Re: Parsing DCC

2006-04-30 Thread Dan
Nevermind, I found the entry: use_dcc { 0 | 1 } (default: 1) Whether to use DCC, if it is available. dcc_timeout n (default: 10) How many seconds you wait for dcc to complete before you go on without the results. dcc_body_max NUMBER dcc_fuz1_max NUMBER dcc_fuz2_max NUMBER DCC (Distributed C

Re: Parsing DCC

2006-04-30 Thread Dan
All that said, I can't see why you'd want to do anything else with DCC. The FP rate on DCC, even with the defaults of |99 for fuzz counts, is significant. In the SA 3.1.0 set3 mass-checks, DCC_CHECK had a S/O of| 0.979, meaning that 2.1% of email matched by it was nonspam. So more detail i

Re: Parsing DCC

2006-04-30 Thread Matt Kettler
Dan wrote: >>> 1) Is capturing header output text the best way to implement DCC in SA? >> >> No, using the DCC plugin that already comes with SA is the best way. >> >> Edit your v310.pre and load the dcc plugin. SA already has pre-scored >> and tested rules built in. No further work needed. > > Exc

Re: Parsing DCC

2006-04-30 Thread Dan
1) Is capturing header output text the best way to implement DCC in SA? No, using the DCC plugin that already comes with SA is the best way. Edit your v310.pre and load the dcc plugin. SA already has pre-scored and tested rules built in. No further work needed. Excellent Matt. Is there a wa

Re: intercource oriented newsgroups

2006-04-30 Thread jdow
"Review your spam bucket, compadre." {o.o} - Original Message - From: "Igor Chudov" <[EMAIL PROTECTED]> To: "Spamassassin Mailing List" Sent: Sunday, April 30, 2006 20:21 Subject: intercource oriented newsgroups A few of my clients are moderated newsgroups that have graphic posts des

RE: intercource oriented newsgroups

2006-04-30 Thread Dallas L. Engelken
> -Original Message- > From: Igor Chudov [mailto:[EMAIL PROTECTED] > Sent: Sunday, April 30, 2006 22:22 > To: Spamassassin Mailing List > Subject: intercource oriented newsgroups > > A few of my clients are moderated newsgroups that have > graphic posts describing certain sexual perversi

intercource oriented newsgroups

2006-04-30 Thread Igor Chudov
A few of my clients are moderated newsgroups that have graphic posts describing certain sexual perversions. They receive posts via email and approve/reject them. Their posts trip spamassassin sometimes, understandably, they talk about big reproducting o rgans, arouzal, etc. So... What can I do,

Re: Parsing DCC

2006-04-30 Thread Matt Kettler
Matt Kettler wrote: > 1) Is capturing header output text the best way to implement DCC in SA? > > > No, using the DCC plugin that already comes with SA is the best way. > > Edit your v310.pre and load the dcc plugin. SA already has pre-scored > and tested rules built in. No further work needed.

Re: Parsing DCC

2006-04-30 Thread Matt Kettler
Dan wrote: > This is partly about DCC and partly about regex (yes, I've ordered two > more regex books). > > > First, there's the basic all or nothing output: > > X-DCC-servers-Metrics: ui1 1049; bulk Body=many Fuz1=many Fuz2=many > X-DCC-servers-Metrics: ui1 1049; bulk Body=0 Fuz1=0 Fuz2=0 > > .

Re: Those "Re: good obfupills" spams

2006-04-30 Thread jdow
From: "Matt Kettler" <[EMAIL PROTECTED]> jdow wrote: And it is scored LESS than BAYES_95 by default. That's a clear signal that the theory behind the scoring system is a little skewed and needs some rethinking. No.. It does not mean there's a problem with the scoring system. It means you're t

Re: Those "Re: good obfupills" spams

2006-04-30 Thread jdow
From: "Matt Kettler" <[EMAIL PROTECTED]> jdow wrote: And it is scored LESS than BAYES_95 by default. That's a clear signal that the theory behind the scoring system is a little skewed and needs some rethinking. No.. It does not mean there's a problem with the scoring system. It means you're t

Re: SQLite

2006-04-30 Thread Jonas Eckerman
Michael Parker wrote: On a stable system with working backup routines running SQLite with 'PRAGMA SYNCHRONOUS=OFF' for bayes makes a lot of sense. It has been awhile, but I believe you just need to do this at create time, so you'd only need a proper .sql file that did it. I think that might

Parsing DCC

2006-04-30 Thread Dan
This is partly about DCC and partly about regex (yes, I've ordered two more regex books).  First, there's the basic all or nothing output: X-DCC-servers-Metrics: ui1 1049; bulk Body=many Fuz1=many Fuz2=many X-DCC-servers-Metrics: ui1 1049; bulk Body=0 Fuz1=0 Fuz2=0...that can be captured with basic

Re: Those "Re: good obfupills" spams

2006-04-30 Thread Matt Kettler
jdow wrote: > And it is scored LESS than BAYES_95 by default. That's a clear signal > that the theory behind the scoring system is a little skewed and needs > some rethinking. No.. It does not mean there's a problem with the scoring system. It means you're trying to apply a simple linear model to

qmail auth mail received as spam

2006-04-30 Thread hamann . w
Here is a piece of mail that gets classified as spam, although it should not. I have replaced a few email addresses by fake ones, they dont contribute to the problem. So what happens: a mail is sent via an authenticated session, to a qmail / qmail-scanner setup running at mydomain.de Here qmail

Re: Tracking Compound Meta's

2006-04-30 Thread Dan
What about using the SA 'test rule' mechanism? (IE use "T_testA1" rather than "__testA1"). Effectivly the micro weighting done automagically and in a standardized way. Nice, micro weighting without the required score lines. Now I just need to ignore or absorb the extra scores. Dan