Re: trying to install 3.0.2 via CPAN

Hello alan, Saturday, December 18, 2004, 7:15:46 PM, you wrote: ap> for some reason i'm getting SPF failures during the 'make test' ap> phase: ... I found a month or so ago, during a system rebuild, that for some reason I was getting errors like this for 3.0.1, from a CPAN install, but I then di

Re: SPF tests fail on 3.02?

On Mon, Dec 20, 2004 at 11:09:51PM +, Henry Kwan wrote: > So if the test didn't actually fail, should I go ahead with the install or > wait for v3.03? As long as everything else passes, just install 3.0.2. -- Randomly Generated Tagline: "I'm happy. I'm giddy. I'm spiffy." - Michael K

Re: SPF tests fail on 3.02?

Theo Van Dinter kluge.net> writes: > > On Mon, Dec 20, 2004 at 10:46:16PM +, Henry Kwan wrote: > > t/spf...Not found: helo_pass = SPF_HELO_PASS > > I checked and v3.01's spf test passed and I don't think I changed anything > > so > > what is 3.02 looking for that's

Re: SPF tests fail on 3.02?

On Mon, Dec 20, 2004 at 10:46:16PM +, Henry Kwan wrote: > t/spf...Not found: helo_pass = SPF_HELO_PASS > I checked and v3.01's spf test passed and I don't think I changed anything so > what is 3.02 looking for that's new? Known issue: http://bugzilla.spamassassin.org

SPF tests fail on 3.02?

Hi. Am trying to upgrade to 3.02 from 3.01 (RH FC1 with sendmail/spamd/procmail) but on 'make test', I get these following errors. t/spf...Not found: helo_pass = SPF_HELO_PASS # Failed test 1 in t/SATest.pm at line 530 Not found: pass = SPF_PASS # Failed test 2

RE: Bayes question

> > On Mon, Dec 20, 2004 at 04:13:44PM -0600, Steve Bondy wrote: > > I'm no expert on Bayes, but as far as I know, repeatedly > learning the > > same message over and over again doesn't do you any good. Once the > > tokens are in there, that's it. The bayes score goes up as more > > tokens

Re: Bayes question

On Mon, Dec 20, 2004 at 04:18:58PM -0600, Chuck Campbell wrote: > It's not the same message... exactly. It is the same spam, coming from many > different senders, each with a unique message ID. I keep getting more of > them, > and I keep learning them with sa-learn. > > I'm just not getting SA

Re: Bayes question

On Mon, Dec 20, 2004 at 04:13:44PM -0600, Steve Bondy wrote: > I'm no expert on Bayes, but as far as I know, repeatedly learning the > same message over and over again doesn't do you any good. Once the > tokens are in there, that's it. The bayes score goes up as more tokens > in the message match

RE: Bayes question

I'm no expert on Bayes, but as far as I know, repeatedly learning the same message over and over again doesn't do you any good. Once the tokens are in there, that's it. The bayes score goes up as more tokens in the message match Someone please correct me if I'm wrong, and confirm if I'm right..

Re: Bayes question

On Mon, Dec 20, 2004 at 12:56:43PM -0600, Steve Bondy wrote: > Just because you learn something as spam doesn't mean it will be > blocked. > SA will add a score to the message based on the bayes rules, but if the > bayes rules are the only ones that get hit, and they score less than > your threshol

Re: OT Boincing Spam

Ring, John C wrote: My boss is twisting off today because he got 350 messages marked [SPAM] over the weekend. His Reaction is to "Bounce em all, Let the isps sort it out." [snip] What you want to do, IMO, is run SpamAssassin during the SMTP session, such as with http://duncanthrax.net/exis

Re: OT Boincing Spam

ChupaCabra said: > First he wanted that. I did it but actually kept em all. So then his > partner didn't get an urgent email so it was turned back to the users to > decide. I get a different kneejerk each week. What fun dealing with an > 80 yo ex military man. This am it was "Lets spambomb eve

RE: OT Boincing Spam

>My boss is twisting off today because he got 350 messages marked [SPAM] >over the weekend. His Reaction is to "Bounce em all, Let the isps sort >it out." And then when a spammer sends tons of e-mail to your site forged as, say, [EMAIL PROTECTED], you stand a good chance IBM may end up blocking

Re: OT Boincing Spam

shane mullins wrote: Could you just discard it? I was till a couple of vips lost important email. I was actually keeping it all because I knew better.

Re: OT Boincing Spam

Evan Platt wrote: Evan Platt said: I don't have a link for you, but tell your boss to imagine if someone decided to dictionary attack every ISP they could find, using not only dictionary words, but every combination of letters up to 9 letters, i.e. a, b, c, etc up to zzz

Re: sa database transferable?

Andy Hester wrote: I have just built a new spam filter with postfix/amavisd/spamassassin to replace our old sendmail/mimedefang/spamassassin spam filter which was buckling under the load. Can I copy the sa databases over to the new filter to help my new filter learn? If not, any ideas on ho

Re: OT Boincing Spam

Evan Platt said: > I don't have a link for you, but tell your boss to imagine if someone > decided to dictionary attack every ISP they could find, using not only > dictionary words, but every combination of letters up to 9 letters, i.e. > a, b, c, etc up to z for eve

Re: OT Boincing Spam

On Mon, 20 Dec 2004 14:49:59 -0600, ChupaCabra <[EMAIL PROTECTED]> wrote: > Or does anyone think bouncing all spam is a good idea. > > Thanks ahead. > > -- > Michael H. Collins Admiral, Penguinista Navy > Bouncing spam will do two things. First, it'll generate a lot of useless traffic, which

sa database transferable?

I have just built a new spam filter with postfix/amavisd/spamassassin  to replace our old sendmail/mimedefang/spamassassin  spam filter which was buckling under the load.  Can I copy the sa databases over to the new filter  to help my new filter learn?  If not, any ideas on how I can train

Re: OT Boincing Spam

ChupaCabra said: > My boss is twisting off today because he got 350 messages marked [SPAM] > over the weekend. His Reaction is to "Bounce em all, Let the isps sort > it out." I tried explaining about forged headers and the myriad of > other methods spammers use to look like they come from somepla

Re: OT Boincing Spam

On Monday 20 December 2004 20:49, ChupaCabra wrote: > I can see where he gets the idea in that I still see people on the > internets saying bouncing it is good but in all my readings I have > learned better. Or does anyone think bouncing all spam is a good idea. Backscatter will get you blacklist

Re: OT Boincing Spam

* ChupaCabra <[EMAIL PROTECTED]>: > My boss is twisting off today because he got 350 messages marked [SPAM] > over the weekend. His Reaction is to "Bounce em all, Let the isps sort > it out." I tried explaining about forged headers and the myriad of > other methods spammers use to look like th

OT Boincing Spam

My boss is twisting off today because he got 350 messages marked [SPAM] over the weekend. His Reaction is to "Bounce em all, Let the isps sort it out." I tried explaining about forged headers and the myriad of other methods spammers use to look like they come from someplace else. Apparantly

RE: Interesting NW article

On Mon, 2004-12-20 at 13:31 -0500, Chris Santerre wrote: > > Completely agree. We don't use Bayes, and we catch 99%. Who did these > people contact? > > SA is not that difficult at all to integrate. I think they confuse the > abondance of options, as difficult. > > --Chris I personally think

Re: Interesting NW article

Jerry Bell wrote: Here's a snippet from the article: "The short answer is that no one submitted it, but of course there's more to it than that. This year we reached out to the SpamAssassin community and asked them to participate. Although a few well-meaning souls volunteered to be the contacts for

RE: Bayes question

Just because you learn something as spam doesn't mean it will be blocked. SA will add a score to the message based on the bayes rules, but if the bayes rules are the only ones that get hit, and they score less than your threshold, it won't keep the stuff out. For example, the default score in 2.6.x

Re: SpamAssassin doesn't parse any email

On Mon, Dec 20, 2004 at 06:46:47PM +0200, Oleksandr Samoylyk wrote: > > How are you calling SpamAssassin? > > /usr/bin/spamd -d -c -m 5 Ok, that runs the daemon... > I use Exim as MTA. Sounds like you may want to talk to Exim people. > transport_filter = /usr/bin/spamc -u > ${lookup{$domain

Re: salearn parsing error

> -BEGIN PGP SIGNED MESSAGE- > Hash: SHA1 > > Am Montag, 20. Dezember 2004 14:36 schrieb Rich: >> Nobody commented on the first mention of this so I'm repeating it: >> >> I move low-scoring but real spam to a folder and then run salearn on it. >> Some messages trigger the following error: >

Re: low scores?

Rich wrote: I have recently upgrades from 2.x to 3.0.1 and have been watching the scores for stuff that is real spam. I had a bunch of up-weighted scores in 2.x but I didn't move those over to the new version while I evaluated what the new version was doing. What I don't understand are what seem to

Re: salearn parsing error

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Am Montag, 20. Dezember 2004 14:36 schrieb Rich: > Nobody commented on the first mention of this so I'm repeating it: > > I move low-scoring but real spam to a folder and then run salearn on it. > Some messages trigger the following error: > > Parsing

RE: Interesting NW article

>-Original Message- >From: Carnegie, Martin [mailto:[EMAIL PROTECTED] >Sent: Monday, December 20, 2004 12:23 PM >To: users@spamassassin.apache.org >Subject: RE: Interesting NW article > > >Well, from our implementation I would say that this article is >junk. We >are running SA with pret

Bayes question

Lately I've been seeing lots of very similar spams get through my 2.6.3 I don't run autolearn, but I save my spam and ham daily, and run them through sa-learn -spam and -ham respectively. I'm puzzled why a spam I've manually learned via sa-learn keeps coming through. What can I check to ensure th

low scores?

I have recently upgrades from 2.x to 3.0.1 and have been watching the scores for stuff that is real spam. I had a bunch of up-weighted scores in 2.x but I didn't move those over to the new version while I evaluated what the new version was doing. What I don't understand are what seem to be extremel

Re: Interesting NW article

Kenneth Porter wrote: Also, SA is a component, not a complete solution. With 41 participants in the survey, it would be surprising not to find SA integrated into some of them. Perhaps some here can identify which products? In the article (http://www.nwfusion.com/reviews/2004/122004spamside2.html

Re: more spam gets through since SA 3.x -- Beg to differ

Hi Steve, Amavisd-new is leaving off some tests? I wonder if in this case the perl version is not so much about SA, but about amavisd-new. The amavisd-new web site recommends perl 5.8.2 or better. thanks, will check that! Florian

Re: Interesting NW article

I agree. After some minor issues SA works perfect for us. It runs perfect on a small PPro 200 machine, and gets almost 100 %. I have one or two spam mails getting through. I´m pretty happy with SA. Cheers, C-Store Hard- und Software GmbH Christoph Peter Düstere Straße 20 37073 Göttingen http://w

RE: Interesting NW article

Well, from our implementation I would say that this article is junk. We are running SA with pretty much default config and no Bayes and are getting about 97% with the only FPs being some mass mailings from vendors (MS Technet for example). If we looked at turning on Bayes then this product would

Re: Interesting NW article

--On Monday, December 20, 2004 11:29 AM -0500 Jerry Bell <[EMAIL PROTECTED]> wrote: They do talk favorably of spamassassin in a few parts, but overall they seemed to have missed the boat. From the article: The important core of SpamAssassin, a Bayesian engine, was recognizable in at least one-t

RE: AWL confusion

I agree it's a very misleading term. The easiest and most appropriate term I've heard is "historical averaging". -Original Message- From: Bill Landry [mailto:[EMAIL PROTECTED] Sent: Monday, December 20, 2004 7:51 AM To: users@spamassassin.apache.org Subject: Re: AWL c

Re: SpamAssassin doesn't parse any email

> On Mon, Dec 20, 2004 at 06:12:19PM +0200, Oleksandr Samoylyk wrote: >> [EMAIL PROTECTED] spamassassin]# /usr/bin/./spamassassin --lint >> [EMAIL PROTECTED] spamassassin]# >> >> Still it doesn't parse emails :(. >> What it can be? > What do you mean "doesn't parse emails"? It doesn't check emai

Re: Interesting NW article

In case anyone else is having problems as well here is the SA-related portion of the review. Tim Donahue Where's SpamAssassin? By Joel Snyder Network World, 12/20/04 "The short answer is that no one submitted it, but of course there's more to it than that. This year we reached out to the Spam

Re: Interesting NW article

On Mon, Dec 20, 2004 at 11:27:23AM -0500, Jim Maul wrote: > >Forbidden > >You don't have permission to access /reviews/2004/122004spamside6.html on > >this server. > > Works for me. Hrm. Apparently they're just blocking all of my employer's IPs. I can get to the page from my home machine, but b

Re: Interesting NW article

Theo Van Dinter wrote: Very much so: Forbidden You don't have permission to access /reviews/2004/122004spamside6.html on this server. Additionally, a 403 Forbidden error was encountered while trying to use an ErrorDocument to handle the request. ?? Works here... -- Regards,

Re: Interesting NW article

Very strange. The link still works for me and everyone I've asked to try it. Maybe they're doing some sort of server side blocking? Here's a snippet from the article: "The short answer is that no one submitted it, but of course there's more to it than that. This year we reached out to the SpamAs

Re: Interesting NW article

Theo Van Dinter wrote: On Mon, Dec 20, 2004 at 10:41:33AM -0500, Jerry Bell wrote: Here's a bit on spamassassin: http://www.nwfusion.com/reviews/2004/122004spamside6.html It's a pretty disappointing article. Very much so: Forbidden You don't have permission to access /reviews/2004/122004spamside6.

Re: SpamAssassin doesn't parse any email

On Mon, Dec 20, 2004 at 06:12:19PM +0200, Oleksandr Samoylyk wrote: > [EMAIL PROTECTED] spamassassin]# /usr/bin/./spamassassin --lint > [EMAIL PROTECTED] spamassassin]# > > Still it doesn't parse emails :(. > What it can be? What do you mean "doesn't parse emails"? How are you calling SpamAssass

Re: Interesting NW article

On Mon, Dec 20, 2004 at 10:41:33AM -0500, Jerry Bell wrote: > Here's a bit on spamassassin: > http://www.nwfusion.com/reviews/2004/122004spamside6.html > It's a pretty disappointing article. Very much so: Forbidden You don't have permission to access /reviews/2004/122004spamside6.html on this se

Re: SpamAssassin doesn't parse any email

Changed my local.cf to: required_score 5.0 rewrite_header Subject *SPAM* report_safe 1 lock_method flock [EMAIL PROTECTED] spamassassin]# /usr/bin/./spamassassin --lint [EMAIL PROTECTED] spamassassin]# Still it doesn't parse emails :(. What it can be? -- Oleksandr Samoylyk

Parsing of undecoded UTF-8

Hi, I'm running Mac OS 10.3.7. I had to make a clean install and therefore I also had to install SpamAssassin again. I was following the description given at . I used to run SpamAssassin 2.6x. Now, I have version 3.0.2. Everything seems to work, but sometim

Re: more spam gets through since SA 3.x -- Beg to differ

Thanks.. I think that's right Steve. I realized this last night while I was thinking about these comments. I had updated Amavis to the latest version as well... RO Steve Bondy wrote: Amavisd-new is leaving off some tests? I wonder if in this case the perl version is not so much about SA, but ab

Spam processing errors

I know I saw this in a previous thread, but for the life of me I can not find it. I saw some postings where people were reporting that SA was only processing every other e-mail, or not processing all e-mail. Was this the correct list, and if so, can someone point me to the problem and solution, A

Interesting NW article

There's a big review of anti-spam products at nw fusion here: http://www.nwfusion.com/reviews/2004/122004spampkg.html?ts Here's a bit on spamassassin: http://www.nwfusion.com/reviews/2004/122004spamside6.html It's a pretty disappointing article. Jerry http://www.syslog.org

RE: more spam gets through since SA 3.x -- Beg to differ

Amavisd-new is leaving off some tests? I wonder if in this case the perl version is not so much about SA, but about amavisd-new. The amavisd-new web site recommends perl 5.8.2 or better. Just a guess Steve > Hi Richard, > > > Perl 5.6.1 simply didn't work properly. It caused Amavis & SA to

Re: AWL confusion

- Original Message - From: "Rich" <[EMAIL PROTECTED]> > > On Sun, 19 Dec 2004 17:02:06 -0500, Rich <[EMAIL PROTECTED]> wrote: > >> So why on earth is a 17-score given to an address in an auto white-list? > >> Shouldn't an address get a negative score (or, at least, a neutral zero) > >> if

Spamcop reporting and insecure dependency

I recently upgraded a RedHat Enterprise Linux server to SA 3.0.1 (from, I think 2.64). Everything went well, but now when I use spamassassin -r, I get the following error: Insecure dependency in connect while running with -T switch at /usr/lib/perl5/5.8.0/i386-linux-thread-multi/IO/Socket.pm line

Re: No subject = not spam?

Michael Weber wrote: Should SA add a subject header if none exists and the message needs to be marked? Yes, it should. And in 3.0.2 it does. One of the things fixed in there. -- Regards, Marco.

No subject = not spam?

Here's a spam I got that was not flagged as spam. It looks like SA recognized it as spam, but because the headers had no subject field, the subject line markup never happened. Should SA add a subject header if none exists and the message needs to be marked? Merry Christmas! -Michael Return-p

salearn parsing error

Nobody commented on the first mention of this so I'm repeating it: I move low-scoring but real spam to a folder and then run salearn on it. Some messages trigger the following error: Parsing of undecoded UTF-8 will give garbage when decoding entities at /usr/local/lib/perl5/site_perl/5.8.6/Mail/S

Re: AWL confusion

> On Sun, 19 Dec 2004 17:02:06 -0500, Rich <[EMAIL PROTECTED]> wrote: >> So why on earth is a 17-score given to an address in an auto white-list? >> Shouldn't an address get a negative score (or, at least, a neutral zero) >> if it's in a WL? > > You may want to read up on the AWL in the WIKI - it e

Re: SA 3.0.2? Why no mail from announce@spamassassin.apache.org

On Sun, 2004-12-19 at 16:07 -0700, Alan Baxter wrote: > On Sun, 19 Dec 2004 13:52:31 +0100, "Maurice Lucas" <[EMAIL PROTECTED]> > wrote: > >By just checking the SA website I found out that there is a 3.0.2 release > >from 2004-12-16. > > > >Why isn't there an announce from the announce list? > >

Re: Running SA globally?

Terence Parker wrote: Thanks for that. I ran sa-learn using the amavis user and indeed, I now get much less spam than before. One thing I haven't done though is checked for false-positives on the server... that's just so much hassle (is there an easy way to do it?). Anyways, for now sa-learn se

Re: SA 3.0.2? Why no mail from announce@spamassassin.apache.org

You did indeed send an announcement to "announce", "dev", and "users". I received one copy, for the user's list. I'm not sure I am on the announce list, though. {^_^}

Re: Running SA globally?

Thanks for that. I ran sa-learn using the amavis user and indeed, I now get much less spam than before. One thing I haven't done though is checked for false-positives on the server... that's just so much hassle (is there an easy way to do it?). Anyways, for now sa-learn seems to have been very