[SAtalk] Forged from header and autowhitelist

2002-01-27 Thread Joey Hess
It's a problem if spammers can avoid spamassassin by forging mail from people I've got autowhitelisted, like ... me. Jan 27 22:12:03 kitenet postfix/smtpd[17022]: connect from unknown[211.144.2.66] Jan 27 22:12:09 kitenet postfix/smtpd[17022]: 1C4C2BC01F: client=unknown[211.144.2.66] Jan 27 22:12

[SAtalk] HTTP_CTRL_CHARS_HOST false triggering

2002-02-03 Thread Joey Hess
This is a trimmed forward from a user. If there were really control characters in one of these urls, I'd sorta expect them to show up as I am composing this message in vim. Hmm, perhaps it is geeing overly greedy about what constitutesa url, and thinks it's all one big url with the whitespace bein

Re: [SAtalk] LINE_OF_YELLING

2002-02-27 Thread Joey Hess
Daniel Rogers wrote: > LINE_OF_YELLING seems to have jumped from a score of 0.70 in SA 2.01 to a > score of 5.442 in SA 2.1. This strikes me as rather a lot. Aren't there > still people who still write their messages all in caps because they don't > know any better? Yeah, like lawyers, warrante

[SAtalk] false positive due to X-Em-Version and TO_LOCALPART_EQ_REAL

2002-03-06 Thread Joey Hess
I think this is interesting because it points at a place where the TO_LOCALPART_EQ_REAL test may be commonly triggered (besides dman's username) -- mail to mailing lists. This may even be likely, if the user uses some kind of address book, and puts in the list's name in the name field, and if the

Re: [SAtalk] HUNZA_DIET_BREAD

2002-03-06 Thread Joey Hess
Craig R Hughes wrote: > Matt Sergeant wrote: > > > Changed to /HUNZA.{1,80}BREAD/i, Thanks. > > What the heck, I changed it to /HUNZA/i I'm sure that will make some of the 20 thousand hits google finds for Hunza happy (Hunza travel services, the Hunza royal family(!), Hunza Graphics, Hunza Paki

[SAtalk] FWD: SPAM: 213.50 [!CrackMonkey!] SpamAssassin this, MOFO!!! ADV: Your Membership Exchange order -- Question to eBay seller g.r.a.p.e?

2002-03-06 Thread Joey Hess
All in good fun, I suppose. :-) I have a signature that scores about 30 points in spamassassin, but this is ridiculous. Hmm, I wonder how many of you won't even see this message. - Forwarded message from the Troll under the Belltown Bridge <[EMAIL PROTECTED]> - From: the Troll under th

[SAtalk] bouncing new false positive

2002-04-16 Thread Joey Hess
I have obscured all names and email addresses since this was private mail, but it is an interesting false positive. From: "xxx xxx" <[EMAIL PROTECTED]> Date: Tue, 16 Apr 2002 19:29:15 -0400 To: "xxx xxx" <[EMAIL PROTECTED]>, "xxx " <[EMAIL PROTECTED]>, "xxx-" <[EMAIL PROTE