Re: Perfect bayes filter ratio spam/ham

2005-08-27 Thread Matt Kettler
At 07:15 PM 8/27/2005, Torsten Bronger wrote: Which bayes filter ratio is better: 1:1 or the natural incoming ratio? 1:1 actualy. I was a strong proponent of natural, but Dan Q corrected me. After a lot of thinking about the statistics, it made sense.

Problems with SpamAssassin 3.1 RC1and MIMEDefang

2005-08-27 Thread John Rudd
This is a problem that some mimedefang people are experiencing with SA 3.1 rc1. (mimedefang slave processes are becoming un-killable due to a mis-feature in SA 3.1 which messes with SIGCHLD) Begin forwarded message: From: "David F. Skoll" <[EMAIL PROTECTED]> Date: August 27, 2005 6:01:28

Re: HELO_DYNAMIC_IPADDR - score too high?

2005-08-27 Thread wolfgang
In an older episode (Saturday, 27. August 2005 19:24), Robert Menschel wrote: > If you can send me the full email, with headers, so I can compose a > whitelist_from_rcvd rule for it, and if you are personally certain > they do not send spam from that From address, I'll add an entry for > them into

Perfect bayes filter ratio spam/ham

2005-08-27 Thread Torsten Bronger
Hallöchen! Which bayes filter ratio is better: 1:1 or the natural incoming ratio? Tschö, Torsten. -- Torsten Bronger, aquisgrana, europa vetusICQ 264-296-646

Re: sa-learn over already-scanned spam

2005-08-27 Thread Loren Wilton
> If I pass this directory to sa-learn, will sa-learn detect the SA > part and skip over it, or do I have to fear that the SA messages > skew my bayes data? Normally SA will do the right thing and recognize the markup. If this is from a really old version of SA and you are learning on a recent ve

sa-learn over already-scanned spam

2005-08-27 Thread Torsten Bronger
Hallöchen! I have a directory with my old spam. Most of it has been recognised by SA as such, so its body got replaced by an SA message with the original body moved to an attachment. If I pass this directory to sa-learn, will sa-learn detect the SA part and skip over it, or do I have to fear tha

Re: SURBL Redirection Problem

2005-08-27 Thread Daryl C. W. O'Shea
Craig McLean wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 3.1.0-rc1 nailed it to the wall. Craig. <...> domain | 4.5 URIBL_SC_SURBL Contains an URL listed in the SC SURBL blocklist | [URIs: moonboard.info] Did you detect that with a redirector

DNS cache size for moderatly busy sites?

2005-08-27 Thread email builder
Hello, We just migrated to Tinydns from BIND and are looking at our cache size (OK, so I am really talking about dnscache, not tinydns itself). Looking at our cache logs from the last 12 hours (2am Friday night to 2pm Saturday afternoon), I see our "cache motion" is already 75MB of data. Wow.

Re: SURBL Redirection Problem

2005-08-27 Thread Craig McLean
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 3.1.0-rc1 nailed it to the wall. Craig. Ilan Aisic wrote: | | pts rule name description | -- - -- | 0.9 RCVD_BY_IP Received by mail server with no na

Re: SURBL Redirection Problem

2005-08-27 Thread Loren Wilton
Perhaps changing the uri check would be a short-term fix. There is a redirector pattern detector in SA which would be the right thing to fix. Loren

Re: HELO_DYNAMIC_IPADDR - score too high?

2005-08-27 Thread Robert Menschel
Hello wolfgang, Saturday, August 27, 2005, 3:50:20 AM, you wrote: w> we received a Duden newsletter (duden is *the* spelling w> rules/grammar/dictionary publisher in germany) with the header: Wolfgang, If you can send me the full email, with headers, so I can compose a whitelist_from_rcvd rule

Re: How does SA detect non-english language?

2005-08-27 Thread Robert Menschel
Hello John, Friday, August 26, 2005, 6:25:14 AM, you wrote: JH> Hello, JH> We have had a complaint from a user that some of his Japanese mail JH> (being received by us) is always marked by SA as spam. As a University JH> it is natural for us to receive foreign mail messages. Understood. JH>

Re: HELO_DYNAMIC_IPADDR - score too high?

2005-08-27 Thread List Mail User
>Hi, > >we received a Duden newsletter (duden is *the* spelling >rules/grammar/dictionary publisher in germany) with the header: > >Received: from ds80-237-180-34.dedicated.hosteurope.de >(ds80-237-180-34.dedicated.hosteurope.de [80.237.180.34]) >by netra27.desy.de (DesyMail_In_27) with E

SURBL Redirection Problem

2005-08-27 Thread Ilan Aisic
This is a sniplet from spam content I got: http://chietaphi.com/catalog/redirect.php?action=url&goto=www.vxneev.moonboard.info/?100aa983aGd9080f4c0bfF3c1362f8e1";>Just VISlT EPharmaccy-By It did not trigger any of the URI rules even though moonboard.info is listed in all the places. They have exp

HELO_DYNAMIC_IPADDR - score too high?

2005-08-27 Thread wolfgang
Hi, we received a Duden newsletter (duden is *the* spelling rules/grammar/dictionary publisher in germany) with the header: Received: from ds80-237-180-34.dedicated.hosteurope.de (ds80-237-180-34.dedicated.hosteurope.de [80.237.180.34]) by netra27.desy.de (DesyMail_In_27) with ESMTP id

Re: Feature Request: dynamic trusted_networks

2005-08-27 Thread Thomas Hochstein
"jdow" schrieb: >> However, >> if a message came from a client who gave SMTP-AUTH, it ought to be >> "trusted" (and not subjected to the blacklist checks). > > Would you care to expound on your theory here. What makes you think > a valid SPF is a sign of a good guy? SMTP authentification has