RE: [SAtalk] Three that got through yesterday

2004-01-19 Thread Robert Strickler
Yoda has turned to the DIM side and started spamming. :) ^^^ Should we classify spammers as evil, or just incredibly lack-witted? > -Original Message- > From: Evan Platt [mailto:[EMAIL PROTECTED] > Sent: Monday, January 19, 2004 11:36 AM > To: SpamAssassin > Subjec

RE: [SAtalk] New trick

2003-06-27 Thread Robert Strickler
>> I could almost bet my left index finger on the fact that 99% >> of those PGP-signatures are invalid. This is something that >> SA could exploit. >I'll profess some degree of ignorance about PGP signatures, but does it matter if it's valid or not? Couldn't a spammer generate a perfectly valid

RE: [SAtalk] SA gatewaying with LDAP user verification?

2003-01-16 Thread Robert Strickler
Jeremy Turner [[EMAIL PROTECTED]] >> keep statistics for a "X strikes and you are out" >> milter to deny access completely for X minutes when they hit too many >> bad addresses or have a 0 ham to X spam ratio. > Sounds like an MTA thing, not really a SpamAssassin thing. I would point you to your

RE: [SAtalk] SA feature/idea? (teergrubing/ stalling SMTP sessions )

2002-10-14 Thread Robert Strickler
Search the recent archive for teergrubing, (I called it a spambump, like a speedbump in a parking lot). Basically you send continuation messages every 15-60 seconds, a perfectly legitimate RFC, you just keep it up until you or the other side gives up. I believe Marc Merlin (Hi Marc) on the list h

[SAtalk] how do deal[sz] and special[sz] in the headers score in the GA corpus?

2002-10-11 Thread Robert Strickler
Following up on the offers (should now test for offer[sz]) in the headers these also seem to be seen frequently in the headers as usernames or embedded in domain names. waaay back Malte said: > | | Subject: Re: [SAtalk] "offers" in header a good rule for trapping > | | spam > | | > | | AFAIK di

RE: [SAtalk] Spammer

2002-10-11 Thread Robert Strickler
That's what VPNs are for, PPTP is built in to NT4 and L2TP into W2K and XP. Not quite as secure, given the current security I would guess their passwords are probably trivially easy to brute force, would be set up a terminal services (application mode) on a server and load the needed applications

RE: [SAtalk] "offers" in header a good rule for trapping spam

2002-10-09 Thread Robert Strickler
Steve, I found this perl script to convert .msg to mbox on a metacrawler search, care to try it? http://www.xs4all.nl/~mvz/software/msgconv.html -Original Message- From: Steve Thomas [mailto:[EMAIL PROTECTED]] Sent: Wednesday, October 09, 2002 6:39 PM To: SpamTalk Cc: [EMAIL PROTECTED

RE: [SAtalk] "offers" in header a good rule for trapping spam

2002-10-09 Thread Robert Strickler
Outlook dropped the post in the folder too, hee hee, proving the superiority of a scoring based system and a binary dumper. --- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf

RE: [SAtalk] useful blackholes

2002-10-02 Thread Robert Strickler
As an ISP with customer that need to communicate worldwide these are far to inclusive to implement on our servers. They would probably be most useful on private SA installs where the scope of email communications is generally pretty narrow and US based. The infrequent exceptions could be adjusted

RE: [SAtalk] URL blacklist

2002-10-01 Thread Robert Strickler
Original proposal posted December 2001, heh. "Nothing new under the sun". To answer my own question, mySQL _does_ do replication the bad news is that the files are not OS/archetecture agnostic, you cannot replicate between a Sun unix and RH Linux, so it does not appear to be a viable distribution

RE: [SAtalk] Teergrubing (stalling SMTP sessions ) was:"new" spam host

2002-09-20 Thread Robert Strickler
http://www.iks-jena.de/mitarb/lutz/usenet/teergrube.en.html I call this kind of delay introduction a "spambump", like speedbumps used to slow you down in a parking lot. It does not surprise me that someone else has already though of it. Basically it consist of sending a continuation instead of "

RE: [SAtalk] How to add rules?

2002-07-22 Thread Robert Strickler
> required_hits 6.1 ... > score RAPE 4.125 ... > rape rape rape I think it only counts once. Since 4.125 < 6.1 makes it not spam. Of course your total showed 0.9, as others noted, restarting spamd would also be needed. -Original Message- From: Joel Epstein [mailto:[EMAIL

RE: [SAtalk] tiny spam-abductor

2002-07-22 Thread Robert Strickler
I'd like to invoke it as a sendmail milter to strip them before SA has a chance to score them. I think it would be valuable in reducing false positives. The real trick would be to get it to autolearn the format of the trailer for each domain in a list. -Original Message- From: Tony L. Sva

RE: [SAtalk] RH 7.3+SA 2.20+spamass-milter spamd falls back to nobody

2002-07-16 Thread Robert Strickler
= "-u"; argv[2] = "spamd"; argv[3] = 0; Any chancee this fallback issue is fixed in SA v2.31? -Original Message- From: Robert Strickler [mailto:[EMAIL PROTECTED]] Sent: Tuesday, July 16, 2002 6:37 PM To: [EMAIL PROTECTED] Subject: RE: [SAtalk] RH 7.3 spamass-m

RE: [SAtalk] RH 7.3 spamass-milter spamd falls back to nobody

2002-07-16 Thread Robert Strickler
) to spamd failed: Connection refused so evidently that is not the fix. Any hints on how to get spamd to process the mail? -Original Message----- From: Robert Strickler [mailto:[EMAIL PROTECTED]] Sent: Tuesday, July 16, 2002 5:32 PM To: [EMAIL PROTECTED] Subject: RE: [SAtalk] RH 7.3 spamass-mi

RE: [SAtalk] RH 7.3 spamass-milter hangs

2002-07-16 Thread Robert Strickler
Better revision at line 128 add: daemon(0, 1); cout << PACKAGE << " " << VERSION << " demonized." << endl; -Original Message- From: Robert Strickler [mailto:[EMAIL PROTECTED]] Sent: Tuesday, July 16, 2002 5:00 PM To: &

RE: [SAtalk] RH 7.3 spamass-milter hangs

2002-07-16 Thread Robert Strickler
http://i.yak.net/twiki/bin/view/Fnord/SpamAssassinHowtoRedhat72#Get_spamass_ milter notes that "spamass-sock doesn't deamonize itself" Anybody want to team up to fix this? We really want to get this working. I know there is a daemon(3). Although I am totally unfamiliar with c++, the code does not

[SAtalk] Autounsubscibe capability for SA

2002-06-27 Thread Robert Strickler
How does everyone feel about building the logic to create and maintain a database of unsubscribe/removes that actually remove an address. I realize that a significant majority of these are simply traps to validate email addresses, but I am wondering if there is not some value in actually getting o