On 9/9/06, Daryl C. W. O'Shea <[EMAIL PROTECTED]> wrote:
Michael Scheidell wrote:Bug 5077 includes a one line patch to fix this. It'll be included in3.1.6 but is trivial to apply by hand now.
http://issues.apache.org/SpamAssassin/show_bug.cgi?id=5077I seem to have multiple versions of SPF.pm on m
I personally am probably not interested in mail from people who don't
know how to set their system's time but you could implement it using
a threshold. To me that's a lot better than assuming an n hour
difference b/w Received and Date: etc which the sender can easily
forge. Unless the Recei
Robert Nicholson wrote:
If you converted all times to GMT and compared them against now and if
they were > now how often would that be FPing?
I suppose that the spam hit rate would go up a little for the
DATE_IN_FUTURE_* rules, while the ham hit rate (caused by the thousands
of people who don
Windows-1255and apparently with locales DB<6> x @locales0 'en'1 'th'2 'it'3 'en_US'Mail::SpamAssassin::Locales::is_charset_ok_for_locales($1, @locales)returns trueMail::SpamAssassin::Locales::is_charset_ok_for_locales(/home/robert/lib/perl5/site_perl/5.8.0/Mail/SpamAssassin/Locales.pm:91):91:
Why didn't foreign charset rules catch this?Begin forwarded message:From: [EMAIL PROTECTED]Date: September 10, 2006 2:17:51 PM CDTTo: [EMAIL PROTECTED]Subject: פריצת דרך מאתגרתX-Spam-Dcc: : grub.camros.com 1113; Body=5 Fuz1=5 Fuz2=3X-Spam-Flag: YESX-Spam-Checker-Version: SpamAssassin 3.1.1 (2006-03
If you converted all times to GMT and compared them against now and if they were > now how often would that be FPing?On Sep 10, 2006, at 2:21 PM, Daryl C. W. O'Shea wrote: Accepting to folder lists/unix/spamassassin-usersFrom: "Daryl C. W. O'Shea" <[EMAIL PROTECTED]>Date: September 10, 2006 2:21
I haven't read any of the rest of this thread, but I'll respond to the
latest...
Robert Nicholson wrote:
Well either way. Assuming that the lowest numbered date diff represents
the real receive time is niave at best.
As is assuming that the rule assumes that the times are real.
Comparing the
Well either way. Assuming that the lowest numbered date diff
represents the real receive time is niave at best.
On Sep 10, 2006, at 2:03 PM, Daryl C. W. O'Shea wrote:
Robert Nicholson wrote:
This looks to be something Spammers are deliberately working
around as how could you possibly get t
Robert Nicholson wrote:
This looks to be something Spammers are deliberately working around as
how could you possibly get two received headers with the same date, time
to the second?
That's like saying how could you possibly get two received headers with
the same date, time to the minute or
The last two received headers in the message looked forged?
[12657] dbg: received-header: parsed as [ ip=61.15.158.107
rdns=cm61-15-158-107.hkcable.com.hk helo=!71353437! by=caching4-
true.asianet.co.th ident= [EMAIL PROTECTED] intl=0 id=WDL-
C580H-YQ auth= ]
[12657] dbg: received-header: rel
At a casual guess, I'd say that the UNPARSABLE_RELAY might be related.
Run it through with -D on and see which Received: headers are unparseable.
Robert Nicholson wrote:
> Why didn't DATE_IN_FUTURE file on this message?
>
> Begin forwarded message:
>
>> *From: *"Frederick Harris" <[EMAIL PROTECT
David Cary Hart wrote:
We are listing a large number of ranges that SORBS does not. There
are numerous operational differences that make both lists useful.
It's ok if the lists contain different entries. my concern is if a list
includes another one. you can setup aggregate lists if you want
So if I use the following instead it then fires the rule # use the date with the smallest absolute difference # (experimentally, this results in the fewest false positives) @diffs = sort { abs($a) <=> abs($b) } @diffs; # pick the first one that isn't 0 foreach my $diff (@diffs) { next if
On Sun, Sep 10, 2006 at 11:14:13AM -0500, Steven Stern wrote:
> The following appears periodically in my maillog. I think it has to do
> with an attempt to do a cpan upgrade or SpamAssassin that I had to back
> out and replace with the Fedora RPM. In any case, is this anything to
> worry about?
I
i'm guessing what happened here was that it took the first Received header... which is the same as the Date: header.What i'd rather it take though is the header closest to me.so instead of usingReceived: from [61.15.158.107] (helo=[71353437]) by caching4-true.asianet.co.th with smtp (Exim 4.60 (Fre
It seems to have decided that date_diff is 0 for some reason in check_for_shifted_dateOn Sep 10, 2006, at 11:42 AM, Robert Nicholson wrote:Why didn't DATE_IN_FUTURE file on this message?Begin forwarded message:From: "Frederick Harris" <[EMAIL PROTECTED]>Date: January 14, 2007 12:07:22 AM CSTTo: [EM
Andreas Pettersson wrote:
I don't know. I haven't used RELAY_COUNTRY, but now that I'm aware of
its existense I'll have a look at it :)
Ok, I've had a quick look now. RelayCountry presents the country code of
the last relay either as a separate header, or as the _RELAYCOUNTRY_
header mar
mouss wrote:
How does/would this compare to using RELAY_COUNTRY?
are they similar (so one should only use one of them) or complementary?
I don't know. I haven't used RELAY_COUNTRY, but now that I'm aware of
its existense I'll have a look at it :)
Regards,
Andreas
Russell Jones wrote:
Sorry if this is covered somewhere in the documentation, and if so can someone
be nice enough to point it to me :) I can't seem to locate it.
I would like to set spamassassin to use a site-wide configuration, so that when
I tell it to sa-learn, it will apply what it learns
Bo Mellberg wrote:
jdow skrev:
From: "Bo Mellberg" <[EMAIL PROTECTED]>
I have SA 3.1.4 configured and running on Debian Sarge using apt-get.
I'm finding it hard to know what directory is actually used for the
bayes-database:
max:~# ls /root/.spamassassin/ -al
total 2344
drwx-- 2 root
Why didn't DATE_IN_FUTURE file on this message?Begin forwarded message:From: "Frederick Harris" <[EMAIL PROTECTED]>Date: January 14, 2007 12:07:22 AM CSTTo: [EMAIL PROTECTED]Subject: Drink it, forget it !X-Spam-Dcc: : grub.camros.com 1113; Body=1 Fuz1=1X-Spam-Flag: YESX-Spam-Checker-Version: SpamAs
The following appears periodically in my maillog. I think it has to do
with an attempt to do a cpan upgrade or SpamAssassin that I had to back
out and replace with the Fedora RPM. In any case, is this anything to
worry about?
Sep 10 11:12:30 mooch spamd[26250]: (?:(?<=[\s,]))* matches null strin
jdow wrote:
Are you sure that the path from the sender to you involves exactly
one SpamAssassin run, yours? The LAST SpamAssassin run is the one that
gets scored. And many initial setups seem to somehow get SpamAssassin
into the loop twice, which is not good.
Another caveat is to run spamassass
Andreas Pettersson wrote:
In case anybody is interrested, I've compiled a config file for the
geo zone at TQM http://tqmcube.com/worldzone.php
It might not be of great use, but it is interresting to gather some
statistics of where the mails come from.
Files found here
http://anp.ath.cx/tqmcube
On Sun, 10 Sep 2006 13:38:37 +0200, mouss <[EMAIL PROTECTED]> opined:
> David Cary Hart wrote:
> > Based upon removal requests, we are seeing a considerable
> > increase in SA usage. I added some notes to our website recently
> > that I wanted to share on this list:
> >
>
> What's the purpose o
Daryl C. W. O'Shea wrote:
>
>>
>> (yes, I looked up the ip address and pulled a txt record from aol, and
>> yes, the ips are in the range, and yes, I have gotten SPF_SOFTFAIL from
>> domains without any spf records)
>
> Bug 5077 includes a one line patch to fix this. It'll be included in
> 3.1.6 b
David Cary Hart wrote:
Based upon removal requests, we are seeing a considerable increase in
SA usage. I added some notes to our website recently that I wanted to
share on this list:
What's the purpose of duplicating sorbs and other lists? This will only
make unlisting more complicated.
gordonnz wrote:
I am new to modifying SpamAssassin but recently I have been daily getting
several hundred spam e-mails addressed to "anything"@mydomain. Can I create
a sort of white list of my proper addresses so that only my properly
addressed messages get through or is there a better way?
From: "gordonnz" <[EMAIL PROTECTED]>
I am new to modifying SpamAssassin but recently I have been daily getting
several hundred spam e-mails addressed to "anything"@mydomain. Can I create
a sort of white list of my proper addresses so that only my properly
addressed messages get through or is the
I am new to modifying SpamAssassin but recently I have been daily getting
several hundred spam e-mails addressed to "anything"@mydomain. Can I create
a sort of white list of my proper addresses so that only my properly
addressed messages get through or is there a better way?
--
View this message
30 matches
Mail list logo
