My bayes journal just keeps growing

2006-12-13 Thread Ramprasad
I run SA 3.1.5 with MailScanner I have in my cf file bayes_learn_to_journal 1 use_bayes 1 bayes_path /var/spool/MailScanner/spamassassin/bayes bayes_file_mode 0666 bayes_auto_expire 0 The problem is my bayes_journal file grows immensely ( around 500Mb a day ) but the bayes_toks f

james and spamassassin

2006-12-13 Thread roger
Hi. Is there anyone has experience in using Apache james working together with spamassassin to anti spam?my OS is linux Gentoo.I have read through the james Doc and spamassassin Doc,however I can't find anything useful.Thanks in advance. roger 2006-12-14

Re: SPF is hopelessly broken and must die!

2006-12-13 Thread Matt Kettler
Marc Perkel wrote: > From openspf.org > > http://old.openspf.org/aspen.html > Marc, this link is not describing SPF as an anti-spam technology. It's describing how SPF can be coupled with an accreditation service to create an anti-spam technology. Nobody's saying SPF has no use in anti-spam, it ha

Re: SPF is hopelessly broken and must die!

2006-12-13 Thread Mathias Homann
Am Donnerstag, 14. Dezember 2006 03:53 schrieb Matt Kettler: > > Yep - they are using "normal" email technology. > > No they're not. They're falsifying mail headers. Something last I > checked was actually illegal in the united states under CAN-SPAM. and a russian criminal sitting in litavia, usi

Re: Why is my yahoo mail being tagged by DCC ?

2006-12-13 Thread Peter Matulis
--- Richard Ozer <[EMAIL PROTECTED]> wrote: > Be careful about the content. If, for instance, you create a message > that has only the word "test" in it, DCC will pick it up. Were you > using short phrases or single words? > > I ran into the exact same thing yesterday when I was testing out

Re: Problems installing 3.1.7 - no update for the binaries

2006-12-13 Thread Steve Sanders
On 14/12/06 1:51 PM, "Albert E. Whale" <[EMAIL PROTECTED]> wrote: > The Target system is Mandriva 2007. Running Perl 5.8.8. > > I have been using SpamAssassin for quite a while. Today I encountered > issues installing version 3.1.7. As strange as it is, it starts with > the installation of the

Re: Problems installing 3.1.7 - no update for the binaries

2006-12-13 Thread Steve Sanders
On 14/12/06 1:51 PM, "Albert E. Whale" <[EMAIL PROTECTED]> wrote: > The Target system is Mandriva 2007. Running Perl 5.8.8. > > I have been using SpamAssassin for quite a while. Today I encountered > issues installing version 3.1.7. As strange as it is, it starts with > the installation of the

Re: Image spam and Bayes problem

2006-12-13 Thread René Berber
Gary W. Smith wrote: > I’ve seen a sharp increase in our OB Ticker spam’s that consist of an > image and some text. It passed the greylist just fine and was labeled > as bayes_00. > > X-Spam-Status: No, score=-7.5 required=5.0 tests=BAYES_00,EXTRA_MPART_TYPE, > > HTML_30_40,HTML_IMAGE_O

Re: spamd won't stay dead. (possible follow-up to bug 4304?)

2006-12-13 Thread snowcrash+spamassassin
> % ps -ef | grep spamd >ps: illegal option -- f Hrm. What platform are you on? "ps -axwg", "ps -el" ? well, what day/time is it? at the moment, MacOSXServer. during the day, usually an OpenSuSE or FreeBSD box. Anyway, you could also look at using a pid file. Tell spamd when startin

Re: spamd won't stay dead. (possible follow-up to bug 4304?)

2006-12-13 Thread Theo Van Dinter
On Wed, Dec 13, 2006 at 09:05:39PM -0800, snowcrash+spamassassin wrote: > not sure what you're looking for here, but, > > % ps -ef | grep spamd >ps: illegal option -- f Hrm. What platform are you on? "ps -axwg", "ps -el" ? Anyway, you could also look at using a pid file. Tell spamd when

Re: spamd won't stay dead. (possible follow-up to bug 4304?)

2006-12-13 Thread snowcrash+spamassassin
Hrm. There's no parent in that output. Try "ps -ef | grep spamd" and see what happens. not sure what you're looking for here, but, % ps -ef | grep spamd ps: illegal option -- f > kills the two child processes, which then immediately restart. Yeah, you need to deal with the parent, not

Re: Image spam and Bayes problem

2006-12-13 Thread Theo Van Dinter
On Wed, Dec 13, 2006 at 08:55:26PM -0800, Gary W. Smith wrote: > The image contained the OB stock ticker and the text was random, but > coherent sentences. What's the best course of action to block these > now. I'm running a couple rules from SARE. Are there some specific > ones that will help o

Re: Why is my yahoo mail being tagged by DCC ?

2006-12-13 Thread Richard Ozer
Be careful about the content. If, for instance, you create a message that has only the word "test" in it, DCC will pick it up. Were you using short phrases or single words? I ran into the exact same thing yesterday when I was testing out a new SA box, and that was the cause. RO - Ori

Image spam and Bayes problem

2006-12-13 Thread Gary W. Smith
I haven't been watching the list much lately so I apologize if this topic has been kicked to death. I've seen a sharp increase in our OB Ticker spam's that consist of an image and some text. It passed the greylist just fine and was labeled as bayes_00. X-Spam-Status: No, score=-7.5 required=5.

Re: spamd won't stay dead. (possible follow-up to bug 4304?)

2006-12-13 Thread Theo Van Dinter
On Wed, Dec 13, 2006 at 08:18:37PM -0800, snowcrash+spamassassin wrote: > ps -ax | grep -i spamd > 922 ?? S 0:00.18 spamd child > 923 ?? S 0:00.14 spamd child > 24006 p1 R+ 0:00.01 grep -i spamd Hrm. There's no parent in that output. Try "ps -ef |

spamd won't stay dead. (possible follow-up to bug 4304?)

2006-12-13 Thread snowcrash+spamassassin
after launching spamd (31x branch, r486953) with, spamd --daemonize --nouser-config --allow-tell --allowed-ips=192.168.1.10,127.0.0.1 --listen-ip=127.0.0.1 --port=783 > /var/log/spamd.log & i see only, ps -ax | grep -i spamd 922 ?? S 0:00.18 spamd child

Re: MSRBL

2006-12-13 Thread Chris
On Wednesday 13 December 2006 11:35 am, Bret Miller wrote: > Has anyone here tried MSRBL (http://www.msrbl.com/site/)? I'm running it > in trial now, but thought I'd ask to see if anyone here had an opinion > before doing anything serious with it. > > TIA, > Bret Bret, on my home system I use the

Re: any TextWrapError follow-up?

2006-12-13 Thread snowcrash+spamassassin
I'd say make sure you have something newer than that and try it again. If you still have problems, please reopen bug 5052 w/ the Text::Wrap and SA versions. yup. too old. i'm co'ing current @ (Revision: 486953) which should do the trick. thanks.

Re: any TextWrapError follow-up?

2006-12-13 Thread Theo Van Dinter
On Wed, Dec 13, 2006 at 07:11:50PM -0800, snowcrash+spamassassin wrote: > where it's noted that the bug was reported to the TextWrap author. > anyone have a bug reference for the issue @ TextWrap? If you follow from the wiki page to the bugzilla listing, there's a link to the Text::Wrap RT entry:

any TextWrapError follow-up?

2006-12-13 Thread snowcrash+spamassassin
i've come across this issue, http://wiki.apache.org/spamassassin/TextWrapError where it's noted that the bug was reported to the TextWrap author. is this being followed up one at all by anyone here? anyone have a bug reference for the issue @ TextWrap? thanks.

SpamdForkScaling messages?

2006-12-13 Thread snowcrash+spamassassin
i have spamassassin --version SpamAssassin version 3.1.8-r454679 running on Perl version 5.8.8 in my debug-level spamd log i see frequently repeating instances of, Wed Dec 13 18:36:13 2006 [923] dbg: prefork: periodic ping from spamd parent Wed

Re: SPF is hopelessly broken and must die!

2006-12-13 Thread Matt Kettler
Marc Perkel wrote: > > > Matt Kettler wrote: >> >> Mark, SPF isn't an anti-spam technology. Anyone who says it is, is an >> imbecile. SPF is an anti-forgery technology. Those who continue to think >> of SPF purely as a spam control technology are doomed to be disappointed >> and/or endlessly make p

Problems installing 3.1.7 - no update for the binaries

2006-12-13 Thread Albert E. Whale
The Target system is Mandriva 2007. Running Perl 5.8.8. I have been using SpamAssassin for quite a while. Today I encountered issues installing version 3.1.7. As strange as it is, it starts with the installation of the following CPAN Module: perl -MCPAN -e 'install ExtUtils::MakeMaker' Can

Re: [Bug report] Botnet uses a lot of time with DSN message

2006-12-13 Thread René Berber
René Berber wrote: [snip] > What I don't understand is what is Botnet doing for about 60 to 80 seconds, > where I pointed out that it stoped. To be clear, I ran the test 3 times and > it > always stopped, so it was no glitch, or temporary problem. Perhaps it was, I just re-ran the test and it to

Re: SPF is hopelessly broken and must die!

2006-12-13 Thread Daryl C. W. O'Shea
Marc Perkel wrote: Daryl C. W. O'Shea wrote: Marc Perkel wrote: So - if you use it for whitelisting - how do you distinguish a good sender using SPF and a spammer using SPF? Wouldn't you be whitelisting spam? A good sender is someone or an organization I know I want to receive mail from.

Re: SPF is hopelessly broken and must die!

2006-12-13 Thread Marc Perkel
Daryl C. W. O'Shea wrote: Marc Perkel wrote: I'm not the one who started this discussion. I did change the subject line when the pro SPF lobby entered my other thread and moved it off the topic I was talking about. Right, I forgot. Your original topic was about securing consumer networks

Re: SPF is hopelessly broken and must die!

2006-12-13 Thread Daryl C. W. O'Shea
Marc Perkel wrote: I'm not the one who started this discussion. I did change the subject line when the pro SPF lobby entered my other thread and moved it off the topic I was talking about. Right, I forgot. Your original topic was about securing consumer networks, something that is way off t

RE: MSRBL

2006-12-13 Thread Bret Miller
> > Has anyone here tried MSRBL (http://www.msrbl.com/site/)? > I'm running > > it in trial now, but thought I'd ask to see if anyone here had an > > opinion before doing anything serious with it. > > I ran it here for a few hours with rblsmtpd and it got 0 hits, which > also means 0 FP's on a very

Re: SPF is hopelessly broken and must die!

2006-12-13 Thread Marc Perkel
Daryl C. W. O'Shea wrote: Marc Perkel wrote: OK Daryl, How do you deal with people forwarding email from another domain when using SPF? Marc, please stop for a moment and make sure you have a clear picture of what you're trying to achieve by this debate which is really close to turning i

Re: [Bug report] Botnet uses a lot of time with DSN message

2006-12-13 Thread René Berber
John Rudd wrote: > René Berber wrote: >> John Rudd wrote: >> [snip] >>> It can be downloaded from: >>> >>> http://people.ucsc.edu/~jrudd/spamassassin/Botnet.tar >>> >>> As usual, feedback, statistics, bug reports, feature suggestions, are >>> all welcome. >> [snip] >> >> Botnet 0.6 causes a timeo

Re: FuzzyOCR Plugin question

2006-12-13 Thread René Berber
Evan Platt wrote: > I hope someone here can help, I've looked at the FuzzyOCR wiki and can't > seem to find an answer.. > > Is there a way to feed a GIF to FuzzyOCR and 'see' the output ? No. FuzzyOcr is a plugin not a standalone application, if you want to test a gif or other image you have to

Re: SPF is hopelessly broken and must die!

2006-12-13 Thread Daryl C. W. O'Shea
Marc Perkel wrote: OK Daryl, How do you deal with people forwarding email from another domain when using SPF? Marc, please stop for a moment and make sure you have a clear picture of what you're trying to achieve by this debate which is really close to turning into a big flame war. If you

Re: SPF is hopelessly broken and must die!

2006-12-13 Thread Kelson
Marc Perkel wrote: Second - tell it to everyone here who is suggesting that SPF is a spam solution of some sort. Oddly enough, the people who seem to be most adamant in stating that SPF is a spam solution are those like yourself who consider it useless. Those who find it useful seem to think

RE: Good source for IP addresses by country

2006-12-13 Thread Giampaolo Tomassoni
From: Ken A [mailto:[EMAIL PROTECTED] > > Giampaolo Tomassoni wrote: > > From: Ken A [mailto:[EMAIL PROTECTED] > >> Just add 10 to a test that matches everything, then subtract 10 for > >> being in the U.S. > > > > Yeah. And keep 10 for canada, mexico and south america... > > > > You're beginni

Re: DNSRBL

2006-12-13 Thread Jason Haar
Richard Frovarp wrote: > > Make sure you are running a local caching name server. Even with a > real name server on the same subnet, I have heard of massive delays in > DNS lookups as a result. This in turn causes a massive slowdown in the > processing of mail. You are absolutely correct. However -

RE: SPF is hopelessly broken and must die!

2006-12-13 Thread Giampaolo Tomassoni
From: Marc Perkel [mailto:[EMAIL PROTECTED] > > > OK Daryl, > > How do you deal with people forwarding email from another domain when > using SPF? Right. That's the big reason for using +all (or not using SPF at all). Using +all means to me: "Look, I - the postmaster - I'm aware of SPF, but

Re: Good source for IP addresses by country

2006-12-13 Thread Ken A
Giampaolo Tomassoni wrote: From: Ken A [mailto:[EMAIL PROTECTED] Just add 10 to a test that matches everything, then subtract 10 for being in the U.S. Yeah. And keep 10 for canada, mexico and south america... You're beginning to speak alone, isn't it? Well, the way I look at it, if you ar

Re: SPF is hopelessly broken and must die!

2006-12-13 Thread Marc Perkel
OK Daryl, How do you deal with people forwarding email from another domain when using SPF?

Re: SPF is hopelessly broken and must die!

2006-12-13 Thread Marc Perkel
Bookworm wrote: I think I can say that even as a casual user of the list (I only take care of about 10 smaller mail systems), I find the discussions more useful than not. I would have little to no use for the direct SPF mailing list - but in so far as it applies to anti-spam, I'm more than

Re: parsing cid: from HTML spam email

2006-12-13 Thread Theo Van Dinter
On Thu, Dec 14, 2006 at 01:31:44AM +0100, vertito wrote: > this is a repost: > body MY_harsh_content_RULE18/cid:/is ... and myself and some others have already responded to you. It's not a useful rule in and of itself, but body isn't going to work. The easiest thing to do is use sa-upda

Re: Botnet question

2006-12-13 Thread John Rudd
Hm. I don't see anything wrong with that domain. I'll look into it. Carlos Horowicz wrote: Hi John, the IP Address is 64.76.24.252 and the domain is comintec.net , Botnet version is 0.6 under SA 3.1.7 THanks, -Carlos John Rudd wrote: I would have to know the IP address of the rel

parsing cid: from HTML spam email

2006-12-13 Thread vertito
this is a repost: I have this rule from local.cf body MY_harsh_content_RULE18/cid:/is describe MY_harsh_content_RULE18Harsh body content score MY_harsh_content_RULE18 5.0 but still I am receiving this HTML spam emails that scores lower than 2.0. The ae above rules doesnt

Re: SPF is hopelessly broken and must die!

2006-12-13 Thread Robert Blayzor
Marc Perkel wrote: > "SPF is not anti-spam in the same way that flour is not food: it is part of > the solution." > > The solution - to what? SPAM! "part of the solution", not "the solution". Big difference. Controlling forgeries is just one step at taking one of the tools out of the tool bag.

Re: SPF is hopelessly broken and must die!

2006-12-13 Thread Gino Cerullo
On 13-Dec-06, at 6:38 PM, Marc Perkel wrote: From openspf.org http://old.openspf.org/aspen.html What's your point? Did you bother reading the article. It talks about accreditation and reputation and only uses spam as an example. You saw a couple of graphics that say spam and ham and now

Re: Botnet question

2006-12-13 Thread Carlos Horowicz
Hi John, the IP Address is 64.76.24.252 and the domain is comintec.net , Botnet version is 0.6 under SA 3.1.7 THanks, -Carlos John Rudd wrote: I would have to know the IP address of the relay in order to give a meaningful answer. Just the 0 shouldn't have been enough. Though, if on

Re: SPF is hopelessly broken and must die!

2006-12-13 Thread Marc Perkel
Robert Blayzor wrote: Marc Perkel wrote: From openspf.org http://old.openspf.org/aspen.html Also from the SPF FAQ: "Sender Policy Framework (SPF) is an attempt to control forged e-mail. SPF is not directly about stopping spam – junk email. It is about giving domain owners a way to

Re: Botnet question

2006-12-13 Thread John Rudd
I would have to know the IP address of the relay in order to give a meaningful answer. Just the 0 shouldn't have been enough. Though, if one of the octets is 0, and you're using an older version of botnet, it might have matched that one octet twice. That's a bug I'm pretty sure I fixed in

Re: SPF is hopelessly broken and must die!

2006-12-13 Thread Bookworm
John Rudd wrote: Spam Assassin wrote: Why was this topic not started on the SPF list? Was the original poster of this topic looking to get MORE attention on the SpamAssassin list? Whether you and the other amateur-topic-police* like it or not, the subject is related to the more general subj

Re: DNSRBL

2006-12-13 Thread Richard Frovarp
Jason Haar wrote: Theo Van Dinter wrote: On Wed, Dec 13, 2006 at 03:35:30PM -0600, Mike French wrote: Do these normally timeout or do they need to be removed from a rule? I'm thinking they are timed out because nothing was found? The problem is likely related to your nam

Re: SPF is hopelessly broken and must die!

2006-12-13 Thread Daryl C. W. O'Shea
Marc Perkel wrote: Justin Mason wrote: Marc -- Please pay attention to what Matt wrote yesterday. Repeat: SPF is *NOT* for catching spam. It works great at what we use it for in SpamAssassin -- as an authentication mechanism, to detect legit ham and whitelist it. This is what you use authe

Re: Breaking up the Bot army - we need a plan

2006-12-13 Thread John Rudd
Duncan Hill wrote: On Monday 11 December 2006 16:16, John Rudd wrote: Duncan Hill wrote: I just finished a very quick test of the Botnet tool, and the sheer number of FPs against eBy mail coming from eBay's servers was staggering - literally every single mail from eBay. It also, for my testing

FuzzyOCR Plugin question

2006-12-13 Thread Evan Platt
I hope someone here can help, I've looked at the FuzzyOCR wiki and can't seem to find an answer.. Is there a way to feed a GIF to FuzzyOCR and 'see' the output ? ie let's say I have a GIF which has "THIS STOCK WILL EXPLODE TOMORROW!" but there's some background noise to attempt to obfuscate it

Re: SPF is hopelessly broken and must die!

2006-12-13 Thread Robert Blayzor
Marc Perkel wrote: > From openspf.org > > http://old.openspf.org/aspen.html Also from the SPF FAQ: "Sender Policy Framework (SPF) is an attempt to control forged e-mail. SPF is not directly about stopping spam – junk email. It is about giving domain owners a way to say which mail sources are le

Botnet question

2006-12-13 Thread Carlos Horowicz
Hi list, I came across an e-mail originating at a customer domain hosted in a dedicated server provided by my company, whose outgoing relay and incoming MX are the same, namely mx0., and that Botnet in my server tagged with: BOTNET=5, BOTNET_CLIENT=0.01, BOTNET_IPINHOSTNAME=0.01 The onl

Re: SPF is hopelessly broken and must die!

2006-12-13 Thread Jay Chandler
Marc Perkel wrote: Justin Mason wrote: Marc Perkel writes: [EMAIL PROTECTED] wrote: Sounds good, I found this an interesting read about why SPF is ineffective: http://en.hakin9.org/products/articleInfo/102 Excellent article. SPF catches no spam - but does create false positi

Re: SPF is hopelessly broken and must die!

2006-12-13 Thread j o a r
On 14 dec 2006, at 00.38, Marc Perkel wrote: From openspf.org http://old.openspf.org/aspen.html This is a description of something that you could conceivably build on top of SPF. What is your point? j o a r

Re: SPF is hopelessly broken and must die!

2006-12-13 Thread Marc Perkel
From openspf.org http://old.openspf.org/aspen.html

Re: SPF is hopelessly broken and must die!

2006-12-13 Thread Marc Perkel
Justin Mason wrote: Marc Perkel writes: [EMAIL PROTECTED] wrote: Sounds good, I found this an interesting read about why SPF is ineffective: http://en.hakin9.org/products/articleInfo/102 Excellent article. SPF catches no spam - but does create false positives. It's less than

Re: MSRBL

2006-12-13 Thread Rick Macdougall
Bret Miller wrote: Has anyone here tried MSRBL (http://www.msrbl.com/site/)? I'm running it in trial now, but thought I'd ask to see if anyone here had an opinion before doing anything serious with it. I ran it here for a few hours with rblsmtpd and it got 0 hits, which also means 0 FP's on a

Re: Bayes doesn't seem to be working for me

2006-12-13 Thread Rainer Dorsch
Am Mittwoch, 13. Dezember 2006 23:40 schrieb Theo Van Dinter: > On Wed, Dec 13, 2006 at 10:39:08PM +0100, Rainer Dorsch wrote: > > [EMAIL PROTECTED]:~$ spamassassin -D --lint 2>&1 |grep bayes > > debug: config: read file /usr/share/spamassassin/23_bayes.cf > > debug: bayes: 18897 tie-ing to DB file

Re: SPF is hopelessly broken and must die!

2006-12-13 Thread Robert Blayzor
Marc Perkel wrote: > SPF catches no spam - but does create false positives. It's less than > useless. It's dangerous. SPF's job is not to catch spam, period! No matter how many times you claim it's supposed to "catch spam", you could never be more wrong. It's sole purpose is to allow domain owne

RE: Good source for IP addresses by country

2006-12-13 Thread Giampaolo Tomassoni
From: Ken A [mailto:[EMAIL PROTECTED] > Just add 10 to a test that matches everything, then subtract 10 for > being in the U.S. Yeah. And keep 10 for canada, mexico and south america... You're beginning to speak alone, isn't it? giampaolo > Ken A. > Pacific.Net > > Robert Swan wrote: > > Let'

Re: [Bug report] Botnet uses a lot of time with DSN message

2006-12-13 Thread John Rudd
René Berber wrote: John Rudd wrote: [snip] It can be downloaded from: http://people.ucsc.edu/~jrudd/spamassassin/Botnet.tar As usual, feedback, statistics, bug reports, feature suggestions, are all welcome. [snip] Botnet 0.6 causes a timeout while MA is running SA on a DSN message. It lo

Re: DNSRBL

2006-12-13 Thread Jason Haar
Theo Van Dinter wrote: > On Wed, Dec 13, 2006 at 03:35:30PM -0600, Mike French wrote: > >> Do these normally timeout or do they need to be removed from a rule? I'm >> thinking they are timed out because nothing was found? >> > > The problem is likely related to your name servers. There sho

Re: parsing cid: from HTML spam email

2006-12-13 Thread David B Funk
On Wed, 13 Dec 2006, vertito wrote: > I have this rule from local.cf > > body MY_harsh_content_RULE18/cid:/is > describe MY_harsh_content_RULE18Harsh body content > score MY_harsh_content_RULE18 5.0 > > but still I am receiving this HTML spam emails that scores lower than 2.0. >

Re: DNSRBL

2006-12-13 Thread Theo Van Dinter
On Wed, Dec 13, 2006 at 03:35:30PM -0600, Mike French wrote: > Do these normally timeout or do they need to be removed from a rule? I'm > thinking they are timed out because nothing was found? The problem is likely related to your name servers. There should always be a response, even if it's "not

Re: Bayes doesn't seem to be working for me

2006-12-13 Thread Theo Van Dinter
On Wed, Dec 13, 2006 at 10:39:08PM +0100, Rainer Dorsch wrote: > [EMAIL PROTECTED]:~$ spamassassin -D --lint 2>&1 |grep bayes > debug: config: read file /usr/share/spamassassin/23_bayes.cf > debug: bayes: 18897 tie-ing to DB file R/O /home/rd/.spamassassin/bayes_toks > debug: bayes: 18897 tie-ing t

Re: Bayes doesn't seem to be working for me

2006-12-13 Thread Theo Van Dinter
On Wed, Dec 13, 2006 at 04:47:53PM -0500, Robert Swan wrote: > Might want to check your local.cf file for: > use_bayes 1 that's the default, so there's no point in setting it unless you want to disable it. -- Randomly Selected Tagline: Professor: I've been a Harold Zoid fan since

Re: Simple mail from Dynamic IP listed as spam

2006-12-13 Thread Daryl C. W. O'Shea
Martin von Gagern wrote: Hello! I've been using SpamAssassin here for some time now, and haven't done much configuration. Procmail calls spamassassin on my Gentoo Linux box, configured without bayes but with network checks. Configure your trusted_networks. http://wiki.apache.org/spamassassin/

Re: Good source for IP addresses by country

2006-12-13 Thread Daryl C. W. O'Shea
Robert Swan wrote: Let's say I wanted to score everything but the US. Do I have to write rule for every country or is there an easier way? Despite me thinking that that is a horrible idea, probably because you wouldn't get this message if my primary out-mx is down, you could just use a meta r

Re: SPF is hopelessly broken and must die!

2006-12-13 Thread Daryl C. W. O'Shea
Thomas Bolioli wrote: You are speaking for me... This became a very relevant topic when the spf tests were packaged with SA by default. As someone who is having a major issue with spf, it is very important that those making these decisions here about the issues that most are having with SPF. I

Re: Simple mail from Dynamic IP listed as spam

2006-12-13 Thread Jay Chandler
Martin von Gagern wrote: Jason Little wrote: Just fire it through your ISP's mail server. They should be able to relay for you without a problem. Jason Why would things look any different if I use my ISP instead of my IMP (Mail Provider)? I'll check this week, but I'm not conviced y

Re: SPF is hopelessly broken and must die!

2006-12-13 Thread j o a r
On 13 dec 2006, at 15.21, Marc Perkel wrote: True - SPF his hopelessly broken and must die. Not so. It does exactly what it sets out to do. That it allows you to specify that messages for fraud.com can be sent from any IP-address, doesn't change the fact that it's a very concrete advantag

Re: SPF is hopelessly broken and must die!

2006-12-13 Thread Thomas Bolioli
John Rudd wrote: Spam Assassin wrote: Why was this topic not started on the SPF list? Was the original poster of this topic looking to get MORE attention on the SpamAssassin list? Whether you and the other amateur-topic-police* like it or not, the subject is related to the more general subj

RE: Bayes doesn't seem to be working for me

2006-12-13 Thread Robert Swan
Might want to check your local.cf file for: It is located in/etc/mail/spamassassin # Enable the Bayes system use_bayes 1 Robert Peace he would say instead of goodbyepeace my brother. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Sent:

Re: Good source for IP addresses by country

2006-12-13 Thread Ken A
Just add 10 to a test that matches everything, then subtract 10 for being in the U.S. Ken A. Pacific.Net Robert Swan wrote: Let's say I wanted to score everything but the US. Do I have to write rule for every country or is there an easier way? Robert header RCVD_IN_NERDSeval:check_rbl(

Bayes doesn't seem to be working for me

2006-12-13 Thread Rainer Dorsch
Hello, I installed exim4 and spamassassin following http://koivi.com/exim4-config/ Installing and configuring Exim 4 on Debian Bayes did not work and I read the wiki entry: http://wiki.apache.org/spamassassin/BayesNotWorking Bayes doesn't seem to be working for me! To create the bayes databa

DNSRBL

2006-12-13 Thread Mike French
Postfix/Amavis-new Spamassassin 3.1.4 I ran Amavis debug-sa and I'm curious if the is normal? [5846] dbg: dns: success for 9 of 26 queries [5846] dbg: dns: timeout for habeas-firsttrusted after 13 seconds [5846] dbg: dns: timeout for njabl after 13 seconds [5846] dbg: dns: timeout fo

RE: Good source for IP addresses by country

2006-12-13 Thread Robert Swan
Let's say I wanted to score everything but the US. Do I have to write rule for every country or is there an easier way? Robert header RCVD_IN_NERDSeval:check_rbl('nerds','zz.countries.nerd.dk.') describe RCVD_IN_NERDS Received from a spam country tflags RCVD_IN_NERDSnet header RCVD_IN

Re: Simple mail from Dynamic IP listed as spam

2006-12-13 Thread Martin von Gagern
Jason Little wrote: > Just fire it through your ISP's mail server. They should be able to relay > for you without a problem. > > Jason Why would things look any different if I use my ISP instead of my IMP (Mail Provider)? I'll check this week, but I'm not conviced yet. And how about those idea

Re: SPF is hopelessly broken and must die!

2006-12-13 Thread John Rudd
Spam Assassin wrote: Why was this topic not started on the SPF list? Was the original poster of this topic looking to get MORE attention on the SpamAssassin list? Whether you and the other amateur-topic-police* like it or not, the subject is related to the more general subject matter of the l

using "report" in userpref sql table

2006-12-13 Thread Matthew S. Cramer
I'm using the latest SpamAssassin, 3.1.7, with perl 5.8.8 with Slack 11.0, MySQL 5.0.24a, DBD-mysql-3.0008, DBI-1.53. I should also mention I am using MIMEDefang to call the Mail::SpamAssassin routines versus running spamc and spamd, but my question (I believe) is independent of that usage. I te

RE: SPF is hopelessly broken and must die!

2006-12-13 Thread Spam Assassin
Why was this topic not started on the SPF list? Was the original poster of this topic looking to get MORE attention on the SpamAssassin list?

Re: SPF is hopelessly broken and must die!

2006-12-13 Thread John Rudd
Gino Cerullo wrote: On 13-Dec-06, at 12:53 PM, Marc Perkel wrote: Yep - they are using "normal" email technology. That's supposed to work. That's what SPF breaks. It also breaks email forwarding. I prefer to say "email forwarding breaks SPF" but that's just semantics. The truth of the matte

Re: Sorry Dhawal - no personal attacks allowed [OT]

2006-12-13 Thread Kenneth Porter
--On Tuesday, December 12, 2006 10:01 AM -0800 Ken A <[EMAIL PROTECTED]> wrote: Some people on this list have to pay per kb of bandwidth used. You might want to read the list with a newsreader, through gmane. Then you just download the headers and pick and choose the bodies you want. My pra

Re: SPF is hopelessly broken and must die!

2006-12-13 Thread John Rudd
Justin Mason wrote: SPF is *NOT* for catching spam. It works great at what we use it for in SpamAssassin -- as an authentication mechanism, Just to pick nits: SPF is not an authentication mechanism, it's an authorization mechanism. It is VERY important to not confuse the two. (and, while

Re: SPF is hopelessly broken and must die!

2006-12-13 Thread Gino Cerullo
On 13-Dec-06, at 1:15 PM, Marc Perkel wrote: [EMAIL PROTECTED] wrote: Sounds good, I found this an interesting read about why SPF is ineffective: http://en.hakin9.org/products/articleInfo/102 Excellent article. SPF catches no spam - but does create false positives. It's less than useles

RE: Simple mail from Dynamic IP listed as spam

2006-12-13 Thread Jason Little
Just fire it through your ISP's mail server. They should be able to relay for you without a problem. Jason -Original Message- From: Chris Purves [mailto:[EMAIL PROTECTED] Sent: Wednesday, December 13, 2006 2:37 PM To: Martin von Gagern Cc: users@spamassassin.apache.org Subject: Re: Sim

Re: Simple mail from Dynamic IP listed as spam

2006-12-13 Thread Chris Purves
Martin von Gagern wrote: Now I realized that mail I send will be marked by such a setup as spam. There are mostly two rules that hit: HELO_DYNAMIC_IPADDR and RCVD_IN_SORBS_DUL. The latter one only happens some times, I guess it's a timeout issue, because it can happen or not for the very same ma

Re: New advice spam

2006-12-13 Thread Chris Purves
Steve Lake wrote: Those razor2 and pyzor checks look interesting, but I haven't seen them on any of my emails that get filtered. Is that something special you have to setup, or is it a default feature of SA? The spamassassin wiki, as well as manual pages are full of information abo

Re: SPF is hopelessly broken and must die!

2006-12-13 Thread Gino Cerullo
On 13-Dec-06, at 12:53 PM, Marc Perkel wrote: Mark, SPF isn't an anti-spam technology. Anyone who says it is, is an imbecile. SPF is an anti-forgery technology. Those who continue to think of SPF purely as a spam control technology are doomed to be disappointed and/or endlessly make posts l

Re: SPF is hopelessly broken and must die!

2006-12-13 Thread Kris Deugau
Marc Perkel wrote: SPF blocks no spam but it does create false positives on legitimate email. Well, so does any other method of trying to decide if a message is legit or not. If I work for $company, and $company publishes a restrictive SPF record, then (presuming the sysadmin is competent) a

Re: Released patchset 2

2006-12-13 Thread decoder
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Ignore that msg... wasn't meant to go here, sorry :) -BEGIN PGP SIGNATURE- Version: GnuPG v1.4.5 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFFgE9rJQIKXnJyDxURAhmgAJwIbRTfUXxcd2xACQXeSDXqcHsZwQCgoXIJ pqAyV

Re: Released patchset 2

2006-12-13 Thread decoder
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hi, can you provide me the message which triggered the 2 warnings + the error? Also, are your files unchanged or did you add any scanset/preprocessor? Chris -BEGIN PGP SIGNATURE- Version: GnuPG v1.4.5 (GNU/Linux) Comment: Using GnuPG with

Topics for SA presentation?

2006-12-13 Thread Theo Van Dinter
Hey folks, ApacheCon EU will be in May, and they're currently running a Call For Papers. I'm planning to put in at least two proposals (more below), but I'm curious as to what kinds of presentations people would be interested in ...? What kind of information would make you want to goto a conferen

Re: Breaking up the Bot army - we need a plan

2006-12-13 Thread Steve Lake
Well, I have a simple plan. Spammers are inherently greedy, right? Why not offer a $25k-$25mil a head bounty on any spammer captured and brought to justice? Even if we can't convict them on crimes of spamming, we can certainly get them on fraud and other things. There's plenty of la

Re: SPF is hopelessly broken and must die!

2006-12-13 Thread Gino Cerullo
What many of you fail to realize is that although SPF was originally envisioned as an anti-spam tool, because it dealt with a major characteristic of spam, address forgery, it is in fact a domain verification tool. With that in mind, it becomes irrelevant whether spammers publish SPF poli

Re: SPF is hopelessly broken and must die!

2006-12-13 Thread Justin Mason
Marc Perkel writes: > [EMAIL PROTECTED] wrote: > > Sounds good, > > I found this an interesting read about why SPF is ineffective: > > http://en.hakin9.org/products/articleInfo/102 > > Excellent article. > > SPF catches no spam - but does create false positives. It's less than > useless. It's d

Re: SPF is hopelessly broken and must die!

2006-12-13 Thread Marc Perkel
[EMAIL PROTECTED] wrote: Sounds good, I found this an interesting read about why SPF is ineffective: http://en.hakin9.org/products/articleInfo/102 Excellent article. SPF catches no spam - but does create false positives. It's less than useless. It's dangerous.

Re: SPF is hopelessly broken and must die!

2006-12-13 Thread robb
Sounds good, I found this an interesting read about why SPF is ineffective: http://en.hakin9.org/products/articleInfo/102 Quoting Kelson <[EMAIL PROTECTED]>: Resending this since I originally sent it from a misconfigured client (forgot to enable SMTP-AUTH, but POP-before-SMTP let it through)

  1   2   >