Re: A bit OT Question

2007-01-16 Thread Chris
On Tuesday 16 January 2007 8:57 am, Dave Williss wrote: > >> corp.mailsecurity.net.au is using it. > >> > >> They should notice it pretty quickly now that *all* of their inbound > >> mail is being TMPFAILed... :) > >> > >> "spam is way down this week. Did you do something to the server?" > > > > T

Re: This score makes no sense

2007-01-16 Thread Chris
On Tuesday 16 January 2007 8:29 pm, Theo Van Dinter wrote: > On Tue, Jan 16, 2007 at 07:14:05PM -0600, Chris wrote: > > I just got this in my inbox. If clamav scores 10, how can this be marked > > as not spam? > > > > X-Spam-Status: No, score=4.5 required=5.0 tests=BAYES_05,CLAMAV, > > HTM

Re: Which is more efficient: two regexp's or one regexp with alternation?

2007-01-16 Thread Theo Van Dinter
On Tue, Jan 16, 2007 at 06:23:48PM -0700, Kelly Jones wrote: > If I want to block subjects matching "foo" or "bar", is it more > efficient to write two regexps or a single "foo|bar" regexp? It'll be more efficient to do a single regexp. > Or are there multiple rules because the scores are differe

Re: This score makes no sense

2007-01-16 Thread Theo Van Dinter
On Tue, Jan 16, 2007 at 07:14:05PM -0600, Chris wrote: > I just got this in my inbox. If clamav scores 10, how can this be marked as > not spam? > > X-Spam-Status: No, score=4.5 required=5.0 tests=BAYES_05,CLAMAV, > HTML_IMAGE_ONLY_16,HTML_MESSAGE,MIME_HTML_ONLY,REPLY_TO_EMPTY >    

Which is more efficient: two regexp's or one regexp with alternation?

2007-01-16 Thread Kelly Jones
If I want to block subjects matching "foo" or "bar", is it more efficient to write two regexps or a single "foo|bar" regexp? I'd think a single regexp is more efficient, but SpamAssassin ships w/ rule-sets that have multiple rules. Given how many spams people get, even a small improvement in effi

This score makes no sense

2007-01-16 Thread Chris
I just got this in my inbox. If clamav scores 10, how can this be marked as not spam? X-Spam-Virus: Yes (Html.Phishing.Fake.Sanesecurity.06080201) X-Spam-Seen: Tokens 75 X-Spam-New: Tokens 126 X-Spam-ASN: AS14492 66.70.0.0/17 X-Spam-Remote: Host localhost.localdomain X-Spam-Checker-Version:

RE: looking for repository of spam email content

2007-01-16 Thread Michael Scheidell
Don't worry, you just posted to a mailing list that is mirrored everywhere. You will get your spam shortly. ;-) - This email has been scanned and certified safe by SpammerTrap(tm) For Information please see http://www.spammertrap.com

Re: bayes poisoning

2007-01-16 Thread Chris Purves
maillist wrote: I see a few emails every-now-and-then about "bayes poisoning", and am wondering what is means. From what I understand, it is some message that gets learned (only through autolearn?) that has certain characteristics that throw the bayes system off. From what I've seen there

looking for repository of spam email content

2007-01-16 Thread Andrea Lisabeth Civan
Can anyone recommend a site that provides examples of content from spam email? I am a researcher looking for content from the 50 "most recent" or "most prevalent" spams. Is a site like http://spamosphere.wordpress.com/ the best source for this? Thanks! Andrea

Re: getting Bayes token data from spamassassin

2007-01-16 Thread Stuart Robinson
Thanks. Once I have this all figured out, I will write up something and put it on my homepage and post a link to it here. > > >> A SHA1 hash is taken of the original token value, and the bottom 40 > > >> bits are used as the token from then-on. There is a plugin call > > >> which can be used to s

Re: getting Bayes token data from spamassassin

2007-01-16 Thread Theo Van Dinter
On Tue, Jan 16, 2007 at 02:02:01PM -0800, Stuart Robinson wrote: > Couldn't the raw tokens just be kept in the same database by adding an > additional column to the table bayes_token that isn't indexed? That > wouldn't affect performance too much, would it? Besides requiring a new data layout for

Re: getting Bayes token data from spamassassin

2007-01-16 Thread Stuart Robinson
> On Tue, Jan 16, 2007 at 10:21:14AM +, Justin Mason wrote: > > by the way, a nice, working plugin that does this would be quite useful on > > the CustomPlugins wiki page, or contributed as an optional plugin... > > The plugin itself is pretty trivial -- the question is: what to do with > the

Re: sa-update failing - I think dev just went live again?

2007-01-16 Thread Daryl C. W. O'Shea
Jason Haar wrote: Justin Mason wrote: 24F434CE is the active subkey of 5244EC45: ... sounds like your sa-update key info got lost somehow? Yeah. This is a CentOS-4 server I installed yesterday. Looks like something went wrong with it. The error message says: Perhaps you need to import th

RE: ClamAV plugin with 3.1.17

2007-01-16 Thread Brent Kennedy
Woops I meant .cf file not pm file. I just wanted to make sure this is still accurate: http://wiki.apache.org/spamassassin/ClamAVPlugin -Original Message- From: Brent Kennedy [mailto:[EMAIL PROTECTED] Sent: Tuesday, January 16, 2007 3:18 PM To: users@spamassassin.apache.org Subject: C

ClamAV plugin with 3.1.17

2007-01-16 Thread Brent Kennedy
I just upgraded to 3.1.7 and I just wanted to make sure that clamav is still run via the pm file and not some how enabled via a .pre file. Thanks -Brent

Re: sa-update failing - I think dev just went live again?

2007-01-16 Thread Jason Haar
Justin Mason wrote: > > 24F434CE is the active subkey of 5244EC45: > > ... > sounds like your sa-update key info got lost somehow? > > Yeah. This is a CentOS-4 server I installed yesterday. Looks like something went wrong with it. The error message says: Perhaps you need to import the channel'

Re: A bit OT Question

2007-01-16 Thread Dave Williss
Chris wrote: On Monday 15 January 2007 7:07 pm, John D. Hardin wrote: On Mon, 15 Jan 2007, Chris wrote: I keep seeing the below bounces in spam reports I'm sending out. I know the ordb is dead, who is using it, Earthlink or corp.mailsecurity.net.au? [EMAIL PROTECTED] SMTP error

RE: Checking for PTR record

2007-01-16 Thread Robert Swan
I use this header rule for the same thing: header LOCAL_INVALID_PTR2 Received =~ /from \S+ \(unknown / score LOCAL_INVALID_PTR2 0.8 describe LOCAL_INVALID_PTR2 Header contains no PTR2 Robert Peace he would say instead of goodbyepeace my brother. -Original M

Re: getting Bayes token data from spamassassin

2007-01-16 Thread Theo Van Dinter
On Tue, Jan 16, 2007 at 10:21:14AM +, Justin Mason wrote: > by the way, a nice, working plugin that does this would be quite useful on > the CustomPlugins wiki page, or contributed as an optional plugin... The plugin itself is pretty trivial -- the question is: what to do with the token inform

Re: sa-update failing - I think dev just went live again?

2007-01-16 Thread Justin Mason
Jason Haar writes: > Similar to the issue found Jan 1 2007, I am currently seeing > > # sa-update > error: GPG validation failed! > The update downloaded successfully, but it was not signed with a trusted GPG > key. Instead, it was signed with the following keys: > > 24F434CE > > Perhaps y

spamc -d failover question

2007-01-16 Thread Marc Perkel
If you use spamc -d host1,host2,host3 and suppose that it connects to host1 but you have hit the max number of connections, will it fail over to hots2 or will it just fail? Thanks in advance.

Re: restart sequence after changing configuration

2007-01-16 Thread Robert Brooks
Mike Kenny wrote: As I understand the situation when using amavis/spamassassin/postfix the flow of a messages is that it is received by postfix, passed to amavisd, from there to clamav, then to spamassassin and then back to postfix. My questions are: 1. is this correct? 2. if I change spamass

restart sequence after changing configuration

2007-01-16 Thread Mike Kenny
As I understand the situation when using amavis/spamassassin/postfix the flow of a messages is that it is received by postfix, passed to amavisd, from there to clamav, then to spamassassin and then back to postfix. My questions are: 1. is this correct? 2. if I change spamassasin's local.cf or use

Re: getting Bayes token data from spamassassin

2007-01-16 Thread Justin Mason
Michael Parker writes: > Stuart Robinson wrote: > > Hello, all. > > > >> On Mon, Jan 15, 2007 at 01:54:07AM -0800, Stuart Robinson wrote: > >>> I've searched around a bit, both on gmane and Google, but I haven't > >>> found much more information regarding your two points. What IS > >>> stored in