Re: [SAtalk] Having trouble coding a local rule

On Mon, 29 Dec 2003, Peter Kiem wrote: > Hi David, > > > So you either need to change your rule to match the header from address or > > code it to look for the envelope from address. > > What is the rule for matching envelope from address? That is mail system dependent, as there is no standard re

[SAtalk] A different approach to spam

Make the spammer pay: In the article it is mentioned that it seems a Microsoft idea, but I doubt that directly. Not that there are no good ideas coming from Redmond, just never new ones.  The link again (to copy yourself) : http://news.bbc.co.uk/2/hi/technology/3324883.stm What would be the

Re: [SAtalk] A different approach to spam

On Monday 29 December 2003 01:07 am, Ivar Snaaijer wrote: > Make the spammer pay : > In the article it is mentioned that it seems a Microsoft idea, but I > doubt that directly. Not that there are no good ideas coming from > Redmond, just never new

[SAtalk] Detailed explanation of rules?

I have been using an outdated system-wide version of SpamAssassin for the last few months, but more and more spam was getting through. So the last few days, I have been working on getting the latest version of SA installed in my own personal area, and despite careful perusal of the documentation, I

Re: [SAtalk] remove markup question and bayes question

At 01:25 PM 12/28/03 -0800, S. M. C. Butler wrote: Can anyone tell me how to use the --remove-markup command in SA? I have a whole folder of spam and I'd like to remove the SA markups so that I can use this with sa-learn (next time my bayes DB goes awol..) As a part of this thread that was overloo

Re: [SAtalk] whitelist question

At 02:08 PM 12/28/03 -0800, S. M. C. Butler wrote: whitelist_from [EMAIL PROTECTED], [EMAIL PROTECTED], root, Super-User but unix system messages like the one below still get trapped as spam. I thought that the whitelist_from took precedence over everything else, am I missing something? Appreciate

Re: [SAtalk] Detailed explanation of rules?

At 09:21 PM 12/29/03 +0800, Gordon Royle wrote: Firstly, I can bring up the list of tests, but is there any way that I can find out more explanation of the tests? There are really two aspects to this question - the brief descriptions of the tests often refer to technical details about mail delivery

RE: [SAtalk] Detailed explanation of rules?

Hi Gordon, > > Firstly, I can bring up the list of tests, but is there any > way that I can find out more explanation of the tests? http://www.spamassassin.org/tests.html There > are really two aspects to this question - the brief > descriptions of the tests often refer to technical details

[SAtalk] how to setup bayesian filtering spamassassin

Hi,   I have slackware 9 box, with sendmail server configured and spamassassin version 2.60. the problem is, I want to configure bayesian filters for the same, I tried with the help available on spamassassin.org site, but no luck, please can anybody helpme  with step by step setup of bayesia

Re: [SAtalk] rule modification

At 12:57 PM 12/28/2003, skumm wrote: How and where do i modify the rules relating to html in the message body? If it is there period i want marked as spam, so I want to change it's weight to something like 10 if html exists in the message You don't need to modify the rules themselves to do th

[SAtalk] Rule to block Paris Hilton spam

Hi, it seems that there are many spam lately offering to view the Paris Hilton video. I tried to devise a rule to spot such spam but with no success (either with 2.55 or 2.60 - upgrade to 2.61 planned) Anybody came up with some solution ? My rule was : uri LOCAL_HILTON /special-selections\.co

[SAtalk] RE: Bigevil 2.05d posted and regex question....

> -Original Message- > From: Scott A Crosby [mailto:[EMAIL PROTECTED] > Sent: Saturday, December 27, 2003 7:49 PM > To: Chris Santerre > Cc: Spamassassin-Talk (E-mail) > Subject: Re: Bigevil 2.05d posted and regex question > > > On Mon, 22 Dec 2003 15:16:34 -0500, Chris Santerre >

Re: [SAtalk] Rule to block Paris Hilton spam

Stephane Lentz said: > Hi, > > it seems that there are many spam lately offering to view the > Paris Hilton video. > I tried to devise a rule to spot such spam but with no success > (either with 2.55 or 2.60 - upgrade to 2.61 planned) > Full spam message with headers available if needed. Please

Re: [SAtalk] Wrapper script to speed up sa-learn?

Dave Kliczbor wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hello out there... I noticed that sa-learn sometimes is a bit too slow for my needs. I call sa-learn via: /usr/bin/sa-learn --no-rebuild --spam To speed the call itself up, I think about writing a script that loads the mailfile

RE: [SAtalk] spamd memory usage.

Which Version of SA are you running? I'm running a patched 2.4x version. (Yeah I know...but it is kicking booty!!!) With WAY more custom rules then prbly anyone else on this list I average only 20 megs of usage. I'm using no net test in SA though. Not sure if that matters. --Chris > -Origin

Re: [SAtalk] V 2.70

At 09:35 PM 12/27/2003, Jim Knuth wrote: what is the difference between V 2.61 and V 2.70? Except for, that it is an developerversion ( I mean V 2.70):-) I download the 2.70-cvs and 2.61 tarballs and diffed them. Note that this is just a summary of me looking at diffs, and any errors are the resu

Re: [SAtalk] how to setup bayesian filtering spamassassin

At 09:55 AM 12/29/2003, Imtiaz Shaik wrote: I have slackware 9 box, with sendmail server configured and spamassassin version 2.60. the problem is, I want to configure bayesian filters for the same, I tried with the help available on spamassassin.org site, but no luck, please can anybody helpme

Re: [SAtalk] V 2.70

On Mon, Dec 29, 2003 at 11:10:14AM -0500, Matt Kettler wrote: > Note that this is just a summary of me looking at diffs, and any errors are > the result of my misreading or misinterpretation of the data. [...] > 9) some general misc rule tweaks. 10) a completely rewritten MIME parser ... I'm fa

Re: [SAtalk] hundreds of spamd processes spawning

Michael P. Varre wrote: > I'm running spamd + vpopmail + qmailscanner + mysql + > clamuko. I have a problem where every once in a while > hundreds of spamd processes are spawning. It absolutely > crushes the server. I have determined it is not because > of any large lists being sent/received to/

Re: [SAtalk] A different approach to spam

At 05:16 AM 12/29/2003, Matthew Cline wrote: SpamAssassin already has something like this, called HashCash (http://www.hashcash.org/). While the receiving end pays to do a check, the sending end has to spend a *lot* more time on the computations, slowing things down on the sending end. Microsoft

[SAtalk] Documentation question

What version of SA does this web page reference? http://www.spamassassin.org/doc/Mail_SpamAssassin_Conf.html It makes mention of deprecated items in version greater than 2.60. Having use_auto_whitelist in my local.cf file for SA v 2.61 gives me an error on --lint. The exact error is: Fail

[SAtalk] E-mail client set-up help request

Hi! I've been using spamassassin at my ISP for a while and am very happy with it. Now, I've had to change my ISP, and want to run spamassassin at home with my e-mail client. I set everything up as I believe that it should be, but it does not work. More to the point the ".forward" command (I

Re: [SAtalk] Fwd: Rude Rape actions

--On Sunday, December 28, 2003 10:40 AM -0800 Raquel Rice <[EMAIL PROTECTED]> wrote: > > Being a woman talking with other women about non-computer things, > often. Ahh.. Good thinking outside the box there Evan. :( Sorry, my bad. Perhaps something with the domain names involved then adding a h

Re: [SAtalk] bayes.lock getting killed on a LONG sa-learn run

Larry Rosenman wrote: > I just had my nice Bayes DB killed on a sa-learn that had 1300+ > messages in it. > > What seemed to happen is the bayes.lock file got deleted by some > spamd process EVEN THOUGH sa-learn WAS STILL ALIVE. Most programs that use a separate file as a lock indicator (rather t

RE: [SAtalk] False positives

On Sun, 28 Dec 2003, schafer wrote: > > > > People have no insentive to help > > rude people Stop being a jerk and you'll likely get more help. > > I did not know spamassassin is home-brew. I thought I was dealing with > one of dozens of commercial outfits, and whom in my experience respond much >

Re: [SAtalk] Sendmail line

"Robt. Miller" wrote: [snip Q&A re: how to set up a sendmail milter for calling SA] > Is it ok to do it this way? Somebody said I should use mimedefang. > I'm not clear on the advantages of either. spamc doesn't know anything about getting called as a sendmail "milter" plugin- assuming you get th

RE: [SAtalk] False positives

--On Monday, December 29, 2003 12:43 PM -0500 "Christopher X. Candreva" <[EMAIL PROTECTED]> wrote: > As someone who owns his own ISP and frequently does support, I can tell > you that rude messages go to the BOTTOM of the queue. Especially if they > are from people who aren't paying customers. (A

Re: [WL] Re: [SAtalk] Fwd: Rude Rape actions

On Sun, 28 Dec 2003, Evan Platt wrote: > >Yow, how am I supposed to stop spam like this? There isn't anything to filter > >on except the word 'adult'. I guess 'rape' works as well.. But I'm not really > >inclined to filter messages with the word rape in them, nor give them a 3+ > >score. > When's

Re: [SAtalk] Rule to block Paris Hilton spam

Hi Chris, On Mon, Dec 29, 2003 at 09:58:33AM -0600, Chris Thielen wrote: > Stephane Lentz said: > > Hi, > > > > it seems that there are many spam lately offering to view the > > Paris Hilton video. > > I tried to devise a rule to spot such spam but with no success > > (either with 2.55 or 2.60 -

[SAtalk] postfix

Hi list,   I am thinking to use Postfix together with SpamAssassin and Amavisd. I guess maybe that is not the right list to ask this question but probably any of you has encountered this issue before.   With postconf -e "mynetworks=." i can setup which machines are allowed to relay mai

Re: [SAtalk] False positives

Seriously, There are some issues you need to work through. (Personal Issues) I switched to Spamassassin over a year ago, and have not looked back. It is by far the most accurate I have ever seen. Not to mention customizable, and very very powerful. I really think you are from some company th

Re: [SAtalk] postfix

* gentian <[EMAIL PROTECTED]>: > With > postconf -e "mynetworks=." > i can setup which machines are allowed to relay mail to my server, > but as I am opened to internet, I do not want to allow relaying based > on the IP address of the sender but based on my domain name. So every > email tha

Re: [SAtalk] postfix

On Mon, Dec 29, 2003 at 02:11:39PM -0500, gentian wrote: > Hi list, > > I am thinking to use Postfix together with SpamAssassin and Amavisd. I guess > maybe that is not the right list to ask this question but probably any of you > has encountered this issue before. > > With postconf -e "mynetwo

Re: [SAtalk] False positives

Hello! If I may toss in my own two cents: 1) In general, responsible service providers make it a user OPTION (opt-IN) to use spamassassin, and allow users to set their own 'comfort level', to minimize what THEY consider to be false positives. 2) Spamassassin on its own does not block or delete

Re: [SAtalk] Rule to block Paris Hilton spam

Stephane Lentz said: > => Thanks for the info. Two samples of such spam are now available at > http://milter.free.fr/spam/ (hilton-sample1.txt & hilton-sample2.txt > files) Stephane, I glanced at the spamassassin source just now. I may be wrong, but it appears that the URI tests only matches on

Re: [SAtalk] False Positive, possible bug?

Matt, Thanks for the suggestion. I checked in the logfiles and it looks like the 192.168.10 domain is already treated as trusted (ie. spamassassin infers automatically that it is trusted). I see lines in the logfile such as: debug: received-header: relay 192.168.10.250 trusted? yes Simon At 0

[SAtalk] Relay trusted when it should not be?

Matt, At 02:28 PM 12/29/03 -0500, Matt Kettler wrote: At 12:17 PM 12/28/2003, Simon Matthews wrote: Specifically, the RCVD_IN_DYNABLOCK check. Note that 192.168.10.250 is a local (within the LAN) relay. If you're going to use 192.168.*.* networks, add them to your trusted_networks statement and i

Re: [SAtalk] False positives

He's gone, folks. He had no interest in getting real assistance, and he never came back. The list has been most helpful in pointing out that his own subscribers use SA voluntarily, train it themselves, and failed to whitelist this web-app travesty of an "email" message. (I particularly like

[SAtalk] Bigevil 2.05m updated + question for devs

Greetings I hope everyone had a great holiday. I've updated Bigevil to version 2.05m. I've been tweaking the rules as I add more. So this update is actually smaller in size with more evil domains! Yeah! 14 rules tweaked so far. Obviously many more to go. Taking a while as I'm being VERY carefull a

Re: [SAtalk] bayes.lock getting killed on a LONG sa-learn run

On Mon, Dec 29, 2003 at 12:20:33PM -0500, Kris Deugau wrote: > IMHO, kernel-level file locks are far cleaner, but I don't know whether > you can even do that cleanly with files accessed through DB_File. :/ Kernel locks don't work so well with NFS shared directories. -- Scott Lambert

Re: [SAtalk] Bigevil 2.05m updated + question for devs

I get: Illegal octal digit '8' ignored at /etc/mail/spamassassin/bigevil.cf, rule BigEvilList_14, line 1. Illegal octal digit '8' ignored at /etc/mail/spamassassin/bigevil.cf, rule BigEvilList_14, line 1. On a lint of this ruleset. SpamAssassin 2.61 on SuSE 9.0 Andrew Hoying

Re: [SAtalk] Bigevil 2.05m updated + question for devs

Chris Santerre said: > Anywho, I have been checking lots of these against RBLs and many show up > in > sorbes and such. Spam didn't come from these places, only images hosted > there. I was wondering if possibly in the future, SA could check the URI > links against RBLs? They all seem to be using

Re: [SAtalk] Bigevil 2.05m updated + question for devs

Hi! On Mon, Dec 29, 2003 at 02:30:57PM -0600, Chris Thielen wrote: > Chris Santerre said: > > > I was wondering if possibly in the future, SA could check the URI > > links against RBLs? They all seem to be using the same servers to host now > > after they are blacklisted. This way they still get

Re: [SAtalk] Relay trusted when it should not be?

At 02:50 PM 12/29/2003, Simon Matthews wrote: Your comment made me look into the issue a little more and I see that a mail server is listed as "trusted" when I don't think it should be. In the email below, the relay on 205.158.62.78 is listed as "trusted" in my logs. Surely this is an error? Cer

Re: [SAtalk] Bigevil 2.05m updated + question for devs

Chris, check the "uri BigEvilList_14" line, you have a couple of dots "." in front of the escape character "\" instead of behind it. That's what's causing the "Illegal octal digit" warning when you --lint the new BigEvil.cf file. Bill - Original Message - From: "Chris Santerre" <[EMAIL P

Re: [SAtalk] False positives

--On Monday, December 29, 2003 1:53 PM -0600 John Beamon <[EMAIL PROTECTED]> wrote: > He's gone, folks. He had no interest in getting real assistance, and he > never came back. I thought he replied with.. > I did not know spamassassin is home-brew. I thought I was dealing with > one of dozens

RE: [SAtalk] Bigevil 2.05m updated + question for devs

Argh!!! Just found it and fixed! Stupid fingers. I tell myself I should NEVER add more to it after I have tested and ready to update. But more spam comes in right before I post it. SO I figure adding a few more IPs couldn't hurt. Stupid typo I had a '.\'nstead of a '\.' I need to listen to mys

RE: [SAtalk] Bigevil 2.05m updated + question for devs

Yeah. I have learned my lesson. Tested > Fresh! 2.50p was posted at 3:50 PM EST. > -Original Message- > From: Bill Landry [mailto:[EMAIL PROTECTED] > Sent: Monday, December 29, 2003 3:48 PM > To: [EMAIL PROTECTED] > Subject: Re: [SAtalk] Bigevil 2.05m updated + question for devs > > >

Re: [SAtalk] Bigevil 2.05m updated + question for devs

On Mon, 29 Dec 2003, Chris Santerre wrote: > Anywho, I have been checking lots of these against RBLs and many show up in > sorbes and such. Spam didn't come from these places, only images hosted > there. I was wondering if possibly in the future, SA could check the URI > links against RBLs? They a

[SAtalk] Re: False positives

Evan Platt <[EMAIL PROTECTED]> wrote: > [...] > I thought he replied with.. > >> I did not know spamassassin is home-brew. [...] I think that was a quote from a personal email to Chris, to which he then Cc:'d the list in response. I got almost the exact same reply from a direct email I sent Lenny

Re: [SAtalk] Relay trusted when it should not be?

Matt, On Mon, 29 Dec 2003, Matt Kettler wrote: > At 02:50 PM 12/29/2003, Simon Matthews wrote: > >Your comment made me look into the issue a little more and I see that a > >mail server is listed as "trusted" when I don't think it should be. In the > >email below, the relay on 205.158.62.78 is l

[SAtalk] Re: False positives

John Beamon <[EMAIL PROTECTED]> wrote: > [...] (I particularly like seeing the "* 0.5 -- BODY: Possible porn - Hot, > Nasty, Wild, Young" rating on a children's autism mailing list...) Having read through the web page (apparently the email was the SAME HTML page -- argh!), I do wonder what flagged

Re: [SAtalk] Re: Having trouble coding a local rule

At 10:44 29/12/2003 +1000, Peter Kiem wrote: > Just a guess ... because the "From" address is not > "[EMAIL PROTECTED]"? I thought the from rule worked on the envelope sender of the email and not the easily forged from header :( You mean on the easily forged envelope sender instead of the easily fo

RE: [SAtalk] Re: False positives

> -Original Message- > From: [EMAIL PROTECTED] [mailto:spamassassin- > [EMAIL PROTECTED] On Behalf Of Bob George > Sent: Monday, December 29, 2003 4:20 PM > To: [EMAIL PROTECTED] > Subject: [SAtalk] Re: False positives > > John Beamon <[EMAIL PROTECTED]> wrote: > > [...] (I particularly

Re: [SAtalk] Rule to block Paris Hilton spam

Hi again, On Mon, Dec 29, 2003 at 01:41:17PM -0600, Chris Thielen wrote: > Stephane Lentz said: > > => Thanks for the info. Two samples of such spam are now available at > > http://milter.free.fr/spam/ (hilton-sample1.txt & hilton-sample2.txt > > files) > > Stephane, > > I glanced at the spamas

RE: [SAtalk] Rule to block Paris Hilton spam

I offer this in UNTESTED form. TEsting overnight ;) Your email viewer will wrap these lines. SHould be 3 lines: rawbody hilton_b64 /(?:aGV5IENvbWUgY2hlY2sgb3V0|PGh0bWw+DQo8Ym9keT4NCjxwP(?:khl|jxr)|aGV5DQoNCk NvbWUgY2hlY2sgb3V0)/ describe hilton_b64 Base 64 encoded paris hilton spam score hilton_b

Re: [SAtalk] Re: False positives

> Yep. I googled him and he's the father of an autistic child who is very > active in promoting awareness and research. Easy to see where the > hyperdrive comes from. Still... mix in a compassion sandwich in other > areas of your life will ya, Len!? ;) I know... not here, quake > server, etc

Re: [SAtalk] False Positive, possible bug?

At 12:17 PM 12/28/2003, Simon Matthews wrote: Specifically, the RCVD_IN_DYNABLOCK check. Note that 192.168.10.250 is a local (within the LAN) relay. If you're going to use 192.168.*.* networks, add them to your trusted_networks statement and it should clear things up a bit. ---

Re: [SAtalk] WhiteLists: manual interaction with AWL

At 05:32 PM 12/29/2003, Shane Wegner wrote: The sender address has manually been whitelisted for some time and the first message he sent got a score of -100, and the score has been falling. Does anyone know why the auto-whitelist would penalise a manually whitelisted address by 25 points? What v

Re: [SAtalk] Documentation question

On Mon, Dec 29, 2003 at 12:09:36PM -0500, Mike Kuentz (2) wrote: > What version of SA does this web page reference? > > http://www.spamassassin.org/doc/Mail_SpamAssassin_Conf.html apparently 2.70. :( -- Randomly Generated Tagline: "It is our job to protect the magic smoke ..." - Prof. Mi

Re: [SAtalk] Re: Having trouble coding a local rule

> Once you realise this, you can see how whitelisting is easy to fool... Which is exactly why I didn't want a whitelisting solution, just a reduction in spam scoring. -- Regards, +-+-+ | Peter Kiem.^. | E-Mail: <[EMAIL

[SAtalk] sa-learn summary, what does it mean?

When I run sa-learn it shows a summary with: Learned from xx message(s) (yy message(s) examined). Sometimes the learned xx is less than the examined yy. My question is what do these two numbers mean. I took a quick look at the code but it is quite circuitous and I was hoping someone just knew the

Re: [SAtalk] sa-learn summary, what does it mean?

At 03:50 PM 12/29/03 -0800, Barton L. Phillips wrote: Learned from xx message(s) (yy message(s) examined). Sometimes the learned xx is less than the examined yy. My question is what do these two numbers mean. I took a quick look at the code but it is quite circuitous and I was hoping someone just

[SAtalk] whitelist_from_rcvd question with unresolveable domains

I need to make some entries in whilist_from_rcvd. But the only hostnames in the Received: header that I can trust, are not resolveable. Does that matter? Is it a simple pattern/string match, or does SA also try to resolve the hostname? Like this: whitelist_from_rcvd [EMAIL PROTECTED] NTDOMAIN

[SAtalk] el1t3 h@ck0rz dictionary needed..

Th1s ju5t 1n... "We Do what V1aqra can.t"http://breadboard.esp ¡£9aln up t0 3" 1n length 1n Just Weekshttp://accusal.esp .become thlcker and fu1lerhttp://armonk.esp ¡£Mu1tlp1e, m0re explos1ve 0rqasmshttp://actualization.esp .Endless stay1n9 Powerhttp://bored.esp ¡£Say g0od6ye T0 premal1ure ejacu

[SAtalk] Annoying false positive & WTF is up with sf.net?

I tried to paste in a spam sample, and sourceforge.net rejected it with this message: <[EMAIL PROTECTED]>: host mail.sourceforge.net[66.35.250.206] said: 550-This message matches a blacklisted regular expression ([Vv] *[Ii] *[Aa] 550 *[Gg] *[Rr] *[Aa]) (in reply to end of DATA comman

Re: [SAtalk] Re: False positives

Bob George <[EMAIL PROTECTED]> wrote: > John Beamon <[EMAIL PROTECTED]> wrote: > > [...] (I particularly like seeing the "* 0.5 -- BODY: Possible porn - Hot, > > Nasty, Wild, Young" rating on a children's autism mailing list...) > > Having read through the web page (apparently the email was the S

Re: [SAtalk] Re: False positives

From: "Keith C. Ivey" <[EMAIL PROTECTED]> wrote: > Bob George <[EMAIL PROTECTED]> wrote: > > > John Beamon <[EMAIL PROTECTED]> wrote: > > > [...] (I particularly like seeing the "* 0.5 -- BODY: Possible porn - Hot, > > > Nasty, Wild, Young" rating on a children's autism mailing list...) > > > > Ha

RE: [SAtalk] Re: False positives

> From: JRiley > Sent: Monday, December 29, 2003 9:43 PM > [...] > > > > The offending sentence is "We are an online discussion group in > > GA for parents and caregivers of children and young adults with > > disabilities." Sounds really pornographic, doesn't it? [...] > > There are several othe