Re: shifting the midpoint between the average spam and average ham

2004-09-03 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Joe Emenaker writes: > Joe Flowers wrote: > > >> If your "spread" is good and it's just the threshold that needs > >> adjusting, it would be trivial to make a rule that fires on every > >> message and give > it a score equal to the desired differen

Re: shifting the midpoint between the average spam and average ham

2004-09-03 Thread Joe Emenaker
Joe Flowers wrote: If your "spread" is good and it's just the threshold that needs adjusting, it would be trivial to make a rule that fires on every message and give > it a score equal to the desired difference... Thanks Pierre. That may be what I have to do, if noone has a better idea. Actually,

Re: shifting the midpoint between the average spam and average

2004-09-03 Thread Joe Emenaker
Steve Bertrand wrote: > SA isn't about the "average" it's about the accuracy. If this were the case, then why aren't the spam scores ("*required_hits*") for each message either 1 or 0 and nothing else? Oh, come on now. This is just a troll on a very legitimate and informative statement. No.

RE: spamd eating up CPU

2004-09-03 Thread David J. Duffner - NWCWEB.com
>-Original Message- >From: Predrag Lezaic [mailto:[EMAIL PROTECTED] >Sent: Friday, September 03, 2004 6:03 PM >To: [EMAIL PROTECTED]; users@spamassassin.apache.org >Subject: RE: spamd eating up CPU > > >> >Hello, I upgraded Ensim 3.5 to Ensim 4.0.1 which comes with >> >SpamAssassin 2.63. N

RE: spamd eating up CPU

2004-09-03 Thread Predrag Lezaic
>Hello, I upgraded Ensim 3.5 to Ensim 4.0.1 which comes with >SpamAssassin 2.63. Now, numerous times every day spamd starts gobbling down >CPU resources when looked at in top. Eventually it locks everything so bad >that the only thing I can do is reboot remotely since I don't have physical >acce

RE: spamd eating up CPU

2004-09-03 Thread David J. Duffner - NWCWEB.com
>-Original Message- >From: Predrag Lezaic [mailto:[EMAIL PROTECTED] >Sent: Friday, September 03, 2004 5:42 PM >To: users@spamassassin.apache.org >Subject: spamd eating up CPU > > >Hello, I upgraded Ensim 3.5 to Ensim 4.0.1 which comes with >SpamAssassin 2.63. Now, numerous times every day

spamd eating up CPU

2004-09-03 Thread Predrag Lezaic
Hello, I upgraded Ensim 3.5 to Ensim 4.0.1 which comes with SpamAssassin 2.63. Now, numerous times every day spamd starts gobbling down CPU resources when looked at in top. Eventually it locks everything so bad that the only thing I can do is reboot remotely since I don't have physical access to

Re: Attching Message Before Spamassassin

2004-09-03 Thread Dan Mahoney, System Admin
On Fri, 3 Sep 2004, Kelson wrote: When viewing the message source with SpamAssassin, pine doesn't break it into attachments, everything's all in one message. -Dan Dan Mahoney, System Admin wrote: > some mail clients (at least pine) don't show the headers when you > view the attachment. As far

Re: Attching Message Before Spamassassin

2004-09-03 Thread Kelson
Dan Mahoney, System Admin wrote: some mail clients (at least pine) don't show the headers when you view the attachment. As far as pine goes, if you start viewing the headers on the main message, then step into the attachment, it will show any headers in the attached message. Commands would be:

Re: Attching Message Before Spamassassin

2004-09-03 Thread Theo Van Dinter
On Fri, Sep 03, 2004 at 05:25:02PM -0400, Dan Mahoney, System Admin wrote: > Hey all, I noticed when SpamAssassin mangles the original email, the > original headers are NOT included in the main email. This gets annoying Well, not all of them anyway. > the attachment. Is there a fix to allow t

Attching Message Before Spamassassin

2004-09-03 Thread Dan Mahoney, System Admin
Hey all, I noticed when SpamAssassin mangles the original email, the original headers are NOT included in the main email. This gets annoying as some mail clients (at least pine) don't show the headers when you view the attachment. Is there a fix to allow the full headers to show through in th

Spamd abnormal handling of spamc timeout.

2004-09-03 Thread Smart,Dan
RH7.3,Postfix 2.1, procmail w/ SpamAssassin. Using type 1 after-queue filtering. === Executing in master.cf: procmail unix - n n - 12 pipe flags=R user=filter argv=procmail -Y -f- -t -m /etc/mail/procmail/procmailrc ${sender} ${re

Re[2]: shifting the midpoint between the average spam and average ham

2004-09-03 Thread Robert Menschel
Hello Joe, Friday, September 3, 2004, 7:01:12 AM, you wrote: >> why do you need to alter the average scores of ham/spam? JF> What a horrible horrible mess if we can't! Sorry, I don't understand. JF> One example: JF> All of my users have set their "optimal" spam thresholds to some number JF> b

RE: Those sneaky porno spammers

2004-09-03 Thread ROY,RHETT G
I had the same problem. 3.0 and the URIBL's fixed it. Big thanks to the people that made that possible. Rhett Roy Manager, Data Center Operations Woman's Hospital Baton Rouge, LA > -Original Message- > From: Gordon Thagard [mailto:[EMAIL PROTECTED] > Sent: Friday, September 03, 2004 1:

Re: shifting the midpoint between the average spam and average ham

2004-09-03 Thread Nix
On Fri, 03 Sep 2004, Joe Flowers yowled: > When I say "ham and spam curves", I'm envisioning 2 bell curves on the same > graph, significantly separated - I hope, and SA > automatically/continually keeping "5.0" sitting right in the middle between > their peaks. The GA (in 2.x) or perceptron (in

RE: Those sneaky porno spammers

2004-09-03 Thread Chris Santerre
It looks good. But WS and OB actually hit more then SC in a nationwide taste test :) Just not in this case. However Multi takes care of all this for you. --Chris >-Original Message- >From: Gordon Thagard [mailto:[EMAIL PROTECTED] >Sent: Friday, September 03, 2004 3:15 PM >To: Chris Sante

Re: 1-Megabyte Spam

2004-09-03 Thread Nix
On Wed, 01 Sep 2004, [EMAIL PROTECTED] yowled: > So I'm wondering - any ideas on dealing with giant-attachment spam? How many of SA's rules run over non-textual attachments? (rawbody rules, I guess... there are only 41 of those. Not many.) It might be worthwhile arranging to have two limits, one

Re: Those sneaky porno spammers

2004-09-03 Thread Gordon Thagard
Great! I'll give it a shot. I suppose I'll know next week how well it works. Are the defaults (below) good enough? uri SPAMCOP_URI_RBL eval:check_spamcop_uri_rbl('sc.surbl.org','127.0.0.2')describe SPAMCOP_URI_RBL URI's domain appears in spamcop database at sc.surbl.org tflags SPAMCOP_URI_RBL n

RE: Those sneaky porno spammers

2004-09-03 Thread Shawn R. Beairsto
I've been being hit by this type of spam quite hard lately, but finally found a way to stop it. Make sure you are running the SARE html and adult rulesets. Then add to your local CF: score SARE_HTML_URI_NODOT2 2.0 score SARE_HTML_A_HIDEtst2 4.0 This spammer's emails ALWAYS hit these 2 rule

RE: Those sneaky porno spammers

2004-09-03 Thread Chris Santerre
>-Original Message- >From: Gordon Thagard [mailto:[EMAIL PROTECTED] >Sent: Friday, September 03, 2004 2:29 PM >To: users@spamassassin.apache.org >Subject: Those sneaky porno spammers > > >Solaris 9 >Postfix 2.1.x >Spamassassin 2.64 >Amavisd-new-20030616-p10 >Clamav-0.74 >Bayes >Razor >DCC

Those sneaky porno spammers

2004-09-03 Thread Gordon Thagard
Solaris 9 Postfix 2.1.x Spamassassin 2.64 Amavisd-new-20030616-p10 Clamav-0.74 Bayes Razor DCC Hello All, I have setup what I consider to be a very good MTA for our College which is fending off a 49/51% SPAM/HAM ratio and dealing with many thousands of emails a day. While the system does a very g

RE: shifting the midpoint between the average spam and average ham

2004-09-03 Thread Bret Miller
> I'm fairly new to using SA, (I was using a pure Razor2 setup > until recently) > and this is the first mention I've heard of a GA to adjust > the scores on the > rules. Can you point me to any documentation of this? I've checked the > website, and I don't see anything there. Actually, it's part

Re: shifting the midpoint between the average spam and average ham scores back to 5.0

2004-09-03 Thread Ryan Thompson
Joe Flowers wrote to users@spamassassin.apache.org: Help please! If the average spam score of all of my ham messages is 1.0 and the average spam score of all of my spam messages is 3.0, then what is the best way to move the average_of_ these_two_averages (2.0) back up to 5.0? The result being th

Re: shifting the midpoint between the average spam and average ham

2004-09-03 Thread Ulysses Cruz
On Fri, Sep 03, 2004 at 10:29:32AM -0400, Matt Kettler whispered: > SA's scores are assigned by a genetic algorithm that evolves out the best > scores for all the rules as one gigantic simultaneous equation. It tunes > this equation to get the most email correctly placed into the spam and ham >

Re: shifting the midpoint between the average spam and average

2004-09-03 Thread Joe Flowers
> Many people have tried to give you advice, Yes, and I appreciate everything that everyone has said and there is some information in no responses too. > for something that really > was not clarified as to why > you were trying to achieve what you were. Because answering why takes the focus off o

RE: Applying SURBL against blog comment spammers

2004-09-03 Thread Chris Santerre
>-Original Message- >From: Jeff Chan [mailto:[EMAIL PROTECTED] >Sent: Thursday, September 02, 2004 9:04 PM >To: [EMAIL PROTECTED] >Cc: SURBL Discuss >Subject: Re: Applying SURBL against blog comment spammers > > >On Thursday, September 2, 2004, 5:43:26 PM, Loren Wilton wrote: >>> Given th

Re: shifting the midpoint between the average spam and average

2004-09-03 Thread Steve Bertrand
> > SA isn't about the "average" it's about the accuracy. > > If this were the case, then why aren't the spam scores > ("*required_hits*") for each message either 1 or 0 and nothing else? Oh, come on now. This is just a troll on a very legitimate and informative statement. If spam were like viri

Re: shifting the midpoint between the average spam and average

2004-09-03 Thread Joe Flowers
> SA isn't about the "average" it's about the accuracy. If this were the case, then why aren't the spam scores ("*required_hits*") for each message either 1 or 0 and nothing else?

Re: shifting the midpoint between the average spam and average ham

2004-09-03 Thread Joe Flowers
If your "spread" is good and it's just the threshold that needs adjusting, it would be trivial to make a rule that fires on every message and give > it a score equal to the desired difference... Thanks Pierre. That may be what I have to do, if noone has a better idea. BUT, that does imply that I

Re: shifting the midpoint between the average spam and average ham

2004-09-03 Thread Matt Kettler
At 10:01 AM 9/3/2004 -0400, Joe Flowers wrote: One example: All of my users have set their "optimal" spam thresholds to some number between 0.0 and 10.0. If the SA developers correctly shift around test scores, add new and/or improved algorithms, etc., and I need to take advantage of the latest,

Re: shifting the midpoint between the average spam and average ham

2004-09-03 Thread Duncan Findlay
On Fri, Sep 03, 2004 at 10:09:38AM -0400, Pierre Thomson wrote: > If your "spread" is good and it's just the threshold that needs adjusting, it > would be trivial to make a rule that fires on every message and give it a > score equal to the desired difference... Or multiply all the scores by a c

Re: shifting the midpoint between the average spam and average ham

2004-09-03 Thread Joe Flowers
Hey Steve, I was hoping not to do it that way because besides putting the human mistake-prone factor back in, it skews and warps the heck out of the spam and ham curves that the SA developers have worked so hard to get near perfect and trumps their priceless knowledge and experience. When I say

RE: shifting the midpoint between the average spam and average ham

2004-09-03 Thread Pierre Thomson
If your "spread" is good and it's just the threshold that needs adjusting, it would be trivial to make a rule that fires on every message and give it a score equal to the desired difference... Pierre Thomson BIC -Original Message- From: Joe Flowers [mailto:[EMAIL PROTECTED] Sent: Frida

Re: shifting the midpoint between the average spam and average ham scores back to 5.0

2004-09-03 Thread Steve Bertrand
> Help please! > > If the average spam score of all of my ham messages is 1.0 and the > average spam score of all of my spam messages is 3.0, then what is the > best way to move the average_of_ these_two_averages (2.0) back up to > 5.0? > > The result being that I need my current average score for

Re: shifting the midpoint between the average spam and average ham

2004-09-03 Thread Joe Flowers
> why do you need to alter the average scores of ham/spam? What a horrible horrible mess if we can't! One example: All of my users have set their "optimal" spam thresholds to some number between 0.0 and 10.0. If the SA developers correctly shift around test scores, add new and/or improved algorit

Re: shifting the midpoint between the average spam and average ham scores back to 5.0

2004-09-03 Thread Adam Lanier
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Joe Flowers wrote: | Help please! | | If the average spam score of all of my ham messages is 1.0 and the | average spam score of all of my spam messages is 3.0, then what is the | best way to move the average_of_ these_two_averages (2.0) back up to 5.0?

shifting the midpoint between the average spam and average ham scores back to 5.0

2004-09-03 Thread Joe Flowers
Help please! If the average spam score of all of my ham messages is 1.0 and the average spam score of all of my spam messages is 3.0, then what is the best way to move the average_of_ these_two_averages (2.0) back up to 5.0? The result being that I need my current average score for ham messages

Re: Baysian Help

2004-09-03 Thread JP
> At 10:19 PM 9/2/2004 -0400, JP wrote: >>Now when I executed the same command as "you" I recieved a permissions >>error? Upon inspecting the Bayes DB files apparently the file >>bayes_toks is now owned by "me" and the permissions have been changed to >> 600. >> >>What am i missing here? > > What

Re: Baysian Help

2004-09-03 Thread Matt Kettler
At 10:19 PM 9/2/2004 -0400, JP wrote: Now when I executed the same command as "you" I recieved a permissions error? Upon inspecting the Bayes DB files apparently the file bayes_toks is now owned by "me" and the permissions have been changed to 600. What am i missing here? What you're missing, and

[SARE] HEADER and SUBJECT rules added

2004-09-03 Thread Robert Menschel
Just a quick note that some rules have been added to: 70_sare_header0.cf, 70_sare_header1.cf, and therefore 70_sare_header.cf 70_sare_genlsubj0.cf, 70_sare_genlsubj1.cf, 70_sare_genlsubj3.cf, and therefore 70_sare_genlsubj.cf 70_sare_genlsubj_eng.cf Bob Menschel

Re: Applying SURBL against blog comment spammers

2004-09-03 Thread Loren Wilton
> Correct. I'm still wavering if a blog spam list should be part > of multi. There are programs that use multi but (unadvisedly) > don't differentiate between the source lists. That kind of > argues for keeping multi focussed on only mail spam and making > a blog spam list separate. On the othe

Re: Apache to Microsoft: who needs Sender-ID?

2004-09-03 Thread Loren Wilton
>How is it you can file for a patent on something long after it has >come into common useage and is already available from multiple >independent sources? A most interesting question, since a patent must be filed within 18 months (or maybe 12 months, I forget) after an invention becomes available t

Baysian Help

2004-09-03 Thread JP
I am running postfix with Procmail and Amavisd-new and SA 2.64 Everything is working fine (and has been for about 5 months now). I finally got around to see about using Baysian filtering site wide. And by sitewide I mean for two domains with a grand total of two actual users. I set-up the /etc/

Re: Applying SURBL against blog comment spammers

2004-09-03 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Bob Apthorpe writes: > Bad form to reply to one's own posts, I know, but I've just updated > babycart so it takes metadata as well comments. Also, there's better > debugging info, better docs, comments are now swaddled in RFC8222 format > for easier d

Re: missing tests in version 2.64?

2004-09-03 Thread Derrell . Lipman
[EMAIL PROTECTED] writes: > Today I upgraded to Debian Sarge and version 2.64 of SpamAssassin, from an old > 2.2x version. I'm now getting the errors shown at the end of this message, > generated by many messages. I'm invoking SpamAssassin via: > > ... > > Sep 2 20:24:43 amber qmail: 1094171083

Re: Applying SURBL against blog comment spammers

2004-09-03 Thread Bob Apthorpe
Hi, Bad form to reply to one's own posts, I know, but I've just updated babycart so it takes metadata as well comments. Also, there's better debugging info, better docs, comments are now swaddled in RFC8222 format for easier digestions by SA (including DNSBL lookup on the source IP address), there

Re: Applying SURBL against blog comment spammers

2004-09-03 Thread Jeff Chan
On Thursday, September 2, 2004, 5:43:26 PM, Loren Wilton wrote: >> Given the lack of commonality, it may not make much sense to >> add to the mail spam lists, since it would be an extra 2000+ >> records that would probably not get hits on mail. >> >> The MT-Blacklist doesn't seem to update too freq

Re: [SURBL-Discuss] RE: Applying SURBL against blog comment spammers

2004-09-03 Thread Loren Wilton
> > Chris... where have you been? We have had extensive discussions recently > > where we all concluded that we have to make getting the FPs down a priority > > and the only way to do this is to (gulp), allow some graymarketers loose > > (those who do a some or much spamming but who do have some le

missing tests in version 2.64?

2004-09-03 Thread Derrell . Lipman
Today I upgraded to Debian Sarge and version 2.64 of SpamAssassin, from an old 2.2x version. I'm now getting the errors shown at the end of this message, generated by many messages. I'm invoking SpamAssassin via: .qmail: |/usr/bin/procmail .procmailrc :0fw: spamassassin.lock | /

Re: Applying SURBL against blog comment spammers

2004-09-03 Thread Loren Wilton
> Given the lack of commonality, it may not make much sense to > add to the mail spam lists, since it would be an extra 2000+ > records that would probably not get hits on mail. > > The MT-Blacklist doesn't seem to update too frequently (the > last new record was from 8/29) and has about 2000 recor

Re: Apache to Microsoft: who needs Sender-ID?

2004-09-03 Thread jdow
One five letter word: Money. plus one six letter word: Lawyers plus a surfeit of a four letter word: Gall {^_^} - Original Message - From: "John Andersen" <[EMAIL PROTECTED]> How is it you can file for a patent on something long after it has come into common useage and is already availab

Re: Apache to Microsoft: who needs Sender-ID?

2004-09-03 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 John Andersen writes: > On Thursday 02 September 2004 03:43 pm, Steve Sobol wrote: > > Kevin Peuhkurinen wrote: > > > Yes. Although Microsoft has refused to disclose what they have > > > actually applied for patents on, their license only applies to

Re: [SURBL-Discuss] RE: Applying SURBL against blog comment spammers

2004-09-03 Thread Jeff Chan
On Thursday, September 2, 2004, 9:24:19 AM, Kelson Kelson wrote: > Jeff Chan wrote: >> Are they advertising legitimate sites or bad guy sites? > Gambling sites, "pillz" sites, etc. The usual. Thanks. Sounds like there are some definite bad guys spamming blogs. > More insidious are the ones tha