Re: Retagging false positives?

2006-07-30 Thread John Andersen
On Sunday 30 July 2006 22:37, Logan Shaw wrote: > On Sun, 30 Jul 2006, Loren Wilton wrote: > > If you know how to run SA to relearn the message, why not just use SA to > > strip the headers off the message? It certainly knows how to do that, > > and I'm pretty sure it will output the clean file. >

Re: Retagging false positives?

2006-07-30 Thread Logan Shaw
On Sun, 30 Jul 2006, Loren Wilton wrote: If you know how to run SA to relearn the message, why not just use SA to strip the headers off the message? It certainly knows how to do that, and I'm pretty sure it will output the clean file. Because if I am understanding this right (not certain of t

Ah, an honest spammer!

2006-07-30 Thread Loren Wilton
Quoting the content of a recent spam: Elimination from database is here . Yep. No link. Not even a fake link. I guess I can't out of their "database" even if I want to. At least they are honest about it. :-( Loren

Re: Image spams getting thru

2006-07-30 Thread Logan Shaw
On Sat, 29 Jul 2006, John D. Hardin wrote: On Sat, 29 Jul 2006, Loren Wilton wrote: From: Rory [mailto:[EMAIL PROTECTED] From: Barbra [mailto:[EMAIL PROTECTED] Something like header FROMFROM=~ /[A-Z]\w+ \[mailto\: \w+\.\w+\@/ There is a way to be more specific, but it costs considerably

Re: spam not detected

2006-07-30 Thread Loren Wilton
postmaster account has been receiving many spam and its not being blocked by SA, I have feed SA to learns hundred of similar spam manually, but still not able to catcth up. *X-Spam-Status:* No, score=3.8 required=5.2 tests=BAYES_99,FORGED_RCVD_HELO, HTML_50_60,HTML_MESSAGE autolearn=d

Re: Retagging false positives?

2006-07-30 Thread Loren Wilton
If you know how to run SA to relearn the message, why not just use SA to strip the headers off the message? It certainly knows how to do that, and I'm pretty sure it will output the clean file. Loren

Re: spam not detected

2006-07-30 Thread Logan Shaw
On Mon, 31 Jul 2006, Beast wrote: I have implemented site wide SA and it works pretty well except for this kind of spam. postmaster account has been receiving many spam and its not being blocked by SA, I have feed SA to learns hundred of similar spam manually, but still not able to catcth up.

spam not detected

2006-07-30 Thread Beast
I have implemented site wide SA and it works pretty well except for this kind of spam. postmaster account has been receiving many spam and its not being blocked by SA, I have feed SA to learns hundred of similar spam manually, but still not able to catcth up. spamassassin --lint -D ... [26113]

Re: Retagging false positives?

2006-07-30 Thread Robert Nicholson
yeah I have a method of correcting bayes whereby I will send myself the message id of the message and it will then use that using IMAP to fetch the message and then relearn it using SA's API's at the perl level but I'm just looking for something that can actually strip the headers of the me

Re: SA Score -> Confidence Percentage

2006-07-30 Thread John Rudd
On Jul 30, 2006, at 5:18 PM, jdow wrote: (You DO review your spam mailbox before tossing the spam, don't you? Sort of... what I do (at home) is: 0) MIMEDefang rejects anything that scores >= 10. MIMEDefang also rejects anything that doesn't have a PTR record, or has a PTR record that does

Re: SA Score -> Confidence Percentage

2006-07-30 Thread jdow
From: "John Rudd" <[EMAIL PROTECTED]> On Jul 30, 2006, at 4:37 PM, jdow wrote: From: "John Rudd" <[EMAIL PROTECTED]> On Jul 26, 2006, at 5:23 PM, jdow wrote: I am a bit of a heretic in this group because I take the nasty step of taking rules that are almost always right (one error per thous

Re: SA Score -> Confidence Percentage

2006-07-30 Thread John Rudd
On Jul 30, 2006, at 4:37 PM, jdow wrote: From: "John Rudd" <[EMAIL PROTECTED]> On Jul 26, 2006, at 5:23 PM, jdow wrote: I am a bit of a heretic in this group because I take the nasty step of taking rules that are almost always right (one error per thousand or more hits) and make sure the sco

Re: SA Score -> Confidence Percentage

2006-07-30 Thread jdow
From: "John Rudd" <[EMAIL PROTECTED]> On Jul 26, 2006, at 5:23 PM, jdow wrote: I am a bit of a heretic in this group because I take the nasty step of taking rules that are almost always right (one error per thousand or more hits) and make sure the score on the rule is designed to push the score

Re: SA Score -> Confidence Percentage

2006-07-30 Thread jdow
From: "Nix" <[EMAIL PROTECTED]> On Wed, 26 Jul 2006, [EMAIL PROTECTED] yowled: My impression is that the perceptron tries to cluster scores NEAR 5.0 with as much spam as possible over 5.0 and as little ham as possible over 5.0. Well, it doesn't *try* to cluster, but since it'll keep tweaking

Re: SA Score -> Confidence Percentage

2006-07-30 Thread John Rudd
On Jul 26, 2006, at 5:23 PM, jdow wrote: I am a bit of a heretic in this group because I take the nasty step of taking rules that are almost always right (one error per thousand or more hits) and make sure the score on the rule is designed to push the score AWAY from 5.0 in the appropriate dire

Re: SA Score -> Confidence Percentage

2006-07-30 Thread Nix
On Wed, 26 Jul 2006, [EMAIL PROTECTED] yowled: > My impression is that the perceptron tries to cluster scores NEAR 5.0 > with as much spam as possible over 5.0 and as little ham as possible > over 5.0. Well, it doesn't *try* to cluster, but since it'll keep tweaking until as many FPs and FNs as po

Re: X-Spam Status Removed

2006-07-30 Thread mouss
Zack Odell wrote: Greetings I have had much success using SA with amavis-new in blocking spam and any other nasty email. So the way my network looks is like this: Server with SA/amavis-new & postfix receives all mail runs through any and all tests and is then relayed to an internal mail server

Re: bayes: not available for scanning

2006-07-30 Thread mouss
Paul Dulaba wrote: Hi all, Running SA 3.1.0. I have been using the Bayes DB for 8-9 months now. All of a sudden it seems like a lot of Spam is getting through, and training it with the new Spam does not seem to have any effect. There is a quirk in the following output: spamassassin -D --li

Re: Retagging false positives?

2006-07-30 Thread mouss
Robert Nicholson wrote: The issue for me is that I need to strip out the SA headers from the message after it's tagged as SPAM. But the problem is always that you cannot get the physical filename from the actual contents of the message itself. Use a special folder for false positives (.Filter

Re: Retagging false positives?

2006-07-30 Thread John Andersen
On Sunday 30 July 2006 09:22, Robert Nicholson wrote: > The issue for me is that I need to strip out the SA headers from the > message after it's tagged as SPAM. But the problem is always that you > cannot get the physical filename from the actual contents of the > message itself. Why not move all

Re: Retagging false positives?

2006-07-30 Thread Robert Nicholson
The issue for me is that I need to strip out the SA headers from the message after it's tagged as SPAM. But the problem is always that you cannot get the physical filename from the actual contents of the message itself. On Jul 30, 2006, at 11:46 AM, Robert Nicholson wrote: So what is the b

Retagging false positives?

2006-07-30 Thread Robert Nicholson
So what is the best strategy to retag a false positive when the server uses imap Maildir folders.