > for several > > messages. > > Looks fine to me! I thin

RE: [SAtalk] Asian language spam not in Razor and DCC?

2002-06-12 Thread Michael Moncur
zor and/or DCC. Just not as many as the English-language spams... -- michael moncur mgm at starlingtech.com http://www.starlingtech.com/ "If we don't change direction soon, we'll end up where we're going."

RE: [SAtalk] How SpamAssassin works & load testing

2002-06-08 Thread Michael Moncur
e it a hard link and it > works now. > > Hmmm... It looks like other people are going for it, too :-) Have fun, > all! You know us. We can't resist the opportunity to get more Spam. :) -- michael moncur mgm at starlingtech.com http://www.starlingtech.com/ "If we don'

RE: freespeech Re: *****SPAM***** [SAtalk] Re: Spamassassin-talk digest, Vol 1 #456 - 14 msgs

2002-06-03 Thread Michael Moncur
hitelist_to worked fine too, but I stopped using it since 6 points isn't enough to guarantee that something gets through. -- michael moncur mgm at starlingtech.com http://www.starlingtech.com/ "You can pretend to be serious; you can't pret

RE: freespeech Re: *****SPAM***** [SAtalk] Re: Spamassassin-talk digest, Vol 1 #456 - 14 msgs

2002-06-03 Thread Michael Moncur
nd SAdev message, doesn't require a new rule, and works in individual user preferences. -- michael moncur mgm at starlingtech.com http://www.starlingtech.com/ "You can pretend to be serious; you can't pretend to be witty." -- Sacha Guitry _

RE: [SAtalk] An amusing spamfooter

2002-06-02 Thread Michael Moncur
s? Doesn't matter much, the character-set rules catch these anyway. -- michael moncur mgm at starlingtech.com http://www.starlingtech.com/ "You can pretend to be serious; you can't pretend to be witty." -- Sacha Guitry _

RE: [SAtalk] An amusing spamfooter

2002-06-01 Thread Michael Moncur
}->{languages_filename}) || die "cannot open languages: $!\n"; >>>>>>> 1.2 Those >>> and <<< symbols aren't mine, they're in the file. There's also a spurious = on line 57. Removing them made it run and the languages stuff seems

RE: [SAtalk] An amusing spamfooter

2002-06-01 Thread Michael Moncur
> > To answer my own question after some testing, "en" is the correct value. > > Yep, it's in the documentation too, BTW. Ah, found it in man Mail::SpamAssassin::Conf. I was looking in the (older) manual on the Web site before. -- michael moncur mgm

RE: [SAtalk] An amusing spamfooter

2002-05-31 Thread Michael Moncur
ules_filename} And it's coming out empty, so the "languages" file isn't found. I tried hardcoding the path to the rules directory in TextCat.pm and now it works. Not sure what the real solution is. Oh, I also had to manually copy the "languages" file from CVS to the r

RE: [SAtalk] An amusing spamfooter

2002-05-31 Thread Michael Moncur
least that's what one of your original messages about the patch said. This isn't in the documentation yet so I wasn't sure of the syntax. -- michael moncur mgm at starlingtech.com http://www.starlingtech.com/ "A good listener is

RE: [SAtalk] large numbers of tiny scores = SPAM!

2002-05-29 Thread Michael Moncur
dy? I'm not sure whether this is a good idea or not. On the one hand, it seems like if any five low-scoring rules are enough to guarantee that something is spam, the GA would have given them higher scores. On the other hand, maybe it wouldn't hurt to let the GA figure this out.

RE: [SAtalk] stopping headers where to: and from: are not part of my domain

2002-05-28 Thread Michael Moncur
e this (in Outlook) as my only spam protection and it caught 90% of spam, but then the spammers got smart and it stopped working very well at all. That's when I switched to SpamAssassin... -- michael moncur mgm at starlingtech.com http://www.starlingtech.com/ "I have often depend

RE: [SAtalk] Bad numbering in this version

2002-05-27 Thread Michael Moncur
ore or less random score because there weren't many non-spam ebay questions in the corpus. There certainly isn't a single spam message with "Question for seller" in the subject in my archive of the last 5,000 spams I've received. -- michael moncur mgm at starlingtech.co

RE: Removing rules with negative score? (Was: Re: [SAtalk] WEB_BUGS tests a negative?)

2002-05-26 Thread Michael Moncur
O_BE_REMOVED_REPLY 0 # -2.150 score TO_UNSUB_REPLY0 # -1.996 score WEB_BUGS 2.0 # -0.823 score X_MSMAIL_PRIORITY_HIGH0 # -1.356 -- michael moncur mgm at starlingtech.com http://www.starlingtech.com/ "

RE: [SAtalk] ADVERT_CODE needs help

2002-05-24 Thread Michael Moncur
EAVE_SUBJECT Spam unsubscribe (LEAVE) score LEAVE_SUBJECT 2.5 I don't recommend them for SA in general since they're only matched by one spammer who are bound to change their name (again) before too long. -- michael moncur mgm at starlingtech.com

[SAtalk] ADVERT_CODE needs help

2002-05-24 Thread Michael Moncur
DVERT_CODE Subject =~ /(?:^\s*|\s+|\[)(?:ADV|cc)[:\]]/i describe ADVERT_CODESubject: contains advertising tag This would also catch the "cc:" that many spam subjects start with. I see more of these than ADV: these days. -- michael moncur mgm at sta

RE: [SAtalk] Weird false negative...

2002-05-15 Thread Michael Moncur
me as whitelist_from but can have its own score, and use default_whitelist_from in 60_whitelist.cf. That way (a) anyone can turn off the default whitelist with a single score entry in a preference file, and (b) spam reports will refer to the "default whitelist" so it's easy to diag

RE: [SAtalk] Weird false negative...

2002-05-15 Thread Michael Moncur
too, but I doubt spammers bother. -- michael moncur mgm at starlingtech.com http://www.starlingtech.com/ "My sources are unreliable, but their information is fascinating." -- Ashleigh Brilliant ___ Have bi

RE: [SAtalk] Weird false negative...

2002-05-15 Thread Michael Moncur
m, @paypal.com, and @amazon.com addresses are becoming all too common in spam... -- michael moncur mgm at starlingtech.com http://www.starlingtech.com/ "Research is the process of going up alleys to see if they are blind."

RE: [SAtalk] updating GA scores

2002-05-13 Thread Michael Moncur
If they're all coming from a similar source (i.e. a mailing list) you might be better off whitelisting rather than changing scores. If you're getting false positives with really high scores, you might let us know which rules they're hitting, as the rules might need work. -

RE: [SAtalk] Problem with current CVS version

2002-05-11 Thread Michael Moncur
Same here. Appears to be a typo - here's the fix: Line 81: if ($self->{conf}->{check_mx_attempts) < 1) { Should be: if ($self->{conf}->{check_mx_attempts} < 1) { -- michael moncur mgm at starlingtech.com http://www.starlingtech.com/ "Research is the process

[SAtalk] RE: [SAdev] RFC: blacklist_to, and execution order

2002-05-09 Thread Michael Moncur
;t use whitelist_to because a score of 6.0 isn't enough to completely "opt out". Have you considered that SA in its default configuration is an "opt in" system anyway? Since it marks messages and doesn't filter them, you could run it sitewide and let users o

RE: [SAtalk] Microsloth Outlook ...

2002-05-09 Thread Michael Moncur
t looks like it. I don't know why this is missing from the right-click menu. I personally use a special IMAP mailbox to report spam. I move the spam to that folder, and a cron job grabs it every few minutes, runs spamassassin -r on it, and returns it to my spam archive folder. -- m

RE: [SAtalk] AWL verses early-terminate

2002-05-05 Thread Michael Moncur
occasions where the AWL causes false negatives. -- michael moncur mgm at starlingtech.com http://www.starlingtech.com/ "The ships hung in the sky in much the same way that bricks don't." -- Douglas Adams

RE: [SAtalk] rule for IMG

2002-05-05 Thread Michael Moncur
th a lot of email clients, the second you make *any* font change -- > italics, color, bolding -- it becomes an HTML message. I believe the "HTML check" in question is a check for Content-type: text/html ONLY. Outlook, in particular, always includes a text version in a multiple-part messa

RE: [SAtalk] Re: Ick Viruses!

2002-05-04 Thread Michael Moncur
ad an optional eval rule that calls FPROT or sophos or another easily available, regularly updated virus scanner. Heck, there's even an open-source one in development: http://www.openantivirus.org/ -- michael moncur mgm at starlingtech.com http://www.starlingtech.com/ "The ships hun

RE: [SAtalk] Re: RATWARE rule and manual vs. GA scores

2002-05-02 Thread Michael Moncur
e. This is not necessarily a bad thing but the threshold should definitely be something larger than 3. -- michael moncur mgm at starlingtech.com http://www.starlingtech.com/ "We forfeit three-fourths of ourselves to be like other people." -- Arthur Schopenhauer

RE: [SAtalk] Re: RATWARE rule and manual vs. GA scores

2002-05-02 Thread Michael Moncur
gs over the threshold. Perhaps after testing it might be good to have a separate LOTS_OF_PORN_3 rule that checks for a higher number... -- michael moncur mgm at starlingtech.com http://www.starlingtech.com/ "We forfeit three-fourths

RE: [SAtalk] Re: RATWARE rule and manual vs. GA scores

2002-05-01 Thread Michael Moncur
Perhaps a count higher than 3 would be better? Second, the @porn_words Daniel posted doesn't include all of the words that PORN_3 does. It's missing everything from, er, "whore" to "titties" in the current CVS. I'm sure it's better than the current PORN_3 regar

RE: [SAtalk] Re: RATWARE rule and manual vs. GA scores

2002-05-01 Thread Michael Moncur
I ran some quick macros on the current RATWARE test and came up with the attached "20_ratware.cf" file with each mailer in its own rule. I haven't included scores - perhaps this could be thrown into the next GA run if it's worthwhile. -- michael moncur mgm at sta

  1   2   >