Re: [SAtalk] FP on MY_HTTP_ODD_PORT

2004-01-15 Thread Martin Radford
; However it is clearly not a non-standard port. SA is not distributed with any rules with that name, and the "MY_" prefix suggests that it's a local configuration. SA does have a WEIRD_PORT rule, which checks explicitly for :80, :443, and :8080 and isn't triggered if those

Re: [SAtalk] FP with backhair

2004-01-15 Thread Martin Radford
ext/plain. A text attachment should be text/plain, and hence I'd expect it to get scanned by SA. Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTED] | men just upload their important stuff -o) Registered Linux user #9257 | on ftp and l

Re: [SAtalk] Ack...razor2 error =(

2004-01-15 Thread Martin Radford
linux/IO/Socket.pm line 108, > line 358. > > Anyone seen this? http://wiki.spamassassin.org/w/RazorInsecureDependency Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTED] | men just upload their important stuff -o) Registered Linux use

Re: [SAtalk] Image-ONLY e-mails not filtered?

2004-01-17 Thread Martin Radford
.0 for that particular rule, 1.0 for DATE_MISSING, and 1.9 for FROM_NO_LOWER (since we don't know whether or not those two hit on the original message which we haven't seen), the 7.5 total comes down to 3.6, which isn't going to get tagged as ham by a default SA install. Martin --

Re: [SAtalk] spam assassin - tru64 unix

2004-01-17 Thread Martin Radford
quot;-m" value -- if it's set too low you run the risk of having a mail backlog build up with the result that mail gets delayed. Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTED] | men just upload their important stuff -o) Registered

Re: [SAtalk] Spam Assassin and Outlook Exchange Server

2004-01-17 Thread Martin Radford
SA a different stage in the mail processing. Perhaps look at using MailScanner (www.mailscanner.info), which will enable you to integrate virus scanning at the same time. Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTED] | men jus

Re: [SAtalk] what can we do with those spam mails

2004-01-17 Thread Martin Radford
score L_TITLE_MESSAGE 1.0 rawbody L_CONVERTED m{} describe L_CONVERTED Converted from text/plain score L_CONVERTED 1.0 Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTED] | men just upload their impor

Re: Re[2]: [SAtalk] what can we do with those spam mails

2004-01-18 Thread Martin Radford
#x27;ve already modified the repeat counts for number of digits in L_MIME_BOUND_MANY_DIG, since it's not constant: header L_MIME_BOUND_MANY_DIGContent-Type =~ /boundary=\"\d{15,}\"/ changed from \d{19,} to \d{15,} Martin -- Martin Radford | "Only wimps use tape back

Re: [SAtalk] Re: Filter rule f. invalid HTML tags?

2004-01-18 Thread Martin Radford
ey appear regularly in ham, the rule You'll probably find that this isn't text/html. It looks more like text/enriched, which is defined in RFC1896. (text/enriched was based on the older "text/richtext", defined in RFC1341.) Martin -- Martin Radford | "On

Re: [WL] [SAtalk] Yikes.. rules_du_jour

2004-01-18 Thread Martin Radford
straightforward way to avoid repeated downloads of a file that hasn't changed, by sending If-Modified-Since requests. Unfortunately wget doesn't yet support this, though it is mentioned in its TODO file. (This is with wget 1.9.1, which is the current version.) Perhaps there's a Perl module

Re: [WL] [SAtalk] Yikes.. rules_du_jour

2004-01-18 Thread Martin Radford
est sent, awaiting response... 200 OK The clue is the "200 OK" message. If If-Modified-Since was being employed, the return code would have been "304 Not Modified". The overhead of this probably doesn't matter on this scale, though. Martin -- Martin Radford

Re: Re[4]: [SAtalk] Set up

2004-01-27 Thread Martin Radford
x27;m pretty sure that the "autolearn=" is always present, irrespective of whether or not Bayes is actually available. Obviously, if autolearn=ham or autolearn=spam, then Bayes *is* available. But you can't tell anything from autolearn=no. Martin -- Martin Radford | &q

Re: [SAtalk] Help: How to add files of tests?

2004-01-27 Thread Martin Radford
= big_evil.cf ? "local" settings go in the /etc/mail/spamassassin directory. All files with names ending in ".cf" in that directory are read. See http://wiki.spamassassin.org/w/WhereDoLocalSettingsGo Martin -- Martin Radford | "Only wimps use tape backup

Re: [SAtalk] too much spam...

2004-01-28 Thread Martin Radford
ssage scored 3.422 when it hit a rule scoring 5.0. The answer (for the benefit of the OP) is that the message hit BAYES_00, which gave -4.9 points. Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTED] | men just upload their important stuff -o)

Re: [SAtalk] help please....cant stop them at all.

2004-01-28 Thread Martin Radford
scores 0 (less than the 0.1 which stops auto-learning as ham). For example, just adding "pcodruts" and "aavilable" with a score of 0.1 each would make sure this probably wouldn't be learnt as ham. Martin -- Martin Radford | "Only wimps use tape backup

Re: [SAtalk] sa-learn & spamassassin question

2004-01-29 Thread Martin Radford
t I've had to add specific rules to catch it. Once you've trained Bayes with a couple of these (assuming you're using Bayes, that is), it shouldn't have any problems with it. Check the list archives for my mail of 23rd Jan, in the thread "Re: [SAtalk] help

Re: [SAtalk] help please....cant stop them at all.

2004-01-29 Thread Martin Radford
At Fri Jan 23 21:30:58 2004, Martin Radford wrote: Five days to reach the list! I hoped SF would have cleared the backlog sooner than that! > This seems to be a signature with these mails, but I haven't put > together a rule for them yet. The following *might* work: > > hea

Re: [SAtalk] how to change the bayes auto_learn threshold to zero or above?

2004-01-29 Thread Martin Radford
hese messages, and give them a negative score. These *will* cause Bayes to pick the messages up, as long as it takes them below the autolearn-as-ham threshold. Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTED] | men just upload their important stuf

Re: [SAtalk] Bayes scoring

2004-01-31 Thread Martin Radford
rent version is 2.63. > However, when an email is scored with BAYES_99 it is only get a 3.0 from In 2.6x, BAYES_99 scores 5.4. Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTED] | men just upload their important stuff -o) Registered Linux u

Re: [SAtalk] how to change the bayes auto_learn threshold to zero

2004-01-31 Thread Martin Radford
At Wed Jan 28 23:01:48 2004, Brett Dikeman wrote: > > Martin Radford wrote: > > > It might be because you get the occasional false positive that you > > want to avoid (but all the rest come under your threshold). You > > probably would want these autolearned as ham. &

Re: [SAtalk] autolearning: how?

2003-08-14 Thread Martin Radford
arnt as ham. This is something of an FAQ that's not yet in the FAQ! Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTED] | men just upload their important stuff -o) Registered Linux user #9257 | on ftp and let the rest of the world /\\

Re: [SAtalk] removing X-Spam-Checker-Version

2003-08-14 Thread Martin Radford
At Mon Aug 4 22:38:46 2003, Florian Effenberger wrote: > > Hello, > > is there any possibility of removing the > > X-Spam-Checker-Version > > header line from messages? I was unable to do so :( I'm puzzled as to why you would want to do this. Can you enlig

Re: [SAtalk] sa-learn running as cron job

2003-08-14 Thread Martin Radford
o a spam > mailbox and then later do an sa-learn as spam on it. I've never bothered > to learn the ham or the spam that spamassassin has already passed > correctly. That's one approach, but it's not using the Bayesian capabilities to the full. Messages that SA is tagging as

Re: [SAtalk] Help understanding spamc and bayes

2003-08-14 Thread Martin Radford
ile: score BAYES_40 0 0 0.001 0.001 score BAYES_44 0 0 0.001 0.001 score BAYES_50 0 0 0.001 0.001 score BAYES_56 0 0 0.001 0.001 0.001 is enough to get the rule name into the report, without significantly skewing the scoring. Martin -- Martin Radford | "Only wimps use tape back

Re: [SAtalk] FORGED_MUA_OIMO: Why me?

2003-08-15 Thread Martin Radford
a possible bug. > Also broken is MSGID_OE_SPAM_4ZERO which triggers on netfolders updates.. Likewise, if that's in the corpora used by people contributing to the mass-checks it'll affect the score in 2.60. Martin -- Martin Radford | "Only wimps use tape backup: _real_

Re: [SAtalk] FORGED_MUA_OIMO: Why me?

2003-08-16 Thread Martin Radford
to the > "feature freeze" at the time. (I argued it was a bug fix to existing > rules, but oh well :) This is one of the problems with beta software. What happens if the developers remove this rule, and then Outlook 2003 is released with different behaviour, and goes back to

Re: [SAtalk] spamassassin --report

2003-08-16 Thread Martin Radford
irus software that's several months old, it won't catch current viruses, and likewise with SA older versions won't catch spammers' new techniques. With your current version, you need to investigate the Bayesian techniques that 2.5x makes available. Read up on the man page for &

Re: [SAtalk] sa-learn on mbox files exported from Exchange?

2003-08-16 Thread Martin Radford
l server, then the Bayesian code should work out that the headers added by your server is not usable as a ham/spam discriminant (and hence won't use it). At least, that's my understanding. Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECT

Re: [SAtalk] Is there a way to multiply the score if it matches 2+ rules

2003-08-17 Thread Martin Radford
nk so. Of course, you could do the following: meta LOCAL_MANY_RBLS_2 ((RCVD_IN_DSBL + RCVD_IN_RFCI + RCVD_IN_SBL) >1) score LOCAL_MANY_RBLS_2 1.0 meta LOCAL_MANY_RBLS_3 ((RCVD_IN_DSBL + RCVD_IN_RFCI + RCVD_IN_SBL) >2) score LOCAL_MANY_RBLS_3 1.0 ... and so on. So, if you hit two or more RBLs,

Re: [SAtalk] catching the Banned CD spam!

2003-08-18 Thread Martin Radford
d doesn't include either of those two patters, so far as I can see. It might well contain "BannedC" or "Banned C", though. It would be really useful if you could post the rules you've added, because without those we can only speculate on what you might have written

Re: [SAtalk] Configure to delete messages

2003-08-21 Thread Martin Radford
is might happen when people start using Outlook 2003!) Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTED] | men just upload their important stuff -o) Registered Linux user #9257 | on ftp and let the rest of the world /\\ - see http://

Re: [SAtalk] spamassassin install

2003-08-24 Thread Martin Radford
MTA - sendmail, qmail, postfix, exim, something else? Are you using spamassassin directly, or a spamc/spamd combination? Are you trying to do it via procmail? Is this sendmail using a milter? Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTE

Re: [SAtalk] Re: bug in header display ?

2003-08-25 Thread Martin Radford
e's no RFC-imposed limit to the total length of a header that's split over multiple lines, but maybe Squirrelmail has a built-in limit that's being exceeded. Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTED] | men just upload their

Re: [SAtalk] Message ID

2003-08-26 Thread Martin Radford
look very good for distinguishing ham from spam. Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTED] | men just upload their important stuff -o) Registered Linux user #9257 | on ftp and let the rest of the world /\\ - see http://counter.li.

Re: [SAtalk] Message ID

2003-08-27 Thread Martin Radford
At Tue Aug 26 13:15:59 2003, 'Carlo Wood' wrote: > > On Tue, Aug 26, 2003 at 11:21:46AM +0100, Martin Radford wrote: > > >From my own collections: > > > >with FQDNwith hostname only > > ham: 2331 (85.6%)

Re: [SAtalk] Message ID

2003-08-27 Thread Martin Radford
case-insensitive - so "MessaGe-iD" is also possible (albeit unlikely), for example. I'd be surprised to see anything other than the first three on the list. While the Message-ID is not strictly speaking required, I'd be extremely surprised if messages didn't get one inserted

Re: [SAtalk] sa-learn

2003-08-31 Thread Martin Radford
ip it off before inspecting the messages. Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTED] | men just upload their important stuff -o) Registered Linux user #9257 | on ftp and let the rest of the world /\\ - see http://coun

Re: [SAtalk] Text in Subject: Triggering BODY Rule?

2003-08-31 Thread Martin Radford
is considered part of the body and becomes the first | paragraph when running the rules. All HTML tags and line breaks will | be removed before matching. Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTED] | men just upload their important stuff

Re: [SAtalk] Problem with a rule

2003-09-01 Thread Martin Radford
From =~ /\.[a-z]{2}\b/i Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTED] | men just upload their important stuff -o) Registered Linux user #9257 | on ftp and let the rest of the world /\\ - see http://counter.li.org | mirror it ;)&q

Re: [SAtalk] osirusoft gone mad?

2003-09-03 Thread Martin Radford
osirusoft open relay? See the news article at http://news.spamassassin.org/ Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTED] | men just upload their important stuff -o) Registered Linux user #9257 | on ftp and let the rest of the world /\\ - see http://co

Re: [SAtalk] SA tags, but won't redirect

2003-09-06 Thread Martin Radford
asterisk (*) is supposed to be on the same line as the "X-Spam-Flag: YES", like this: :0: * X-Spam-Flag: YES $HOME/mail/SPAM Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTED] | men just upload their important stuff -o) Registere

Re: [SAtalk] Tagged Mail Format Problem

2003-09-15 Thread Martin Radford
ith attachments. Which version of SpamAssassin are you running? Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTED] | men just upload their important stuff -o) Registered Linux user #9257 | on ftp and let the rest of the world /\\ - see h

Re: [SAtalk] FORGED_MUA_OUTLOOK from a mac

2003-09-17 Thread Martin Radford
NT_COLOR_BLUE, > HTML_MESSAGE,MIME_LONG_LINE_QP,USER_IN_WHITELIST > version=2.55 > X-Spam-Level: > X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp) > X-Envelope-To: [EMAIL PROTECTED] > X-UIDL: 7d25fb7527b86057a6fce909449c3314 >

Re: [SAtalk] Weird

2003-09-17 Thread Martin Radford
DAI LY_PL, line 8, near > "25FREEMEGS_URL_uri_test" I'd hazard a guess that your copy of spamd is picking up rules from a previous version of SpamAssassin (i.e. you have multiple copies installed). Martin -- Martin Radford | "Only wimps use tape backup: _r

Re: [SAtalk] Any ideas????

2003-09-20 Thread Martin Radford
rrivalTime: 18 Sep 2003 05:40:43.0603 (UTC) FILETIME=[66E88230:01C37DA7] and has been wrapped. (FILETIME is a 64-bit counter starting from the Windows NT "epoch", which is midnight UTC 1 Jan 1601. The count is in 100ns intervals. One of its uses in Windows is for storing creation/modificatio

Re: [SAtalk] core DONOT_REPLY 1.5

2003-09-20 Thread Martin Radford
MS (security bulletins, newsletters, etc), there's a significant risk of FPs with a score of 3.7, unless those messages are whitelisted. Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTED] | men just upload their important stuff -o) Registered

Re: [SAtalk] SpamAssassin 2.60 rc5

2003-09-20 Thread Martin Radford
s released, I'm sure it'll appear in CPAN before long. Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTED] | men just upload their important stuff -o) Registered Linux user #9257 | on ftp and let the rest of the world /\\ - see http://co

Re: [SAtalk] required_hits < or =?

2003-09-23 Thread Martin Radford
t mail > would be considered spam. > > X-Spam-Status: No, hits=0.6 required=0.6 tests=FORGED_YAHOO_RCVD, > MICROSOFT_EXECUTABLE autolearn=no version=2.60 0.477 + 0.1 = 0.577 0.577 is rounded up to 0.6 for display purposes. 0.577 < 0.6, therefore message is not tagged as

Re: [SAtalk] God, I HATE CPAN!

2003-09-23 Thread Martin Radford
the one that SpamAssassin was compiled in. Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTED] | men just upload their important stuff -o) Registered Linux user #9257 | on ftp and let the rest of the world /\\ - see http://counter.li.org | mirro

Re: [SAtalk] Why is auto-learn set to no?

2003-09-23 Thread Martin Radford
high enough. It doesn't mean autolearning is disabled. Interesting point. Perhaps instead of "autolearn=", it should read: autolearnt=ham/spam/no or autolearned=ham/spam/no (depending on spelling preference :-) Martin -- Martin Radford | "Only wimp

Re: [SAtalk] Why is auto-learn set to no?

2003-09-24 Thread Martin Radford
as spam, and only the most hammy-looking messages get learned as ham. There's a wide range where SpamAssassin plays it safe and doesn't learn, rather than possibly making a mistake. Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTED] |

Re: [SAtalk] lots of false positives in 2.60

2003-09-24 Thread Martin Radford
normal? is it safe to use all of the rules from the 2.55 > distribution while running 2.60? No. The rules go with the release. You may well find that it simply doesn't work. Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTED] | men just

Re: [SAtalk] lots of false positives in 2.60

2003-09-24 Thread Martin Radford
t gives spammers something to abuse, and I'd expect that's why they've mostly vanished in 2.60. There was a lot of abuse of negative-scoring rules in 2.5x (x<=3). Options - whitelist these mailing lists, or write your own rules to give a negative score to them to compensate in

Re: [SAtalk] Sa-learn not learning

2003-09-29 Thread Martin Radford
ned from 0 message(s) (1 message(s) examined). You don't give much to go on here. What format are the messages in? Is it a single message? A firectory full of messages? An mbox format file? What command-line are you using? Martin -- Martin Radford | "Only wim

Re: [SAtalk] Forged mail pretending to be from MS

2003-09-30 Thread Martin Radford
Outlook 11. That would mean that the check would still work for checking mail apparently sent by Outlook <=11. Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTED] | men just upload their important stuff -o) Registered Linux

Re: [SAtalk] Problems sending to list

2003-09-30 Thread Martin Radford
message probably contained the regular expression that was matched, but going on previous reports, it was probably the name of a blue diamond-shaped pill used to treat impotence. The V-drug. Rhymes with "Niagara". Martin -- Martin Radford | "Only wimps use tape backup

Re: [SAtalk] HTML character entities

2003-10-12 Thread Martin Radford
> SA 2.55, Razor 2 The rule itself is present in the current version of SA -- 2.60. I don't know why it doesn't appear in the list of tests on the website, though. Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTED] | men just upl

Re: [SAtalk] Bayes not working.. On System Wide SA

2003-10-14 Thread Martin Radford
output a '.' to the screen for each message processed. Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTED] | men just upload their important stuff -o) Registered Linux user #9257 | on ftp and let the rest of the world

[SAtalk] Possible rule - excessive punctuation in subject

2003-10-15 Thread Martin Radford
I suspect this would work better as an eval rule, but I'm not confident enough to try to write one. Any comments on whether this is a reasonable approach? I'll bugzilla this tomorrow. Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTED]

Re: [SAtalk] strange behavior of Bayesian analyzer in SA 2.6

2003-10-19 Thread Martin Radford
this when I first upgraded to one of the pre-releases of 2.60. The developers said that this was due to changing the method of calculating the Bayes score. The newer code is much more likely to cluster around 0, 0.5, and 1. I have seen a few messages outside those cluster areas, but not too

Re: [SAtalk] X-Transfer-number and X-Transfer-stamp ?

2003-10-19 Thread Martin Radford
ed in those standards. > 2) Worth coding rules for? There have been a few reports on this list of spam appearing with these headers in place. I would guess it would be worth adding rules for this -- I've never seen these headers in legitimate mail. Martin -- Martin Radford |

Re: [SAtalk] Re: Swap Space

2003-10-19 Thread Martin Radford
tup if the user didn't specify a -m value on the startup command-line. One might also imagine spamd doing some OS-dependent checks to guess at what might be a reasonable default -m value, but I think that's going a bit far :-) Thoughts, flames? Martin -- Martin Radford

Re: [SAtalk] [OT] What is next step?

2003-10-22 Thread Martin Radford
27;t think sending mail to apnic.net about spammers is likely to be productive -- they just allocate address space to ISPs. Ditto for RIPE, ARIN, and LACNIC. Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTED] | men just upload their important

Re: [SAtalk] Building SA 2.60, errors

2003-10-25 Thread Martin Radford
out of the codebase for 2.70. Given that none of the developers use 5.005 regularly (the reason why we currently get so many minor bugs that hit 5.005 users), it seems unlikely that that SA 2.70 will work under 5.005 even if the current compatibility code isn't removed by then. Martin -- Martin

Re: [SAtalk] need help sizing a dedicated server

2003-10-25 Thread Martin Radford
ce being a close #2. I'd think it's not necessarily "more drive space" but perhaps "faster disks" and "more disks" to keep throughput high and disk contention low. Martin -- Martin Radford | "Only wimps use tape backup: _real_ [

Re: [SAtalk] Whitelist / Rule Question...

2003-10-25 Thread Martin Radford
username" mail, or someone I know who simply didn't bother to capitalise my first name. Of course, if the first part of my address was "mr1267", Hello, mr1267 would stand out as being spammy. So the effectivemess of "hello, username" rules depends on the format o

Re: [SAtalk] Error in mail logs relating to SPAMD

2003-10-26 Thread Martin Radford
assassin under the > SPAMDOPTIONS"-d -c -a -m5 -H" > adding the -u=spamd option gives errors saying I'm pretty sure you need to add -u spamd (i.e. no '='). I would guess that -u=spamd would cause SA to try to use the username "=spamd". Martin --

Re: [SAtalk] Disable FORGED_MUA_IMS tests

2003-10-27 Thread Martin Radford
y this? > I tried putting > forged_mua_ims 0 > in /etc/mail/spamassassin/local.cf but no luck. > Would I be able to put something like: > score forged_mua_ims 0 > in the local.cf file? Yes, but you must remember that SA is case-sensitive. score FORGED_MUA_IMS 0 shou

Re: [SAtalk] symbols and punctuation in subject

2003-10-27 Thread Martin Radford
any particular test. > > I looked at the list of tests and didnt see anything that addressed it. What if > there were a test that looked for somewhat unusual symbols and characters like > > | ` ~ * ^ [ > > and so on, with a higher incidence of any one of these earning more p

Re: [SAtalk] 0 messages

2003-10-28 Thread Martin Radford
t 70% filtering). Am I doing > > > something wrong? What is suppose to happen? > > > > Try these couple of things. > > > > a) run it with the debug flag -d > > > > sa-learn -D --spam --mbox spam > > Martin -- Martin Radford |

Re: [SAtalk] Disable FORGED_MUA_IMS tests

2003-10-28 Thread Martin Radford
n scans the new message. The new message does not have spammy headers and hence gets a lower score. I'm puzzled as to how both got the FORGED_MUA_IMS, though, if the encapsulation did happen. Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTE

Re: [SAtalk] Auto-Learn

2003-10-28 Thread Martin Radford
indicates that this particular message was not learned from, not that autolearning as a whole is switched off. Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTED] | men just upload their important stuff -o) Registered Linux user #9257 | on ftp an

Re: [SAtalk] [RD] Open source is Naughty!!!

2003-10-29 Thread Martin Radford
ing to the middle regex to match the strings > you're interested in? There has been a lot of spam which matches this pattern: /\b[Pp]en\xEDs\b/ \xED is a letter "i" with an acute accent, IIRC. Martin -- Martin Radford | "Only wimps use tape backup: _re

Re: [SAtalk] Auto-Learn

2003-10-29 Thread Martin Radford
it (on the basis that you're a human and know whether a message is ham or spam), while the auto-learning is much more conservative to avoid learning spammy-looking ham in error. Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTED] | men just upload

Re: [SAtalk] [RD] Meta rules vs. SA version

2003-11-03 Thread Martin Radford
g a > spamassassin -D --lint. The '+' is throwing it off. > > I wonder if that feature is 2.60 dependant? That syntax was in use in 2.50, for (at least) the Nigerian rules. It isn't present in 2.44. Martin -- Martin Radford | "Only wimps use

Re: [SAtalk] Re: Tomorrow's Crypto-Gram (fwd)

2003-02-17 Thread Martin Radford
have done this: is it possible to get sendmail to accept mails sent to non-existent addresses so they can be collected as "known spam"? I'm running Sendmail 8.9.3 (Red Hat 6.1). Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTED] | men

Re: [SAtalk] Comments on 2.50

2003-02-22 Thread Martin Radford
n a bid to "do something" about the problem, even though I get relatively few of them (always less than 10 a day, currently). Perhaps if I did get dozens a day, I'd be less relaxed about spending time on them. (As it is, I report spam that's not already razor'd, and that t

Re: [SAtalk] CompuServe numerical addresses

2003-03-05 Thread Martin Radford
ch /7[0-7]{4}\.[0-7]{1,[EMAIL PROTECTED]/ and /1[0-7]{5}\.[0-7]{1,[EMAIL PROTECTED]/ (The numbers are octal, for those wondering about the [0-7]s.) Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTED] | men just upload their important stuff -o

Re: Enough with the conspiracy theories! (was Re: [SAtalk] (no subject))

2003-06-06 Thread Martin Radford
ning SA to have a meaningful name and be configured correctly. But I think it would help. (In addition, it would be nice if the added *headers* also included one indicating what host had done the scanning.) Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAI

Re: [SAtalk] Outlook 2003 coming thru as spam

2003-06-04 Thread Martin Radford
Open a bug in the Bugzilla and attach a copy of a genuine mail, making sure that you include the X-Mailer and Message-ID headers (though obviously you should include the rest of the headers too). Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTED] | men j

Re: [SAtalk] Removing headers etc.. to feed Bayes correctly

2003-06-10 Thread Martin Radford
0 and restart spamd (if you're using spamd). I don't see anything Groupwise-specific in the headers. sa-learn will ignore any SpamAssassin markup it finds. Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTED] | men just upload their impor

Re: [SAtalk] Sick of spam? Sure am!

2003-06-13 Thread Martin Radford
heard (but don't know how true it is), that in some cases spammers send spam advertising anti-spam software in a bid to discredit the software and spread misinformation about it (and its authors). Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROT

Re: [SAtalk] Phrase for Nigerian spams...

2003-06-20 Thread Martin Radford
gt; > this particular phrase. > > It seems to me catching such spam is the work for bayers filter. That may well be the case. But don't forget that not everyone uses the Bayesian capabilities of SpamAssassin - either because they choose not to, or because they can't. Mart

Re: [SAtalk] spamassassin supported??

2003-06-23 Thread Martin Radford
At Mon Jun 23 15:27:31 2003, Matt Kettler wrote: > However, I'm not sure what version of perl redhat 6.2 has.. It might be > below the minimum requirements of SA.. SA 2.55 works fine on Red Hat 6.1, so should be OK on 6.2. Martin -- Martin Radford | "Only wimps

Re: [SAtalk] New trick

2003-06-27 Thread Martin Radford
PGP signature, which is going to slow down the spam run. Alternatively, if they use the same message body for all messages (and hence the same signature) they'll be hammered by Razor and similar checksum databases. Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL

Re: [SAtalk] New trick

2003-06-27 Thread Martin Radford
e key - for example, I could create a perfectly valid key as Martin Radford <[EMAIL PROTECTED]> even though the "address" is not valid. It's of limited use, of course, precisely because the "address" isn't usable, but a spammer won't care about t

Re: [SAtalk] Re: "Naughty" test names

2003-06-27 Thread Martin Radford
rough. > At least then they will have a legit complaint. The rule names appear in the message report, and that's part of the message body in the deafult configuration (the original message is transformed into an attachment). Martin -- Martin Radford | "Only wimps u

Re: [SAtalk] Installing spamassasin...

2003-06-28 Thread Martin Radford
ing of SpamAssassin immediately - the defaults are fine to start off with. Once you've got some experience of using it, you may want to make some tweaks, but it really isn't that difficult to edit the text files. And I'm sure no one would mind if you asked here. Martin -- Marti

Re: [SAtalk] FORGED_MUA_AOL and AOL employees

2003-06-28 Thread Martin Radford
can open a bug in the SA bugzilla and > attach a sample message to it. This will give the SADevs a copy of a > legitimate message to test and tweak the rules against it so that this > false positive case is fixed. You should only need to attach the headers - the body shouldn't matte

Re: [SAtalk] SA Marks AOL Bounce messages as spam

2003-06-28 Thread Martin Radford
unce message - obfuscate any personal details if you want, but try not to change any of the bits that cause the hits on those rules. There's nothing the developers can do with the report above without being able to examine the bounce message to see why it's triggering those rules. Martin -

Re: [SAtalk] Installing spamassasin...

2003-06-28 Thread Martin Radford
> tears. Unix / Linux server installations expect and demand a basic level > of proficiency and skills (the desktops don't necessarily.) And those > skills still have to be learned. Absolutely - you have to get used to editing config files on Unix/Linux platforms, it's the Uni

Re: [SAtalk] "Naughty" test names

2003-06-28 Thread Martin Radford
Who really wins? describe ONE_TIME One Time Rip Off describe UNCLAIMED_MONEY People just leave money laying around describe DONT_DELETEDon't delete me! No describe WORRY_FREE No Worries, Mate Martin -- Martin Radford | "Only w

Re: [SAtalk] pre-release: SpamAssassin 2.60 beta now available

2003-06-28 Thread Martin Radford
transcript of the compile/install process at http://www.zamenhof.demon.co.uk/sa260pr1.txt for those who need to see more information. But if there's anything else you need, please let me know. Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTE

Re: [SAtalk] BUGGY_CGI?

2003-06-29 Thread Martin Radford
) but couldn't get that to work either. If you're using spamd, did you restart it after making the change? Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTED] | men just upload their important stuff -o) Registered Linux user #

[SAtalk] High Bayes scores with 2.60-pr1

2003-06-29 Thread Martin Radford
et BAYES_99 as often (though spam did generally get BAYES_70 and above), and the scores weren't very much higher than 0.990. So I was surprised to see so many getting 1.000. My question is: is this expected behaviour? Is Bayes in 2.60 that much better than in 2.5x? Martin -- Martin Radfo

Re: [SAtalk] 2.60-cvs (20030627) rules

2003-06-30 Thread Martin Radford
e statistically more likely to be spam. Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTED] | men just upload their important stuff -o) Registered Linux user #9257 | on ftp and let the rest of the world /\\ - see http://counter

Re: [SAtalk] "Naughty" test names

2003-06-30 Thread Martin Radford
ult to implement. However, I don't believe that the existing developers should consider this a priority. But if someone actually put in the work to implement this, I'd hope the developers would consider including it. CRAVF_RAYNETR2 Information on enlarging body parts Martin --

Re: [SAtalk] How do I know whether Bayes is working or not?

2003-06-30 Thread Martin Radford
overall score. Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTED] | men just upload their important stuff -o) Registered Linux user #9257 | on ftp and let the rest of the world /\\ - see http://counter.li.org | mirror it

[SAtalk] Intriguing header forgery

2003-06-30 Thread Martin Radford
to try to mislead anyone (or anything) which is trying to trace the spammer - or at least throw them off course. Is this common? Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTED] | men just upload their important stuff -o) Registered Linux us

Re: [SAtalk] why not use SA on this SA list?

2003-06-30 Thread Martin Radford
t love to quote the whole message in your > replies, the more bytes, the merrier, yummm, headers and all. Guess > I'm old fashioned. Guess you're trolling. Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTED] | men just upload th

  1   2   3   >