Re: URIBL_BLACK + OB_SURBL double-listed nonspam domain

2006-02-19 Thread List Mail User
>... >List Mail User wrote: >> Huh? (Lookup "strawman" in a dictionary, please.) >That's my understanding of what you were claiming happened. Yes, it >looks like an absurdly weak argument. However, it's the argument you >presented, as best I can make sense of your posts. > >Or are you admitting th

Re: Over-scoring of SURBL lists...

2006-02-19 Thread Jeff Chan
On Sunday, February 19, 2006, 8:07:30 PM, Theo Dinter wrote: > On Sun, Feb 19, 2006 at 07:19:28PM -0800, Jeff Chan wrote: >> > 37.539 42.4763 7.26260.854 0.380.00 URIBL_WS_SURBL >> >> Should the ham hit rate of WS really be 7%? That seems rather >> high. May we ask you to please d

Yup, I really believe this remove link will work!

2006-02-19 Thread Loren Wilton
If you wish to stop future mailings, or if you feel you have been wrongfully placed in our membership, send a blank e mail with No Thanks in the sub ject to [EMAIL PROTECTED] -- You can kinda tell the parts of the spam the spammers don't consider important... Loren

Re: URIBL_BLACK + OB_SURBL double-listed nonspam domain

2006-02-19 Thread Matt Kettler
List Mail User wrote: > Huh? (Lookup "strawman" in a dictionary, please.) That's my understanding of what you were claiming happened. Yes, it looks like an absurdly weak argument. However, it's the argument you presented, as best I can make sense of your posts. Or are you admitting that you made

Re: procmail error or mine?

2006-02-19 Thread Gene Heskett
On Sunday 19 February 2006 19:03, jdow wrote: >From: "Gene Heskett" <[EMAIL PROTECTED]> > >> On Sunday 19 February 2006 03:45, jdow wrote: >>>From: "Gene Heskett" <[EMAIL PROTECTED]> >>> >===8<--- >PROCMAILMATCH="X-Procmail: Matched on" >PROCMAILHEADER="X-Procmail: " > >:0 fw >>

Re: URIBL_BLACK + OB_SURBL double-listed nonspam domain

2006-02-19 Thread List Mail User
>... >List Mail User wrote: > >> Paul.. None of those pages contain a link. The user would have to >> >copy-paste or hand-type the url. That would defeat any referrer mechanism. >> >> >> Also, whether cut&paste generates a referral all depends on your >> browser and the setting used in some

Re: Over-scoring of SURBL lists...

2006-02-19 Thread Theo Van Dinter
On Sun, Feb 19, 2006 at 07:19:28PM -0800, Jeff Chan wrote: > > 37.539 42.4763 7.26260.854 0.380.00 URIBL_WS_SURBL > > Should the ham hit rate of WS really be 7%? That seems rather > high. May we ask you to please double check that result? I was waiting for someone to ask me about

Re: Over-scoring of SURBL lists...

2006-02-19 Thread jdow
From: "Jeff Chan" <[EMAIL PROTECTED]> On Thursday, February 16, 2006, 9:07:48 PM, Theo Dinter wrote: I was going to tell you that the stats were real-time, but that's only true for the SURBL rules. URIBL hits aren't being reused during the weekly runs since 3.1 doesn't have those rules. So

RE: Exiscan + subject rewrite not working

2006-02-19 Thread Terry Miller
You're right. You have to set a system filter, documentation is a little sparse on that. This link was helpful http://ws.edu.isoc.org/workshops/2004/CEDIA/presentaciones/bc/correo/exim/Ex imPrac.html It works now, thanks for the reply. -Original Message- From: Tony Finch [mailto:[EMA

Re: Over-scoring of SURBL lists...

2006-02-19 Thread jdow
From: "Matt Kettler" <[EMAIL PROTECTED]> jdow wrote: This is a potential if a list will add a site on the basis of ONE spam report. When it takes ten or twenty or more spam reports then sites will get listed. Your Scotts example is an example of how a large number of people would be likely to

Re: Question on long scan times - 4500 seconds with a blip at 300.

2006-02-19 Thread Gary V
From: "Andrew Donkin" <[EMAIL PROTECTED]> This is a tally of SA scan times at my site from January 14th, rounded down to the nearest 100 seconds, ignoring those below 1000 seconds: 1000 30 1100 41 1200 14 1300 5 3000 3 3100 35 3200 11 4400 1 4500 3 Those are combined figures from two load-balan

Re: Over-scoring of SURBL lists...

2006-02-19 Thread Jeff Chan
On Thursday, February 16, 2006, 9:07:48 PM, Theo Dinter wrote: > I was going to tell you that the stats were real-time, but that's only > true for the SURBL rules. URIBL hits aren't being reused during the > weekly runs since 3.1 doesn't have those rules. > So I did a small tweek and generated my

Re: Over-scoring of SURBL lists...

2006-02-19 Thread Matt Kettler
jdow wrote: > > This is a potential if a list will add a site on the basis of ONE > spam report. When it takes ten or twenty or more spam reports then > sites will get listed. Your Scotts example is an example of how a > large number of people would be likely to consider it to be spam > and complai

Re: Over-scoring of SURBL lists...

2006-02-19 Thread jdow
From: "Matt Kettler" <[EMAIL PROTECTED]> Theo Van Dinter wrote: On Sun, Feb 19, 2006 at 02:20:05AM -0500, Matt Kettler wrote: How can we keep the spam tagged, and try to mitigate the FPs by keeping additive scores for multiple URIBLs more moderate? +20 worth of URIBL hits is fine on spam, but

Re: URIBL_BLACK + OB_SURBL double-listed nonspam domain

2006-02-19 Thread jdow
From: "Matt Kettler" <[EMAIL PROTECTED]> List Mail User wrote: Paul.. None of those pages contain a link. The user would have to >copy-paste or hand-type the url. That would defeat any referrer mechanism. Also, whether cut&paste generates a referral all depends on your browser and the settin

Re: Over-scoring of SURBL lists...

2006-02-19 Thread Matt Kettler
Theo Van Dinter wrote: > On Sun, Feb 19, 2006 at 02:20:05AM -0500, Matt Kettler wrote: > How can we keep the spam tagged, and try to mitigate the FPs by keeping additive scores for multiple URIBLs more moderate? +20 worth of URIBL hits is fine on spam, but astronomically high scor

Re: URIBL_BLACK + OB_SURBL double-listed nonspam domain

2006-02-19 Thread Matt Kettler
List Mail User wrote: > Paul.. None of those pages contain a link. The user would have to > >copy-paste or hand-type the url. That would defeat any referrer mechanism. > > > Also, whether cut&paste generates a referral all depends on your > browser and the setting used in some (e.g. Opera

Re: Question on long scan times - 4500 seconds with a blip at 300.

2006-02-19 Thread jdow
From: "Andrew Donkin" <[EMAIL PROTECTED]> Kevin Gagel: I'm finding that scans are taking as long as 798 seconds Daryl O'Shea: Scan times of 798 seconds are probably a result of a bayes expiry. If auto expiry is enabled (default) I'd disable it and run a manually expiry as a cron job. Th

Re: procmail error or mine?

2006-02-19 Thread jdow
From: "Gene Heskett" <[EMAIL PROTECTED]> On Sunday 19 February 2006 03:45, jdow wrote: From: "Gene Heskett" <[EMAIL PROTECTED]> ===8<--- PROCMAILMATCH="X-Procmail: Matched on" PROCMAILHEADER="X-Procmail: " :0 fw * ^List-Id: .*(spamassassin\.apache.\org) | formail -A "$PROCMAILHEADER an SA

ApacheCon EU 2006 (fwd)

2006-02-19 Thread jm
I will, of course, be there ;) --j. --- Forwarded Message Date:Fri, 17 Feb 2006 15:29:10 -0500 From:Rich Bowen <[EMAIL PROTECTED]> To: [EMAIL PROTECTED] Subject: ApacheCon EU 2006 The ApacheCon Planners are pleased to announce that ApacheCon Europe 2006 will be held in Dublin,

Re: Over-scoring of SURBL lists...

2006-02-19 Thread Raymond Dijkxhoorn
Hi! And again, it's not the over-lap in-and-of-itself that's a problem. It's when the overlap matches nonspam that problems occur. I don't have any nonspam samples onhand with surbl overlap. Only surbl/uribl overlap. We get reports allmost daily, most of them are only listed in one single lis

Re: Question on long scan times - 4500 seconds with a blip at 300.

2006-02-19 Thread Andrew Donkin
Kevin Gagel: >> I'm finding that scans are taking as long as 798 seconds Daryl O'Shea: > Scan times of 798 seconds are probably a result of a bayes expiry. If > auto expiry is enabled (default) I'd disable it and run a manually > expiry as a cron job. This is a tally of SA scan times at my si

Re: getmail?

2006-02-19 Thread Nix
On Thu, 09 Feb 2006, Gene Heskett spake: >>From re-reading a 'man fetchmail' I don't see the fileing ability. It > only presents it to localhost:25 and apparently sendmail takes it from > there. The comm thru port 25 is apparently bilateral as it can be told ?! Definitely not. > to summarily

Re: Exiscan + subject rewrite not working

2006-02-19 Thread Tony Finch
On Sun, 19 Feb 2006, Terry Miller wrote: > I looked this up and can't see where I'm doing anything wrong, but the > subject is not being rewritten. You should probably ask this question on the exim-users list. I suspect (but I am not certain) that exiscan doesn't support the message rewrite parts

Re: A Spam Message That Got Through!

2006-02-19 Thread mouss
Yousef Raffah a écrit : > Received: from emailmarketingmasters.com (i538754C0.versanet.de > [83.135.84.192]) by kansai.savoladns.com (Postfix) with SMTP id > 7B42810073 for <[EMAIL PROTECTED]>; Fri, 17 Feb 2006 18:43:21 +0300 (AST) you could - use njabl's dynablock to block the client (83.135.84.1

Re: A Spam Message That Got Through!

2006-02-19 Thread mouss
Evan Platt a écrit : > At 10:48 PM 2/17/2006, you wrote: > >> Today I got a spam message which seems, at least for a newbie like me, >> succeeded in passing SA for some reason! >> >> I'm calling SA through amavisd-new and have my Rules Du Jour updated >> (manual updates so far) >> >> I would like

Re: procmail error or mine?

2006-02-19 Thread Gene Heskett
On Sunday 19 February 2006 03:45, jdow wrote: >From: "Gene Heskett" <[EMAIL PROTECTED]> > >>>===8<--- >>>PROCMAILMATCH="X-Procmail: Matched on" >>>PROCMAILHEADER="X-Procmail: " >>> >>>:0 fw >>> >>>* ^List-Id: .*(spamassassin\.apache.\org) >>> >>>| formail -A "$PROCMAILHEADER an SA list. Mail not pr

Updated Pump and Dump rules. 2006-02-18

2006-02-19 Thread Doc Schneider
I just committed version 01.00.06 of this ruleset to: http://rulesemporium.com/rules/70_sare_stocks.cf It should appear within the hour. Enjoy. -Doc (SA/SARE/URIBL/SURBL -- Ninja)

Re: Over-scoring of SURBL lists...

2006-02-19 Thread Raymond Dijkxhoorn
Hi! Yes, but the frequency of overlap in nonspam that I'm seeing at my site is disturbing. I've posted examples of this, and they keep getting ignored. You posted overlap in URIBL and SURBL, thats the same as posting overlap inside Spamcop and Spamhaus... This IS a real problem. I am not s

Exiscan + subject rewrite not working

2006-02-19 Thread Terry Miller
I looked this up and can't see where I'm doing anything wrong, but the subject is not being rewritten. Some relevant data: /etc/mail/spamassassin/local.cf # How many hits before a message is considered spam. required_score 3.0 # Change the subject of suspected spam rewrite_header Subject *S

Re: URIBL_BLACK + OB_SURBL double-listed nonspam domain

2006-02-19 Thread List Mail User
>... > Matt, >> In each case, normal HTML gives a "referrer" page, so no affiliate >> ID is needed. > >Paul.. None of those pages contain a link. The user would have to >copy-paste or hand-type the url. That would defeat any referrer mechanism. Also, whether cut&paste genera

Re: Over-scoring of SURBL lists...

2006-02-19 Thread Theo Van Dinter
On Sun, Feb 19, 2006 at 02:20:05AM -0500, Matt Kettler wrote: > >> How can we keep the spam tagged, and try to mitigate the FPs by keeping > >> additive scores for multiple URIBLs more moderate? +20 worth of URIBL > >> hits is fine on spam, but astronomically high scores don't really help > >> SA w

Re: URIBL_BLACK + OB_SURBL double-listed nonspam domain

2006-02-19 Thread Matt Kettler
List Mail User wrote: >> > In each case, normal HTML gives a "referrer" page, so no affiliate > ID is needed. Paul.. None of those pages contain a link. The user would have to copy-paste or hand-type the url. That would defeat any referrer mechanism. (more extensive commentary directe

Re: URIBL_BLACK + OB_SURBL double-listed nonspam domain

2006-02-19 Thread jdow
From: "List Mail User" <[EMAIL PROTECTED]> >List Mail User wrote: winterizewithscotts.com Scott's lawncare registered user updates. Matt, winterizewithscotts.com looks like a case of "affiliate" spamming or misuse of "sweepstakes" entries. See: http://forums.gottadeal.com/archive/index.php

Re: URIBL_BLACK + OB_SURBL double-listed nonspam domain

2006-02-19 Thread List Mail User
>List Mail User wrote: >>> winterizewithscotts.com >>> >>> Scott's lawncare registered user updates. >>> >>> >> Matt, >> >> winterizewithscotts.com looks like a case of "affiliate" spamming or >> misuse of "sweepstakes" entries. >> See: >> http://forums.gottadeal.com/archive/index.p

Re: URIBL_BLACK + OB_SURBL double-listed nonspam domain

2006-02-19 Thread jdow
From: "Matt Kettler" <[EMAIL PROTECTED]> I'm thinking of something like: score URIBL_SURBL 2.0 score URIBL_AB_SURBL 1.812 score URIBL_JP_SURBL 2.087 score URIBL_OB_SURBL 1.008 score URIBL_PH_SURBL 0.800 score URIBL_SC_SURBL 2.498 score URIBL_WS_SURBL 0.140 Whereas I am thinking of increas

Re: procmail error or mine?

2006-02-19 Thread jdow
From: "Gene Heskett" <[EMAIL PROTECTED]> ===8<--- PROCMAILMATCH="X-Procmail: Matched on" PROCMAILHEADER="X-Procmail: " :0 fw * ^List-Id: .*(spamassassin\.apache.\org) | formail -A "$PROCMAILHEADER an SA list. Mail not processed." | :0 fw * ^TO_:.*([EMAIL PROTECTED]|users\.spamassassin\.apach