Re: [SAtalk] bayes should ignore habeas headers?

Pedro Sam wrote: I tried to remove the habeas headers mannually You can get the same results by putting in your preference or configuration file bayes_ignore_header X-Habeas-SWE-1 bayes_ignore_header X-Habeas-SWE-2 bayes_ignore_header X-Habeas-SWE-3 bayes_ignore_header X-Habeas-SWE-4 bayes_ignore

Re: [WL] Re: [SAtalk] More obfuscation

Charles Gregory wrote: So I guess the question is, how 'expensive' would it be in terms of processing power There's also the question of how much benefit would it have. I recall someone trying out searching for close matches to spam words in a corpus and not getting very good results at picking u

Re: [SAtalk] Turning off Habeas?

Scott Lambert wrote: Your idea turns the HABEAS_SWE test into a network test. Actually it _is_ a network test: It relies on legal means to shut down violators and the HIL to block ip addresses whose use of the Habeas headers can't be or has not yet been stopped by legal means. Instead of reducin

Re: [SAtalk] Whitelisting a recipient

Link, Pete <[EMAIL PROTECTED]> > Is it possible to whitelist a recipient??? You use the all_spam_to list, or if you want to filter some but not all spam to the address you use whitelist_to or more_spam_to. Search for those keywords on http://www.spamassassin.org/doc/Mail_SpamAssassin_Conf.html fo

Re: [SAtalk] help with goldfish

Milt Epstein <[EMAIL PROTECTED]> wrote: > there are different definitions of > what spam is, and I'm sure it fits some of them. [...] > appears to the person receiving the mail, it looks like spam and can > be dealt with as if it were spam. It doesn't really matter how it > originated. Actually

Re: [SAtalk] RBL question

"Rice, Kevin" <[EMAIL PROTECTED]> said: > Actually, it looks like I get RBL+ as one big zone > rather than a split zone for RBL, DUL, and RSS. > Is there any way to set up a custom RBL check. Search for the various rules with OSIRUS in their name and see how they are implemented. relays.osirusoft

Re: [SAtalk] Osirusoft - trustworthy?

Matt Kettler <[EMAIL PROTECTED]> > I definitely agree that trying to separate out some of the lists might be > a good thing, instead of using relays.osirusoft.com as a single query. Of > course this also has the drawback of requiring more DNS lookups to get a > good sampling of lists, but that's p

Re: [SAtalk] Osirusoft - trustworthy?

Justin Mason" <[EMAIL PROTECTED]> wrote: > Can SpamAssassin use Osirusoft without the SPEWS results? If not, > I recommend we stop using it. SPEWS just has too many FPs for > my taste. The various X_OSIRU... rules separate out the different return values from the Osirusoft DNS check. The RCVD_I

Re: [SAtalk] "new" spam host

Jeremy Zawodny" <[EMAIL PROTECTED]> wrote: >Hasn't stopped them from attemping to deliver roughly 4,000 > messages per day--every day. How many could they send if traffic from their ip address to the SMTP port on your mail server's ip address went to an SMTP tarpit instead of being simply rejecte

Re: [SAtalk] audio/x-wav rule suggestion

Rossz Vamos-Wentworth <[EMAIL PROTECTED]> asked: > Can someone tell me how to call f-prot from procmail and > nuke the message if it is virused? This is the recipe I used to use before I installed mimedefang to do it earlier in the mail processing. It is more complicated than absolutely necessary

Re: [SAtalk] audio/x-wav rule suggestion

Bob Proulx <[EMAIL PROTECTED]> wrote: > I have been getting a lot of audio (Klez virus) files lately. So have I. So have a lot of people. Rather than reinvent the wheel and have to do it all over again for the next virus du jour, just install an antivirus program that is made for the job and come

[SAtalk] Can SA use user prefs with MIMEDefang?

I just set up MIMEDefang on my system, set up as a sendmail milter, calling f-prot and SpamAssassin. I don't see how it would be possible for SpamAssassin to use any user preferences, such as whitelist_from or all_spam_to, since SA gets called so early in the process. Is it true that this type o

Re: [SAtalk] Elementary Question

A followon to my previous message: Running sendmail on my own server, the only time its ip address appears in a Received header is when it is used to send out mail. Incoming mail results in a Received header that shows its local ip address inside the NAT firewall. So it would be easy to filter out

Re: [SAtalk] Elementary Question

Brian <[EMAIL PROTECTED]> wrote: > I have white_list(ed) *@mydomain.com > Spam comes in from someone claiming to > be [EMAIL PROTECTED] I've been wondering about that too. You appear to have control of your entire domain and to be using your own mail server for outgoing mail, which is my situatio

Re: [SAtalk] (no subject)

Doug Crompton <[EMAIL PROTECTED]> wrote: > Well I got my first XXX that made it through SA today. [...] > Subject: (Adult) Eatme, Juicy ripe P*ssy for you. I got that too. It slipped right through the distribution SA but I checked it using the latest CVS SA and that tagged it right off with a sco

Re: [SAtalk] Strange Headers...

On Fri, 2002-05-31 at 15:37, Brian May wrote: > Has anyone seen this header before? Google had no matches. > > X-Stormpost-To: If you try a google search for 'stormpost spam' you'll find that there are people who consider StormPost spamware and block mail with X-Stormpost and X-Mailer: StormPo

Re: [SAtalk] Ughhh... High Processor Utilization

On Tue, 2002-05-21 at 11:20, Joel Epstein wrote: > Is there a way to set a size limit as to which mails are scanned? Since you are using procmail you can simply add a test * < 25 to the recipe that you use to call spamassassin. By the way, I have a similar RedHat 6.2/sendmail/procmail setu

Re: [SAtalk] Klez

On Mon, 2002-05-20 at 17:17, Ed Kasky wrote: > Could you post that procmail recipe to the list? I started to, then did not because I have been lazy and took a shortcut with it that really should be fixed before anyone else uses it. But I'll post it now with lots of comments added. Maybe someone w

Re: [SAtalk] Klez

On Mon, 2002-05-20 at 14:18, Peter Scott wrote: > Does anyone have a rule for matching the Klez virus? Following Craig's suggestion, made earlier on this list, I installed f-prot for virus scanning and call it from procmail before any other filters, sending any catches to /dev/null. That replaced

Re: [SAtalk] Spam Tracking

On Fri, 2002-05-17 at 14:32, Michael Stenner wrote: > Now, with odds of about 10^-34, if you decide you're going to try > enough hashes to give yourself a 1% CHANCE of finding one, you only > need to try > > 0.01 * 10^34 = 10^32 times. at 1,000,000,000 tries per second, that > will only take you

Re: [SAtalk] Spam Tracking

On Fri, 2002-05-17 at 12:03, Chris Petersen wrote: > > Offhand, how does Razor get false positives? I thought that it was MD5-based > > and the email had to be exact? > > it does. but md5 doesn't generate a unique id... there's no way that a > smallish number can be used to identify an infi

Re: [SAtalk] way was this rejected??

On Fri, 2002-05-17 at 10:07, Debbie Doerrlamm wrote: > I'm afraid I wasn't able to deliver your message to the following addresses. > This is a permanent error; I've given up. Sorry it didn't work out. > > <[EMAIL PROTECTED]>: > Connected to 216.40.216.155 but sender was rejected. > Remote host s

Re: [SAtalk] Speed/Performance Issue

On Thu, 2002-05-16 at 12:39, Justin Robinson wrote: > We are running FreeBSD 4.3-Release, sendmail 8.12.2, procmail 3.15.1, and > spamassassin 2.11 Some of the bugs that have been reported and fixed since 2.11 had to do with rules with regexps that took really long times at high loads on some inp

Re: [SAtalk] First of two problems - implementing user "opt-out"from spamassassin...

On Wed, 2002-05-15 at 08:26, LuKreme wrote: > :0: > * X-Spam-Level: ** > /dev/null Doesn't that have to be * X-Spam-Level: \*\*\*\*\*\*\*\*\*\* in regexp syntax? > Although I would prefer a way to bounce it (with spamassasin headers), on > the off chance that there is ever legitimate

Re: [SAtalk] First of two problems - implementing user "opt-out" from spamassassin...

On Tue, 2002-05-14 at 18:28, Ron Carter wrote: > :0 > * ! ? test -f $HOME/.nospamcheck > > :0fw > | spamassassin -P > > :0: > * ^X-Spam-Status: Yes > /dev/null Theo gave you one workable answer, but you probably meant to do was: :0 * ! ? test -f $HOME/.nospamcheck { :0fw | spamassassin -P :0

Re: [SAtalk] Not tagged though HITS > Threshold? (one of 100identical replies?)

On Fri, 2002-05-10 at 16:15, Henry Kwan wrote: > I was just curious why it didn't tag it. [...] > X-Spam-Status: No, hits=-6.5 required=6.0 Perhaps because -6.5 really is less than +6.0? -- sidney ___ Have big pipes? SourceForge.

Re: [SAtalk] AWL verses early-terminate

On Thu, 2002-05-02 at 09:16, Charlie Watts wrote: > It has just occured to me that this will adjust the AWL math because > I won't be getting "big" positive numbers into the AWL any more. The fact that the -S option is reasonable points out that the scoring is not a linear measure of spamminess.

Re: [SAtalk] (no subject)

"Jeff Shepherd" <[EMAIL PROTECTED]> asked: > Also, I need to add something to the header that will make > SpamAssassin will recognize it as not spam. > Any recommended way? You would not want SpamAssassin to default to anything that spammers could put in spam to get it to pass. But there should b

[SAtalk] Re: [SAdev] Re: CVS:spamassassin/lib/Mail/SpamAssassinPerMsgStatus.pm,1.99,1.100

On Tue, 2002-04-30 at 11:11, rODbegbie wrote: > OE would display it to the user, but SA would miss it for scoring. That's a good point, especially since according to Theo it is not just OE, it is IE's renderer that sees them as comments. We are talking about what spammers are going to use to reac

Re: [SAtalk] How do I avoid this being spam?

"Doug Crompton" <[EMAIL PROTECTED]> asked: > What can I tell this person to do differently to avoid this? > When you say it is a known address from where spam was sent > (dialup) do you mean the dialup account of the original AOL user? Here is what relays.osirusoft.com has to say when I look up t

Re: [SAtalk] outgoing mail & mailing lists

Dan Wilson <[EMAIL PROTECTED]> wrote: > These are my settings... other than the rewrite_subject. > My users use that to filter in the mail client. That's ok if you add a rule that guarantees that mail is not flagged as spam on the way out, since then the subject will not be changed. You want to b

Re: [SAtalk] outgoing mail & mailing lists

Dan Wilson <[EMAIL PROTECTED]> wrote: > 2. Is there a way to configure it to not scan outgoing email. > I'm thinking this is actually done through qmail-scanner? The qmail-scanner faq says: 10. How do I configure/install Spam Assassin? [...] I'd recommend not running it in the default mode, wher

[SAtalk] Re: False Positives and SpamAssassin

[moved from Razor-users mailing list]: On Mon, 2002-04-15 at 11:36, Craig R Hughes wrote: > Is the problem that you're seeing "real" email generating scores in > excess of 30 in SA, or that people are ignoring the warning and > reducing the threshold substantially below 30? Craig - As someone sa

Re: [SAtalk] Re: Messages being munged [was: some random topic]

On Mon, 2002-04-15 at 11:49, Barry L. Kline wrote: > Here's the only thing in the recipe in /etc/procmailrc: Wouldn't that make spamc run as root? Does that mean you have to give spamc the -u option to get user prefs (IIRC - I am not at a machine with spamassassin docs right now). Or even better,

Re: [SAtalk] New Scientist article on an anti-spam using Razor

On Wed, 2002-04-10 at 17:04, Sidney Markowitz wrote: > It feels to me like the kind of thing a reporter would > get wrong while being taken in by an business > man's self promotion. I asked Vipul on the Razor mailing list and it turns out that my intuition was wrong -- Vipu

Re: [SAtalk] spamc not working?

On Thu, 2002-04-11 at 12:09, Chuck Wolber wrote: > :0fw > | spamc > > It turns out that no mail gets reported that way. When I alter the > procmail rule to the following: > > :0fw > | /usr/bin/spamassassin -P > > Mail is reported just fine. I use /usr/bin/spamc in my RH system. The procmailrc

Re: [SAtalk] New Scientist article on an anti-spam using Razor

On Wed, 2002-04-10 at 16:57, David Koblas wrote: > He is in a new venture a friend ever so nicely forwarded me the following > article recently: > > http://news.bbc.co.uk/hi/english/sci/tech/newsid_1919000/1919576.stm That article prefaces every statement about the venture with "New Scientist re

[SAtalk] New Scientist article on an anti-spam using Razor

This may be of interest -- It's about an upcoming spam fighting program that uses Vipul's Razor combined with something that matches phrases from a spam corpus. My experience with reporters tells me to take some things with a grain of salt: The article is written as if Vipul is an active partner i

Re: [SAtalk] 'Grandfathering' SpamAssassin

On Fri, 2002-04-05 at 15:25, Andrew Salamon wrote: > I tried the simplistic approach of simply piping a Unix mbox file through > SpamAssassin but it only seems to have looked at the first email. Yes, SpamAssassin expects that its input is a single mail message. formail is designed to do what yo

Re: [SAtalk] SA sightings

On Thu, 2002-04-04 at 17:42, Olivier Nicole wrote: > Is there a way to report to sa-sightings list, without receiving all > the reports from others? Does this mean that none of the spam I've been forwarding there has arrived because I'm not subscribed to the list? -- sidney _

Re: [SAtalk] In need of very basic HELP

Christopher Faylor <[EMAIL PROTECTED]> wrote: > Can I point out that it is probably possible to use spamassassin on > Windows, if you run it under Cygwin (www.cygwin.com)? Although, I sort > of run the cygwin project, I have never actually tried it. Just for grins I saw how far I could get witho

Re: [SAtalk] In need of very basic HELP

On Mon, 2002-04-01 at 09:53, Søren Boll Overgaard wrote: > Not everybody watches good morning america. I, for one, do not. > Sorry for the misguided attempt to be helpful. At the risk of being off topic, following the theory that politeness should always be as public as the opposite, I would like

Re: [SAtalk] In need of very basic HELP

On Mon, 2002-04-01 at 08:41, Søren Boll Overgaard wrote: > Simply use the "unzip" program, which should be part of your distribution. No, no, no! These questions are from Windows users! Craig, before this list gets overwhelmed with pleas for help from naive PC owners who watched Good Morning Ame

Re: [SAtalk] help exploiting formmail to black list

Whoops - not a filter, just a slow server. Sorry about the redundant post. -- sidney ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk

Re: [SAtalk] help exploiting formmail to black list

This is a resend. It appears that the mailing list software on sourceforge filters out mail that contains the formmail.cgi signature and it dropped my message which contained a quote of some formmail.cgi output :-) On Fri, 2002-03-29 at 11:05, dman wrote: > If the spammer can send me the spam, wh

Re: [SAtalk] help exploiting formmail to black list

On Fri, 2002-03-29 at 11:05, dman wrote: > If the spammer can send me the spam, why can't I send > the listme request? Actually, now that I have taken another look at http://dsbl.org/faq-help.html I see that you can. I thought the "specially formatted" message had something in the headers. All i

Re: [SAtalk] help exploiting formmail to black list

dman <[EMAIL PROTECTED]> > The trick is to make the script put the data we want it to > in the body of the message :-). Exactly -- I doubt it is possible. If you really want to see what you are dealing with, download the formmail.cgi script itself that the site is using from http://www.agn-e.co

Re: [SAtalk] help exploiting formmail to black list

"dman" <[EMAIL PROTECTED]> said: > So I'm trying to exploit the script to make the site blacklist > itself at dsbl.org. I found a form on the site with the action > as "/cgi-bin/formmail.cgi". It's easy enough to find the details of the exploits of formmail.cgi version 1.9 and less using a Googl

[SAtalk] ORBZ reborn as DSBL [Was: Freedom of Press / Speech / Junk Mail(yah right)]

http://orbz.org has an announcement and link to http://dsbl.org which is a new service that should not be so subject to lawsuits and injunctions. It's a neat and simple idea, and you can see the details there. -- sidney ___ Spamassassin-talk mailing

Re: [SAtalk] hi sa-talk, my name is ben, and I get spam

On Fri, 2002-03-22 at 10:28, rODbegbie wrote: > I usually take the time to log-on to whatever service it is, > change their password, then mess with their settings a bit. Here's a hint that's actually slightly relevant to this mailing list (well, at least it is anti-spam): If the service they si

Re: [SAtalk] hi sa-talk, my name is ben, and I get spam

On Fri, 2002-03-22 at 01:12, Ben Jackson wrote: > I get a LOT of spam. You can just look at my email address > and guess why. I can relate to that :-) -- sidney [EMAIL PROTECTED] Not spelled the same nor related to the law firm at sidley.com, nor disney.com, nor Sydney, Australia, nor

Re: [SAtalk] SA should block spam that matches government rules

On Thu, 2002-03-21 at 18:24, William R Ward wrote: > > http://www.spamlaws.com/state/summary.html > > Wisconsin: "ADULT ADVERTISEMENT" anywhere in subject line > > I've never seen spam with this in the subject line, caught by SA > or otherwise. Maybe Wisconsin doesn't have the right weather f

Re: [SAtalk] Bypassing "unsubscribe" test for known mailing lists?

On Thu, 2002-03-21 at 12:00, Christopher Faylor wrote: > I'd like to trap all spam from the mailng lists but specifically disable > the unsubscribe test when header elements indicate that the email came > from the mailing lists. Maybe I could set the score for the unsubscribe > to zero in some ca

Re: [SAtalk] Spamd, sendmail, and procmail on a raq3

On Tue, 2002-03-19 at 14:29, AHA Lists wrote: > > Here is what I have in my procmailrc file, what is the syntax error? > > :0fw > | spamc > /home/Mail-SpamAssassin-2.11/rules I'm guessing that the rules file is supposed to be an argument to spamc of a file that contains your custom rules, you h

[SAtalk] intervolved.net spammer

I've had two messages squeak through SA's spam filters that came from intervolved.net. They claim that they are opt-in, but the opt-in is with some "business partner" that they do not name and the spam is sent advertising other "business partners" so there is no way of knowing how I got on the lis

Re: [SAtalk] Messages with empty bodies?

Olivier Nicole <[EMAIL PROTECTED]> wrote: > I would not think that spammer are dumb enough to send empty email > just to see what would bounce. because by the time they are done with > their testing, they will end up blacklisted/blackholed or whatever. No, the ones I saw looked like they were usi

Re: [SAtalk] Messages with empty bodies?

On 12 March 2002, Charlie Watts said: > I'm seeing more and more of a strange phenomenon - spam with no body. I've recently seen a number of similar messages saying something like "Hi" or nothing at all. Since I have a domain where I can see messages sent to different wrong addresses that have be

Re: [SAtalk] SA should block spam that matches government rules

There's a summary of anti-spam laws of various states in the US at http://www.spamlaws.com/state/summary.html The ones that require some identifying text in the Subject line are (Where only an "Adult" version is mentioned the law only applies to porn spam): California, Colorado, Tennessee: "

Re: [SAtalk] SUBJ_ALL_CAPS regex broken

I don't really know perl, but I tried to duplicate the slow match on the rule in a little test program to see if I could experiment with ideas for a working regexp. The following program did not take long to run. What am I doing wrong? #!/usr/bin/perl $string="AAA foofoo"; if ($s

Re: [SAtalk] Re: [SA] Tired of those speeding tickets?

> each client is bound by a definitive anti-spam policy > which must be agreed to prior to becoming an EM5000 client. Yes, and they assure me that under Bill s.1618 TITLE III passed by the 105th US Congress their letter cannot be considered spam as long as the sender includes contact information

[SAtalk] I hate free porn!

I just got another one of these slip by the filters. I forwarded it to spamassassin-sightings, but I want to bring up the proposed rule again here. I'm surprised that it didn't make it in already. I see quite a bit of porn spam that ends with the line I hate free porn! Don't ever tell me about i

Re: [SAtalk] RichDad.com e-mail is treated as spam

On Fri, 2002-03-01 at 17:52, William R Ward wrote: > Hmm, looks like I was wrong. It does apparently have spammish > headers. I don't know anything about osirusoft.com, but spamassassin > says it's a spammer Actually I would say that I was wrong. Spamassassin did not think that the body was spa

Re: [SAtalk] RichDad.com e-mail is treated as spam

On Fri, 2002-03-01 at 16:37, William R Ward wrote: > >and therefore not spam to you is for you to put it in your whitelist. > > I did. And it was still marked spam? That sounds like a bug and you should post the full message with headers including the spam report if you want it to be possible to

Re: [SAtalk] RichDad.com e-mail is treated as spam

On Fri, 2002-03-01 at 14:34, William R Ward wrote: > This is *not* spam... If I were to receive that Rich Dad email unsolicited it would clearly be spam. The only way Spamassassin could know that it is not unsolicited and therefore not spam to you is for you to put it in your whitelist. If [EMAI

Re: [SAtalk] razor check skipped: No such file or directoryundefined Razor::Client

On Fri, 2002-03-01 at 09:58, Christopher Albert wrote: > I just installed [...]razor-agents-1.20 As Vilpul stated in the latest Razor version 1.20 is only for people who want to risk the bleeding edge, checked in without full testing

Re: [SAtalk] Rule idea: "real name" == local part

On Thu, 2002-02-28 at 13:22, Craig Hughes wrote: > Sounds like a good rule -- even people like me who use > their name as email address probably won't have many > people using "Craig" <[EMAIL PROTECTED]>; if > they're going to go to the trouble of setting > the real name, they'll now what my last

Re: [SAtalk] Administrivia: list organization question

On Thu, 2002-02-28 at 10:08, Theo Van Dinter wrote: > you're probably already using procmail for spamassassin, > so add in the rule (it's in the procmail man page) that > unduplicates your messages based on message-id. That doesn't help people he sends to who might not have that, but your suggest

[SAtalk] Re: Question about sightings list

"Craig R Hughes" <[EMAIL PROTECTED]> wrote: > I have to admit that I haven't actually been > monitoring sa-sightings at all. I guess my intuition was right :-) > Most of the reason for that is that I don't > really have the time to manually process all the mails Exactly. I don't see how a sight

[SAtalk] Question about sightings list

Craig - I've been holding off sending email to spamassassin-sightings list because I'm not comfortable with any of the options I have to forward mail there. The mailers I use to read my mail don't have a bounce or resend option, but even if they did that would change some of the headers that migh

Re: [SAtalk] SA speed

On Tue, 2002-02-26 at 13:41, Bob Plankers wrote: > However, SA is really slow, and I need to deal > with 150-200 email messages per second > for 85,000 accounts without a room full of hardware. The two things you can do are 1) Run spamd/spamc so that you don't have to load up a new spamassassin

Re: [SAtalk] spamassassin in 100% C

> Are they still not doing that? > Wow, I'm surprised. A system like that > really needs good vetting. What "they" (Vilpul) are still doing is implementing a sophisticated system with some details obfuscated to make it more difficult for people to game the system, and not doing a whole lot of pub

Re: [SAtalk] Spammer's new ideas ...

Andre - > I just received a spam with myself in the From: line. I don't rely on SpamAssassin for my whitelist. I use procmail to run SA, and precede the recipe that invokes spamc with an include of a procmail recipe file that filters my mailing list and other expected mail into appropriate mailb

Re: [SAtalk] Stock advisory spams slipping through

Michael Moncur <[EMAIL PROTECTED]> wrote: > This also appears to be connected (whether with their knowledge or not) > to DoubleClick, the relatively respectable banner-ad company. Here's a > "remove" URL from the message: > http://ad.doubleclick.net/clk;3824278;6743144;o?http://home.ingdirect.co m

Re: [SAtalk] auto whitelist behavior with spamassassin -t

On Tue, 2002-01-29 at 05:43, J. Davis wrote: > As a point-of-interest related to this, how does one remove an > address from the auto whitelist database (DBM)? The spamassassin man page says: -W Add all email addresses, in the headers and body of the mail message read from STDIN, to the a

Re: [SAtalk] Reporting SPAM that didn't get caught by SpamAssassin?

> ''bounce'' or ''redistribute'' it, as forwards are very hard to > de-forward-ize -- the format is different for each MUA :( Wouldn't it be easy to set up something that would process mail that is forwarded as a MIME attachment? That preserves the headers even better than bouncing and is someth

Re: [SAtalk] Some rule bugs and improvements needed

On Mon, 2002-01-28 at 07:04, Greg Ward wrote: > If you read the regex carefully, you'll realize that there are some odd > restrictions on that line of yelling: > * it must be at least 45 characters long > * there must be a "word" at least 5 characters long in the middle, > at least 20 char

[SAtalk] An amazing catch by SpamAssassin

I am amazed! I received a spam with a message consisting of just a URL, no other text. SpamAssassin caught it handily, as you can see from the headers below. Great work! -- sidney == X-Spam-Status: Yes, hits=8.3 required=5.0 tests=RATWARE,PLING_PLING,PLING,FROM_AND_TO_SAME,FROM_

[SAtalk] Some rule bugs and improvements needed

Here are some excerpts from a spam that scored 4.9 using a cvs pull from a few weeks ago and 4.2 with a fresh cvs pull. I think someone has introduced a bug into the LINE_OF_YELLING rule: [begin excerpts] HAPPY NEW YEAR! INSTEAD OF GIVING YOU A KISS WHEN THE BALL DROPS, WE'VE DECIDED TO GIVE YOU

Re: [SAtalk] .procmailrc for courier

On Wed, 2002-01-23 at 15:23, Charlie Watts wrote: > You mean for delivery to a Maildir, so that courier-imap can use it, Yes, I interpreted his request as being for courier-imap Maildir format, which is what I use. > I don't think you need locking for delivery to a maildir ... you can > probably

Re: [SAtalk] .procmailrc for courier

On Wed, 2002-01-23 at 14:50, Mike Coughlan wrote: > Can someone please send a sample .procmailrc for courier. Here is what I use. spamc makes it a whole lot faster than calling spamassassin directly. The test for X-Spam-Flag works whether or not you set your options to mess with the subject. As f

Re: [SAtalk] Auto-whitelist improvement ideas

What about a blacklist? Or am I forgetting that there already is one? The From addresses are usually faked, but I'm sure I see some names that repeat, such as "Jack Strap" for porn spam and "Denise Smith, MBA" for a whole bunch of money/insurance spam. It would be nice to be able to drop address

Re: [SAtalk] Scaling to 100k emails per day.

On Thu, 2002-01-17 at 13:01, brad wrote: > Are you recomending spamd -d -L -D is ok and then call it with the > procmailrc of spamc -f Well, "recommend" is too strong a word, since I don't run a large volume mailserver to lots of customers.But I do know that I run spamd -d -L -c and put spamc -f

Re: [SAtalk] Scaling to 100k emails per day.

On Thu, 2002-01-17 at 10:51, brad wrote: > SA takes 5-7 seconds per message and can leave > hundreds of procmail processes running. That sounds like a problem right there. I run spamc/spamd with -L option to skip all network access and it takes a tiny fraction of a second per message. Razor and t

[SAtalk] porn tests

I sent a copy of the entire mail message to [EMAIL PROTECTED] but I thought some of it should be brought up on this list. The following body text didn't get hits. I would think that "FREE HARDCORE TEEN PORN" should be worth some points in one of the porn filters Also the "I hate free porn! Don't

[SAtalk] 0 hit porn

I just sent mail to spamassassin-sightings under the subject "0 hit porn" (my subject, not the spam's :-) ) I didn't want to post spam to this list, but I want to make sure that it gets noticed. It is short but looks like it should be obvious spam, yet got no hits at all. Is this a bug, or do th