Hi, all,
I wonder if the iXhash Plugin I did last summer would catch these.
FYI, the plugin uses some form(s) of fuzzy MD5 checksums of the complete
mail body (not seperate mime parts) and does compare the results with
those I provide via DNS.
It's available at http://wiki.apache.org/spamassas
I just committed version 01.00.12 of this ruleset to:
http://rulesemporium.com/rules/70_sare_stocks.cf
It should appear within the hour.
This new update includes better all gif stox detection.
Enjoy.
-Doc (SA/SARE/URIBL/SURBL -- Ninja)
Theo Van Dinter wrote:
On Tue, Mar 07, 2006 at 09:41:53PM -0500, Gabriel Wachman wrote:
The motivation for this is that I'm comparing a filter a colleague wrote
to various other filters (including SpamAssassin) and I want to make
sure that the summary I give of SpamAssassin in my paper is ac
On Tue, Mar 07, 2006 at 09:41:53PM -0500, Gabriel Wachman wrote:
> The motivation for this is that I'm comparing a filter a colleague wrote
> to various other filters (including SpamAssassin) and I want to make
> sure that the summary I give of SpamAssassin in my paper is accurate.
> Neural net
Theo Van Dinter wrote:
On Tue, Mar 07, 2006 at 08:44:59PM -0500, Gabriel M. Wachman wrote:
The perceptron (form of neural net used in SA 3.0.0 and higher) is used by the
developers to generate the scores prior to release. 99.9% of end-users do not
ever use the perceptron.
By "do not
On Tue, Mar 07, 2006 at 08:44:59PM -0500, Gabriel M. Wachman wrote:
> > The perceptron (form of neural net used in SA 3.0.0 and higher) is used by
> > the
> > developers to generate the scores prior to release. 99.9% of end-users do
> > not
> > ever use the perceptron.
> >
> By "do not use" do
Matt Kettler wrote:
> Gabriel M. Wachman wrote:
>> It says in the SpamAssassin FAQ that version 3.x uses a neural network
>> to learn scores of messages. Where is the state of this neural network
>> saved? In other words, how does SpamAssassin keep track of the neural
>> network from one invocation
On Tue, Mar 07, 2006 at 08:14:38PM -0500, Dan Mahoney, System Admin wrote:
> >=item languages_filename
> >
> >If you want to be able to use the language-guessing rule
> >C, and are using C instead of
> >C, C, and C, you
[...]
>
> I'm NOT using rules_text though, unless this is the default behavio
On Thu, 2 Mar 2006, Daryl C. W. O'Shea wrote:
Hmm, that's your bug:
http://issues.apache.org/SpamAssassin/show_bug.cgi?id=4803
From SpamAssassin.pm pod (I don't think anything else uses this config
option... it should probably be moved to the plugin):
=item languages_filename
If you want t
Gabriel M. Wachman wrote:
> It says in the SpamAssassin FAQ that version 3.x uses a neural network
> to learn scores of messages. Where is the state of this neural network
> saved? In other words, how does SpamAssassin keep track of the neural
> network from one invocation to another?
It doesn't k
It says in the SpamAssassin FAQ that version 3.x uses a neural network
to learn scores of messages. Where is the state of this neural network
saved? In other words, how does SpamAssassin keep track of the neural
network from one invocation to another?
On Thu, 2 Mar 2006, Daryl C. W. O'Shea wrote:
Daryl,
Still working on clearing the other issues. I'm using MOST of the plugins
that come with spamassassin, but no third party plugins -- there's some
third party RULESETS including rules du jour, chickenpox, etc -- but those
are all fairly str
Good evening, Jack, all,
On Tue, 7 Mar 2006, Jack Gostl wrote:
I've seen some references to this in threads, but I didn't see an
answer.
Starting in late November, we started getting hit with spam that was
almost entirely a jpeg. They seem to be mostly "stock recommendations".
There is mini
Craig Green wrote:
Scott Russell wrote:
Greets.
Running SA 3.1.0 with spamc/spamd on RHEL4 i386. I have the following
options for my spamd: -d --allow-tell --max-children=30
--min-children=10 --min-spare=3 --max-spare=6 -q -x -u spamd
Today I saw the following error in /var/log/maillog:
s
Greets.
Running SA 3.1.0 with spamc/spamd on RHEL4 i386. I have the following
options for my spamd: -d --allow-tell --max-children=30
--min-children=10 --min-spare=3 --max-spare=6 -q -x -u spamd
Today I saw the following error in /var/log/maillog:
spamd[23150]: prefork: ordered child to acce
On Mar 7, 2006, at 2:48 PM, Gary W. Smith wrote:I just manually ran the update and it went fine. Stop scarring me! J. seems that some time after 12:30 Eastern time it started to work again.
John,
I think the group is of the opinion that these commercial apps aren't
anything more than glorified SA installs with a huge price tag. Huge
being more than the cost of a good SA box plus your time...
We just recently upgraded our Dell 4600's to Dell 5150's (4 of them) for
under $3000. The
I just manually ran the update and it went
fine. Stop scarring me! J.
Gary Wayne smith
From: Vivek Khera
[mailto:[EMAIL PROTECTED]
Sent: Tuesday, March 07, 2006
11:28 AM
To: SpamAssassin Users
Subject: Re: Amavisd replacement
suggestion
On Mar 7, 2006, at
On Mar 7, 2006, at 12:35 PM, Gary W. Smith wrote:We use Vexira from centralcommand.com for our own company mail. It seems to work fairly well and isn’t that tricky to setup. We had a bear of a time getting amavisd working with postfix a couple years back so we decided to go commercial.heh... for
On Tue, Mar 07, 2006 at 02:02:28PM -0500, Harold Pritchett wrote:
> Outsource it! I'm sure that there are small business computer consultants
> in your area who could, for a one time fee, build the hardware, install
> the software, and do the initial configuration and testing.
Optionally, complet
Stewart, John wrote:
So I have to triage what I do. If we can spend way too much money on a
reasonable commercial product that we can slap onto our Exchange box, we'd
rather do that than have my time be tied up for a few weeks while I get a
new SA server built and tested.
Outsource it! I'm su
Use of mailscanner with postfix is unsupported by the author of postfix.
He (Mr. Venema) says that mailscanner mucks about in the internal queues of
postfix, and because of that doesn't play nice.
Some of the most knowledgable users on the postfix list, especially those
with very large installati
> -Original Message-
> From: Stewart, John [mailto:[EMAIL PROTECTED]
> Sent: Tuesday, March 07, 2006 12:36
> To: 'users@spamassassin.apache.org'
> Subject: RE: Commercial SA packages?
>
>
> John Stewart wrote:
> > > The fact is, I just don't have the time to give SA proper
> care and
>
John Stewart wrote:
> > The fact is, I just don't have the time to give SA proper
> > care and feeding.
> > I know there are some commercial anti-spam packages based on
> > SA. I'd like to
> > know if anyone has opinions on their effectiveness and admin
> > ease. We can
> > afford to shell
Title: RE: Commercial SA packages?
>
> We've been running SpamAssassin with amavisd-new for years...
> still on an
> old version, and been meaning to update for far too long.
>
> The fact is, I just don't have the time to give SA proper
> care and feeding.
>
> I know there are some comme
Shane,
We use Vexira from centralcommand.com for
our own company mail. It seems to work fairly well and isn’t that tricky
to setup. We had a bear of a time getting amavisd working with postfix a
couple years back so we decided to go commercial.
Gary Wayne Smith
From
On Tue, 2006-03-07 at 17:29 +0100, nick wrote:
> Michael W Cocke wrote:
> > On Tue, 7 Mar 2006 15:04:11 -, you wrote:
> >
> >
> >>Works fine with postfix...
> >>
> >>http://wiki.mailscanner.info/doku.php?id=documentation:configuration:mta:pos
> >>tfix:politics&s=politics
> >
> >
> >
> > Th
My recommendation is to take this approach Penalize emails with
inline gifs, and penalize them even more if they hit in combination with
HTML_IMAGE_ONLY_*.
meta __IMG_ONLY(HTML_IMAGE_ONLY_04 || HTML_IMAGE_ONLY_08 ||
HTML_IMAGE_ONLY_12 || HTML_IMAGE_ONLY_16 || HTML_IMAGE_ONLY_20
Quoting Martin Hepworth <[EMAIL PROTECTED]>:
> Jack
>
> If you turn on the URI-RBLs in 3.1 (see v310.pre) you should see a
> reduction
> in this type of spam.
I don't think I've ever seen a URI in one of these... They purposely leave
out anything in the actual message body that could be used t
I'm having similar results here. As others have mentioned, the SARE stock
rules do help somewhat, but it's by no means the proverbial "silver bullet".
As someone else also mentioned, it helps to increase the HTML_IMAGE_ONLY_XX
rules. I increased 12,16,20, and 24 by one point each. However, t
Daryl C. W. O'Shea writes:
> Justin Mason wrote:
> > Dan Mahoney, System Admin writes:
> >> And 4) This whenever it gets hung up (those __alarm__ things couldn't be
> >> more vague, could they?):
> >>
> >> Mar 2 12:53:07 quark spamd[94770]: __alarm__
> >> Mar 2 12:53:07 quark spamd[94770]: __al
Michael W Cocke wrote:
On Tue, 7 Mar 2006 15:04:11 -, you wrote:
Works fine with postfix...
http://wiki.mailscanner.info/doku.php?id=documentation:configuration:mta:pos
tfix:politics&s=politics
Thanks Martin - very interesting! When I first heard of mailscanner I
was very excited - I
On Tue, Mar 07, 2006 at 04:42:31PM +0100, Michael Monnerie wrote:
> Isn't PITA some sort of Greek bread? The one they use for Gyros, I
> believe. Wait, looking on wikipedia: http://en.wikipedia.org/wiki/Pita
> So why is it like Greek bread?
May be, amavisd is best if toasted (as I like pita==pide
Michael Monnerie wrote:
> On Dienstag, 7. März 2006 16:11 Craig White wrote:
> > personally found amavisd-new to be a PITA
>
> Isn't PITA some sort of Greek bread? The one they use for Gyros, I
> believe. Wait, looking on wikipedia: http://en.wikipedia.org/wiki/Pita
> So why is it like Greek brea
* Michael Monnerie <[EMAIL PROTECTED]>:
> On Dienstag, 7. März 2006 16:11 Craig White wrote:
> > personally found amavisd-new to be a PITA
>
> Isn't PITA some sort of Greek bread? The one they use for Gyros, I
> believe. Wait, looking on wikipedia: http://en.wikipedia.org/wiki/Pita
> So why is i
On Tue, 7 Mar 2006 15:04:11 -, you wrote:
>Works fine with postfix...
>
>http://wiki.mailscanner.info/doku.php?id=documentation:configuration:mta:pos
>tfix:politics&s=politics
Thanks Martin - very interesting! When I first heard of mailscanner I
was very excited - I've been using Amavisd-ne
On Dienstag, 7. März 2006 16:11 Craig White wrote:
> personally found amavisd-new to be a PITA
Isn't PITA some sort of Greek bread? The one they use for Gyros, I
believe. Wait, looking on wikipedia: http://en.wikipedia.org/wiki/Pita
So why is it like Greek bread?
mfg zmi
--
// Michael Monnerie
On Tue, 2006-03-07 at 09:57 -0500, Michael W Cocke wrote:
> On Tue, 7 Mar 2006 14:10:26 -, you wrote:
>
> >Shane
> >
> >Have a look at MailScanner as an alternative to amavisd - it's nice to have
> >a choice isn't it..
>
> My understanding is that mailscanner doesn't work safely with postfix.
Works fine with postfix...
http://wiki.mailscanner.info/doku.php?id=documentation:configuration:mta:pos
tfix:politics&s=politics
--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300
> -Original Message-
> From: Michael W Cocke [mailto:[EMAIL PROTECTED]
On Tue, 7 Mar 2006 14:10:26 -, you wrote:
>Shane
>
>Have a look at MailScanner as an alternative to amavisd - it's nice to have
>a choice isn't it..
My understanding is that mailscanner doesn't work safely with postfix.
(IIRC someone on this list told me that when I first encountered
mailscan
Yousef Raffah wrote:
> On Tue, 2006-03-07 at 02:34 -0800, Loren Wilton wrote:
> > X-Spam-Status: No, score=4.863 tagged_above=-100 required=6.3
> > tests=[BAYES_50=0.001, HTML_IMAGE_ONLY_12=1.867, HTML_MESSAGE=0.001,
> > HTML_SHORT_LINK_IMG_1=0.948, RCVD_IN_SORBS_DUL=2.046]
> >
> > > How can I inc
Shane
Have a look at MailScanner as an alternative to amavisd - it's nice to have
a choice isn't it..
--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300
> -Original Message-
> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
> Sent: 07 March 2006 13:
My experience of the SARE Stock rules to date hasn't
been good. They score way too low to kick stuff into the high score region
even with the help of Bayes.
What's probably needed is two sets of rules or scores
for the SARE Stock ruleset - one for investors/stockbrokers, another for those
We have been running Spamassassin for two years or
so now. Spamassassin has been great. We run Postfix, Amavisd
and Spamassassin. I really need some suggestions to replace
Amavisd. I have two problems with Amavisd that I cannot seem to fix.
Any recommendations on how to call Spamassassi
We jacked up the scoring on HTML_IMAGE_ONLY_12
to a 5, and are catching about 90% of these now with almost no false
positives.
"Jack Gostl"
<[EMAIL PROTECTED]>
03/07/2006 07:26 AM
To
cc
Subject
All image spam
I've seen some references to this in threads,
but I didn't see
On Tue, 2006-03-07 at 02:34 -0800, Loren Wilton wrote:
> X-Spam-Status: No, score=4.863 tagged_above=-100 required=6.3
> tests=[BAYES_50=0.001, HTML_IMAGE_ONLY_12=1.867, HTML_MESSAGE=0.001,
> HTML_SHORT_LINK_IMG_1=0.948, RCVD_IN_SORBS_DUL=2.046]
>
> > How can I increase the score of this message?
> Any suggestions?
The SARE stock rules. They won't catch all of 'em, but
they will catch a lot.
Loren
Jack
If you turn on the URI-RBLs in 3.1 (see v310.pre) you should see a reduction
in this type of spam.
--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300
> -Original Message-
> From: Jack Gostl [mailto:[EMAIL PROTECTED]
> Sent: 07 March 2006 11:55
>
I've seen some references to this in threads, but I
didn't see an answer.
Starting in late November, we started getting hit
with spam that was almost entirely a jpeg. They seem to be mostly "stock
recommendations". There is minimal message, usually HTML, and the real spam
content is in the
From: "Will Nordmeyer" <[EMAIL PROTECTED]>
I have bumped SpamAssassin 3.1.0 up to 10 clients (from 5) and added
round-robin to the startup routine. my daemon startup now looks like this:
daemon /home/spam-filter/bin/spamd -d -c -m 10 --round-robin
--socketpath=/home/spam-filter/tmp/spamd.soc
I have bumped SpamAssassin 3.1.0 up to 10 clients (from 5)
and added round-robin to the startup routine… my daemon startup now looks
like this:
daemon /home/spam-filter/bin/spamd -d -c -m 10
--round-robin --socketpath=/home/spam-filter/tmp/spamd.sock -H
/home/spam-filter/razor
But
X-Spam-Status: No, score=4.863 tagged_above=-100 required=6.3
tests=[BAYES_50=0.001, HTML_IMAGE_ONLY_12=1.867, HTML_MESSAGE=0.001,
HTML_SHORT_LINK_IMG_1=0.948, RCVD_IN_SORBS_DUL=2.046]
> How can I increase the score of this message?
1.Train Bayes. It doesn't know if this is ham or spam. You
Hi,
One of the spam messages I received in my inbox today hit the following
triggers:
X-Spam-Status: No, score=4.863 tagged_above=-100 required=6.3
tests=[BAYES_50=0.001, HTML_IMAGE_ONLY_12=1.867, HTML_MESSAGE=0.001,
HTML_SHORT_LINK_IMG_1=0.948, RCVD_IN_SORBS_DUL=2.046]
How can I increase the sc
I suggest you get in touch these hardworking fellows.
http://www.messagepartners.com
Patrick Sneyers
Belgium
http://www.messagepartners.com/http://www.messagepartners.com/http://
www.messagepartners.com/
Op 6-mrt-06, om 18:05 heeft Stewart, John het volgende geschreven:
We've been running
> I think you will have to ask the VHCS people. Their site is
> all in German; and, I don't speak German. So I could not
> glean anything from their site at all when I searched for
> SpamAssassin.
I had the same problem unfortunately, but thank you all for trying, it is
most appreciated.
--
Ja
> Another question: Is there any way to dump the rawtokens that sa learned
> from my corpus? I saw that there are only encoded strings.
Previously they were actual tokens and could be dumped. Now they are hashes
and can not be tracked back to the original tokens by any particularly easy
means.
Andrzej Adam Filip wrote:
> The perl script is available at:
> http://anfi.homeunix.net/perl/spamcop-ack.pl
> *It is first public Beta*
>
> It logs into spamcop.net account (via web) and makes spamcop send LARTs
> about all spam previously submitted via SMTP ("spamassassin -r").
>
> If you want t
57 matches
Mail list logo
