Re: [SAtalk] Spamassassin

2003-06-25 Thread Hannu Liljemark
On Tue, Jun 24, 2003 at 07:57:00PM +0300, Link, Pete wrote: > My spamassassin still allows quite a few SPAMs to the owner of the > company... > > Does anyone have any suggestions on how to tweak spamassassin without > writing too many custom rules and without enabling the RBL checks? Forget about

Re: [SAtalk] cannot write to user_prefs

2003-06-25 Thread Hannu Liljemark
On Tue, Jun 24, 2003 at 05:55:00PM +0300, DM wrote: > Jun 24 07:23:57 mx4 spamd[16795]: Cannot write to > /nonexistent/.spamassassin/user_prefs: No such file or directory > > I've checked the paths and perms for sharedstatedir, localstatedir, and of > course, the home directory for the spam user.

Re: [SAtalk] URI rule -- how big?

2003-06-25 Thread Tony Earnshaw
Kai Schaetzl wrote: You can probably do more efficient blocking at the MTA level...which one are you using? No, he can't, this is a body test. Postfix (my version is 2.0.12) can do body tests, but Postfix UCE rules are "all or nothing" - one can't allocate points, as SA can. Therefore I prefer t

[SAtalk] Qmail + QmailAdmin + Spamassassin

2003-06-25 Thread Nicholas Chua
hi list,   does anyone has a filter script which will work with Qmailadmin, and the mail forwarding and vocation functions. Now i am using a little script which willfilter spam mails, but it has also disable the forwarding and vocation function. My files as below:-   .qmail-default | preline

[SAtalk] switch off auto learn funktion

2003-06-25 Thread Holger Glaess
hi all i try now for a long time to switch off the auto learn / whitelist funktion. but not settings works well. here my settings --- use_pyzor 0 use_razor1 0 use_razor2 0 use_bayes 0 use_dcc 0 subject_tag [SPAM] skip

[SAtalk] Target those 3l33+ typings

2003-06-25 Thread Per Björklund
Wouldn't it be possible to expand all tests so that they can match all those p0rn, rem0ve and g1rls and so on, like the example I created below? Would it decrease performance to much? Or does it have any other side effects? It would at least make it harder for spammers to avoid spamassassin by o

[SAtalk] How could I know that Spamassassin is working in my system?

2003-06-25 Thread Puth Chan Choth
Hello all, I am new to Spamassassin. I installed spamassassin in my server but I do not know that it is working in my system or not. How could I know that Spamassassin is working in my system? Thanks, Chan Choth --- This SF.Net email is spons

Re: [SAtalk] switch off auto learn funktion

2003-06-25 Thread SqM
Are you using "spammassassin" or "spamd/spamc".. If using "spamd/spamc" dont forget to restart "spamd".. ( I keep forgetting it myself all the time..;-) /SqM > i try now for a long time to switch off the auto learn / whitelist > funktion. > but not settings works well. > here my settings > -

Re: [SAtalk] Target those 3l33+ typings

2003-06-25 Thread Tony Earnshaw
Per Björklund wrote: Wouldn't it be possible to expand all tests so that they can match all those p0rn, rem0ve and g1rls and so on Perhaps uri references to real live p0rn sites, so that SA could watch what was going on and learn for itself. Or, better, install a webcam in your bedroom and wait

RE: [SAtalk] pre-release: SpamAssassin 2.60 beta now available

2003-06-25 Thread Erik Slooff
> If you fancy testing a pre-release of SpamAssassin 2.60, one is now > available: > I currently have a running SA 2.60-cvs setup (from 220603) with which I had no probs running "make test". However, with SA 2.60-PR1 I have the following errors running "make test": t/spamd_report_ifspam...ok

RE: [SAtalk] How could I know that Spamassassin is working in my system?

2003-06-25 Thread Bill
[EMAIL PROTECTED] wrote: > Subject: [SAtalk] How could I know that Spamassassin is working in my > system? > > > Hello all, > > I am new to Spamassassin. I installed spamassassin in my > server but I do not know that it is working in my system or > not. How could I know that Spamassassin is wor

Re: [SAtalk] How could I know that Spamassassin is working in my system?

2003-06-25 Thread Ralf Guenthner
Hi - Original Message - From: "Puth Chan Choth" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Wednesday, June 25, 2003 12:30 PM Subject: [SAtalk] How could I know that Spamassassin is working in my system? > not know that it is working in my system or not. How could I know that > Sp

SV: [SAtalk] Target those 3l33+ typings

2003-06-25 Thread Per Björklund
Well, for example, I tried the attached porn spam (which uses a lot of 0's and 1's) with 2.60-CVS, but it still didn't score more than 0.6. (I don't have razor, pyzor, bayes etc. on the machine I tried 2.60-CVS on so perhaps that would have increased the score.) This is what 2.60-CVS on my mach

Re: SV: [SAtalk] Target those 3l33+ typings

2003-06-25 Thread Alexander Litvinov
I belive this is work for bayes. I just wondering why people turn it off ? Why they try to use 'manual' bayes filtering ? > > Wouldn't it be possible to expand all tests so that they can match all > > those p0rn, rem0ve and g1rls and so on > > Perhaps uri references to real live p0rn sites, so tha

Re: [SAtalk] switch off auto learn funktion

2003-06-25 Thread Holger Glaess
On Wednesday 25 June 2003 12:47, SqM wrote: > Are you using "spammassassin" or "spamd/spamc".. > If using "spamd/spamc" dont forget to restart "spamd".. > ( I keep forgetting it myself all the time..;-) i use spamd/spamc and it is more then one time restarted with this settings. holger > > /SqM

Re: [SAtalk] Global bayes path

2003-06-25 Thread Kai Schaetzl
Jose M.Herrera wrote on Tue, 24 Jun 2003 18:50:52 -0400: > The database is ok and the bayes files (tokens, etc). > But (for example) when I attemp to train bayes... not function!! > > sa-lean --spam --showdots --mbox mymail Again, *what* does not function? What happens if you issue the command

Re: [SAtalk] URI rule -- how big?

2003-06-25 Thread Kai Schaetzl
Tony Earnshaw wrote on Wed, 25 Jun 2003 09:11:23 +0200: > Postfix (my version is 2.0.12) can do body tests, but Postfix UCE rules > are "all or nothing" > Well, sendmail can do this as well, and with the same caveat. But I think Matt simply confused that body rule with a one that rejects mail b

[SAtalk] What is the current preferred spam threshold?

2003-06-25 Thread Dragoncrest
Just curious what the preferred spam threshold is for spam these days. In my user prefs I'm running at a spam threshold of 5.0 and not having many problems with it save for the occasional 1 or 2 missed spam messages. I don't believe it's getting any false positives as I haven't seen any late

[SAtalk] New trick

2003-06-25 Thread Jack Gostl
A message just slipped through, no text, just an image. It slipped through with a ridiculously low score, minus .6 When I expanded the headers, I found that the message got through mostly because of the following. USER_AGENT_MSN (-2.3 points) Headers indicate valid mail from MSN PGP_SIGNAT

RE: [SPAM] [SAtalk] spamassassin-talk get you hacker toolz here cwgh

2003-06-25 Thread Chris Santerre
> -Original Message- > From: Alan Leghart [mailto:[EMAIL PROTECTED] > Sent: Tuesday, June 24, 2003 7:27 PM > To: [EMAIL PROTECTED] > Subject: RE: [SPAM] [SAtalk] spamassassin-talk get you hacker > toolz here > cwgh > > > --On Tuesday, June 24, 2003 7:12 PM -0400 Bill > <[EMAIL PROTECT

Re: [SAtalk] updated PR1 builds

2003-06-25 Thread Theo Van Dinter
On Tue, Jun 24, 2003 at 10:32:35PM -0700, Justin Mason wrote: > hmm -- Theo? Sounds OK to me, I thought that was already the default ;) hmmm. it is, sorta. apparently the subsys locks are still spamd, but the sysconfig file is spamassassin now (the spec file enforces this too). I'm opening a

Re: SV: [SAtalk] Target those 3l33+ typings

2003-06-25 Thread Tony Earnshaw
Per Björklund wrote: Well, for example, I tried the attached porn spam (which uses a lot of 0's and 1's) with 2.60-CVS, but it still didn't score more than 0.6. (I don't have razor, pyzor, bayes etc. on the machine I tried 2.60-CVS on so perhaps that would have increased the score.) This is what

[SAtalk] Pronouncability of Sender Address

2003-06-25 Thread Fox Flanders
We need a prounouncability test of the sender addresses. If it has a bunch of ixf38jk3 crud in it, it is more likely to be spam. --- This SF.Net email is sponsored by: INetU Attention Web Developers & Consultants: Become An INetU Hosting Partn

Re: [SAtalk] pre-release: SpamAssassin 2.60 beta now available

2003-06-25 Thread Theo Van Dinter
On Wed, Jun 25, 2003 at 01:12:11PM +0200, Erik Slooff wrote: > t/spamd_report_ifspam...ok 1/10 Not found: date = INVALID_DATE rules/50_scores.cf:score INVALID_DATE 0.000 0.001 0.000 0.001 the GA shut the rule off, so it's not running during the "make test" ... I'll undisable them since

Re: [SAtalk] pre-release: SpamAssassin 2.60 beta now available

2003-06-25 Thread Tony Earnshaw
Erik Slooff wrote: If you fancy testing a pre-release of SpamAssassin 2.60, one is now available: I currently have a running SA 2.60-cvs setup (from 220603) with which I had no probs running "make test". However, with SA 2.60-PR1 I have the following errors running "make test": Stick with the CVS

Re: [SAtalk] pre-release: SpamAssassin 2.60 beta now available

2003-06-25 Thread Theo Van Dinter
On Wed, Jun 25, 2003 at 01:12:11PM +0200, Erik Slooff wrote: > t/spamd_report_ifspam...ok 1/10 Not found: date = INVALID_DATE ok, this is fixed in cvs now. -- Randomly Generated Tagline: "Note that if I can get you to \"su and say\" something just by asking, you have a very serious sec

Re: [SAtalk] New trick

2003-06-25 Thread Tony Earnshaw
Jack Gostl wrote: A message just slipped through, no text, just an image. It slipped through with a ridiculously low score, minus .6 You know better by now :-) That's what you get for using SA 1.1 Tony -- Tony Earnshaw Humor him, and he'll go away again http://j-walk.com/blog/docs/conference.h

[SAtalk] installing SpamAssassin

2003-06-25 Thread Bryan E Fairchild
Hi everyone, I have Qmail1.03 running on a RedHat9 build. I am new to linux and was very excited when I got it going last week; however, I now want to rid my inbox of this annoying spam. I have been parusing all the readme files in the Mail-SpamAssassin-2.55 distribtion to figure out hot to go

Re: [SAtalk] New trick

2003-06-25 Thread Jonathan Vanasco
How can you suggest incorporating a PGP into the ruleset though? You can check if its a valid length, but then spammers will use valid PGP sigs. You can't pointify all PGP sigs, because lots of valid mail is signed w/a PGP So you can either: Remove the negative points for PGP sigs -- essential

[SAtalk] DNS forgeries

2003-06-25 Thread Rice, Kevin
Are there any rules for DNS forgeries in SA 2.53? I had a message pass through whose forged From: line was from a domain that has a whitelist entry, but the sender basically set up a PTR record to resolve back to that domain. Is there any way to prevent this? --

[SAtalk] 2.60

2003-06-25 Thread Tim
Hi, SpamAssassin 2.60 works fine here. Thanks, Tim -- Timothy J. Schutte | AIM: TimSchutte | ICQ: 57061028 [EMAIL PROTECTED] | Yahoo: kc8hr| http://www.wwnet.net/~kc8hr "If it ain't broke, then you're not trying hard enough!" --Red Green -

[SAtalk] I'm fed up with Viagra spam ...

2003-06-25 Thread Tony Earnshaw
... time for new spam types. What's more, I'm in a vile mood today. Many spammers follow this list. O.k. I keep on getting Viagra spam, which Postfix 2.0.12/amavisd-new/SA 2.60-CVS consigns to the cesspit and sends postmaster e-mail messages, so that he knows. There seems to be a gap in the ma

RE: [SAtalk] I'm fed up with Viagra spam ...

2003-06-25 Thread Chris Santerre
> -Original Message- > From: Tony Earnshaw [mailto:[EMAIL PROTECTED] > Sent: Wednesday, June 25, 2003 11:06 AM > To: [EMAIL PROTECTED] > Subject: [SAtalk] I'm fed up with Viagra spam ... > > > ... time for new spam types. > > What's more, I'm in a vile mood today. > > Many spammers fo

[SAtalk] quick regex question for rules

2003-06-25 Thread Chris Santerre
\w is a word correct?   Is this right:? /(build(ing)?|increase|more) \w?wealth/i   should hit "building real weatlh" ?   Or is it just easier to write: /(build(ing)?|increase|more).{1,10}wealth/i Chris SanterreSystem Admin"A little nonsense now and then, is relished by the wisest men." 

[SAtalk] SA-Learn

2003-06-25 Thread Jerry Rasmussen
When I run SA-Learn I get this error message. "Failed to create default user preference file". I am running spamassassin 2.53 on RedHat 9. Do I just need to create a user Preference file. I want SA-Learn to be applied to all emails not just a particular users emails. I am also running spamd

Re: [SAtalk] I'm fed up with Viagra spam ...

2003-06-25 Thread David Chait
Spammers stick to what they know generally...screwing people, not protecting them. - Original Message - From: "Tony Earnshaw" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Wednesday, June 25, 2003 8:06 AM Subject: [SAtalk] I'm fed up with Viagra spam ... > ... time for new spam type

[SAtalk] Re: What is PLING_PLING?

2003-06-25 Thread Theo Van Dinter
On Wed, Jun 25, 2003 at 03:35:26PM +0100, LBsys wrote: > would you be so kind as to redirect this mail to whomever it may concern? > TIA, LB you should send these types of mails to [EMAIL PROTECTED] > First: what is PLING_PLING? It cannot be found in the FAQ / Test > performed list. There is only

Re: [SAtalk] Pronouncability of Sender Address

2003-06-25 Thread Nigel Metheringham
On Wed, 2003-06-25 at 15:30, [EMAIL PROTECTED] wrote: > We need a prounouncability test of the sender addresses. If it has a bunch > of ixf38jk3 crud in it, it is more likely to be spam. /me points and laughs at lds0062 Nigel. -- [ Nigel Metheringham [EMAIL PROTECTED] ] [ - Co

Re: [SAtalk] quick regex question for rules

2003-06-25 Thread Theo Van Dinter
On Wed, Jun 25, 2003 at 11:17:33AM -0400, Chris Santerre wrote: > \w is a word correct? no. "perldoc perlre" ... \w is an alphanumeric character (includes underscore too). > Is this right:? > /(build(ing)?|increase|more) \w?wealth/i > > should hit "building real weatlh" ? nope. -- Ran

Re: [SAtalk] URI rule -- how big?

2003-06-25 Thread Matt Thoene
On Wednesday, June 25, 2003 @ 6:31:39 AM [-0700], Kai Schaetzl wrote: > Well, sendmail can do this as well, and with the same caveat. But I think > Matt simply confused that body rule with a one that rejects mail by > sender/sending server which would be an optinmal use for the MTA access > confi

[SAtalk] Yea, that oughta do it... (Will this config work/effective)

2003-06-25 Thread Steve Jones
Hello, I've been wading through all the information regarding spam fighting and think I know how I want my configuration to look. I'm hoping someone will verify it for me, pass along any pointers and most importantly point me in the right direction for specific tools. What I need is someone to s

Re: [SAtalk] New trick

2003-06-25 Thread Jack Gostl
No... I'm not suggesting anything about PGP sigs. What (I think) happened here was that a marginally passable PGP sig was buried in the HTML portion of the message. I almost didn't see it. So not only do I question the negative value on a PGP sig, I'm noting that this is a suspicious sig that slip

[SAtalk] wtf? global destruction?

2003-06-25 Thread Jonathan Nichols
Now THIS is a scary thing to see in /var/log/mail: Jun 25 08:49:49 jezebel spamd[28618]: Attempt to free non-existent shared string during global destruction. I half expected a computer named Joshua to ask me if I'd like to play a game. What does that error mean, anyway? ;)

Re: [SAtalk] New trick

2003-06-25 Thread Jack Gostl
> > A message just slipped through, no text, just an image. It slipped through > > with a ridiculously low score, minus .6 > > You know better by now :-) That's what you get for using SA 1.1 I'm using 2.55. -- Jack Gostl [EMAIL PROTECTED] -

RE: [SAtalk] quick regex question for rules

2003-06-25 Thread Chris Santerre
> -Original Message- > From: Theo Van Dinter [mailto:[EMAIL PROTECTED] > Sent: Wednesday, June 25, 2003 11:31 AM > To: Chris Santerre > Cc: Spamassassin-Talk (E-mail) > Subject: Re: [SAtalk] quick regex question for rules > > > On Wed, Jun 25, 2003 at 11:17:33AM -0400, Chris Santerre wr

[SAtalk] Subscribing to RBLs?

2003-06-25 Thread Jim Ford
Hi, Do we need to subscribe to the RBLs that Net::DNS call? Regards: Jim Ford -- Spam poison - don't use! ---> [EMAIL PROTECTED] <--- --- This SF.Net email is sponsored by: INetU Attention Web Developers & Consultants: Become An INetU Hostin

Re: [SAtalk] Ideas on dealing with Joe Job?

2003-06-25 Thread Jim Ford
On Tue, Jun 24, 2003 at 03:30:40PM -0700, Abigail Marshall wrote: > As to proving where it comes from, I'm just not sure it's > worth the effort on an individual basis -- a lot of time & > expense involved. That's another thing the big ISP's could Any pointers as to how to trace email from the h

[SAtalk] Re: [sam] Reading user preferences?

2003-06-25 Thread Krishna
Hi James, You have to create a user spamd Run spamd every time at startup in rc.local spamd -C /etc/mail/spamassassin -d -q -x -a -u spamd Then in the users .procmailrc file add this :0wf | /usr/bin/spamc -f -u $LOGNAME If you want to redirect spam flagged mails to the Spam folder add this als

[SAtalk] Re: Pine Not Able to Read Mailboxes Correctly

2003-06-25 Thread Brad Marcoux
Hey Nancy/All, Thanks for getting back to me - this isn't a huge problem, but it's been driving me mad. I should better explain my setup: - accessing pine (and mailboxes) directly - ssh'ing into the server (i.e. no IMAP) - server is running QMail My procmail recipe is as follows: --

Re: [SAtalk] pre-release: SpamAssassin 2.60 beta now available

2003-06-25 Thread Justin Mason
Erik Slooff writes: >> If you fancy testing a pre-release of SpamAssassin 2.60, one is now >> available: >> > >I currently have a running SA 2.60-cvs setup (from 220603) with which I >had no probs running "make test". However, with SA 2.60-PR1 I have the >following errors running "make test": > >t

RE: [SAtalk] How could I know that Spamassassin is working in my system?

2003-06-25 Thread John McGivern
Another wasy to be sure that it is working in and of itself is to find the sample files (sample-nonspam.txt and sample-spam.txt) and pipe them through spamassassin like this: spamassassin -t < [path to]sample-spam.txt This will return a response indicating waht it did with the sample on your sc

Re: [SAtalk] Ideas on dealing with Joe Job?

2003-06-25 Thread Bob Apthorpe
Hi, On Wed, 25 Jun 2003, Jim Ford wrote: > On Tue, Jun 24, 2003 at 03:30:40PM -0700, Abigail Marshall wrote: > > > As to proving where it comes from, I'm just not sure it's > > worth the effort on an individual basis -- a lot of time & > > expense involved. That's another thing the big ISP's cou

[SAtalk] abuse of the X-Mailer: header

2003-06-25 Thread alex avriette
I got this gem today: On Wednesday, June 25, 2003, at 10:08 PM, Saphenoscope Oapheresis wrote: From [EMAIL PROTECTED] Wed Jun 25 12:00:21 2003 Return-Path: <[EMAIL PROTECTED]> Delivered-To: [EMAIL PROTECTED] Received: (qmail 11133 invoked from network); 25 Jun 2003 15:41:19 - Received: from m

Re: [SAtalk] Re: Pine Not Able to Read Mailboxes Correctly

2003-06-25 Thread up
I'm coming in on this thread late, so sorry if you've already covered this, but if you're running qmail with Maildir, the standard pine won't work; you need the version patched for Maildir. This has nothing to do with procmail or SA, in either case... On Wed, 25 Jun 2003, Brad Marcoux wrote: >

Re: [SAtalk] URI rule -- how big?

2003-06-25 Thread Charles Mount
PLEASE DO NOT REPLY UNLESS YOU CAN ANSWER THE QUESTION. I have a working SpamAssassin rule which rejects messages based on URLs within the body of the message. This is used for spammers who forge From addresses and are otherwise careful not to break rules. I collect the "click here to order" an

[SAtalk] spamd as root vs as user

2003-06-25 Thread Dave Stern - Former Rocket Scientist
I'm currently running spamd as root (so it does an suid to each user.) Were I to run this as another user (spamd -u someone), wouldn't that user still have to suid to whomever is running spamc? Does this other user need any special privs? TIA =-=-=-=-=-=-=-=-=-=-=-=- generated by /dev/dave -=

Re: [SAtalk] SpamAssassin 2.55 RedHat RPM

2003-06-25 Thread Greg A
That worked! Thanks to all who helped. Theo Van Dinter <[EMAIL PROTECTED]> wrote: On Fri, Jun 20, 2003 at 01:57:45PM -0700, Greg A wrote:> perl-Mail-Spamassassin = 2.53-1 spamassassin> perl-Mail-Spamassassin = 2.53-1 spamassassin-tools> *notice the above error refers to version 2.53? weirdness...>

Re: [SAtalk] Ideas on dealing with Joe Job?

2003-06-25 Thread Harold Hallikainen
http://www.spamcop.net does a great job of taking apart headers. Harold > On Tue, Jun 24, 2003 at 03:30:40PM -0700, Abigail Marshall wrote: > >> As to proving where it comes from, I'm just not sure it's >> worth the effort on an individual basis -- a lot of time & >> expense involved. That's ano

Re: [SAtalk] Re: spammers aren't the only ones who can teach. (wasWe TEACH you how

2003-06-25 Thread Vivek Khera
> "JF" == Jim Ford <[EMAIL PROTECTED]> writes: JF> Surely it would be a trivial thing for them to do. I'm no programmer, JF> but I think I could write a perl script to examine a bounced message You greatly underestimate the difficulty of processing bounces from random remote sources. If eve

RE: [SAtalk] URI rule -- how big?

2003-06-25 Thread Chris Santerre
> -Original Message- > From: Charles Mount [mailto:[EMAIL PROTECTED] > Sent: Wednesday, June 25, 2003 1:48 PM > To: [EMAIL PROTECTED] > Cc: [EMAIL PROTECTED] > Subject: Re: [SAtalk] URI rule -- how big? > > > > PLEASE DO NOT REPLY UNLESS YOU CAN ANSWER THE QUESTION. > > I have a worki

[SAtalk] calling spamc (or spamd) from .qmail-default

2003-06-25 Thread John McGivern
Hi! I am calling spamassassin from within my .qmail-default file like this: | /var/qmail/bin/preline -d /var/qmail/bin/bouncesaying "SPAM Bounce message" /var/qmail/bin/except /usr/bin/spamc -c | /home/vpopmail/bin/vdelivermail '' bounce-no-mailbox I know this way works and differentiates the

Re: [SAtalk] URI rule -- how big?

2003-06-25 Thread Justin Mason
Charles Mount writes: > >PLEASE DO NOT REPLY UNLESS YOU CAN ANSWER THE QUESTION. > >I have a working SpamAssassin rule which rejects messages based on URLs >within the body of the message. This is used for spammers who forge From >addresses and are otherwise careful not to break rules. I collect

RE: [SAtalk] pre-release: SpamAssassin 2.60 beta now available

2003-06-25 Thread Erik Slooff
Thx, indeed the code runs fine as far as I can tell for now. > Erik Slooff writes: > >> If you fancy testing a pre-release of SpamAssassin 2.60, one is now > >> available: > >> > > > >I currently have a running SA 2.60-cvs setup (from 220603) > with which I > >had no probs running "make test". H

Re: [SAtalk] Ideas on dealing with Joe Job?

2003-06-25 Thread Alan Leghart
--On Wednesday, June 25, 2003 5:13 PM +0100 Jim Ford <[EMAIL PROTECTED]> wrote: On Tue, Jun 24, 2003 at 03:30:40PM -0700, Abigail Marshall wrote: As to proving where it comes from, I'm just not sure it's worth the effort on an individual basis -- a lot of time & expense involved. That's another

Re: [SAtalk] wtf? global destruction?

2003-06-25 Thread Matt Kettler
At 08:51 AM 6/25/2003 -0700, Jonathan Nichols wrote: Now THIS is a scary thing to see in /var/log/mail: Jun 25 08:49:49 jezebel spamd[28618]: Attempt to free non-existent shared string during global destruction. I half expected a computer named Joshua to ask me if I'd like to play a game. What

Re: [SAtalk] wtf? global destruction?

2003-06-25 Thread Theo Van Dinter
On Wed, Jun 25, 2003 at 02:40:37PM -0400, Matt Kettler wrote: > but that's just an educated guess. fyi: that's going to be a perl error message, not a SA one. -- Randomly Generated Tagline: "I'll have to be careful when I walk past that thing ... It'll blow the rest of my hair off."

Re: [SAtalk] Pronouncability of Sender Address

2003-06-25 Thread Brian Godette
From: "Fox Flanders" <[EMAIL PROTECTED]> On Wednesday 25 June 2003 08:30 am, Fox Flanders wrote: > We need a prounouncability test of the sender addresses. If it has a bunch > of ixf38jk3 crud in it, it is more likely to be spam. > The irony is astounding. --

Re: [SAtalk] Ideas on dealing with Joe Job?

2003-06-25 Thread mikea
On Wed, Jun 25, 2003 at 05:13:32PM +0100, Jim Ford wrote: > On Tue, Jun 24, 2003 at 03:30:40PM -0700, Abigail Marshall wrote: > > > As to proving where it comes from, I'm just not sure it's > > worth the effort on an individual basis -- a lot of time & > > expense involved. That's another thing t

[SAtalk] Re: Re: Pine Not Able to Read Mailboxes Correctly

2003-06-25 Thread Nancy McGough
On 25 Jun 2003 [EMAIL PROTECTED] ([EMAIL PROTECTED]) wrote: > > I'm coming in on this thread late, so sorry if you've already > covered this, but if you're running qmail with Maildir, the > standard pine won't work; you need the version patched for > Maildir. But if you've got procmail delivering

[SAtalk] question about sa-learn and message/rfc822 attached mail

2003-06-25 Thread Gary Schrock
Ok, with recent discussion on the list I've gotten somewhat confused by this issue. What I thought happens is that sa-learn can recognize an email message that contains a message/rfc822 attached message, and learn from that attached message, hence the reason you should forward a spam message to

Re: [SAtalk] URI rule -- how big?

2003-06-25 Thread Kai Schaetzl
Charles Mount wrote on Wed, 25 Jun 2003 12:47:49 -0500: > PLEASE DO NOT REPLY UNLESS YOU CAN ANSWER THE QUESTION. > Please stop shouting. If you don't like well-intended answers to your question then please stop posting here. Kai -- Kai Schätzl, Berlin, Germany Get your web at Conactive Int

Re: [SAtalk] Subscribing to RBLs?

2003-06-25 Thread Kai Schaetzl
Jim Ford wrote on Wed, 25 Jun 2003 17:13:14 +0100: > Do we need to subscribe to the RBLs that Net::DNS call? > To the ones that require it: yes. (Those are the ones not enabled by default.) Kai -- Kai Schätzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.conactive

Re: [SAtalk] question about sa-learn and message/rfc822 attached mail

2003-06-25 Thread Theo Van Dinter
On Wed, Jun 25, 2003 at 03:06:24PM -0400, Gary Schrock wrote: > What I thought happens is that sa-learn can recognize an email message that > contains a message/rfc822 attached message, and learn from that attached > message, hence the reason you should forward a spam message to it using > that

Re: [SAtalk] What is the current preferred spam threshold?

2003-06-25 Thread Kai Schaetzl
Dragoncrest wrote on Wed, 25 Jun 2003 09:41:23 -0400: > So I was curious if 5.0 was a good setting or if I should set it > higher to like 7.0 or 5.5 or if I should just leave it as is. :) > 5.0 works very well with 2.60 and also did with 2.55, just that you had some more false negatives. Kai

[SAtalk] SpamAssassin Tutorial..

2003-06-25 Thread Kevin
I've just installed SpamAssassin from rpm's to use on our company's sendmail server. Everything seems to be installed correctly. Is there any newbie's guide to setting up and configuring a fresh install of SpamAssassin? I am pretty familiar with Redhat and sendmail but never messed around with

[SAtalk] Bypass local.cf settings

2003-06-25 Thread Matt Thoene
Hi, I have tried searching the archives on this but I apparently can't get the correct search string...hopefully one of you can assist with what is probably an easy one. I have been running SA for a few local users for quite a while. It's worked so well that I decided to take it global so to spea

[SAtalk] sa-learn from stdin?

2003-06-25 Thread Will Yardley
Is there an easy way to pipe a message to sa-learn as you can with bogofilter? For instance, when using a console based mailer like mutt or Pine, it's a lot easier to do: |spamassassin -d | bogofilter -S (to remove SA markup and mark a message as spam within bogofilter) than it is to export the m

[SAtalk] ~/sauser

2003-06-25 Thread Will Yardley
When I build SA in a user's home directory, stuff seems to go in ~/sauser/local/bin instead of just ~/sauser/bin. Is this the intended behavior? My recollection in the past was that it put stuff in ~/sauser/bin. If it matters, I'm using Debian 3.0 on x86 hardware with Perl 5.6.1.

RE: [SAtalk] Public folders, IMAP

2003-06-25 Thread Mike Batchelor
I basically do the same thing, but I use fetchmail called from a shell script to grab the messages, then rsync over SSH to get the messages to the SpamAssassin relays. I run fetchmail script from our internal mail hub to get the messages off of Exchange, and run a cron job on the SA relays to

[SAtalk] Spammers sneaking lower Bayes scores

2003-06-25 Thread Mike Batchelor
Note the random words within the tags at the end of the spam. I think they lowered its Bayes score, which dropped it below my threshold overall. That, and the lack of any other text aside from the links... Is this tactic likely to succeed for them, rendering our Bayesian classifiers ineffect

Re: [SAtalk] question about sa-learn and message/rfc822 attached mail

2003-06-25 Thread Kai Schaetzl
Gary Schrock wrote on Wed, 25 Jun 2003 15:06:24 -0400: > Do I need to be doing something before the message gets piped to > sa-learn to pull the attachment out so it's seperate? > Yes, sa-learn needs the message in the attachment, not the whole thing. That's why it is in the attachment, so you

Re: [SAtalk] Bypass local.cf settings

2003-06-25 Thread Kai Schaetzl
Matt Thoene wrote on Wed, 25 Jun 2003 12:56:01 -0700: > I have been running SA for a few local users for quite a while. It's > worked so well that I decided to take it global so to speak. However, > myself and the existing users have user_prefs with personal scores, > rules, etc. that we'd like to

Re: [SAtalk] sa-learn from stdin?

2003-06-25 Thread Theo Van Dinter
On Wed, Jun 25, 2003 at 01:20:25PM -0700, Will Yardley wrote: > than it is to export the message to a file, open a subshell, and then do: > > sa-learn --spam --single < spamfile > > Perhaps sa-learn could accept messages on stdin if you add a '-' to the end, > like: > > sa-learn --spam - uh ...

RE: [SAtalk] What is the current preferred spam threshold?

2003-06-25 Thread Bret Miller
> > So I was curious if 5.0 was a good setting or if I should set it > > higher to like 7.0 or 5.5 or if I should just leave it as is. :) > > > > 5.0 works very well with 2.60 and also did with 2.55, just > that you had some more false negatives. Probably depends on your environment. I use 8.0 he

Re: [SAtalk] Bypass local.cf settings

2003-06-25 Thread Patrick Morris
I think custom rules may be a problem. I don't believe (though I could be wrong) SA allows rules to be defined in user prefs. Kai Schaetzl wrote: Matt Thoene wrote on Wed, 25 Jun 2003 12:56:01 -0700: I have been running SA for a few local users for quite a while. It's worked so well that I

Re: [SAtalk] sa-learn from stdin?

2003-06-25 Thread Will Yardley
Theo Van Dinter wrote: > On Wed, Jun 25, 2003 at 01:20:25PM -0700, Will Yardley wrote: > > than it is to export the message to a file, open a subshell, and then do: > > > > sa-learn --spam --single < spamfile > > > > Perhaps sa-learn could accept messages on stdin if you add a '-' to the > > end

[SAtalk] SA and webmail: Downloading only the spam from the server

2003-06-25 Thread Colin Bell
I wonder if anyone can help me with the following: My main machine is at home, but I also read e-mail through a webmail client at work. I would like to filter out the 'likely spam' automatically to avoid clogging the webmail client. At present I end up deleting all the spam that arrives in work

Re: [SAtalk] Ideas on dealing with Joe Job?

2003-06-25 Thread Simon Byrnand
At 12:25 25/06/03 -0500, Bob Apthorpe wrote: Some caveats: 1) Bogus Received headers are common but always occur below the last legitimate header (once you find one bogus one the rest are probably junk too), 2) envelope sender (helo_name) is often forged, Just being pedantic here, but the helo na

[SAtalk] how to add more points according to message size?

2003-06-25 Thread Dan Jacobson
How does one add more points according to message size? Maybe I must check for a Lines: header, then what? Anyway, say I want to add 2 points per 100 KB. i.e. $message_size/5 --- This SF.Net email is sponsored by: INetU Attention Web Develop

Re: [SAtalk] Ideas on dealing with Joe Job?

2003-06-25 Thread Alan Leghart
--On Thursday, June 26, 2003 11:20 AM +1200 Simon Byrnand <[EMAIL PROTECTED]> wrote: At 12:25 25/06/03 -0500, Bob Apthorpe wrote: Some caveats: 1) Bogus Received headers are common but always occur below the last legitimate header (once you find one bogus one the rest are probably junk too), 2)

Re: [SAtalk] sa-learn from stdin?

2003-06-25 Thread Bart Schaefer
On Wed, 25 Jun 2003, Will Yardley wrote: > If I do: |sa-learn --spam > from within mutt or Pine, it seems to just sit there. It needs --single as well. In pine what you want to do is | to get to the pipe prompt ^W (ctrl-w) to select RAW

Re: [SAtalk] SA and webmail: Downloading only the spam from the server

2003-06-25 Thread Will Yardley
Colin Bell wrote: > My main machine is at home, but I also read e-mail through a webmail > client at work. I would like to filter out the 'likely spam' > automatically to avoid clogging the webmail client. At present I end > up deleting all the spam that arrives in work hours by hand... > I t

Re: [SAtalk] sa-learn from stdin?

2003-06-25 Thread D.J. Bolderman
On wo, 25 jun 2003, Will Yardley wrote: > That's exactly what I'd like to do (hence my question) - however i haven't > had luck doing this in the past. What's the syntax for doing it this way. > There's no mention of this in the man-page. > If I do: |sa-learn --spam > from within mutt or Pine, it

Re: [SAtalk] sa-learn from stdin?

2003-06-25 Thread Chris Halverson
Will Yardley <[EMAIL PROTECTED]> writes: > If I do: |sa-learn --spam > from within mutt or Pine, it seems to just sit there. I have the following setup for Gnus and it works just fine: (global-set-key "\C-cs" 'cdh-sa-learn-spam) (defun cdh-sa-learn-spam () "Pipe a message to sa-learn so that

Re: [SAtalk] sa-learn from stdin?

2003-06-25 Thread Will Yardley
Bart Schaefer wrote: > On Wed, 25 Jun 2003, Will Yardley wrote: > > If I do: |sa-learn --spam > > from within mutt or Pine, it seems to just sit there. > > It needs --single as well. > > In pine what you want to do is > > | to get to the pipe prompt > ^W

Re: [SAtalk] how to add more points according to message size?

2003-06-25 Thread Matt Kettler
At 04:43 AM 6/26/03 +0800, Dan Jacobson wrote: How does one add more points according to message size? Maybe I must check for a Lines: header, then what? Anyway, say I want to add 2 points per 100 KB. i.e. $message_size/5 I don't think you can do this with a simple rule, but if you dig out an o

Re: [SAtalk] sa-learn from stdin?

2003-06-25 Thread Will Yardley
Bart Schaefer wrote: > On Wed, 25 Jun 2003, Will Yardley wrote: > > If I do: |sa-learn --spam > > from within mutt or Pine, it seems to just sit there. > > It needs --single as well. > > In pine what you want to do is > > | to get to the pipe prompt > ^W

Re: [SAtalk] Bypass local.cf settings

2003-06-25 Thread Matt Thoene
On Wednesday, June 25, 2003 @ 3:55:28 PM [-0700], Patrick Morris wrote: > I think custom rules may be a problem. I don't believe (though I could > be wrong) SA allows rules to be defined in user prefs. Actually, the most important thing for me is to be able to have users set their own required h

[SAtalk] DCC Source

2003-06-25 Thread Scott Rothgaber
For some reason, I am unable to connect to `calcite.rhyolite.com' via HTTP. Is there a way to fetch the DCC tarball via FTP? Is there an alternate site? Thanks! Scott --- This SF.Net email is sponsored by: INetU Attention Web Developers & Con

[SAtalk] Need a little help with a proof of concept cgi.

2003-06-25 Thread Dragoncrest
hi all. I've got a little proof of concept idea I want to do and I was looking to get some advice from some of the CGI experts on this list to help me with it. What I want to do is simple. I have like 3 users I want to track and retrieve the following stats on. 1. Total number of total me

  1   2   >