On Thu, Aug 28, 2003 at 09:10:09AM +0200, Rainer Sokoll wrote:
> On Wed, Aug 27, 2003 at 12:44:20PM -0700, Justin Mason wrote:
>
> Good morning,
>
> > Larry Gilson writes:
> > >There was another suggestion that the tests could be commented out in
> > >20_head_tests.cf. Which is the best and/or r
On Thu, 2003-08-28 at 11:50, Carlo Wood wrote:
> Are you 100% sure that is also the case for RBL checks?
> It seems 'weird' that this test will indeed be completely
> turned off if, and only if, all six related scores are set
> to 0 (and not when you forget one). That seems like an
> almost compli
Mail::SpamAssassin::Conf indicates that:
"Setting a rule's score to 0 will disable that rule from running.".
--Larry
> -Original Message-
> From: Carlo Wood
> Are you 100% sure that is also the case for RBL checks?
> It seems 'weird' that this test will indeed be completely
> turned
On Thu, Aug 28, 2003 at 09:56:59AM +0100, Nigel Metheringham wrote:
> Remember that scoring a test as zero inhibits the test being run at all,
Are you 100% sure that is also the case for RBL checks?
It seems 'weird' that this test will indeed be completely
turned off if, and only if, all six relat
> On Wed, Aug 27, 2003 at 12:44:20PM -0700, Justin Mason wrote:
>
> Good morning,
>
>> Larry Gilson writes:
>> >There was another suggestion that the tests could be commented out in
>> >20_head_tests.cf. Which is the best and/or recommended method?
>>
>> either works fine. This way is easier.
>
>
On Thu, 2003-08-28 at 08:10, Rainer Sokoll wrote:
> On Wed, Aug 27, 2003 at 12:44:20PM -0700, Justin Mason wrote:
> > Larry Gilson writes:
> > >There was another suggestion that the tests could be commented out in
> > >20_head_tests.cf. Which is the best and/or recommended method?
> >
> > either
On Wed, Aug 27, 2003 at 12:44:20PM -0700, Justin Mason wrote:
Good morning,
> Larry Gilson writes:
> >There was another suggestion that the tests could be commented out in
> >20_head_tests.cf. Which is the best and/or recommended method?
>
> either works fine. This way is easier.
In this case
;[EMAIL PROTECTED]'; [EMAIL PROTECTED]
> Subject: RE: [SAtalk] Scores for OSIRU Tests
>
> Hey Justin,
>
> There was another suggestion that the tests could be
> commented out in 20_head_tests.cf. Which is the best and/or
> recommended method?
>
> --Larry
Larry Gilson writes:
>There was another suggestion that the tests could be commented out in
>20_head_tests.cf. Which is the best and/or recommended method?
either works fine. This way is easier.
>> -Original Message-
>> From: [EMAIL PROTECTED]
>
>>
>> Alexander Skwar writes:
>> >Good
Hey Justin,
There was another suggestion that the tests could be commented out in
20_head_tests.cf. Which is the best and/or recommended method?
--Larry
> -Original Message-
> From: [EMAIL PROTECTED]
>
> Alexander Skwar writes:
> >Good morning,
> >
> >now that osirusoft is officially
Alexander Skwar writes:
>Good morning,
>
>now that osirusoft is officially dead, what should we SA admins do? Set
>all scores for OSIRUSOFT related test to 0? Which are all the tests? Is
>the following sufficient?
>
>score RCVD_IN_OSIRUSOFT_COM 0
>score X_OSIRU_DUL 0
>score X_O
On Wed, Aug 27, 2003 at 04:26:19PM +0200, Alexander Skwar wrote:
> Rainer Sokoll wrote:
>
> > I think it is better to disable rblcheck for osirusoft completly in
> > 20_head_test.cf:
>
> Okay. What about those X_OSIRU_ tests? Are they related to
As far as I understand this, by disabling check_rb
Rainer Sokoll wrote:
> I think it is better to disable rblcheck for osirusoft completly in
> 20_head_test.cf:
Okay. What about those X_OSIRU_ tests? Are they related to
osirusoft.com? Seems so.
Alexander Skwar
--
-> Keine Kopien senden - ich lese die Listen in denen ich schreibe! <-
-> Do not
On Wed, Aug 27, 2003 at 08:28:56AM +0200, Alexander Skwar wrote:
> Good morning,
>
> now that osirusoft is officially dead, what should we SA admins do? Set
> all scores for OSIRUSOFT related test to 0? Which are all the tests? Is
> the following sufficient?
>
> score RCVD_IN_OSIRUSOFT_COM 0
At 12:17 PM 8/15/03 -0700, Stephen Boals wrote:
Just upgraded to 2.55, and in testing found that I am getting different
scores between versions. Has the scoring changed for rules? Can I get
some background on why, and thought process? Thanks.
New scores were generated in 2.50, and they were
Scoring changes between versions because -- well, spam does. New rules
or added and old rules are retested before every release.
Stephen Boals wrote:
Just upgraded to 2.55, and in testing found that I am getting
different scores between versions. Has the scoring changed for
rules? Can I get
On Thu, Jul 17, 2003 at 12:31:32PM +0200, Tony Earnshaw wrote:
> >Hey - that was a good one! I wonder why I've never received a copy - I feel
> >left out! Perhaps there's a Nigerian Scam mailing list I ought to subscribe
> >to ([EMAIL PROTECTED]).
> I take it you're attending our conference?
I'v
Jim Ford wrote:
One user reported an undected spam to me (quoted below, headers
included). Your usual Nigerian scam-style spam. It got 3.8 points, but
Hey - that was a good one! I wonder why I've never received a copy - I feel
left out! Perhaps there's a Nigerian Scam mailing list I ought t
On Wed, Jul 16, 2003 at 06:01:12PM +0700, Alain Fauconnet wrote:
> Hello,
> One user reported an undected spam to me (quoted below, headers
> included). Your usual Nigerian scam-style spam. It got 3.8 points, but
Hey - that was a good one! I wonder why I've never received a copy - I feel
l
Quoting spamassassin <[EMAIL PROTECTED]>:
> How is everyone using SA? Do you auto delete spam after some high score? I
> would like to find the safest score to delete spam, and keep the other mail
> with smaller score.
Personalised the score needed for the users, then let all spam through but wit
* spamassassin ([EMAIL PROTECTED]) wrote this on 10 14, 02 at 12:06:
>
> How is everyone using SA? Do you auto delete spam after some high score? I
> would like to find the safest score to delete spam, and keep the other mail
> with smaller score.
I never auto-delete anything. :-) Losing real m
| How is everyone using SA? Do you auto delete spam after some high score? I
| would like to find the safest score to delete spam, and keep the
| other mail with smaller score.
I archive everything first, just in case, then /dev/null anything that
scores 20+ and put anything from 5-19.x into a sp
I use a 'suspicious' score of 5-10, and an auto deletion
score of 10. Perhaps 10 is overly-cautious because my
highest scoring 'false suspicious' email has been 8.9 (an
MLM newsletter). Many people here would consider 10 to be
too low, I'm sure.
I have my clients opt in for spamassassin on thei
--On Thursday, April 4, 2002 2:01 PM -0800 Daniel Rogers
<[EMAIL PROTECTED]> is rumoured to have written:
> On Thu, Apr 04, 2002 at 09:31:50AM -0600, Casimir Couvillion wrote:
>> Highest in March was 43.4. Several 41s behind it.
>
> Sounds like a challenge! Ok, this one is from yesterday:
>
> X
Daniel Rogers <[EMAIL PROTECTED]> writes:
> On Thu, Apr 04, 2002 at 09:31:50AM -0600, Casimir Couvillion wrote:
> > Highest in March was 43.4. Several 41s behind it.
>
> Sounds like a challenge! Ok, this one is from yesterday:
I can't beat that, but here's everything I've received in the last
On Thu, Apr 04, 2002 at 09:31:50AM -0600, Casimir Couvillion wrote:
> Highest in March was 43.4. Several 41s behind it.
Sounds like a challenge! Ok, this one is from yesterday:
X-Spam-Status: Yes, hits=47.8 required=5.0
tests=NO_REAL_NAME,SUBJ_ALL_CAPS,FROM_ENDS_IN_NUMS,INVALID_DATE_NO_TZ,PLIN
On Thu, Apr 04, 2002 at 11:14:32AM +0100, Tony Evans wrote:
> As a totally frivolous query, what's the highest score anyone's seen on
> [legitimate] incoming SPAM [using the default SA scores]?
>
> I've seen scores in the low 30's.
45.1
http://www.sonic.net/scott/wowspam.txt
-Scott
__
Highest in March was 43.4. Several 41s behind it.
I had a 143, but it was from this list, so I think was a false positive .
-cpc-
-Original Message-
From: Tony Evans [mailto:[EMAIL PROTECTED]]
Sent: Thursday, April 04, 2002 4:15 AM
To: [EMAIL PROTECTED]
Subject: [SAtalk] Scores on the D
At 12:14 04/04/2002, you wrote:
>As a totally frivolous query, what's the highest score anyone's seen on
>[legitimate] incoming SPAM [using the default SA scores]?
>
>I've seen scores in the low 30's.
41.8 is the record here - used to be 38.x something. Heavy use of RBL (I
think flagged by five
It must be partially because I run a bunch of custom rules to single out stock
spam, MLM spam, and frequent spammers, but I seem to get higher scores than
many people have posted. I get one or two scores over 30 per day.
In my archive of the last month of spam (1058 messages total from 3/11/2002
Top ten (message IDs changed to protect the spamtraps). Note these were
when scanning with mass-check, so no network tests.
[craig@belphegore masses]$ sort -rn +1 spam.log |head -10
Y 51
/home/craig/spams/spamtrap.mbox:<[EMAIL PROTECTED]>
SUBJ_HAS_SPACES,MSG_ID_ADDED_BY_MTA_2,NO_REAL_NAME,EARN_
On one month worth of spam, here are the highest hits:
30.4
30.8
30.9
31.2
39.5
55.8
The 39.5 triggered the following tests: SUBJ_ALL_CAPS, NO_REAL_NAME,
ADVERT_CODE, SUBJ_HAS_SPACES, TO_MALFORMED, PLING, FROM_ENDS_IN_NUMS,
INVALID_DATE_TZ_ABSURD, SMTPD_IN_RCVD, VIAGRA, CLICK_BELOW,
CASHCASHCASH
On 3/11/02 4:53 AM, "Michael Moncur" <[EMAIL PROTECTED]> wrote:
> Matt Sergeant wrote:
>> I would suggest that we be extremely careful about checks that get given
>> a score over 5. Part of the beauty of SpamAssassin (and heuristics in
>> general) is that usually a hit just contributes to the ove
Matt Sergeant wrote:
> I would suggest that we be extremely careful about checks that get given
> a score over 5. Part of the beauty of SpamAssassin (and heuristics in
> general) is that usually a hit just contributes to the overall score, but
> doesn't necessarily tip things over. Having said tha
34 matches
Mail list logo
