Re: Fighting spam by public education?

2006-05-04 Thread Kelson
Marc Perkel wrote: Has anyone done this or anything like it? http://www.spamdontbuyit.org/ is another one. It's not terribly detailed, but it focuses on the economic issue. They have a great diagram illustrating the disparity between the large number of messages a spammer sends out and the

Re: Strict SA config. and Postfix

2006-05-04 Thread Rick Macdougall
LDB wrote: I am invoking spamc through a filter script where spamd is listening. Also, I am using PostFix as the MTA. My platform is Debian Linux. I am SA version 3.0.3. The below config. captures about 1700 spams a day but it is NOT enough. Can anyone kindly suggest a better more strict conf

Re: URI_NO_WWW_INFO_CGI rule

2006-05-04 Thread Loren Wilton
> If all the rule does is check for uri's in a certain form, then I would say > that this specific rule can backfire on completely legitimate mail. Essentially ALL spam rules "can" misfire on legit mail. In fact statistically most of them WILL misfire on some small percentage of legit mail. If t

Strict SA config. and Postfix

2006-05-04 Thread LDB
I am invoking spamc through a filter script where spamd is listening. Also, I am using PostFix as the MTA. My platform is Debian Linux. I am SA version 3.0.3. The below config. captures about 1700 spams a day but it is NOT enough. Can anyone kindly suggest a better more strict config. for me or

Re: URI_NO_WWW_INFO_CGI rule

2006-05-04 Thread jdow
From: "Wiebe Cazemier" <[EMAIL PROTECTED]> Hi, What exactly does the URI_NO_WWW_INFO_CGI rule mean? The description is: URI: CGI in .info TLD other than third-level "www" I get false positive spam which have URI's in the .info TLD in it. Like: http://foo.hello.info/forum/vi

RE: URI_NO_WWW_INFO_CGI rule

2006-05-04 Thread Bowie Bailey
Wiebe Cazemier wrote: > On Thursday 04 May 2006 16:00, Magnus Holmgren wrote: > > > uri URI_NO_WWW_INFO_CGI /^(?:https?:\/\/)?[^\/]+(? > {7,}\.info\/(?=\S{15,})\S*\?/i > > > > Let's see if I can get this straight... > > > > (?:https?:\/\/)? (optionally) "http://"; or "https://"; followed by >

RE: home owner

2006-05-04 Thread Hardt, Jon
-Original Message- From: Martin Hepworth [mailto:[EMAIL PROTECTED] Sent: Thursday, May 04, 2006 8:43 AM To: users@spamassassin.apache.org Subject: RE: home owner Jean-Paul If can put the full email on a web page (headers and all)... I can run it over my system, and let you know which

Re: URI_NO_WWW_INFO_CGI rule

2006-05-04 Thread Wiebe Cazemier
On Thursday 04 May 2006 16:00, Magnus Holmgren wrote: > uri URI_NO_WWW_INFO_CGI /^(?:https?:\/\/)?[^\/]+(? {7,}\.info\/(?=\S{15,})\S*\?/i > > Let's see if I can get this straight... > > (?:https?:\/\/)? (optionally) "http://"; or "https://"; followed by > [^\/]+ one or more of any

Re: Fighting spam by public education?

2006-05-04 Thread Michael Clark
At 8:03 AM -0700 5/4/06, Marc Perkel wrote: Has anyone done this or anything like it? http://spam.getnetwise.org We're in PcMagazine's annual Top 100 Classic web sites, used to be linked from the home pages of AOL.com, MSNBC.com, hotmail.com, etc... Yes, I'm the webmaster for the site. Mike

Re: Blocking IPs

2006-05-04 Thread Dan
Can be done with brute-force rule creation, EG:  # ISKIMARO 66.55.160.0/19  (12/8/05) SBL11507  header L_RCVD_SPAMMER161     Received =~ /\[66\.55\.1[678]\d\.\d{1,3}\]/  describe L_RCVD_SPAMMER161   ISKIMARO Spamhaus  score L_RCVD_SPAMMER161      1.5Bit of a pain to maintain but does work. The only

Re: Fighting spam by public education?

2006-05-04 Thread Jeff Chan
On Thursday, May 4, 2006, 8:03:36 AM, Marc Perkel wrote: > I hope I'm not the first one who has though of this but suppose we > created a web site with material to educate the public on how not to get > ripped off from spam. The idea being that it is both simple and > comprehensive and targeted

RE: Amavisd - SA misses The Bat spams sometimes

2006-05-04 Thread Timothy Burt
Thanks for your feedback. Amavisd runs spamassassin from a dedicated (non-root) login and the user_prefs file is read for that user for all emails processed by amavisd. This is what I believe, and I have seen results that support this belief. But this is the area of my problems, so perhaps I

Spamnix

2006-05-04 Thread Jacob Hoppe
Does anyone here have any experience using spamnix and feel pretty knowledgeable about the software? If so, does it display the SA rules that a message actually meets or does it just assign a general score without showing how that score was achieved? Thanks again! Jacob Hoppe Information Tec

Re: Silly Question

2006-05-04 Thread Michael Monnerie
On Mittwoch, 3. Mai 2006 22:10 Brent Kennedy wrote: > My problem with that > is that some companies don't have them even though they are > legitimate. They usually don't have them because of the lack of good > or full time IT staff. Sell them service. I ususally offer to make their system fixed, i

Re: home owner

2006-05-04 Thread Craig McLean
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Jean-Paul Natola wrote: I have a couple of homebrew ones which seem to work, although as soon as I post them here they will become obsolete :-) They are not masschecked, so use them with care. http://fukka.co.uk/sa-rules/local/loans_rules.cf C. - --

Fighting spam by public education?

2006-05-04 Thread Marc Perkel
I hope I'm not the first one who has though of this but suppose we created a web site with material to educate the public on how not to get ripped off from spam. The idea being that it is both simple and comprehensive and targeted at educating the public. The theory being that if the public is

RE: home owner

2006-05-04 Thread Martin Hepworth
Jean-Paul If can put the full email on a web page (headers and all)... I can run it over my system, and let you know which of many extra rules I run hit...more than like some from www.rulesemporium.com/rules.htm -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842

home owner

2006-05-04 Thread Jean-Paul Natola
I'm getting creamed here with the home owner crap We don't care about your credit , yada yada yada Any new rule out there for this yet? Jean-Paul Natola Network Administrator Information Technology Family Care International 588 Broadway Suite 503 New York, NY 10012 Phone:212-941-5300 xt

RE: URI_NO_WWW_INFO_CGI rule

2006-05-04 Thread Bowie Bailey
Wiebe Cazemier wrote: > > What exactly does the URI_NO_WWW_INFO_CGI rule mean? The description > is: > > URI: CGI in .info TLD other than third-level "www" > > I get false positive spam which have URI's in the .info TLD in it. > Like: > > http://foo.hello.info/forum/viewtopic.

Re: URI_NO_WWW_INFO_CGI rule

2006-05-04 Thread Magnus Holmgren
Thursday 04 May 2006 14:42 skrev Wiebe Cazemier: > Hi, > > What exactly does the URI_NO_WWW_INFO_CGI rule mean? The description is: > > URI: CGI in .info TLD other than third-level "www" > uri URI_NO_WWW_INFO_CGI /^(?:https?:\/\/)?[^\/]+(?http://"; or "https://"; followed by [^\/]+

Apache SpamAssassin in the Google Summer Of Code 2006

2006-05-04 Thread Justin Mason
Are you a student, and interested in earning $4,500 for contributing to open source, and fighting spam, over the course of the summer? If so, get thee hence to the Google Summer of Code 2006 site, and propose a project! http://code.google.com/soc/ We have a few prospective project mentors and a f

RE: Amavisd - SA misses The Bat spams sometimes

2006-05-04 Thread Bowie Bailey
Timothy Burt wrote: > > On Wed, 3 May 2006, Matt Kettler wrote: > > > > 2) Since your rules are declared in user_prefs, have you declared > > allow_user_rules in your local.cf? > > Curious that the answer to this is no. I saw this in the docs, after > I had the user_prefs confirmed as working..

Re: drop spam mail by user pref

2006-05-04 Thread Matt Kettler
martin wrote: > Dear all, > spamd/spamc can had a user pref. file for user defined socring/white list > etc, > and using milter (spamass-milter) to control drop the spam mail or not. > my question is, can drop the spam mail based on user pref. file? e.g. some > user can decide to drop [marked]

URI_NO_WWW_INFO_CGI rule

2006-05-04 Thread Wiebe Cazemier
Hi, What exactly does the URI_NO_WWW_INFO_CGI rule mean? The description is: URI: CGI in .info TLD other than third-level "www" I get false positive spam which have URI's in the .info TLD in it. Like: http://foo.hello.info/forum/viewtopic.php?p=1 Does this rule mean that the

Re: OR NOT Logic

2006-05-04 Thread Craig McLean
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Peter P. Benac wrote: [snip] > > And your domain is my Mother's Maiden Name :) > > Regards, > Pete Remind me who you bank with? ;-) C. - -- Craig McLeanhttp://fukka.co.uk [EMAIL PROTECTED] Where the fun never starts Power

Re: Tinurl being abused by spammers..

2006-05-04 Thread Jeff Chan
On Wednesday, May 3, 2006, 7:50:41 AM, Chris Santerre wrote: > This is something Jeff had done a long time ago that was awesome. Right off > the bat he saw the redirects being a problem, and got TinyURL to use SURBL. Thanks Chris, but TBH, IIRC they used it without prompting from us. Perhaps they