Re: Rule for OpenPGP-signed mail

2006-04-05 Thread Michael Monnerie
On Mittwoch, 5. April 2006 22:25 Tristan Miller wrote: > Anyone care to discuss?  Has anyone else prepared some SA rulesets > which implement any of the above checks? Sounds very good, I love to sign e-mails, even when most receivers can't check (is there some plugin for Outlook easy and free?).

Re: Moving bayes from bdb to MySQL

2006-04-05 Thread Lars Ringh
Michael Monnerie wrote: On Montag, 3. April 2006 14:34 Lars Ringh wrote: Now, since in each case the source data can come from two different servers scanning the same kind of mails, should I try to merge the bayes-data from servers home1 and home2 into the the same myqsl-db and then merge the d

RE: Postfix/SpamAssassin Integration

2006-04-05 Thread Gary W. Smith
James, Timeout is 600 seconds. If spamd doesn't have respond in that amount of time them there is something else is wrong. I suppose that if all of the spamd threads are clogged then you might find a waiting list but 600 seconds is a lifetime. We had a misconfigured DNS once that slowed all th

Re: Postfix/SpamAssassin Integration

2006-04-05 Thread James Keating
[EMAIL PROTECTED] wrote: Is this a high volume mail server? Yes it is rather high volume server, I don't have any estimates on # of messages. Something like this should do the trick (this is off the cuff, and just a reference, you will have to modify for your exact setup). master.cf spam

Re: Postfix/SpamAssassin Integration

2006-04-05 Thread mostlyharmless
James Keating wrote: Dear Sirs/Madams, I have been attempting to properly integrate SpamAssassin into Postfix and have not found the solution that I am looking for. Currently I have Spamassassin running as a daemon (spamd, version 3.1.0a-2) which uses MySQL to store Bayes, AWL, user prefer

Re: Ok, I'm stumped...

2006-04-05 Thread Matt Kettler
Philip Prindeville wrote: > Matt Kettler wrote: > >> Philip Prindeville wrote: >> >> >>> Matt Kettler wrote: >>> >>> >>> Philip Prindeville wrote: > Matt Kettler wrote: > > > > >> Perhaps you want somethin

Postfix/SpamAssassin Integration

2006-04-05 Thread James Keating
Dear Sirs/Madams, I have been attempting to properly integrate SpamAssassin into Postfix and have not found the solution that I am looking for. Currently I have Spamassassin running as a daemon (spamd, version 3.1.0a-2) which uses MySQL to store Bayes, AWL, user preferences and stats. Postf

Re: Ok, I'm stumped...

2006-04-05 Thread Philip Prindeville
Matt Kettler wrote: >Philip Prindeville wrote: > > >>Matt Kettler wrote: >> >> >> >>>Philip Prindeville wrote: >>> >>> >>> >>> Matt Kettler wrote: >>> >>> >>> >>> >Perhaps you want something more like: > >header L_INCOMPETENT

Re: Ok, I'm stumped...

2006-04-05 Thread Matt Kettler
[EMAIL PROTECTED] wrote: > Philip Prindeville wrote: >>> header L_INCOMPETENT1ALL =~ /\\r\\n/ >>> >>> header L_INCOMPETENT2ALL =~ /\\r\\n\s?$/ >>> >>> header L_INCOMPETENT3ALL =~ /\\r\\n\s?\n/ >> Ok, I tried #3 and it worked, as you said... But leaving the \s? >

RE: Ok, I'm stumped...

2006-04-05 Thread Matthew.van.Eerde
Philip Prindeville wrote: >> header L_INCOMPETENT1ALL =~ /\\r\\n/ >> >> header L_INCOMPETENT2ALL =~ /\\r\\n\s?$/ >> >> header L_INCOMPETENT3ALL =~ /\\r\\n\s?\n/ > > Ok, I tried #3 and it worked, as you said... But leaving the \s? > didn't. > > I'm confused.

Re: Ok, I'm stumped...

2006-04-05 Thread Matt Kettler
Philip Prindeville wrote: > Matt Kettler wrote: > >> Philip Prindeville wrote: >> >> >>> Matt Kettler wrote: >>> >>> >> >> Perhaps you want something more like: header L_INCOMPETENTALL =~ /\\r\\n\s?$/ >> Scratch my last email. $ doesn't work with

Re: Ok, I'm stumped...

2006-04-05 Thread Philip Prindeville
Matt Kettler wrote: >Philip Prindeville wrote: > > >>Matt Kettler wrote: >> >> > > > >>>Perhaps you want something more like: >>> >>>header L_INCOMPETENTALL =~ /\\r\\n\s?$/ >>> >>> > >Scratch my last email. $ doesn't work with ALL. > >I just tested 3 variants: > >header L

Re: spamassassin thinks i'm a spammer

2006-04-05 Thread Theo Van Dinter
On Wed, Apr 05, 2006 at 02:58:19PM -0700, Alex wrote: > is there a way to check if my own email address somehow got onto a blacklist? I don't know of any "email address" blacklists, other than people's personal ones. > an email I sent to myself comes up with > > 0.5 RAZOR2_CHECK Listed

spamassassin thinks i'm a spammer

2006-04-05 Thread Alex
hi, is there a way to check if my own email address somehow got onto a blacklist? an email I sent to myself comes up with 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% [cf: 100] 3

Re: Ok, I'm stumped...

2006-04-05 Thread Matt Kettler
Philip Prindeville wrote: > Matt Kettler wrote: >> Perhaps you want something more like: >> >> header L_INCOMPETENTALL =~ /\\r\\n\s?$/ Scratch my last email. $ doesn't work with ALL. I just tested 3 variants: header L_INCOMPETENT1ALL =~ /\\r\\n/ header L_INCOMPETENT2

Re: Ok, I'm stumped...

2006-04-05 Thread Matt Kettler
Philip Prindeville wrote: > Matt Kettler wrote: >> Perhaps you want something more like: >> >> header L_INCOMPETENTALL =~ /\\r\\n\s?$/ >> >> The $ forces end-of-line match, and the \s? allows any single whitespace to >> be >> inserted before the actual EOL. >> >> >> >> > > I know t

Re: Ok, I'm stumped...

2006-04-05 Thread Philip Prindeville
Matt Kettler wrote: >Philip Prindeville wrote: > > >>Theo Van Dinter wrote: >> >> >> >>>The malformed content-type header caused this. The MIME part isn't >>>"text/html", it's "text/htmlcontent-transfer-encoding8bitrn". So the best >>>that can happen is URLs are parsed out of the text. >>>

Rule for OpenPGP-signed mail

2006-04-05 Thread Tristan Miller
Greetings. Has anyone considered the utility of having SpamAssassin score based partly on the presence and validity of an OpenPGP signature, and on the trust of the OpenPGP key? Here are some ideas: 1) So far I've never received any spam which has been digitally signed; on the other hand, I do r

Re: Ok, I'm stumped...

2006-04-05 Thread Matt Kettler
Philip Prindeville wrote: > Theo Van Dinter wrote: > >> The malformed content-type header caused this. The MIME part isn't >> "text/html", it's "text/htmlcontent-transfer-encoding8bitrn". So the best >> that can happen is URLs are parsed out of the text. >> >> > > Ok, we'll here's a new rule:

Re: Ok, I'm stumped...

2006-04-05 Thread Philip Prindeville
Philip Prindeville wrote: >Theo Van Dinter wrote: > > > >>The malformed content-type header caused this. The MIME part isn't >>"text/html", it's "text/htmlcontent-transfer-encoding8bitrn". So the best >>that can happen is URLs are parsed out of the text. >> >> >> >> > >Ok, we'll here's a

Re: Ok, I'm stumped...

2006-04-05 Thread Philip Prindeville
Theo Van Dinter wrote: >The malformed content-type header caused this. The MIME part isn't >"text/html", it's "text/htmlcontent-transfer-encoding8bitrn". So the best >that can happen is URLs are parsed out of the text. > > Ok, we'll here's a new rule: # incompetent spamware programmers... he

Re: Ok, I'm stumped...

2006-04-05 Thread Kelson
Philip Prindeville wrote: Doesn't RFC-822 require that the addresses be bracketed? Or is that only when a comment string is present? Only when there's a comment. -- Kelson Vibber SpeedGate Communications

Re: Ok, I'm stumped...

2006-04-05 Thread Matt Kettler
Philip Prindeville wrote: > Theo Van Dinter wrote: > >>> Well, for a start, normally the X-Spam-* stuff gets inserted at the very >>> >>> end of the header block, but what I'm seeing instead is: >>> >>> >> You're running 3.1 which puts them at the top of the headers. It was in the >> 3.1.0 re

Re: Ok, I'm stumped...

2006-04-05 Thread Kelson
Philip Prindeville wrote: things would be a little clearer if there was a consistent place that the X-Spam-*: stuff got inserted at... It seems to move around. IIRC this is the first time it's moved in the lifetime of the product, but perhaps I've forgotten another occasion... -- Kelson Vib

Re: Ok, I'm stumped...

2006-04-05 Thread Philip Prindeville
Theo Van Dinter wrote: >> Well, for a start, normally the X-Spam-* stuff gets inserted at the very >> >>end of the header block, but what I'm seeing instead is: >> >> > >You're running 3.1 which puts them at the top of the headers. It was in the >3.1.0 release announcement: > >- modify header

Re: Ok, I'm stumped...

2006-04-05 Thread Theo Van Dinter
On Wed, Apr 05, 2006 at 01:46:08PM -0600, Philip Prindeville wrote: > >What gives you that idea? The debug output clearly shows the received > >headers > >being parsed, the mime parser finds the message part (malformed content-type > >and all), URIs are parsed out of the message, etc. > > Well,

Re: Ok, I'm stumped...

2006-04-05 Thread Daryl C. W. O'Shea
Matt Kettler wrote: Philip Prindeville wrote: What gives you that idea? The debug output clearly shows the received headers being parsed, the mime parser finds the message part (malformed content-type and all), URIs are parsed out of the message, etc. Well, for a start, normally the X-Spam-

RE: Ok, I'm stumped...

2006-04-05 Thread Matthew.van.Eerde
Matt Kettler wrote: > Erm.. When do you see SA inserting X-Spam-* at the END of the header > block??? SA doesn't (anymore.) MIMEDefang does, when using action_add_header, which calls libmilter's smfi_addheader function. Recent versions of MIMEDefang have action_insert_header, which can be use

Re: Ok, I'm stumped...

2006-04-05 Thread Matt Kettler
Philip Prindeville wrote: > >>> >> What gives you that idea? The debug output clearly shows the received >> headers >> being parsed, the mime parser finds the message part (malformed content-type >> and all), URIs are parsed out of the message, etc. >> >> > > Well, for a start, normally the X

Re: Ok, I'm stumped...

2006-04-05 Thread Matt Kettler
Philip Prindeville wrote: > The following message got through and I couldn't figure out why: > > ftp://ftp.redfish-solutions.com/pub/paypal4.eml > > so I ran: > > spamassassing -x -LD > > on it and saved the output into: > > ftp://ftp.redfish-solutions.com/pub/paypal4.log > > what's odd is th

Re: Ok, I'm stumped...

2006-04-05 Thread Philip Prindeville
Theo Van Dinter wrote: >On Wed, Apr 05, 2006 at 01:30:20PM -0600, Philip Prindeville wrote: > > >>The following message got through and I couldn't figure out why: >> >>ftp://ftp.redfish-solutions.com/pub/paypal4.eml >> >> > >The first problem is that the headers are a bit malformed: > >MIME-

Re: Ok, I'm stumped...

2006-04-05 Thread Theo Van Dinter
On Wed, Apr 05, 2006 at 01:30:20PM -0600, Philip Prindeville wrote: > The following message got through and I couldn't figure out why: > > ftp://ftp.redfish-solutions.com/pub/paypal4.eml The first problem is that the headers are a bit malformed: MIME-Version: 1.0 Content-Type: text/html\r\n Con

Ok, I'm stumped...

2006-04-05 Thread Philip Prindeville
The following message got through and I couldn't figure out why: ftp://ftp.redfish-solutions.com/pub/paypal4.eml so I ran: spamassassing -x -LD on it and saved the output into: ftp://ftp.redfish-solutions.com/pub/paypal4.log what's odd is that it reads the first line (the Return-Path:) line a

Re: Idea for new SA Rule

2006-04-05 Thread Daryl C. W. O'Shea
Philip Prindeville wrote: litre, and if I'm feeling really silly, aluminium (I hate that word). Aluminium rocks! Especially aluminium foil and aluminium airplanes.

Re: include not working as expected

2006-04-05 Thread Aaron Grewell
> Ah, that's it. According to file(1) the thing ended up in UTF-8. That's a > side effect of my spreadsheet addiction, I was using OpenOffice Calc (on > Linux) to edit the file. I found a program that will do the conversion to > ASCII, so this should be pretty easy to fix once I get that built.

Re: include not working as expected

2006-04-05 Thread Matt Kettler
Aaron Grewell wrote: > On Wednesday 05 April 2006 11:38, Matt Kettler wrote: >> Sounds like you've got something other than spaces/tabs on that line (ie: >> unprintable escape codes), or the file was created on a windows machine >> with windows end-of-line format but is being read by a *nix machine

Re: Idea for new SA Rule

2006-04-05 Thread mouss
Matt Kettler wrote: Of course you could train your spell checker to your companies local mail words.. however, at that point you've implemented a low-quality version of a bayes checker. and he can just use a bayesian classifier to implement his "feature". training is easy: - ham = all words

Re: include not working as expected

2006-04-05 Thread Aaron Grewell
On Wednesday 05 April 2006 11:38, Matt Kettler wrote: > > Sounds like you've got something other than spaces/tabs on that line (ie: > unprintable escape codes), or the file was created on a windows machine > with windows end-of-line format but is being read by a *nix machine. Ah, that's it. Accor

Re: Idea for new SA Rule

2006-04-05 Thread Philip Prindeville
Daryl C. W. O'Shea wrote: >Gustafson, Tim wrote: > > > >>>3) FPs on email sent by lazy/stupid folks that can't spell. >>>(Translation: management material) >>> >>> >>I don't mind these getting blocked. In fact, I'd love it if every time >>someone sent me a very poorly written e-mail they

Re: Idea for new SA Rule

2006-04-05 Thread Philip Prindeville
Matt Kettler wrote: >Gustafson, Tim wrote: > > >>Hello >> >>One thing I've noticed about almost ALL spam that gets through at this >>point is that they have a LOT of misspelled (and obfuscated) words. >> >>Could SpamAssassin benefit from a filter that would actually check the >>spelling of the t

Re: include not working as expected

2006-04-05 Thread Matt Kettler
Aaron Grewell wrote: >> Using include completely redundant at the local.cf level, as SA >> automatically parses /etc/mail/spamassassin/*.cf. Rather than use >> custom_scores.txt, just use custom_scores.cf and put it alongside local.cf. > > That's what I tried first, and got the same errors. So I

Re: include not working as expected

2006-04-05 Thread Aaron Grewell
> Using include completely redundant at the local.cf level, as SA > automatically parses /etc/mail/spamassassin/*.cf. Rather than use > custom_scores.txt, just use custom_scores.cf and put it alongside local.cf. That's what I tried first, and got the same errors. So I thought that maybe I was su

Re: include not working as expected

2006-04-05 Thread Theo Van Dinter
On Wed, Apr 05, 2006 at 10:59:13AM -0700, Aaron Grewell wrote: > I removed my score changes from > local.cf and put them in a separate file called custom_scores.txt, then put > include custom_scores.txt in local.cf. Now SA will no longer lint my config > properly, and fails on each score line t

Re: include not working as expected

2006-04-05 Thread Matt Kettler
Aaron Grewell wrote: > Hi all, > I'm using SA 3.0.4, and I wanted to keep my score modifications in a separate > file from the rest of my configuration. I removed my score changes from > local.cf and put them in a separate file called custom_scores.txt, then put > include custom_scores.txt in l

Re: Idea for new SA Rule

2006-04-05 Thread Kelson
Magnus Holmgren wrote: Also, the rule probably wouldn't detect misuses of "then" in place of "than". May bee yore you sirs half goad spelling, oar naught. Orphan, there justice likely two right pore lee. Eye no this is write cause Thunderbird excepts it. They're are know read lines hear.

Re: include not working as expected

2006-04-05 Thread Jim Maul
Aaron Grewell wrote: Hi all, I'm using SA 3.0.4, and I wanted to keep my score modifications in a separate file from the rest of my configuration. I removed my score changes from local.cf and put them in a separate file called custom_scores.txt, then put include custom_scores.txt in local.cf.

include not working as expected

2006-04-05 Thread Aaron Grewell
Hi all, I'm using SA 3.0.4, and I wanted to keep my score modifications in a separate file from the rest of my configuration. I removed my score changes from local.cf and put them in a separate file called custom_scores.txt, then put include custom_scores.txt in local.cf. Now SA will no longer

Re: UNSUBSCRIBE

2006-04-05 Thread Evan Platt
On Wed, April 5, 2006 10:53 am, Jim Zimmerman wrote: > UNSUBSCRIBE As I'm sure this isn't the first list you'll want to unsubscribe from, nor will it be the last, there's a general rule for lists: You don't send UNSUBSCRIBE commands to the 'list'. There's generally a specific address to send them

UNSUBSCRIBE

2006-04-05 Thread Jim Zimmerman
UNSUBSCRIBE -Original Message- From: Philip Prindeville [mailto:[EMAIL PROTECTED] Sent: Wednesday, April 05, 2006 10:52 AM To: users@spamassassin.apache.org Subject: Re: Filtering based on the recipients Philip Prindeville wrote: >Matt Kettler wrote: > > > >>[EMAIL PROTECTED] wrote: >

Re: Filtering based on the recipients

2006-04-05 Thread Philip Prindeville
Philip Prindeville wrote: >Matt Kettler wrote: > > > >>[EMAIL PROTECTED] wrote: >> >> >> >> >>>Matt Kettler wrote: >>> >>> >>> >>> >>> [It] has no access to the message envelope, only the headers and body, so this information isn't accessible to SA.

Re: Filtering based on the recipients

2006-04-05 Thread Philip Prindeville
Matt Kettler wrote: >[EMAIL PROTECTED] wrote: > > >>Matt Kettler wrote: >> >> >> >>>[It] has no access to the message envelope, only the headers and >>>body, so this information isn't accessible to SA. >>> >>> >>> >>Well, unless you add an Apparently-To header in the MTA prior to

Re: Filtering based on the recipients

2006-04-05 Thread Philip Prindeville
Magnus Holmgren wrote: >onsdag 05 april 2006 06:43 skrev Philip Prindeville: > > >>I was looking on the FAQ and the Wiki, but couldn't find this... >> >>How do I filter based on the recipient mailbox address? For instance, I'm >>running Linux, so if I get email sent to [EMAIL PROTECTED] or [EMA

RE: Filtering based on the recipients

2006-04-05 Thread Matthew.van.Eerde
Steve Lindemann wrote: > A good choice... and another way to accomplish the task (assuming > sendmail, I'm not sure about other MTAs): > > /etc/mail/access > >bogus_user ERROR "550 Go away - you are not welcome here" > or >bogus_userREJECT (acknowledge & reject message) > or

Re: Idea for new SA Rule

2006-04-05 Thread Magnus Holmgren
Also, the rule probably wouldn't detect misuses of "then" in place of "than". ;-) (Nothing personal, lots of people, make that mistake, as well as "insure"/"ensure", "effect"/"affect" and many similar ones.) Seriously though, I get the feeling that a well-trained bayes database, which to a bi

Re: Idea for new SA Rule

2006-04-05 Thread Matt Kettler
Gustafson, Tim wrote: >> 1) FPs on highly technical mail due to words not known to the spell >> checker. >> > > I hadn't thought of that, but people who are dealing with highly > technical e-mails would probably also be able to customize their > local.cf file to effectively turn off the rule.

RE: Antwort: RE: Idea for new SA Rule

2006-04-05 Thread Gustafson, Tim
> Rule No.1: If a rule is likely to hit more > ham then spam due to certain circumstances, > it is not a rule to consider implementing unless > you know you'll never meet the circumstances - > but then it's up to YOU to modify your local.cf > and implement the rule ;) You say to-may-to, I say to-m

Re: Filtering based on the recipients

2006-04-05 Thread Steve Lindemann
John D. Hardin wrote: On Tue, 4 Apr 2006, Philip Prindeville wrote: How do I filter based on the recipient mailbox address? For instance, I'm running Linux, so if I get email sent to [EMAIL PROTECTED] or [EMAIL PROTECTED] then I know they're bogus... And can probably block it, even if some of

Antwort: RE: Idea for new SA Rule

2006-04-05 Thread srunschke
"Gustafson, Tim" <[EMAIL PROTECTED]> schrieb am 05.04.2006 17:11:10: > > 1) FPs on highly technical mail due to words not known to the spell > > checker. > > I hadn't thought of that, but people who are dealing with highly > technical e-mails would probably also be able to customize their > local

RE: Filtering based on the recipients

2006-04-05 Thread Bowie Bailey
[EMAIL PROTECTED] wrote: > Bowie Bailey wrote: > > [EMAIL PROTECTED] wrote: > > > You have now. :) From mimedefang.pl: > > > > > > if ($AddApparentlyToForSpamAssassin and > > > ($#Recipients >= 0)) { > > > push(@sahdrs, "Apparently-To: " . > > > join(", ", @Recipie

Re: Filtering based on the recipients

2006-04-05 Thread John D. Hardin
On Tue, 4 Apr 2006, Philip Prindeville wrote: > How do I filter based on the recipient mailbox address? For instance, I'm > running Linux, so if I get email sent to [EMAIL PROTECTED] or [EMAIL > PROTECTED] > then I know they're bogus... > > And can probably block it, even if some of the recipie

Re: Idea for new SA Rule

2006-04-05 Thread Daryl C. W. O'Shea
Gustafson, Tim wrote: 3) FPs on email sent by lazy/stupid folks that can't spell. (Translation: management material) I don't mind these getting blocked. In fact, I'd love it if every time someone sent me a very poorly written e-mail they got a bounce message back telling them to turn on the s

RE: Filtering based on the recipients

2006-04-05 Thread Matthew.van.Eerde
Bowie Bailey wrote: > [EMAIL PROTECTED] wrote: >> You have now. :) From mimedefang.pl: >> >> if ($AddApparentlyToForSpamAssassin and >> ($#Recipients >= 0)) { >> push(@sahdrs, "Apparently-To: " . >> join(", ", @Recipients) . "\n"); >> } > > Hmmm... Is this he

RE: Idea for new SA Rule

2006-04-05 Thread Gustafson, Tim
> And how would you deal with messages in other languages? Over here 99% > of messages in English are spam! AFAIK there's no language indicator in > email messages. I wouldn't deal with messages in other languages. My clients are all english speaking Americans, and we already block all foreign

RE: Idea for new SA Rule

2006-04-05 Thread Gustafson, Tim
> 1) FPs on highly technical mail due to words not known to the spell > checker. I hadn't thought of that, but people who are dealing with highly technical e-mails would probably also be able to customize their local.cf file to effectively turn off the rule. > 2) FPs on email sent by folks of the

Re: Idea for new SA Rule

2006-04-05 Thread Ron Johnson
Paolo Cravero as2594 writes: > > Gustafson, Tim wrote: > > > Could SpamAssassin benefit from a filter that would actually check the > > spelling of the text parts of the message, and if misspelled words > > exceeds, for example, 50%, then we can add a few points to the SPAM > > score? I'm not su

Re: Idea for new SA Rule

2006-04-05 Thread Matt Kettler
Gustafson, Tim wrote: > Hello > > One thing I've noticed about almost ALL spam that gets through at this > point is that they have a LOT of misspelled (and obfuscated) words. > > Could SpamAssassin benefit from a filter that would actually check the > spelling of the text parts of the message, and

Re: Idea for new SA Rule

2006-04-05 Thread Paolo Cravero as2594
Gustafson, Tim wrote: Could SpamAssassin benefit from a filter that would actually check the spelling of the text parts of the message, and if misspelled words exceeds, for example, 50%, then we can add a few points to the SPAM score? I'm not sure how to begin coding this, but I think it should

Idea for new SA Rule

2006-04-05 Thread Gustafson, Tim
Hello One thing I've noticed about almost ALL spam that gets through at this point is that they have a LOT of misspelled (and obfuscated) words. Could SpamAssassin benefit from a filter that would actually check the spelling of the text parts of the message, and if misspelled words exceeds, for e

Re: RFC: ruleset to tag French-language hoax virus warnings

2006-04-05 Thread David Landgren
Rick Macdougall wrote: David Landgren wrote: List, if you have a significant number of French-language users, I'd love to have some feedback on a ruleset to catch the endless virus hoax messages. Things like "the worst ever according to CNN", "only discovered yesterday, no rememdy, according

Re: Is Spamassassin failing math?

2006-04-05 Thread List Mail User
>... >Loren Wilton wrote: >>> 3 decimal places, not 3 significant digits. >>> >>> ie: 10.001 has 5 significant digits, but 3 decimal places. >>> >>> AFAIK there are no SA rules with scores more exact than 3 decimal places. >>> >>> So, no.. you would not have any rounding issues at that point. >>>

Re: RFC: ruleset to tag French-language hoax virus warnings

2006-04-05 Thread Michael Monnerie
On Mittwoch, 5. April 2006 15:48 Rick Macdougall wrote: > Strange, I'm the Network admin for an ISP in Montreal, Quebec and > I've never ever seen anything like that (about 30k email accounts, > 90% French). So you're either 1) happy and 2) not subscribed to the wonderful spam lists Post some of

Re: RFC: ruleset to tag French-language hoax virus warnings

2006-04-05 Thread Rick Macdougall
David Landgren wrote: List, if you have a significant number of French-language users, I'd love to have some feedback on a ruleset to catch the endless virus hoax messages. Things like "the worst ever according to CNN", "only discovered yesterday, no rememdy, according to McAfee", "burns the

RFC: ruleset to tag French-language hoax virus warnings

2006-04-05 Thread David Landgren
List, if you have a significant number of French-language users, I'd love to have some feedback on a ruleset to catch the endless virus hoax messages. Things like "the worst ever according to CNN", "only discovered yesterday, no rememdy, according to McAfee", "burns the sector zero of your ha

Antwort: sa-learn & Lotus Notes

2006-04-05 Thread srunschke
Andy Jezierski <[EMAIL PROTECTED]> schrieb am 04.04.2006 23:13:08: > There have been numerous threads on how to have end users drop > misclassified mail to spam/ham folders in Exchange, but I don't recall > seeing any mention of a way of doing this with Notes. > > Is anyone doing this with Not

Re: Filtering based on the recipients

2006-04-05 Thread Magnus Holmgren
onsdag 05 april 2006 15:02 skrev Bowie Bailey: > [EMAIL PROTECTED] wrote: > > You have now. :) From mimedefang.pl: > > > > if ($AddApparentlyToForSpamAssassin and > > ($#Recipients >= 0)) { > > push(@sahdrs, "Apparently-To: " . > > join(", ", @Recipients) . "\n"); >

RE: Filtering based on the recipients

2006-04-05 Thread Bowie Bailey
[EMAIL PROTECTED] wrote: > Matt Kettler wrote: > > [EMAIL PROTECTED] wrote: > > > Matt Kettler wrote: > > > Well, unless you add an Apparently-To header in the MTA prior to > > > calling SpamAssassin. > > > > > Yes, but I've never seen an "Apparently-To" implementation that > > listed all the rec

RE: Filtering based on the recipients

2006-04-05 Thread Matthew.van.Eerde
Matt Kettler wrote: > [EMAIL PROTECTED] wrote: >> Matt Kettler wrote: >> Well, unless you add an Apparently-To header in the MTA prior to >> calling SpamAssassin. >> > Yes, but I've never seen an "Apparently-To" implementation that listed > all the recipients of a multi-recipient message... You h

Re: Filtering based on the recipients

2006-04-05 Thread Justin Mason
[EMAIL PROTECTED] writes: > Matt Kettler wrote: > > [It] has no access to the message envelope, only the headers and body, > > so this information isn't accessible to SA. > > Well, unless you add an Apparently-To header in the MTA prior to calling > SpamAssassin. MIMEDefang has an $AddApparently

Re: Filtering based on the recipients

2006-04-05 Thread Matt Kettler
[EMAIL PROTECTED] wrote: > Matt Kettler wrote: > >> [It] has no access to the message envelope, only the headers and >> body, so this information isn't accessible to SA. >> > > Well, unless you add an Apparently-To header in the MTA prior to calling > SpamAssassin. MIMEDefang has an $AddA

RE: Filtering based on the recipients

2006-04-05 Thread Matthew.van.Eerde
Matt Kettler wrote: > [It] has no access to the message envelope, only the headers and > body, so this information isn't accessible to SA. Well, unless you add an Apparently-To header in the MTA prior to calling SpamAssassin. MIMEDefang has an $AddApparentlyToForSpamAssassin variable you can se

Re: Filtering based on the recipients

2006-04-05 Thread Matt Kettler
Philip Prindeville wrote: > I was looking on the FAQ and the Wiki, but couldn't find this... > > How do I filter based on the recipient mailbox address? For instance, I'm > running Linux, so if I get email sent to [EMAIL PROTECTED] or [EMAIL > PROTECTED] > then I know they're bogus... > > And can

Re: Filtering based on the recipients

2006-04-05 Thread Benny Pedersen
> I was looking on the FAQ and the Wiki, but couldn't find this... > How do I filter based on the recipient mailbox address? For instance, I'm > running Linux, so if I get email sent to [EMAIL PROTECTED] or [EMAIL > PROTECTED] then I know they're bogus... you accept them in your mta ? > And can

Antwort: sa-learn & Lotus Notes

2006-04-05 Thread Nico Prenzel
Hello Andy, we've been already in contact the last year. But after I've sent you a test version of my DomSpamC/DSCLearner, I haven't heart anything from you. Pherhaps you'll take a fresh look at my newest DSCLearner. It allows user-based and site-wide bayesian training. It runs as Lotus Domino t

Re: Is Spamassassin failing math?

2006-04-05 Thread Matt Kettler
Loren Wilton wrote: >> Erm.. Loren.. While that may be true of binary fractions, nobody uses >> binary fractions. >> >> In IEEE floating point format (single precision or otherwise), 0.001 has >> an exact binary representation. >> >> Very few things in this world use binary fractions. Standard floa

Re: Filtering based on the recipients

2006-04-05 Thread Sipos Gabor
Don't do this from spamassassin, reject messages sent to nonexistent users from your MTA (postfix, exim4, whatever you use). This will also lower the backscatter mail volume from your system (sending bounces to forged sender addresses). Gabor Sipos > I was looking on the FAQ and the Wiki, b

Re: Is Spamassassin failing math?

2006-04-05 Thread Matt Kettler
Loren Wilton wrote: >> Erm.. Loren.. While that may be true of binary fractions, nobody uses >> binary fractions. >> >> In IEEE floating point format (single precision or otherwise), 0.001 has >> an exact binary representation. >> >> Very few things in this world use binary fractions. Standard floa

Re: Is Spamassassin failing math?

2006-04-05 Thread Bernd Petrovitsch
On Wed, 2006-04-05 at 00:25 -0400, Matt Kettler wrote: [...] > AFAIK there are no SA rules with scores more exact than 3 decimal places. > > So, no.. you would not have any rounding issues at that point. Long answer: Only as long that you only add and subtract. But additions/subtractions are inhe

Re: Is Spamassassin failing math?

2006-04-05 Thread Loren Wilton
> Erm.. Loren.. While that may be true of binary fractions, nobody uses > binary fractions. > > In IEEE floating point format (single precision or otherwise), 0.001 has > an exact binary representation. > > Very few things in this world use binary fractions. Standard floating > point numbers on com

Re: Is Spamassassin failing math?

2006-04-05 Thread Matt Kettler
Matt Kettler wrote: > Loren Wilton wrote: > >>> 3 decimal places, not 3 significant digits. >>> >>> ie: 10.001 has 5 significant digits, but 3 decimal places. >>> >>> AFAIK there are no SA rules with scores more exact than 3 decimal places. >>> >>> So, no.. you would not have any rounding issue

Re: Is Spamassassin failing math?

2006-04-05 Thread Matt Kettler
Loren Wilton wrote: >> 3 decimal places, not 3 significant digits. >> >> ie: 10.001 has 5 significant digits, but 3 decimal places. >> >> AFAIK there are no SA rules with scores more exact than 3 decimal places. >> >> So, no.. you would not have any rounding issues at that point. >> > > Yes y

Re: sa-learn & Lotus Notes

2006-04-05 Thread Paolo Cravero as2594
Andy Jezierski wrote: There have been numerous threads on how to have end users drop misclassified mail to spam/ham folders in Exchange, but I don't recall seeing any mention of a way of doing this with Notes. Although we don't let users train Bayes, Lotus client and server from version 5 an

Re: false positive on FORGED_MUA_OUTLOOK (v.3.1)

2006-04-05 Thread Paolo Cravero as2594
Tony Finch wrote: The following headers come from a legitimate message - I have obscured the sender's name, but that's all. The "SlipStream SP Server" seems to have appended the client username and IP address to the message-ID, causing the FP. See also: http://mail-archives.apache.org/mod_mbox/sp

Re: Filtering based on the recipients

2006-04-05 Thread Magnus Holmgren
onsdag 05 april 2006 06:43 skrev Philip Prindeville: > I was looking on the FAQ and the Wiki, but couldn't find this... > > How do I filter based on the recipient mailbox address? For instance, I'm > running Linux, so if I get email sent to [EMAIL PROTECTED] or [EMAIL > PROTECTED] > then I know t

Re: Is Spamassassin failing math?

2006-04-05 Thread Loren Wilton
> 3 decimal places, not 3 significant digits. > > ie: 10.001 has 5 significant digits, but 3 decimal places. > > AFAIK there are no SA rules with scores more exact than 3 decimal places. > > So, no.. you would not have any rounding issues at that point. Yes you would, or at least could. .001 is