Sorry that's not correct either. Conf doesn't seem to be reading the
max's from my local.
-Original Message-
From: Rose, Bobby
Sent: Thursday, May 02, 2002 3:07 AM
To: [EMAIL PROTECTED]
Cc: Richie Laager; [EMAIL PROTECTED]
Subject: RE: [SAtalk] [PATCH] DCC Reporting
I think the sectio
Rose, Bobby wrote:
RB> I think the section for dcc in Conf.pm is wrong. Shouldn't it be $1
RB> instead of $1+0 for the dcc_body_max,etc?
No, that's OK the way it is. All the defaults stuff is wrong though, that
needs to get moved, which i'll take care of.
C
_
Ok, I'll go look at what was in CVS and build the word list from there. I agree
on the number of words thing. We can probably get around that by calculating
the %age of words which are on the list, instead of having a hard threshold. ie
more like the spam phrases stuff where it comes up with a
On Thursday, May 2, 2002, at 01:04 AM, Michael Moncur wrote:
> I'm sure it's better than the current PORN_3 regardless.
But will generate more false positives if you have any friend who like the
word "puss{ies|y)" and use it a couple of times in an email along with
"dick."
Like, "That dick is
On Thursday, May 2, 2002, at 01:00 AM, LuKreme wrote:
> On Thursday, May 2, 2002, at 12:50 AM, Craig R Hughes wrote:
>> LuKreme wrote:
I-R-A-MORON.
sigh.
Hey, NOTHING I read said I had to explicitly turn on procmail in the master.
cf file for postfix. And I searched DOZENS of sites.
And n
Craig R Hughes wrote:
CRH> Ok, I'll go look at what was in CVS and build the word list from there. I agree
CRH> on the number of words thing. We can probably get around that by calculating
CRH> the %age of words which are on the list, instead of having a hard threshold. ie
CRH> more like the s
LuKreme wrote:
L> And no one ever said, "hey dumbass, did you edit master.cf so that procmail
L> is set?"
Well, you said procmail was being invoked sometimes, so I assumed it was being
invoked, and that meant you'd added it into the chain somehow.
C
___
> Ok, I just checked in a "fixed" version of Daniel's suggested
> change. It's not
> doing the adjustment-to-threshold-based-on-message length SO BE
> WARY IF YOU'RE
> IN THE HABIT OF USING CVS -- THIS CURRENT CODE MIGHT YIELD A
> BUNCH OF FALSE
> POSITIVES. It's somewhat unlikely, I think it's
> But will generate more false positives if you have any friend who
> like the
> word "puss{ies|y)" and use it a couple of times in an email along with
> "dick."
>
> Like, "That dick is such a pussy. Pussies like him piss me off."
Actually, I pasted your message 20 times into a test message to t
On Thursday 02 May 2002 02:14 am, Michael Moncur wrote:
> Actually it seems harmless - unlike the old spam phrases stuff, there's
> still only one rule and PORN_3 has a score of 0.6, so it's not going to
> push too many things over the threshold.
>
> Perhaps after testing it might be good to have
Craig R Hughes wrote:
> Yes, see bugzilla #18 which I merged into #130. This is the major piece of
> stuff I'd like to get done for 2.30 -- and I'm actually quite motivated to do
> the coding myself; I have a couple of other things I'm probably going to be
> working on, but might well have 130 do
Craig R Hughes wrote:
> You are correct that
> there is no current Perl DCC client implementation; I've been discussing it
> today on the DCC mailing list, and it sounds like it would non-trivial to
> implement.
If it's just a bit of XS code to write, it's actually trivial. Let me
know if you w
I,
is there any receipt for using SpamAssassin with qmail on a system wide
basis? How can it be done?
--
Jose Celestino <[EMAIL PROTECTED]> SAPO.pt::Systems http://www.sapo.pt
-
Titanic 1912 / Hindenburg Zeppelin 1937 / Microso
subscribe
smime.p7s
Description: application/pkcs7-signature
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
On Wednesday 01 May 2002 22:29 pm, Craig R Hughes wrote:
> Richie Laager wrote:
>
> RL> Attached is a patch that runs messages through "dccproc
> -t RL> many" when "spamassassin -r" is run.
>
>
> Great, thanks. Just checked it into CVS. One thing
>
This looks strange - it hit my triggering limit exactly, and isn't
considered spam. Why?
--
Derek Broughton
--- Begin Message ---
BIZ and .INFO Available Here
Dear sir/madam,
The Internet Corporation for Assigned Names and Numbers [ICANN] has recently approved
the addition of new extensions t
Derek Broughton wrote:
> This looks strange - it hit my triggering limit exactly, and isn't
> considered spam. Why?
Floating point inaccuracies. Witness:
$ perl -le 'printf "%0.1f vs %0.1f", 4., 5.0'
Matt.
___
Have big pipes
Might be worth doing the check on the rounded number, just to eliminate
the visual confusion.
-- Nathan
Nathan Neulinger EMail: [EMAIL PROTECTED]
University of Missouri - Rolla Phone: (573) 341-4841
Comp
> Might be worth doing the check on the rounded number, just to eliminate
> the visual confusion.
I wouldn't say _just_ to eliminate the visual confusion. If the header had
been:
X-Spam-Status: No, hits=4.999 required=5.0
it would have been correct. If the header tells me the hit count wa
On Wed, 1 May 2002, Kelsey Cummings wrote:
> Take a look at spamd times. I checked the razor list and didn't see any
> chatter about lagged servers but it sure looks like razor is suffering a
> bit right now. I've seen processing times >100 seconds...
Can you share your bit of spamd + cricket
On Thu, 2 May 2002, Derek Broughton wrote:
> > Might be worth doing the check on the rounded number, just to eliminate
> > the visual confusion.
>
> I wouldn't say _just_ to eliminate the visual confusion. If the header had
> been:
> X-Spam-Status: No, hits=4.999 required=5.0
> it would ha
I've been running with the site-wide AWL and the spamd -S early-terminate
option.
It has just occured to me that this will adjust the AWL math because I
won't be getting "big" positive numbers into the AWL any more.
And I suppose this makes it more of an Auto-WHITE-list than an Auto-WHITE
& BLAC
subscribe
smime.p7s
Description: application/pkcs7-signature
Hi,
I got a new mutation of Nigerian scams. This time it's about Sierra Leone.
Anyone else got this ?
I filed an update to the Nigerian rules as bug #271.
ciao
Klaus
___
Have big pipes? SourceForge.net is looking for download mi
On Thu, 2002-05-02 at 09:16, Charlie Watts wrote:
> It has just occured to me that this will adjust the AWL math because
> I won't be getting "big" positive numbers into the AWL any more.
The fact that the -S option is reasonable points out that the scoring is
not a linear measure of spamminess.
> > LOGABSTRACT=all
> > LOGFILE=/var/log/prcmail.log
> > VERBOSE=YES
>
> I did this about 2 hours ago. Actually, closer to 3. I've send numerous
> copies of the spam to various email accounts and have seen nothing in
> procmail.log.
FWIW, I'm seeing the *EXACT* same behaviour. Forgive me i
On Wed, 1 May 2002, Bart Schaefer wrote:
> So about all you could say from just this analysis is that rules that were
> never hit could possibly be deleted.
In addition, any rules analysis is incomplete without the frequency
of rule hits in non-spam mail. After all, just beacuse there's a
Recei
The biggest problem with -S is due to the ordering of the rule checks.
If all of the negative rules (or at least the _large_ negative rules)
were processed first, it would probably be ok, but right now (or at
least with 2.20) - if you enabled it, the whitelisting would never get
used, since it wou
No relay it appears, and submitting it to Razor seems pointless at this point.
Looks like the ruleset for "pr0n" words is going to continue to grow.
---
Return-Path: <[EMAIL PROTECTED]>
Received: from arcturus.whitcon.net (arcturus.whitcon.net [65.171.144.13])
by mail
On Wed, 1 May 2002, Richie Laager wrote:
> Every once and a while, a message sent to this mailing list is caught as
> spam on my system (and the systems of others). Could the following lines
> be added to 60_whitelist.cf (or some other config file)?
>
> all_spam_to spamassassin-*@lists.source
On Wed, 1 May 2002, LuKreme wrote:
> I would like to enable some sort of logging on spamd so that I can see
> exactly why most of the incoming spam is NOT getting marked as spam. Even
> when sending the sample-spam.txt file it doesn't "ring up" as spam on all
> my local accounts. It does on som
On Thu, 2 May 2002, Onie Camara wrote:
> I'm running postfix with local delivery. I have installed spam assassin.
> I've tried the sample-nospam.txt and sample-spam.txt and it works.
>
> Now, since I have already spam assassin installed, I just need confirmation
> about my configuration file, mai
On Thu, 2 May 2002, LuKreme wrote:
> On Wednesday, May 1, 2002, at 11:46 PM, Kelsey Cummings wrote:
> > LOGABSTRACT=all
> > LOGFILE=/var/log/prcmail.log
> > VERBOSE=YES
>
> I did this about 2 hours ago. Actually, closer to 3. I've send numerous
> copies of the spam to various email accounts and
On Wed, 1 May 2002, Derek Broughton wrote:
> From: "Dave Strickler" <[EMAIL PROTECTED]>
>
> > Looks like SendMail uses Milter(s) to hook in...
> > Looks like ProcMail has easy hooks...
> >
> > Anyone have a preference for ease of use / clean install / less
> > headaches? The box it will run on wil
On Tue, 30 Apr 2002, Ron wrote:
> I recently installed SA, but find that spamd sometimes hangs. Our mail
> server receives about 3500 emails a day with the following setup:
> Exim uses a pipe/filter transport to pass mail to spamc -> spamd
>
> spamd is launched with the following parameters:
>
>
On Mon, 29 Apr 2002, Sean Harding wrote:
> So is +1.9 the correct score? I could just change it manually on my install
> for now. Actually, I just whitelisted apple.com, so I guess it doesn't
> matter much...
>
> And, yeah, I'd love to go back and order even more from the Apple Store to
> help th
From: "Charlie Watts" <[EMAIL PROTECTED]>
> On Wed, 1 May 2002, Derek Broughton wrote:
> > _nothing_ beats Exim. Exim installation on a Debian system is almost
> > trivial. Spamassassin installation on top of Exim, and it wouldn't need
to
> > be Debian, using dman's instructions (check the arc
Michael Moncur wrote:
MM> > Ok, I just checked in a "fixed" version of Daniel's suggested
MM> > change. It's not
MM> > doing the adjustment-to-threshold-based-on-message length SO BE
MM> > WARY IF YOU'RE
MM> > IN THE HABIT OF USING CVS -- THIS CURRENT CODE MIGHT YIELD A
MM> > BUNCH OF FALSE
MM>
I think my opinion is that it's not critical at this juncture, I just wanted to
get a sense of what the options and complexities would be down the road when
(if?) we do eventually need to deal with the issue. I wouldn't prioritize it
particularly high at the moment. We'll see where things go aft
On Thu, May 02, 2002 at 09:41:56AM -0600, Charlie Watts wrote:
> On Wed, 1 May 2002, Kelsey Cummings wrote:
>
> > Take a look at spamd times. I checked the razor list and didn't see any
> > chatter about lagged servers but it sure looks like razor is suffering a
> > bit right now. I've seen pro
Michael Moncur wrote:
MM> it includes three separate listed words, but "wild wild wild hot hot hot"
Insightful +1
I hadn't noticed that before, but you're right. We could use $& and stuff to
find multiple matches of each word, but then performance is going to go down the
tubes again...
C
__
How about using split and then counting chunks? ie something like:
@chunks = split $patterns,$$fulltext;
$score = some_function_of(scalar @chunks);
For the proximity thing, you can check the length() of the various elements of
@chunks
C
Matthew Cline wrote:
MC> On Thursday 02 May 2002 02:14
Craig R Hughes said:
> and have not just two, but maybe 3-4 levels of porniness.
Many levels of porniness would be good.
:-)
[sorry, couldn't resist]
Now, on topic, if I get messages from a mailing list that test out as spam
I know I can whitelist the mailing list.
whitelist_to [EMAIL PROTECT
Richie Laager wrote:
RL> > why this is so. Any thoughts on why the two shouldn't be
RL> > consolidated, or perhaps broken out as separate DCC.pm and
RL> > Razor.pm modules which are called to from the other files?
RL>
RL> I think they should. However, I'm not that familiar with the
RL> SA code o
Well, I think that better than comparing the rounded number, we should instead
compare the real numbers, and just round down instead. So 4.9 would be
displayed as 4.9 not 5.0 -- it's less mathematically correct, but makes it
clearer why 5.0 < 5.0 sometimes.
C
Derek Broughton wrote:
DB> > M
I think that AWL will just be whitelist-only if you use -S; you're not going to
be able to get around that I think. If you use -S, you're not going to be able
to guess what the score would have been if you'd let thing keep running and not
short-circuited. I can't think of any posisble adjustment
The first Nigerian scam mail I ever received was Sierra Leone. Expanding the
rule(s) to cover all sub-saharan west african nations might be a useful
prophylactic action.
C
Klaus Heinz wrote:
KH> Hi,
KH>
KH> I got a new mutation of Nigerian scams. This time it's about Sierra Leone.
KH> Anyone e
On Thu, May 02, 2002 at 05:51:49PM -0600, LuKreme wrote:
| Now, on topic, if I get messages from a mailing list that test out as spam
| I know I can whitelist the mailing list.
| whitelist_to [EMAIL PROTECTED] # Messages are addresed TO the list, right?
Maybe, maybe not. Depends on the poster
I'm following the instructions in the README, but when I send a message to
myself (from another account), it bounces back with this message:
- The following addresses had permanent fatal errors -
"|IFS=' ' && exec /usr/bin/procmail -f- || exit 75 #jason"
(reason: service unavail
I would've presumed that SpamAssassin would give a score (presumably
negative) for MIME attachments, in particular digitally signed messages.
I can't imagine many spammers going to the trouble of digitally signing
email.. :)
Daz
___
H
Sidney Markowitz wrote:
SM> The fact that the -S option is reasonable points out that the scoring is
SM> not a linear measure of spamminess. The function P(s) of the probability
SM> that a message with score s is spam stays near 0 until some small
SM> positive s, then asymptotically approaches 1
Neulinger, Nathan wrote:
NN> The biggest problem with -S is due to the ordering of the rule checks.
NN> If all of the negative rules (or at least the _large_ negative rules)
NN> were processed first, it would probably be ok, but right now (or at
NN> least with 2.20) - if you enabled it, the white
Hmm, 2 interesting things in the message there:
1. X-UIDL is often added by legitimate mailer like UW-IMAP and such, but that
format of the string looks suspicious to me.
2. Never before seen a Comment: header containing a unique ID like that
C
PremierNET Abuse wrote:
PA> Return-Path: <[EMAI
I agree. The only addresses I feel comfortable at all with in a default
whitelist are large, sophisticated, lawyer-rich companies who are likely to
agressively pursue spammers who debase their trademarks. eg if a spammer forges
a @amazon.com return address, they will not long continue to do that
On Thu, May 02, 2002 at 05:13:03PM -0700, Jason Hough wrote:
| I'm following the instructions in the README, but when I send a message to
| myself (from another account), it bounces back with this message:
|
|- The following addresses had permanent fatal errors -
| "|IFS=' ' && exec
Charlie Watts wrote:
CW> The messages, once passed through SA, should have an X-Spam-Status header
CW> that lists the SA tests that were caught.
CW>
CW> If that header isn't there, the messages aren't going through SA.
CW>
CW> Is that header there-but-different on the working/non-working accounts
Charlie Watts wrote:
CW> Lemme guess: PBG4 ?
CW>
CW> I have a 550 ... very happy with it. Much more fragile than the iceBook,
CW> but also much more usable - the screen real estate is nice, and yours will
CW> be even better.
My fiancee has a 550, I got a 667. I'm pissed because now 2 weeks late
Matt Sergeant wrote:
MS> Craig R Hughes wrote:
MS> > Yes, see bugzilla #18 which I merged into #130. This is the major piece of
MS> > stuff I'd like to get done for 2.30 -- and I'm actually quite motivated to do
MS> > the coding myself; I have a couple of other things I'm probably going to be
MS
On Thu, 02 May 2002, Matt Sergeant wrote:
> Craig R Hughes wrote:
>> Yes, see bugzilla #18 which I merged into #130. This is the major
>> piece of stuff I'd like to get done for 2.30 -- and I'm actually
>> quite motivated to do the coding myself; I have a couple of other
>> things I'm probably goi
Daniel Pittman wrote:
DP> Also, will it handle a MIME part separator such as...
DP>
DP> --terrorist-Marxist-counter-intelligence-security-PLO-arrangements
DP>
DP> ...a separator that I know has caused some email parsing tools to fail
DP> and die in the past. Oh, and spaces in MIME breaks?
DP>
DP>
LuKreme wrote:
L> now, let's say I want to decrease the value of DNSBL from 3.0 to 2.9. How
L> do I know the name of the test? It doesn't seem to be DNSBL?
L> I mean, I know it's one of RCVD_IN_OSIRUSOFT_COM,X_OSIRU_SPAM_SRC since
L> those are in the header, but if I look at the actaul defs I g
Just out of curiosity, what does the IFS= part do, and how necessary is it
here?
By the way thanks for the info, Im reading up on smrsh now...
At 07:50 PM 5/2/2002 -0500, dman wrote:
>On Thu, May 02, 2002 at 05:13:03PM -0700, Jason Hough wrote:
>| I'm following the instructions in the README, b
On Thu, 2 May 2002, Craig R Hughes wrote:
> 1. X-UIDL is often added by legitimate mailer like UW-IMAP and such,
> but that format of the string looks suspicious to me.
I get that X-UIDL format from the a server that advertises itself as QPOP
-- don't recall if that's qpopper or something else.
On Thu, May 02, 2002 at 06:03:47PM -0700, Jason Hough wrote:
| Just out of curiosity, what does the IFS= part do, and how necessary is it
| here?
man bash
It is the Internal Field Separator list. All characters in that
string are considered delimiters for the individual parts of a string
(used
On Thursday 02 May 2002 05:20 pm, Darren Coleman wrote:
> I would've presumed that SpamAssassin would give a score (presumably
> negative) for MIME attachments, in particular digitally signed messages.
> I can't imagine many spammers going to the trouble of digitally signing
> email.. :)
As has b
On Thursday, May 2, 2002, at 06:19 PM, dman wrote:
> /etc/spamassassin/99_local.cf
Any particular reason not to put it in /etc/mail/spamassassin/local.cf? I
mean, is th 99_ significant?
--
You know you've achieved perfection in replying to a list message, not when
you have nothing more to add
I'll be forwarding this to SA sightings shortly, but I thought I'd share
it with the group. I found it humorous.
- Forwarded message from James <[EMAIL PROTECTED]> -
Reply-To: "James" <[EMAIL PROTECTED]>
From: "James" <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
Subject: Your address is on
And, hey, if you've got ESP math working even to the point of a test
release, you can quit your day job.
I haven't actually noticed it to be a useful blacklisting tool, anyway.
I've had it in my head that it could be useful as both, but haven't seen
it dragging otherwise-uncaught spam across the
On Thu, 2 May 2002, Craig R Hughes wrote:
> Charlie Watts wrote:
>
> CW> Lemme guess: PBG4 ?
> CW>
> CW> I have a 550 ... very happy with it. Much more fragile than the iceBook,
> CW> but also much more usable - the screen real estate is nice, and yours will
> CW> be even better.
>
> My fiancee h
On Thu, May 02, 2002 at 08:00:57PM -0600, Charlie Watts wrote:
> I think OS X is what Linux *wishes* it were. Solid core, pretty GUI.
Heh. OS X is cute (heck, I bought a TiBook too,) but it has some time
to go before it's really "solid". I've had numerous friends have to
reinstall the OS due to
Charlie Watts wrote:
CW> And, hey, if you've got ESP math working even to the point of a test
CW> release, you can quit your day job.
CW>
CW> I haven't actually noticed it to be a useful blacklisting tool, anyway.
CW> I've had it in my head that it could be useful as both, but haven't seen
CW> it
Both will work. Actually any file ending in .cf will be fine. All files will
be read in alpha-numeric sorted order, with later files overriding earlier ones.
I can't really think of any compelling reason why you'd need more than one
lcoal.cf though -- but you are certainly free to name it whatev
Theo Van Dinter wrote:
TVD> I'm still very much looking forward to getting this thing finally.
TVD> I just got a wireless access point in house (err, apartment) so I can
TVD> do the computing thing from anywhere I feel like. Heh heh heh.
My standard SpamAssassin work location is on the couch in
On Thu, May 02, 2002 at 07:26:02PM -0600, LuKreme wrote:
| On Thursday, May 2, 2002, at 06:19 PM, dman wrote:
| >/etc/spamassassin/99_local.cf
|
| Any particular reason not to put it in /etc/mail/spamassassin/local.cf? I
| mean, is th 99_ significant?
Ordering. 99 is "greater" than the prefix
SpamAssassin is rocking and rolling.
https://sourceforge.net/project/stats/index.php?report=months&group_id=25457
That more or less reflects the traffic growth on spamassassin.org, the
spamassassin related parts of hughes-family.org, the mailing lists, bugzilla,
etc.
Clearly the hard work of al
dman wrote:
d> On Thu, May 02, 2002 at 07:26:02PM -0600, LuKreme wrote:
d> | On Thursday, May 2, 2002, at 06:19 PM, dman wrote:
d> | >/etc/spamassassin/99_local.cf
d> |
d> | Any particular reason not to put it in /etc/mail/spamassassin/local.cf? I
d> | mean, is th 99_ significant?
d>
d> Ordering
On Thu, May 02, 2002 at 09:35:58PM -0400, Theo Van Dinter wrote:
I wonder if this particular spammer has ways around this...
> DO: yourname(AT)example(DOT)com
>
> DO: [EMAIL PROTECTED] (Replace Z with E)
>
> DO: [EMAIL PROTECTED]
> (use ONLY .invalid to do this!)
>
> DO: [EMAIL PROTECTED]
>
On Thu, May 02, 2002 at 08:43:56PM -0700, Craig R Hughes wrote:
> It'll get read after anyway, because the /etc/ stuff is read after the /usr/
> stuff; name ordering is only significant within a given directory. Except I
> guess if you're using Debian I suppose it's installing all the config file
On Thu, 2 May 2002, Theo Van Dinter wrote:
> Yeah, I know exactly how that goes. I ordered a 667 in April, and it's
> due to ship to me next week. If I had known the new Gen3's were coming
> out, I would've waited and just bought one of those.
That's what I said earlier - Apple has a policy th
On Thu, May 02, 2002 at 11:56:09PM -0400, Duncan Findlay wrote:
| On Thu, May 02, 2002 at 08:43:56PM -0700, Craig R Hughes wrote:
| > It'll get read after anyway, because the /etc/ stuff is read after the /usr/
| > stuff; name ordering is only significant within a given directory. Except I
| > gu
On Thu, 2 May 2002, Duncan Findlay wrote:
> On Thu, May 02, 2002 at 09:35:58PM -0400, Theo Van Dinter wrote:
>
> I wonder if this particular spammer has ways around this...
Duh. :)
Seriously, for a long time now I have been rather irritated at all the
people who mangle their email address when
I'm basically finished adapting TextCat, an open source language
guesser, for use in SA. Thanks to the upstream author, it is now
licensed under the same terms as Perl. At this point, I'm looking for
testing help and comments.
- 76 different languages are currently recognized.
- The level o
82 matches
Mail list logo
