Re: [SAtalk] thank you guys

2004-01-26 Thread Tim B
HolyMoly...69.27 seconds?! How'd you port SpamAssassin to run on a Commodore Vic-20? -JR BAHAHA... that ALMOST got me to spew coffee out my nose. --- The SF.Net email is sponsored by EclipseCon 2004 Premiere Conference on Open Tools Developm

Re: [SAtalk] the list itself???

2004-01-26 Thread Tim B
Whew... thought I maybe I offended or something --- The SF.Net email is sponsored by EclipseCon 2004 Premiere Conference on Open Tools Development and Integration See the breadth of Eclipse activity. February 3-5 in Anaheim, CA. http://www.ecli

[SAtalk] the list itself???

2004-01-26 Thread Tim B
did I get booted off the list, no list traffic or is sourceforge down? I haven't gotten anything really since friday --- The SF.Net email is sponsored by EclipseCon 2004 Premiere Conference on Open Tools Development and Integration See the

Re: [SAtalk] doing a kind of "! whitelist_from_rcvd" possible ?

2004-01-21 Thread Tim B
Matt Kettler wrote: At 04:56 PM 1/21/2004, you wrote: Hi SA offers the possibility of having a "smarter" whitelist which whitelists only if the sending relay is "related" to the sending email, like whitelist_from_rcvd [EMAIL PROTECTED] example.com is there a possibility to somehow do the oppos

Re: [SAtalk] Popcorn & Backhair have been combined into 1 Set

2004-01-21 Thread Tim B
Jennifer Wheeler wrote: Hello spam peeps Adam Lopresto and I have recently begun working together on Chickenpox, and while working on that set, it occurred to him how to fix the limitations in Backhair, using similar ideas we're using in pox. This change in essence "combines" Backhair & Popcorn.

Re: [SAtalk] Re: Looking for comments on this rule: EMAIL in URL

2004-01-19 Thread Tim B
humm.. didn't think of ^ thanks ack just shoot my copy and past cleanup. uri MY_EMAILINURL_1/https?:([EMAIL PROTECTED])/i This an be subject to a mild denial of service attack. You probably mean to use '[EMAIL PROTECTED]' and '[^.]' instead of '.' in a couple of places. Scott -

Re: [SAtalk] Looking for comments on this rule: EMAIL in URL

2004-01-18 Thread Tim B
ack just shoot my copy and past cleanup. uri MY_EMAILINURL_1/https?:([EMAIL PROTECTED])/i Tim B wrote: because a lot of spam contains some email address in an embedded uri that I'm seeing. I threw together this rule: uri MY_EMAILINURL_1 /https?:([EMAIL PROTECTED])/i des

[SAtalk] Looking for comments on this rule: EMAIL in URL

2004-01-18 Thread Tim B
because a lot of spam contains some email address in an embedded uri that I'm seeing. I threw together this rule: uri MY_EMAILINURL_1 /https?:([EMAIL PROTECTED])/i describe MY_EMAILINURL_1Contains what appears to be an Email Address in URL score MY_EMAILINURL_1 1.5

[SAtalk] Books...

2004-01-15 Thread Tim B
Hey does anyone know if there are any spamassassin books comming out? --- This SF.net email is sponsored by: Perforce Software. Perforce is the Fast Software Configuration Management System offering advanced branching capabilities and atomic

Re: [SAtalk] [OT and long] Port Blocking

2004-01-14 Thread Tim B
This is why I beleive ISPs who have a restriction should publish their address blocks which are NOT supposed to be sending mail directly out. It then becomes the recipient mail domain's responsibility if they choose to block on the information published. In your small ISP case, you would not pu

Re: [SAtalk] Spamwriter

2004-01-14 Thread Tim B
It's well known that filtering is *only* useful for keeping one's inbox uncluttered; it does nothing to interdict the flow of crap from upstream. You want to put a serious dent in spam? IDP broadband providers that give their customers direct access to port 25 on remote systems by default. Spam fro

Re: [SAtalk] New Ruleset Available!!! TRIPWIRE! You don't want to miss this o ne!

2004-01-13 Thread Tim B
Excellent News! Chris Santerre wrote: Ladies and Gentlemen, Not since eating popcorn covered in backhair in the weeds have I been so excited about a ruleset. Fred, along with the rule writers consortium, has developed a new ruleset called Tripwire. Much testing has gone into this set. I

Re: [SAtalk] habeus

2004-01-11 Thread Tim B
that's exactly what I started doing a few weeks agao. I want to send enough habeas to enforce their copyrights :) jenni baier wrote: I guess we can all start putting together a "habeas corpus" On Sun, 11 Jan 2004, Jack Gostl wrote: I must have gotten 20 of these in the last three hours! I'm

Re: [SAtalk] OT: My REALY REALY Crazy idea!! ahahahahahah

2004-01-09 Thread Tim B
How many do think would end up with an overly outgoing well blessed healthy abit thin gorilla with a huge desire to descramble tv while becoming financially secure and well insured Chris Santerre wrote: Ok, this one is out in left field but I think it would make spam fun. The idea jumped i

Re: [SAtalk] handling spamc failures...

2004-01-06 Thread Tim B
Kris Deugau wrote: With your method of making sure mail gets scanned, mail will slowly build up in the queue until the server runs out of disk space, the MTA can't process the queue because it's too big, or SA's memory usage triggers the Linux kernel OOM process killer. (Exactly which happens fir

[SAtalk] handling spamc failures...

2004-01-06 Thread Tim B
I think we all have our favorite ways of calling spamc/spamassassin, and one of my biggest concerns is that spamd will die for some obscure reason and mail will stop getting scanned, or I'll be restarting spamd and a flood mail suddendly comes in. Well this is how I finally settled into my co

Re: [SAtalk] spamd -m and a good number....

2004-01-03 Thread Tim B
thanks! that's exactly what I needed to know! Robert Lacroix wrote: from the spamd documentation: "-m number, --max-children=number Specify a maximum number of children to spawn. Spamd will wait until another child finishes before forking again. Meanwhile, incoming connections will be queue

[SAtalk] spamd -m and a good number....

2004-01-03 Thread Tim B
the spamd -m commandline option for max child processes... is that per spamc call? for instance if I use: spamd -d -m10 -x -u filter and I run 50 instances of spamc, does that mean that all 50 call of the spamc process get 10 spamd child processes for a total of up to 500 spamd child processes?

Re: [SAtalk] Multiple CF Files & Performance

2004-01-02 Thread Tim B
Evans Martin wrote: I recently split out my CF file into multiple files. Ex. whitelist.cf, blacklist.cf, bigevil.cf, evilrules.cf, etc. Will this noticably degrade system performance? Thanks, Evans Martin I've not notice any performance decrease due to having multiple cf files, and afaik, spamd

Re: [SAtalk] False positives

2003-12-28 Thread Tim B
schafer wrote: To Spamassassin: My publication is double-opted in by 15,000 families with children with autism. We are routinely victimized by incompetent software like spamassassin because of false positives. This is just as intolerable as > spam. It is worse than spam because it victimizes t

Re: [SAtalk] downside to sa-learn and extra headers...

2003-12-23 Thread Tim B
Matt Kettler wrote: At 07:52 AM 12/23/2003, Tim B wrote: I want to feed ham into sa-learn every night. However when I get the ham i'm going to have a bunch more received headers and extra Microsoft SMTP headers because of the way it's going to be send to me. What's the downs

[SAtalk] downside to sa-learn and extra headers...

2003-12-23 Thread Tim B
Howdy All, I want to feed ham into sa-learn every night. However when I get the ham i'm going to have a bunch more received headers and extra Microsoft SMTP headers because of the way it's going to be send to me. What's the downside to learning ham with these extra headers? I know I can use

Re: [SAtalk] IE redirect rule

2003-12-18 Thread Tim B
Tim B wrote: Bill Larson wrote: http://www.dslreports.com/shownews/36402 http://www.enterpriseitplanet.com/security/news/article.php/3288771 http://www.secunia.com/advisories/10395/ Microsoft Knowledge Base Article - 833786: http://support.microsoft.com/?id=833786 In this exploit using: http

Re: [SAtalk] IE redirect rule

2003-12-18 Thread Tim B
Bill Larson wrote: http://www.dslreports.com/shownews/36402 http://www.enterpriseitplanet.com/security/news/article.php/3288771 http://www.secunia.com/advisories/10395/ Microsoft Knowledge Base Article - 833786: http://support.microsoft.com/?id=833786 In this exploit using: http://[EMAIL PROTECTED

Re: [SAtalk] required_hits = 5.x ???

2003-12-18 Thread Tim B
Theo Van Dinter wrote: On Thu, Dec 18, 2003 at 11:01:22PM -0500, Tim B wrote: I don't think I've seen this covered ever. can required_hits = 5.5? yes. the documentation (and code) specifies 5.0 as the default. integers are used just for simplicity, but floats are allowed. Ok g

[SAtalk] required_hits = 5.x ???

2003-12-18 Thread Tim B
I don't think I've seen this covered ever. can required_hits = 5.5? everywhere points to a whole number, like 5, or 6 ect ect. --- This SF.net email is sponsored by: IBM Linux Tutorials. Become an expert in LINUX or just sharpen your skills.

Re: [SAtalk] Domain DNS Blacklists

2003-12-16 Thread Tim B
Matt Kettler wrote: At 09:06 AM 12/16/03 -0500, Tim B wrote: this should work. may need a little tweeking. header RCVD_SECSAGE_RBL eval:check_rbl('SECSAGE', 'blackhole.securitysage.com.') describe RCVD_SECSAGE_RBL SECSAGE: listed in Security Sage's RBL score RCVD

Re: [SAtalk] Domain DNS Blacklists

2003-12-16 Thread Tim B
Mark Lowes wrote: Afternoon all, I've had a dig through the archives and wiki for a definitive answer with no success. Is it currently possible to use DNS based domain blacklists at the moment in SA? (such as http://www.securitysage.com/guides/postfix_uce_rhsbl.html) thanks Mark Yes th

Re: [SAtalk] Interesting service...

2003-12-16 Thread Tim B
Fred wrote: Tim B wrote: Hey I stumbled over this little gem of a marketeer, looks like they claim they can bypass any spamfilter. Anyone familiar with this group? onlinemarketingpros.net That's funny, their website says in business since 1997, but their whois shows different (10 day

[SAtalk] Interesting service...

2003-12-15 Thread Tim B
Hey I stumbled over this little gem of a marketeer, looks like they claim they can bypass any spamfilter. Anyone familiar with this group? onlinemarketingpros.net --- This SF.net email is sponsored by: IBM Linux Tutorials. Become an expert

Re: [SAtalk] New to SA

2003-12-09 Thread Tim B
Rachel E. Hewitt wrote: New to SA and unix. I am using SA 2.6 with Guinevere and GW 6. It is helping a lot. I have spent about 3 hours looking through the archives of this list and have not found the answer yeta couple questions: 1. if using the spamassassin --lint at the command prompt and it

Re: [SAtalk] Postfix - procmail - spamassassin config

2003-12-09 Thread Tim B
Daniel Kaliel wrote: Hey At least once a week our server hangs. I can't figure this out. It seems to be hanging when spamassassin is working on large emails. Here is how I have it setup and where I am confused. My confusion lies in this. If I use the mailbox_command field in postfix do I need

Re: [SAtalk] Rules Modification /Content Filtering Results

2003-12-01 Thread Tim B
<--- snip > My Question/Concerns Does anybody have any ideas about how this would affect the bayesian learning system? If i suddenly changed my mind about liking porn one day and decided to block all porn, would I need to clear out my bayesian learning database so that it would begin t

Re: [SAtalk] 5.0 spampoints

2003-10-25 Thread Tim B
Jeffrey Schilperoord wrote: What is the easyest way to change the 5.0 spampoints to a higher level ? greetings Jeffrey Schilperoord in your /etc/mail/spamassassin/local.cf file add/change the line required_hits 5 to whatever you want it to be. --

Re: [SAtalk] incorectly identified trusted host

2003-10-09 Thread Tim B
David B Funk wrote: On Tue, 7 Oct 2003, Tim B wrote: Yes I have.. that was the first thing I tried... it still thinks when there's just one other host that the host is trusted. Havn't seen that one, sounds like a true bug. I guess I will open a bugzilla request then.

[SAtalk] incorectly identified trusted host

2003-10-07 Thread Tim B
Problem in spamassassin 2.60 -- trusted relay There seems there might be a glitch in the detection of trusted relays which is causing RBL checks to be bypassed. Is there a way to bypass the autodetection of trusted relays and use only ones specified in a .cf file? I searched bugzilla and didn'

Re: [SAtalk] SA and tagging/removing

2003-09-17 Thread Tim B
[EMAIL PROTECTED] wrote: OK, fine, you have persuaded me. So I have one question: how can I delete the message, when we use qmail and for local delivery we use the qmail-local? We run the SA after the AMAVIS + antivirus (both written in the .qmail file, because these programs must be turn off/o

Re: [SAtalk] defining the min/max score per test

2003-08-30 Thread Tim B
Mark C wrote: Hi, I have spamassassin installed on my debian woody e-mail server, out of the box it works generally ok, except for a few false alerts, which is why this mail comes in, I wish to allow each use to setup their own user_prefs file, I have sucsessfully implimented this, but I'm having

[SAtalk] Checking the validity of from against another header

2003-06-04 Thread Tim B
Hi all I'm currently adding a header field which contains the enevelope from email address. I was wondering if there was a way to write a rule where I could check this header against the from header field? Spamassassin 2.55 Postfix 1.11 Procmail/formail in use. I add the header: X-Enve-sender

Re: [SAtalk] Bayes is enabled, but not being included in tests

2003-03-26 Thread Tim B
Don't know if this one of your problems or not, but you might want to look at adding: bayes_file_mode since you are using a site wide configuration. Also make sure the user that spamassassin is running as has the proper read and write permissions to the files defined in your bayes_path stateme

Re: [SAtalk] How to tell if Bayes is working?

2003-02-17 Thread Tim B
Theo Van Dinter wrote: On Mon, Feb 17, 2003 at 02:05:00PM -0500, Tim B wrote: Thanks.. :) since the ones I'm using to teach 2.50 bayes filters were tagged as spam and non spam by 2.43 & 2.44 do I need to remove the spamassassin markup? sa-learn will remove the markup if it

[SAtalk] How to tell if Bayes is working?

2003-02-17 Thread Tim B
How can I tell if the Bayes Filtering is working in 2.50? --- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf ___ Spamassassin-talk mailing list [EMAIL PRO