Re: [SAtalk] Suggestion to Reduce False Positive

2002-11-25 Thread Tom Allison
John Rudd wrote: Along those lines, it'd be nice to define things which are like whitelists and blacklists, but have separate lists and separate scores. So, like, I might have: addlist white to [EMAIL PROTECTED] # same as whitelist_to addlist black from [EMAIL PROTECTED] # same as blackli

Re: [SAtalk] Suggestion to Reduce False Positive

2002-11-25 Thread Christopher Eykamp
To give maximum flexibility, you could add these lines to the 4 you listed score whitelist -100 score blacklist +10 score blocklist + 100 score graylist -10 score greenlist -5 At 12:35 PM 11/25/2002 -0800, John Rudd wrote: Along those lines, it'd be nice to define things which are like white

Re: [SAtalk] Suggestion to Reduce False Positive

2002-11-25 Thread John Rudd
Along those lines, it'd be nice to define things which are like whitelists and blacklists, but have separate lists and separate scores. So, like, I might have: addlist white to [EMAIL PROTECTED] # same as whitelist_to addlist black from [EMAIL PROTECTED] # same as blacklist_from addlist bl

Re: [SAtalk] Suggestion to Reduce False Positive

2002-11-25 Thread Christopher Eykamp
This would work well most of the time, but I have been getting spam with the return address of others on my domain to whom I regularly send mail. That is, the spammers are trolling their address database and using people I likely know as the return address. Your scheme would let these message

Re: [SAtalk] Suggestion to Reduce False Positive

2002-11-25 Thread Ralf Hildebrandt
* Tom Allison <[EMAIL PROTECTED]>: > So if I have an entry like (/etc/postfix/main.cf): > > mailbox_command = procmail -a "$EXTENSION" This is only for local delivery via "local" > just add one like: > content_filter = procmail -a "$EXTENSION" This is for all mail in transit. Note: The above

Re: [SAtalk] Suggestion to Reduce False Positive

2002-11-25 Thread Tom Allison
Ralf Hildebrandt wrote: * Tom Allison <[EMAIL PROTECTED]>: How do you use procmail to filter outbound email? If you're using Postfix, you can use a content_filter that invokes procmail. So if I have an entry like (/etc/postfix/main.cf): mailbox_command = procmail -a "$EXTENSION" just ad

Re: [SAtalk] Suggestion to Reduce False Positive

2002-11-25 Thread Ralf Hildebrandt
* Tom Allison <[EMAIL PROTECTED]>: > How do you use procmail to filter outbound email? If you're using Postfix, you can use a content_filter that invokes procmail. -- Ralf Hildebrandt (Im Auftrag des Referat V a) [EMAIL PROTECTED] Charite Campus MitteTel. +49 (0)3

Re: [SAtalk] Suggestion to Reduce False Positive

2002-11-25 Thread Justin Mason
Steve Evans said: > Keep a database with every address that e-mail is sent to. Have a rule > with a negative value that checks that database on incoming mail. > > I find it quite unlikely that any address that someone would send a > message to would ever be sending my server spam. Any thoughts?

Re: [SAtalk] Suggestion to Reduce False Positive

2002-11-25 Thread Tom Allison
Tony L. Svanstrom wrote: On Sun, 24 Nov 2002 the voices made John Rudd write: 1) Have your mail client put a copy of all outgoing messages into a particular folder (like "Sent"). (most clients do this already, so its no big deal) 2) Write a program which parses that file out and adds those add

RE: [SAtalk] Suggestion to Reduce False Positive

2002-11-25 Thread Steve Evans
but the point isn't to be perfect here. Just get the highest majority possible. Steve Evans SDSU Foundation (619) 594-0653 -Original Message- From: Steve Evans Sent: Sunday, November 24, 2002 8:29 PM To: SpamAssasin Mailing List Subject: [SAtalk] Suggestion to Reduce False Positiv

Re: [SAtalk] Suggestion to Reduce False Positive

2002-11-25 Thread Tony L. Svanstrom
On Sun, 24 Nov 2002 the voices made Jeremy Zawodny write: > Well, it's not *trivial* but I don't think it's huge either. You need > to scan all outgoing mail and maintain a list of destination > addresses. Then integrate that into a site-wide SA whitelist. > > Am I missing some complexity? Wel

Re: [SAtalk] Suggestion to Reduce False Positive

2002-11-25 Thread Tony L. Svanstrom
On Sun, 24 Nov 2002 the voices made John Rudd write: > 1) Have your mail client put a copy of all outgoing messages into a > particular folder (like "Sent"). (most clients do this already, so its > no big deal) > > 2) Write a program which parses that file out and adds those addresses > to a file,

Re: [SAtalk] Suggestion to Reduce False Positive

2002-11-25 Thread Jeremy Zawodny
On Mon, Nov 25, 2002 at 06:59:14AM +0100, Tony L. Svanstrom wrote: > On Sun, 24 Nov 2002 the voices made Steve Evans write: > > > Keep a database with every address that e-mail is sent to. Have a rule > > with a negative value that checks that database on incoming mail. > > > > I find it quite un

Re: [SAtalk] Suggestion to Reduce False Positive

2002-11-24 Thread John Rudd
On Sunday, Nov 24, 2002, at 21:59 US/Pacific, Tony L. Svanstrom wrote: On Sun, 24 Nov 2002 the voices made Steve Evans write: Keep a database with every address that e-mail is sent to. Have a rule with a negative value that checks that database on incoming mail. I find it quite unlikely tha

Re: [SAtalk] Suggestion to Reduce False Positive

2002-11-24 Thread Tony L. Svanstrom
On Sun, 24 Nov 2002 the voices made Steve Evans write: > Keep a database with every address that e-mail is sent to. Have a rule > with a negative value that checks that database on incoming mail. > > I find it quite unlikely that any address that someone would send a > message to would ever be se

Re: [SAtalk] Suggestion to Reduce False Positive

2002-11-24 Thread Jeremy Zawodny
On Sun, Nov 24, 2002 at 08:29:28PM -0800, Steve Evans wrote: > Keep a database with every address that e-mail is sent to. Have a rule > with a negative value that checks that database on incoming mail. > > I find it quite unlikely that any address that someone would send a > message to would ever

[SAtalk] Suggestion to Reduce False Positive

2002-11-24 Thread Steve Evans
Keep a database with every address that e-mail is sent to. Have a rule with a negative value that checks that database on incoming mail. I find it quite unlikely that any address that someone would send a message to would ever be sending my server spam. Any thoughts? Steve Evans SDSU Foundation