RE: [SAtalk] Spam Collecting

> From: cube > Sent: Friday, January 16, 2004 8:52 AM > > Does anyone have a good way of collecting ham for the bayesian > filters. I > can collect spam quite easily, but mixed in with my ham is all > kinds of spam. > (There is a buttload of spam with less hits than 1.) > > I read everywhere t

RE: [SAtalk] sa-learn, mbox deleted messages

> From: Barton L. Phillips > Sent: Saturday, January 17, 2004 9:28 AM > > I am using Mozilla and when I delete a message it is marked: > Status: RO > X-Status: D > > When I run sa-learn the deleted messages are learned. I can "compact > this folder" but I sometimes forget. Is there a way to ha

RE: [SAtalk] sa-learn, mbox deleted messages

> > You could use formail/procmail, > > formail -s procmail sa_learn.rc < mbox | sa-learn > > where sa_learn.rc might appear as follows: > > > LOGFILE=$HOME/sa_learn.log # While debugging > VERBOSE=yes# """" > LOGABSTRACT=yes# """" > SENDMAIL=

[SAtalk] (OT) Spam Conference 2004 re-cap?

> > There was an excellent presentation by John Graham-Cumming at the > 2004 Spam Conference about this and how your experience is what most > people find. The issue being that spammers don't know what tokens are > considered hammy in your Bayes DB, so random dictionary words tend to fail > very

[SAtalk] better whitelisting - using feedback?

One of the speakers at Spamcon 2004, talked about the effectiveness of automatically generated white lists. As I recall, his scheme depended upon two sources of info: the mail addresses that typically appeared in your To: From: and Cc: lines in your corpus of ham, during training and automatically

RE: [SAtalk] better whitelisting - using feedback?

> > I'm not sure I'd do this. One day (for a bunch of reasons) I whitelisted > my own address, and promptly got a bunch of spam "from" myself. > Good point, but all local addresses can (and must) be verified based upon the incoming gateway's Received: header. ---

[SAtalk] expand_regex: a tool for debugging regex rules

Attached is a perl script, expand_regex.pl, which will accept an SA rules file on standard input and will by default output the expansions of those rules, taking into account regex factoring due to parentheses. When invoked with the -verbose option, the program will preface the expansion by the r

[SAtalk] A simple tool to extract URL's from mail folders

Inspired by "Filters that fight back", by Paul Graham http://www.paulgraham.com/ffb.html I found a reference to a short script that scans e-mail for URL's, and then turns around and automatically references the offending page. Well, I'm not interested in doing that at the moment, but I have enhan

RE: [SAtalk] A simple tool to extract URL's from mail folders

Wow. I sent that e-mail out last *week*, and it is just dribbling in today. Received: from intrepid.intrepid.com ([192.195.190.1] ident=[1qHbG1J2WyZEN0gY3ydWgHO2WHps6+zg]) by sc8-sf-mx1.sourceforge.net with esmtp (TLSv1:AES256-SHA:256) (Exim 4.30) id 1Ak5VT-TZ-H9 for [

[SAtalk] expand_regex.pl - bug fixes, improvements

Attached, is version 1.4 of expand_regex.pl. Notable changes are: - improved handling of bracketed regex's in situation like ( ( )? ) where the previous version did not deal with nested balanced expressions correctly - added a -lint option which will run the most helpful warning options. -

RE: [SAtalk] Suddenly, spamd runs me out of memory (physical and swap)

As a follow-up, here's a link to the SA developers thread, where I reported the resource-hogging problems with mass-check: http://sourceforge.net/mailarchive/message.php?msg_id=5751288 > Gary wrote: > > > > This sounds amazingly similar to the failure mode that I've encountered > > running mass-c

RE: [SAtalk] SA finally working... but now it needs to learn, how?

Angel, what did you do to fix the problem you were having with procmail? > From: Angel Gabriel > Sent: Monday, August 11, 2003 12:43 PM > > Now that my mail is actually getting filtered [...] --- This SF.Net email sponsored by: Free pre-bu

RE: [SAtalk] Default Bayes scoring, and default cutoff value - too many false positives

> -Original Message- > From: Robert Menschel > Sent: Tuesday, August 05, 2003 8:29 PM [...] > > Of those 1100 messages, how many were spam, and how many were ham? I > don't think I've seen more than a half dozen FPs in any *month*, much > less a day. > > GF> Generally, I'm using SA in loc

RE: [SAtalk] Re: help with procmail script

> -Original Message- > From: John P Verel > Sent: Monday, August 18, 2003 1:24 PM [...] > > I do this, use the following, as I prefer to not have [SAtalk] on the > subject line. This recipe strips out the string and sends the message > along to the Spamassassin_talk folder. You can modi

RE: [SAtalk] Re: How To Change Recipient In User Unknown Message?

> -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of John > P Verel > Sent: Tuesday, August 19, 2003 6:43 AM > To: spamassassin list > Subject: [SAtalk] Re: How To Change Recipient In User Unknown Message? > > > > On 08/19/03 07:06 +0100, Yorkshire Dave wro

RE: [SAtalk] big attachments taking too long to process

> -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of > Abigail Marshall > Sent: Friday, August 22, 2003 4:35 PM > To: Paul Adams > Subject: Re: [SAtalk] big attachments taking too long to process > > > > > Hello Paul, > > Wednesday, August 20, 2003, 8:37:30

RE: [SAtalk] Spam filters rated on Slashdot

The test was uniformily unfair. The author trained the Bayesian spam detector programs with something like 70 messages of spam and ham each. Thus, even if SA had been run with Bayes enabled, it might've yielded atypical results that fell short of how SA might perform in a production environment. As

RE: [SAtalk] big attachments taking too long to process

> > The procmail rule might look like this: > > # Filter small messages the regular way > :0fw:spamassassin.lock > * ! > 14999 > | spamassassin > > # Otherwise, just test an excerpt, and deliver spam > # directly into big-spam.mbox. > :0E: > ? (head -c 7500; echo ""; tail -c 7500) | spamassassin -

RE: [SAtalk] big attachments taking too long to process

> -Original Message- > From: Bart Schaefer > Sent: Sunday, August 24, 2003 3:02 PM > > > On Sun, 24 Aug 2003, Gary Funck wrote: > > > # Otherwise, just test an excerpt, and deliver spam > > # directly into big-spam.mbox. > > :0E: > &

[SAtalk] A quick look at differences between 2.55 and 2.60 (rc4) - rules/scores

[below, words containing a well-known spam word, were changed to NIAGRA, in order to make it past Source Forge's lame spam filters.] I was curious to get a feeling for the differences bwtween the 2.55 release and the upcoming 2.60 release, and gathered the following brief statistics. New rules in

RE: [SAtalk] System goes down

You might be experiencing hardware problems that only occur under load. SA/spamd uses a lot of cpu and memory cycles. If it runs long enough, on large messages, it might push the cpu past its operating range temperature, if for example, the system cooling is marginal. Likewise, marginal memory mig

RE: [SAtalk] Scan Message Max Size

> -Original Message- > From: Tom Meunier > Sent: Thursday, September 18, 2003 1:44 PM > To: [EMAIL PROTECTED] > Subject: RE: [SAtalk] Scan Message Max Size > > > Define "safe" - I stick with the default of 250kb and have never had > an issue with it. I can't see receiving a spam anywh

RE: [SAtalk] Scan Message Max Size

> -Original Message- > From: Tom Meunier > Sent: Friday, September 19, 2003 1:20 PM > To: Spamassassin List > Subject: RE: [SAtalk] Scan Message Max Size > > > > > > Define "near". The latest Microsoft update spoof is about 155K. > > > > That'd be like that New Shimmer! It's a viru

RE: [SAtalk] image only porn

> -Original Message- > From: John Scully > > I have been running spamassassin 2.55 for some time (am about to go to > 2.60). > I'd recommend trying out 2.60, and seeing if things get better. In particular, it has a pattern which matches HTML redirection through a a Yahoo! site. Last ti

[SAtalk] Easy way to join two Bayes databases?

My personal Bayes database is more up-to-date than a co-worker's. I'd like to share the database with him, but since he likely also has Bayes entries which are unique to his own mix of ham and spam, I was wondering if there might be some tool/trick for merging the databases? Is this a meaningful o

RE: [SAtalk] problem with spamassassin, bmf and procmail

Your note didn't clearly say what exactly is wrong with the headers that you're seeing. Is it that the X-Spam-Status heeader is screwed up? If that's the case, the probably `bmf' (see http://sourceforge.net/projects/bmf/) is messing things up, when you call it with the -p switch. I don't know how

RE: [SAtalk] whitelist: help please ;'o(

This may not be quite on the mark, but is something I've been looking at, so will pass it along. There's a utility called 'fam', which has been contributed to the open source community by SGI. Fam monitors files for changes, and notifies clients when those files have been chaged: http://oss.sgi.co

RE: [SAtalk] problem with spamassassin, bmf and procmail

> From: sandolo > Sent: Friday, June 06, 2003 6:17 AM > > I choose to rename the spamassassin's header and all seems to work fine That's good. I'd recommend that you also file a bug report on bmf's development site, indicating that they are not properly rewriting the X-Spam-Status header, by ign

[SAtalk] On trying out CVS'ed spam assassin

Since spam is a moving target, and SA is under constant development, and the newer versions always seem to do a better job of spotting the latest spam, there are some of us out here in the peanut gallery who'd like to try the latest. But we're often warned away because (1) obviously, the latest is

RE: [SAtalk] Speeding Up SpamAssassin

Timothy, that's the way that I have my procmmail set up as well. This doen's work that well though for sites which filter on a site-wide basis. > From: Timothy J. Schutte > Sent: Friday, June 06, 2003 8:29 AM > > I subscribe to thirteen e-mail lists, several of which generate > 50-100 posts per d

RE: [SAtalk] On trying out CVS'ed spam assassin

> -Original Message- > From: Kai Schaetzl > Sent: Friday, June 06, 2003 10:32 AM > > scores *are* available on cvs, but not alone. You cannot drop in > new tests and > scores in an old sa. You need the full package. Hmmm, So if I go here, http://spamassassin.rediris.es/downloads.html

RE: [SAtalk] using procmail to run local only, then net tests

> -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of Gary > Funck > Sent: Monday, May 26, 2003 12:57 PM > To: Spamassassin List > Subject: [SAtalk] using procmail to run local only, then net tests > > > > In the interest of

RE: [SAtalk] Spam detection performance degrading

I also found that 2.55 was a bit too permissive. After looking at how a few of the mis-classified spams were scored, I tweaked the defaults a little and added language/locale checking. Here's my local.cf file: ok_languages en ru fr it es de ok_locales en ru fr it es de # limit RBL checking to ma

[SAtalk] Some observations on doing more with less

I've been experimenting with the effectiveness of limiting the amount of data that SA uses to make its decisions - by cutting back on the message size fed to SA. The results of those experiments are given below. Given a sample of 1543 bonafide spam messages that have been trapped over the past we

RE: [SAtalk] Some observations on doing more with less

> -Original Message- > From: Steve Schofield > Sent: Tuesday, May 27, 2003 8:27 PM > > If I may ask, is this in a user_pref for a specific user or domain wide? > Where is the conf file at? I've been running the experiments in my own account, working from a spam sample that I'd saved off

RE: [SAtalk] Some observations on doing more with less

> -Original Message- > From: Reijo Pitkanen > Sent: Wednesday, May 28, 2003 12:07 AM > > A few ideas, below... > > > I'm curious as to how many of these messages are inline-mime images, and how > much this has to do with mucked-up mime bounds detection out of spamassassin > (if it even do

RE: [SAtalk] Spam nstallingassasin

Couple of things: - You mention "squid proxy" below. That's a proxy server which serves up things like HTTP and FTP. It's not mail software per se. Are your users accessing their e-mail from a mail service you provide or some sort of outside provider like Yahoo or MSN (hotmail)? If it's an outsid

RE: [SAtalk] Strange spamc problem with SA 2.54 and qmail

A question: was the entire mail (header + body) longer than 1 chars. in length? If so, then the first spamc call only passes the first 10K of the message. The spamassassin call passes the entire message. Perhaps there was info in the remaining part of the truncated message that would've helped

RE: [SAtalk] Strange spamc problem with SA 2.54 and qmail

Ralf, Did you see my recent thread titled "Some observations on doing more with less"? I ran some tests trying different cut off points. I think it's possible that 1 will work for you, but you need to send the first and the last parts of the message off to spamc, rather than just the first part

RE: [SAtalk] Spam nstallingassasin

Hi Bob, Excellent info. thanks. Got a qeustion on MIME defang. I'm thinking of installing it, along with a caching name daemon, in a month/so. But, I'm not sure how to best set things up in our configuration: Internet (ISP) ---> Firewall (Linux/sendmail *internal* relay) > (continued f

RE: [SAtalk] Procmail - DROPPRIVS

> -Original Message- > From: Jose M. Herrera > Sent: Wednesday, May 28, 2003 12:22 PM > > Why is necesary put DROPPRIVS=yes in /etc/procmailrc ??? > > What is DROPPRIVS for? From "man procmailrc": DROPPRIVS If set to `yes' procmail will drop all privileges it might

RE: [SAtalk] whitelist

> > I don't suppose someone out there could tell me how to tell procmail to > simply accept the message and stop processing? > Generally, just deliver it to $DEFAULT. Something like this (towards the beginning of your procmailrc): FROM=`formail -rx To: | sed -e 's/^[ ]*//'` REALLY_FROM=`forma

RE: [SAtalk] some emails not tagged with SA headers

> -Original Message- > From: Frank Ng > Sent: Wednesday, May 28, 2003 10:52 PM > > I noticed that spams fall through after I upgraded to spamassassin 2.54, and > when I look closer, it doesn't look like spamassassin even tags them. > > I turned on procmail logging and verbose mode and thi

RE: [SAtalk] Attaboy

First, let me second those att-a-boys. Spamassassin is a demonstration of what a full spectrum, high technology implementation can do. It solves an important problem, and solves it well. Congrats to the SA team (and to the supporting cast of Razor, Pyzor, DCC and the RBL's). > OK, time for show an

RE: [SAtalk] Best way to whitelist mailing list msgs?

> -Original Message- > From: Robert Sinton > Sent: Thursday, May 29, 2003 4:26 PM > > Could somebody please advise the best method of whitelisting > messages from a given mailing list? > > Users here are occasionally getting incoming mailing list > messages flagged because of their co

[SAtalk] Untrested relays?

I'm running SpamAssassin 2.60-cvs (1.185-2003-04-22-exp), and notice that I have the following header in messages scanned by SA: X-SA-Relays-Trusted: X-SA-Relays-Untrusted: [ ip=192.195.190.1 rdns=intrepid.intrepid.com helo=intrepid.intrepid.com by=localhost.localdomain ident= ] [ ip=64.88.148.10

RE: [SAtalk] Untrusted relays?

> -Original Message- > From: Tony Earnshaw > Sent: Thursday, May 29, 2003 10:39 PM > > fre, 30.05.2003 kl. 07.03 skrev Matt Kettler: > > > I'm not sure what the trust config option would be in 2.60-cvs that you > > have... heck, the feature you mention may have been removed by > now.. rea

RE: [SAtalk] Re: Forwarding ham to another mailbox (using .forward)

> > Also, you don't need the spamassassin.lock file > [this avoids the lock fiile] > ;0fw > | /usr/bin/spamassassin > Yeah, the lock file is recommended in the SA docs. as I recall, to keep from creating too many processes (ie, to serialize spamassassin calls on a per-user basis). Since procm

RE: [SAtalk] Open lists, irrate users, spam [was: no subject]

> -Original Message- > From: Jack Gostl > Sent: Sunday, June 01, 2003 5:11 AM > > You didn't think there was a person at the other end of the > > subscribe/unsubscribe interface who manually processed things > did you ? :) > > No... but if you aren't going to qualify people who come onto

RE: [SAtalk] Bayes safety zone

> -Original Message- > From: Mike Leone > Sent: Sunday, June 01, 2003 8:25 AM > > So bayes wouldn't learn this was spam, unless the score was 19? I > rarely get > spam with scores higher than that. Am I misunderstanding? > In my recent spam mailbox, with about 2500 messages (over the pas

RE: [SAtalk] Problems with RBL after migrating to 2.55

Are any of the network checks (Razor, etc) working? Maybe you're somehow running in local mode only, due to the way it way built you installed SA? You might try debug mode: spamassassin -tD < test_msg.mail and see what it tells you. Also make sure and 'lint' your rules: spamassassin

RE: [SAtalk] all roads lead to SA talk [was: no subject]

Bob offers an excellent, thourogh response: > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of Bob > Sent: Tuesday, June 03, 2003 7:44 PM > To: [EMAIL PROTECTED] > Subject: Re: [SAtalk] (no subject) > [...] 3. An ISP you're sending mail to or receiving ma

RE: [SAtalk] spamassassin strange low hits

Is it possible that the second system is behind some sort of firewall router, that prevents it from sending its net queries out? You might try running a test with debug mode set: spamassassin -tD < sample_spam.txt and see what it says. -Original Message- From: Steve N Sent: Tuesday, J

[SAtalk] OT: AOL to Offer Security, Spam Tools

Perhaps appropos: Next Version of AOL to Offer Security, Spam Tools Mon Jun 9,11:51 AM ET NEW YORK (Reuters) - America Online said on Monday the next version of its Internet service, to be releas

RE: [SAtalk] Yet another stats program, this time with RRDtool graphs

> -Original Message- > From: Frank Pineau > Sent: Monday, June 16, 2003 3:06 PM > > On Sun, 15 Jun 2003 21:56:20 -0600, you wrote: > > >I don't mean to drag this too far off-topic, but I'm a little curious. > >What happened about two-thirds > >of the way after 02/01 that increased the

RE: [SAtalk] Big problem - SA crashing

> -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of Matt > Kettler > Sent: Thursday, July 24, 2003 8:21 PM > To: [EMAIL PROTECTED] > Subject: Re: [SAtalk] Big problem - SA crashing > > > At 07:06 PM 7/24/2003 -0700, Abigail Marshall wrote: > >I had seen

[SAtalk] those pesky small v*agra ads

I'm having trouble thinking of a good way to handle these short ads that fly under SA's radar. I'm running 2.60(cvs), fyi. Here's the HTML: satchel brains alexander evacuation metier extant crept bonaparte ar testifiers eventide acyclically barrymore merlin austin powersets ploughman break albu

RE: [SAtalk] those pesky small v*agra ads

> > Also of note it looks like the thing has some bugs in it.. it would appear > that $RANDOMIZE is intended to be replaced with random words, but in a few > spots, a $RANDOMIZE got split with a newline in between. It might be > interesting to do a rule to look for it which has some \s?'s added in

RE: [SAtalk] HTML_FONT_INVISIBLE

> -Original Message- > From: David Watson > Sent: Friday, August 01, 2003 8:13 AM > > I just received the spam below. Shouldnt a white font trigger > HTML_FONT_INVISIBLE if there is no bgcolor set? > > > > humidistat millenarian > tax bart http://sourceforge.net/mailarchive/mes

RE: [SAtalk] those pesky small v*agra ads

> -Original Message- > From: Mark > Sent: Friday, August 01, 2003 8:34 AM [...] > > That is the good news. :) The bad news is, that the true > background color, or > I should say, background appearance, is almost impossible to determine. > Consider table colors, colors, etc. Not to men

RE: [SAtalk] those pesky small v*agra ads

> This one seems easy to me, but I'm not a programmer. :) Just count the > number of "font color" tags. How about a test that is even more generic > by counting repeating numbers of HTML tags? > EXCESSIVE_REPEATED_HTML something > like that. This is not a bad idea, but it is worth noting that

RE: [SAtalk] Bayes must be working...

See related thread "[SAtalk] those pesky small v*agra ads": http://sourceforge.net/mailarchive/message.php?msg_id=5693626 and Mark's reply: http://sourceforge.net/mailarchive/forum.php?thread_id=2883539&forum_id=1981 > From: Steve Thomas > Sent: Friday, August 01, 2003 4:28 PM > > Just got a spa

[SAtalk] How to detect *only* obfuscated strings?

Simple example: body REMOVE_OBFUSCATE /(Rem(o|0)ve|Delete).{0,10}y(o|0)ur.{0,10}(e[-]?mai(l|1)|address)/i describe REMOVE_OBFUSCATE Remove y0ur e-mail Above, this pattern will match (among other things): Remove your e-mail Rem0ve y0ur e-mai1 where the second string has been obfusca

RE: [SAtalk] Problem with "penis enlargement" :)

Sorry to hear about your problem. In the example you show below, there's a sequence of HTML text, but you didn't tell us how it was encoded in the e-mail message (ie, clear text or base64) Lots of spammers encode their messages to avoid being detected by simple text string matches. Per the docu

RE: [SAtalk] Where can the newbies go?

> -Original Message- > From: Pat Traynor > Sent: Saturday, August 02, 2003 7:49 AM [...] > > > If you're concerned about re-asking questions that have been asked > > before, then the best thing to do is to search the mailing list > > archives - see http://www.spamassassin.org/lists.html f

RE: [SAtalk] separate rules from distribution

> -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of Raul > Dias > Sent: Saturday, August 02, 2003 2:17 PM > To: [EMAIL PROTECTED] > Subject: Re: [SAtalk] separate rules from distribution > > > > Hi, > > Em S?, 2003-08-02 às 16:49, Florin Andrei escreveu: >

[SAtalk] is a look-alike word a viseme?

The spammers are definitely getting more creative. Saw this in an HTML-encoded spam message recently: Everyone wants to see A/V=5CATEUR college ... The way this shows up on the screen is: Everyone wants to see A/V\ATEUR college ... So, now /V\ becomes an alternate spelling for M. I wonde

RE: Re[2]: [SAtalk] How to detect *only* obfuscated strings?

Bob, Excellent. thanks. - Gary > > I've just added a page to the SA Wiki at > http://www.exit0.us/index.php?MaskedWordList which explores this topic. > It discusses options, and lists all of the various masked / obfuscated > words I've identified so far. > I followed some of the links on the main

[SAtalk] Easy way to get messages in clear text?

Thinking over the topic of mispellings and phrases that commonly appear in spams, I'd like to be able to run a few simple programs to pull out the words that appear in a collection of spam and ham, to find the obvious mispellings, and sequences of words that commonly appear in spam and differentia

[SAtalk] SA cv6 2.60 - Bayes auto learn set by default?

I've been trying out 2.60 (cvs) the last few days, and have been liking it fine. Today, I browsed through a few bounced spams and much to my surprise, I noticed that some of the messages were being given Bayes scores. I was surprised because I hadn't explicitly enabled Bayes scoring, or auto learn

RE: [SAtalk] Re: SA cv6 2.60 - Bayes auto learn set by default?

> -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of Fuzzy > Fox > Sent: Sunday, August 03, 2003 10:13 PM > To: Spamassassin List > Subject: [SAtalk] Re: SA cv6 2.60 - Bayes auto learn set by default? > > > Gary Funck <[EM

RE: [SAtalk] Re: SA cv6 2.60 - Bayes auto learn set by default?

(BHello Alan, (B (B> -Original Message- (B> From: alan premselaar (B> Sent: Sunday, August 03, 2003 11:52 PM (B> (B> On 8/4/03 3:20 PM, "Gary Funck" <[EMAIL PROTECTED]> wrote: (B> (B> [...] (B> > (B> > The problem is that I saw

RE: [SAtalk] getting spam to goto a users spam folder.

Rob, Not directly related, but setting ERRORCODE=67, which will return "no such user" back to the sender, isn't very useful on spam, because spammers fake their from addresses, and most of the time those from addresses point to non-existent users. It probably will only serve to confuse your friend

RE: [SAtalk] [RD] How to detect *only* obfuscated strings?

> -Original Message- > From: Chris Santerre > Sent: Monday, August 04, 2003 8:53 AM [...] > > > > > > I'm a little behind in reading and writing today :) > > You could try the NOT function, that's what I call it :) > > /rem[^o]ve/i would give you everything BUT remove with an 'o'. > But

RE: [SAtalk] Your account worm

Interestingly, 2.60(cvs dated 6/30) and Bayes did a pretty good job on this (I'm using the default cut off of 5, but the result is well over that). Content analysis details: (11.5 points, 5.0 required) 0.3 NO_REAL_NAME From: does not include a real name 1.6 SUBJ_HAS_SPACESSu

RE: [SAtalk] Wired Article

Nice article. Rather than looking for higher scores, I like writing new rules that stomp out the latest vermin that sneak under the radar screen. A good day is when no spams show up in my inbox. > -Original Message- > From: Tim > Sent: Monday, August 04, 2003 9:19 AM > To: [EMAIL PROTECTE

[SAtalk] RE: dustbinning spam (was: Wired Article)

I used to file high scoring spam into /dev/null with no ill-effect, but went to keeping it all in a spam folder, to be saved for future Bayes scoring and regression runs. > -Original Message- > From: Kai MacTane > Sent: Monday, August 04, 2003 11:23 AM > [...] > >A good day is when no s

RE: [SAtalk] My rules don't work.

Maybe there was a rule parse error on an earlier rule. Try running spamassassin --lint to check the rules, and see it turns up anything. A couple of suggestions: 1. Don't use .* -- it is unbounded and cen be really slow on a long message. Use something line .{0,16}, where the choice of 16 is

RE: [SAtalk] Header rewrite question

Gary wrote, before completely checking the facts: > I noticed the same thing [that Received headers > were seemingly missing in spam that had been > reported by SA]. Before writing that reply, I quickly looked at the beginning of a big spam mbox that I've collected since last year. As already

[SAtalk] Re: improved SA user interface (was: feature suggestions ...)

Summary: Mark H. notes that as a POP client user of an ISP that runs SA that it can be difficult configuring items that go into user_prefs (white lists, black lists, etc). Mark states > Its complex and difficult to communicate with SA. I do have a shell > account, but not everyone does, and no o

RE: [SAtalk] Suddenly, spamd runs me out of memory (physical and swap)

> -Original Message- > From: Mike Burger > Sent: Thursday, August 07, 2003 2:47 PM > To: [EMAIL PROTECTED] > Subject: [SAtalk] Suddenly, spamd runs me out of memory (physical and > swap) > > > I've been running spamd/spamc from the SA 2.54 set quite happily > for quite > some time. > > To

RE: [SAtalk] Procmail files being skipped?

> -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of Angel > Gabriel > Sent: Monday, August 11, 2003 9:39 AM > To: Spam Assassin > Subject: [SAtalk] Procmail files being skipped? > > > I have a feeleing that my ~/.procmailrc files are being skipped, it > se

RE: [SAtalk] Spam role account

> -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of > Christopher Wall > Sent: Monday, August 11, 2003 1:52 PM > To: [EMAIL PROTECTED] > Subject: [SAtalk] Spam role account > [...] > The problem is this: exchange/outlook users cannot bounce/resend > mess

RE: [SAtalk] Header rewrite question

I noticed the same thing. Seems like this can be a bit of problem for those of us who would like to collect spam (and mis-classified ham) that that is later fed to sa-learn, or that is used to calibrate local scores via mass check. It is my understanding that the Bayes scoring, and various rules p

[SAtalk] Default Bayes scoring, and default cutoff value - too many false positives

Hello, I've been running SA with Bayes enabled only the past few days. Bayes has been auto-learned on two rather large corpuses, which yielded about 1100 auto-learn messages (per the Bayes journal file). I've noticed the number of false negatives (ie, spam mis-classified as ham) have dropped to a

RE: [SAtalk] SA - Seems to not want to work :(

> -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of > ODHIAMBO Washington > Sent: Monday, August 11, 2003 10:16 PM > To: Spam Assassin > Subject: Re: [SAtalk] SA - Seems to not want to work :( > > > * Steve Thomas <[EMAIL PROTECTED]> [20030811 20:59]: wrot

RE: [SAtalk] how to handle white listed falsified From: address

> -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED]]On Behalf Of > Justin Mason > Sent: Tuesday, September 17, 2002 4:09 AM > To: Gary Funck > Cc: Spamassassin List > Subject: Re: [SAtalk] how to handle white listed falsified From: addr

[SAtalk] How to filter win-a-bike?

A new one dropped in today: >From [EMAIL PROTECTED] Tue Sep 17 02:32:10 2002 Return-Path: <[EMAIL PROTECTED]> Received: from domain.com (IDENT:vJOZX4JS12QEzRRGzbZm0jNb9/n3FOaJ@domain [192.99.99.1]) by domain.com (8.11.6/8.11.2) with ESMTP id g8H9W9V20563 for <[EMAIL PROTECTED]>;

RE: [SAtalk] how to handle white listed falsified From: address

> > > > upgrade to 2.41, the auto-whitelist in that version avoids that problem; > > it tracks IPs as well as names. > > > > Thanks Jason (and Bret). I installed 2.41 (via CPAN) and it fixed the > problem. >- Gary er, make that Bart (Schaefer). Thanks again. - Gary ---

RE: [SAtalk] Razor2 method not found

> > razor2 check skipped: No such file or directory Can't locate object > method "new" via package "Razor2::Client::Agent" at > /usr/local/lib/perl5/site_perl/Mail/SpamAssassin/Dns.pm line 374. > > I can't see what changes between the two ways of running SA. Razor > itself seems to work properly

RE: [SAtalk] Razor2 method not found

follow up: > > - I'm a bit confused regarding the distinction between Razor, and > Razor2. I > added the Razor package via CPAN, but I see from e-mail traffic > on this list > that if I'm running SA version 2.41, I should go to Razor2? I did see a > installation warning message similar to the one

RE: [SAtalk] Razor2 method not found

follow up: > > - I'm a bit confused regarding the distinction between Razor, and > > Razor2. I > > added the Razor package via CPAN, but I see from e-mail traffic > > on this list > > that if I'm running SA version 2.41, I should go to Razor2? I did see a > > installation warning message similar t

[SAtalk] checking out Razor2 (and SA 2.41) install - Net::DNS:Resolver problem?

Hello, after installing Razor2, I had to bang through a few more installation difficulties. At this point, I've installed the following additional modules: Archive-Tar-0.22 Digest-Nilsimsa-0.06Net-Telnet-3.03 Attribute-Handlers-0.77 Digest-SHA1-2.01Params-Validate-0.2

RE: [SAtalk] checking out Razor2 (and SA 2.41) install - Net::DNS:Resolver problem?

k.com << 5 Sep 17 18:21:14.072893 check[13050]: [ 6] a=q debug: leaving helper-app run mode debug: DCC is not available: dccproc not found debug: Razor1 is not available debug: Pyzor is not available: pyzor not found debug: DNS MX records found: 1 debug: forged_rcvd_trail: entry 0: by=dom

RE: [SAtalk] SA Results

> -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED]]On Behalf Of Lars > Hansson > Sent: Thursday, September 19, 2002 2:47 AM > To: [EMAIL PROTECTED] > Subject: Re: [SAtalk] SA Results > > > On Thu, 19 Sep 2002 08:48:46 +0200 > Pawel Wojnicki <[EMAIL PROTECTED]> wro

[SAtalk] -P warning considered harmful

Our mail server computer is offline at the moment, so we substituted a spare, which generally has the same OS and software, but differs in a few regards. It turns out that one major difference is that the substitute computer runs an older version of SA; it runs v. 2.20, while the main computer ha

RE: [SAtalk] Help.... sendmail DSN service unavailable

> -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED]]On Behalf Of > Charles Dennett > Sent: Saturday, September 21, 2002 6:38 PM > To: Fogarty, Chris > Cc: [EMAIL PROTECTED] > Subject: Re: [SAtalk] Helpplease > > > Hmmm. Ya got me. I just stared using SA a cou

RE: [SAtalk] -P warning considered harmful

> -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED]]On Behalf Of Bob > Proulx > Sent: Sunday, September 22, 2002 11:44 AM > To: Spamassassin List > Subject: Re: [SAtalk] -P warning considered harmful > > > Gary Funck <[EMAIL PROTE

RE: [SAtalk] "offers" in header a good rule for trapping spam

> -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED]]On Behalf Of > SpamTalk > Sent: Wednesday, October 09, 2002 4:22 PM > To: SpamTalk > Cc: [EMAIL PROTECTED] > Subject: RE: [SAtalk] "offers" in header a good rule for trapping spam > > > >they're binary (Outlook?)

[SAtalk] conditional non-local execution?

Perhaps this has been discussed before, but I was wondering if it might make sense in many instances for SA not to invoke non-local agents if the local spam score is already above the spam threshold? Thus, if this new configuration dependent mode was enabled, SA would only check RBL, razor, pyzo

  1   2   >