Quoting Jari Fredriksson :
Hi,
We're rebuilding a mail server and are having some issues
with SQL-based SA preference lookups. We're running
Postfix 2.5.5 and SA 3.2.5 (Debian Lenny version) -
here's our Postfix config from master.cf:
spamassassin unix - n n - -
pipe
user
> Hi,
>
> We're rebuilding a mail server and are having some issues
> with SQL-based SA preference lookups. We're running
> Postfix 2.5.5 and SA 3.2.5 (Debian Lenny version) -
> here's our Postfix config from master.cf:
> spamassassin unix - n n - -
> pipe
> user=spa
> -Original Message-
> From: Charles Gregory [mailto:cgreg...@hwcn.org]
> Sent: Tuesday, 15 September 2009 9:34 a.m.
> To: users@spamassassin.apache.org
> Subject: Drivel
>
> On Mon, 14 Sep 2009, Clunk Werclick wrote:
> (more drivel)
>
> Good users all. Never heard of a troll?
> Nonsensic
> -Original Message-
> From: --[ UxBoD ]-- [mailto:ux...@splatnix.net]
> Sent: Monday, 14 September 2009 11:27 p.m.
> To: Matus UHLAR - fantomas
> Cc: users@spamassassin.apache.org
> Subject: Re: Non scoring 'Bank Deposit' spam
>
> - "Matus UHLAR - fantomas" wrote:
>
> | > > > > On 1
On man 14 sep 2009 15:46:22 CEST, Mark Martinec wrote
Benny, I very much agree with you, the /16 is too wide, and I've
seen cases where good and bad sites share the same /16 address range.
is the dkim awl not solveing it in 3.3 ?
why is spf not added ?
Would you please open a problem report
On Mon, 14 Sep 2009, Clunk Werclick wrote:
(more drivel)
Good users all. Never heard of a troll?
Nonsensical. Irritating. Taunting.
Best defense against this kind of childish antic is to IGNORE it.
Yes, a firewall setting doesn't hurt.
- Charles
Hi,
We're rebuilding a mail server and are having some issues with SQL-based
SA preference lookups. We're running Postfix 2.5.5 and SA 3.2.5 (Debian
Lenny version) - here's our Postfix config from master.cf:
spamassassin unix - n n - - pipe
user=spamd argv=/usr/bin/spa
On man 14 sep 2009 20:52:29 CEST, "--[ UxBoD ]--" wrote
Blocked now @ FW .. Will contact Zen tomorrow and report as the OP
is in violation of the ISP AUP.
i use sa2dnsbl plugin, it have aroud 400 ips not listed elsewhere :)
wondered if zen wants my data ?
--
xpoint
From: "LuKreme"
Sent: Monday, 2009/September/14 09:38
On 14-Sep-2009, at 10:17, jdow wrote:
:0
* 9876543210^0 ^From: .*\
* 9876543210^0 ^From:.*clunk\.wercl...@wibblywobblyteapot\.co\.uk
/dev/null
Will work better. (and you don't need a lock on /dev/null)
Simply used "* ^From:.*wibblywo
On Mon, 2009-09-14 at 12:49 -0700, Bill Landry wrote:
> Clunk Werclick wrote:
> > On Mon, 2009-09-14 at 20:38 +0100, --[ UxBoD ]-- wrote:
> >> - "Clunk Werclick" wrote:
> >>
> >> | On Mon, 2009-09-14 at 19:52 +0100, --[ UxBoD ]-- wrote:
> >> | > - "Benny Pedersen" wrote:
> >> | >
> >> |
Clunk Werclick wrote:
> On Mon, 2009-09-14 at 20:38 +0100, --[ UxBoD ]-- wrote:
>> - "Clunk Werclick" wrote:
>>
>> | On Mon, 2009-09-14 at 19:52 +0100, --[ UxBoD ]-- wrote:
>> | > - "Benny Pedersen" wrote:
>> | >
>> | > | On man 14 sep 2009 16:54:39 CEST, Bill Landry wrote
>> | > | > So
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
Let's try this again with sending to the list. Sorry Mike!
Mike Cardwell wrote:
> That wouldn't help in this particular case:
>
> "All domains registered in the last 5 days under the .BIZ, .COM, .INFO,
> .NAME, .NET and .US TLDs"
>
> Doesn't work f
--[ UxBoD ]-- wrote:
> - "Clunk Werclick" wrote:
>
> | On Mon, 2009-09-14 at 19:52 +0100, --[ UxBoD ]-- wrote:
> | > - "Benny Pedersen" wrote:
> | >
> | > | On man 14 sep 2009 16:54:39 CEST, Bill Landry wrote
> | > | > So how far does someone have to go before getting banned from
> | th
On Mon, 2009-09-14 at 20:38 +0100, --[ UxBoD ]-- wrote:
> - "Clunk Werclick" wrote:
>
> | On Mon, 2009-09-14 at 19:52 +0100, --[ UxBoD ]-- wrote:
> | > - "Benny Pedersen" wrote:
> | >
> | > | On man 14 sep 2009 16:54:39 CEST, Bill Landry wrote
> | > | > So how far does someone have to g
- "Clunk Werclick" wrote:
| On Mon, 2009-09-14 at 19:52 +0100, --[ UxBoD ]-- wrote:
| > - "Benny Pedersen" wrote:
| >
| > | On man 14 sep 2009 16:54:39 CEST, Bill Landry wrote
| > | > So how far does someone have to go before getting banned from
| the
| > | > list? Is this not far enoug
On Mon, 2009-09-14 at 19:51 +0100, UxBoD wrote:
> - "Karsten Bräckelmann" wrote:
> | grep _DOB *.cf# Part of the stock rule-set.
>
> How dumb me be ;) Thanks Karsten :D
Heh, no problem. :) Just figured I should spare you the time of adding
it, and prevent you from scoring twice.
--
c
On Mon, 2009-09-14 at 19:52 +0100, --[ UxBoD ]-- wrote:
> - "Benny Pedersen" wrote:
>
> | On man 14 sep 2009 16:54:39 CEST, Bill Landry wrote
> | > So how far does someone have to go before getting banned from the
> | > list? Is this not far enough yet?
> |
> | he just come back with another
- "Benny Pedersen" wrote:
| On man 14 sep 2009 16:54:39 CEST, Bill Landry wrote
| > So how far does someone have to go before getting banned from the
| > list? Is this not far enough yet?
|
| he just come back with another sender email, with another reply-to, it
|
| will be endless banning
- "Karsten Bräckelmann" wrote:
| On Mon, 2009-09-14 at 18:55 +0100, --[ UxBoD ]-- wrote:
| > | Still working fine for me here, 51 hits so far today against DOB.
| >
| > Not come across that RBL before! Thanks :)
|
| grep _DOB *.cf# Part of the stock rule-set.
|
|
| --
| char
| *t="\1
On man 14 sep 2009 16:54:39 CEST, Bill Landry wrote
So how far does someone have to go before getting banned from the
list? Is this not far enough yet?
he just come back with another sender email, with another reply-to, it
will be endless banning new email adresses
--
xpoint
On Mon, 2009-09-14 at 18:55 +0100, --[ UxBoD ]-- wrote:
> | Still working fine for me here, 51 hits so far today against DOB.
>
> Not come across that RBL before! Thanks :)
grep _DOB *.cf# Part of the stock rule-set.
--
char *t="\10pse\0r\0dtu...@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf
On Mon, 14 Sep 2009, Mike Cardwell wrote:
Chris Owen wrote:
http://spameatingmonkey.com/lists.html
They will tell you domains that are 5, 10 and 15 days old.
That wouldn't help in this particular case:
"All domains registered in the last 5 days under the .BIZ, .COM, .INFO,
.NAME, .NET a
Chris Owen wrote:
One thing they all have in common is their registration dates are
very young according to whois lookups. It seems in general if we had
a reliable way to lookup domain age we might be able to differentiate
spam.
What's the current status of the Day Old Bread BL? Has it move
- "Bill Landry" wrote:
| > On Mon, 14 Sep 2009, Warren Togami wrote:
| >
| >> One thing they all have in common is their registration dates are
| very
| >> young according to whois lookups. It seems in general if we had a
| >> reliable way to lookup domain age we might be able to
| different
On Sep 14, 2009, at 12:41 PM, John Hardin wrote:
On Mon, 14 Sep 2009, Warren Togami wrote:
One thing they all have in common is their registration dates are
very young according to whois lookups. It seems in general if we
had a reliable way to lookup domain age we might be able to
differ
> On Mon, 14 Sep 2009, Warren Togami wrote:
>
>> One thing they all have in common is their registration dates are very
>> young according to whois lookups. It seems in general if we had a
>> reliable way to lookup domain age we might be able to differentiate
>> spam.
>
> What's the current status
On Mon, 14 Sep 2009, Warren Togami wrote:
One thing they all have in common is their registration dates are very
young according to whois lookups. It seems in general if we had a
reliable way to lookup domain age we might be able to differentiate
spam.
What's the current status of the Day O
(resend, first attempted about 14 hours ago)
I noticed that many spam (in English) have links like this post because of apache.org's spam filter>.cn where the domains are
not triggering URIBL's. It seems that they have thousands of
.cn domains (very cheap to register?), and I very rarely see
- "Chris Owen" wrote:
| On Sep 14, 2009, at 11:38 AM, LuKreme wrote:
|
| > On 14-Sep-2009, at 10:17, jdow wrote:
| >> :0
| >> * 9876543210^0 ^From: .*\
| > * 9876543210^0 ^From:.*clunk\.wercl...@wibblywobblyteapot\.co\.uk
| >> /dev/null
| >
| > Will work better. (and you don't need a lock on
On Mon, 14 Sep 2009, Clunk Werclick wrote:
On Mon, 2009-09-14 at 17:30 +0100, --[ UxBoD ]-- wrote:
As expressed to a couple of other members, off list, the OP also
launched a SMTP DoS attack against me. If anybody would like further
information please let me know.
Now you are living in a
On Sep 14, 2009, at 11:38 AM, LuKreme wrote:
On 14-Sep-2009, at 10:17, jdow wrote:
:0
* 9876543210^0 ^From: .*\
* 9876543210^0 ^From:.*clunk\.wercl...@wibblywobblyteapot\.co\.uk
/dev/null
Will work better. (and you don't need a lock on /dev/null)
I usually also use the 'h' flag on /dev/nu
On 14-Sep-2009, at 09:45, Gene Heskett wrote:
On Monday 14 September 2009, Bill Landry wrote:
Clunk Werclick wrote:
On Mon, 2009-09-14 at 08:05 -0600, LuKreme wrote:
Based on his reply to Matus I put him on my 'soft' kill list.
Now see, when you all quote his messages in full it's kind of
On Mon, 14 Sep 2009, Clunk Werclick wrote:
Clearly not - but then, using Spamassassin as a filter ensures just
about everything gets through CUNTFACE.
Congratulations! You've done something I have very rarely seen
on any internet forum. You've gotten everyone to AGREE on something!
I also agre
On Monday 14 September 2009, Bill Landry wrote:
>Clunk Werclick wrote:
>> On Mon, 2009-09-14 at 08:05 -0600, LuKreme wrote:
>>> On 14-Sep-2009, at 05:24, --[ UxBoD ]-- wrote:
If the OP cannot refrain from that sort of foul language when
presented with counter arguments then please ban. T
- "LuKreme" wrote:
| On 14-Sep-2009, at 10:17, jdow wrote:
| > :0
| > * 9876543210^0 ^From: .*\
| * 9876543210^0 ^From:.*clunk\.wercl...@wibblywobblyteapot\.co\.uk
| > /dev/null
|
| Will work better. (and you don't need a lock on /dev/null)
|
| --
| In England 100 miles is a long distance.
Clunk Werclick wrote:
> On Mon, 2009-09-14 at 08:05 -0600, LuKreme wrote:
>> On 14-Sep-2009, at 05:24, --[ UxBoD ]-- wrote:
>>> If the OP cannot refrain from that sort of foul language when
>>> presented with counter arguments then please ban. The list would be
>>> far happier IMHO.
>> Based o
On Mon, 14 Sep 2009, LuKreme wrote:
On 14-Sep-2009, at 05:24, --[ UxBoD ]-- wrote:
If the OP cannot refrain from that sort of foul language when presented
with counter arguments then please ban. The list would be far happier
IMHO.
Based on his reply to LuKreme, +1 on a ban.
Maybe we can p
On Mon, 2009-09-14 at 11:06 -0400, Rick Macdougall wrote:
> John Hardin wrote:
> > On Mon, 14 Sep 2009, LuKreme wrote:
> >
> >> On 14-Sep-2009, at 05:24, --[ UxBoD ]-- wrote:
> >>
> >>> If the OP cannot refrain from that sort of foul language when
> >>> presented with counter arguments then pleas
On 14-Sep-2009, at 10:17, jdow wrote:
:0
* 9876543210^0 ^From: .*\
* 9876543210^0 ^From:.*clunk\.wercl...@wibblywobblyteapot\.co\.uk
/dev/null
Will work better. (and you don't need a lock on /dev/null)
--
In England 100 miles is a long distance. In the US 100 years is a
long time
On Sep 14, 2009, at 11:34 AM, John Hardin wrote:
Public warning: he is apparently attempting a SMTP DoS on at least
one participant in this thread.
From Google ;-] He obviously isn't capable for running his own mail
server.
Chris
On Mon, 2009-09-14 at 07:54 -0700, Bill Landry wrote:
> Clunk Werclick wrote:
> > On Mon, 2009-09-14 at 08:05 -0600, LuKreme wrote:
> >> On 14-Sep-2009, at 05:24, --[ UxBoD ]-- wrote:
> >>> If the OP cannot refrain from that sort of foul language when
> >>> presented with counter arguments then p
John Hardin wrote:
On Mon, 14 Sep 2009, LuKreme wrote:
On 14-Sep-2009, at 05:24, --[ UxBoD ]-- wrote:
If the OP cannot refrain from that sort of foul language when
presented with counter arguments then please ban. The list would be
far happier IMHO.
Based on his reply to LuKreme, +1 on a
On Mon, 14 Sep 2009, Charles Gregory wrote:
On Mon, 14 Sep 2009, Clunk Werclick wrote:
{childish rant snipped}
Congratulations! You've done something I have very rarely seen on any
internet forum. You've gotten everyone to AGREE on something!
I also agree: +1 Ban "Clunk".
Public warning
- "Charles Gregory" wrote:
| On Mon, 14 Sep 2009, Clunk Werclick wrote:
| > Clearly not - but then, using Spamassassin as a filter ensures just
| > about everything gets through CUNTFACE.
|
| Congratulations! You've done something I have very rarely seen
| on any internet forum. You've gott
On Mon, 2009-09-14 at 08:05 -0600, LuKreme wrote:
> On 14-Sep-2009, at 05:24, --[ UxBoD ]-- wrote:
> > If the OP cannot refrain from that sort of foul language when
> > presented with counter arguments then please ban. The list would be
> > far happier IMHO.
>
> Based on his reply to Matus I
On 14-Sep-2009, at 05:24, --[ UxBoD ]-- wrote:
If the OP cannot refrain from that sort of foul language when
presented with counter arguments then please ban. The list would be
far happier IMHO.
Based on his reply to Matus I put him on my 'soft' kill list.
(soft because all it does is mark
On Monday 14 September 2009 13:57:44 Benny Pedersen wrote:
>why not adjust awl factor ?
>
> (i hope ip can be set to other then /16 in 3.3.x) for the fyzzy
> matching ip ranges
>
> imho /24 should be default
Benny, I very much agree with you, the /16 is too wide, and I've seen
cases where good a
On Mon, 14 Sep 2009, Clunk Werclick wrote:
And trained some spam and I'll see how we get on.
Don't forget you also need to train some ham before Bayes will be able to
start analyzing.
As a general rule of thumb it's a good idea to keep the trained ham:spam
token ratio near even, or slightl
On Mon, 2009-09-14 at 13:57 +0200, Benny Pedersen wrote:
> On man 14 sep 2009 12:39:21 CEST, Martin Gregorie wrote
> > AWL, which is simply an averager, can get badly off target with
> > some mixes of ham/spam. It did with my mail feed, so I disabled it.
>
> in that case you dont understand what a
On man 14 sep 2009 12:39:21 CEST, Martin Gregorie wrote
AWL, which is simply an averager, can get badly off target with
some mixes of ham/spam. It did with my mail feed, so I disabled it.
in that case you dont understand what awl does, why not adjust awl factor ?
(i hope ip can be set to other
On man 14 sep 2009 11:51:32 CEST, Matus UHLAR - fantomas wrote
-4.1 AWL AWL: From: address is in the auto white-list
... ouch!
?
just means that this msg was more spammy then what jari have seen from
same from email ip pairs
maybe i am wroung :=)
--
xpoint
On man 14 sep 2009 11:46:21 CEST, Matus UHLAR - fantomas wrote
If you insist on not using bayes, just because it can be
mistrained, better don't use any configurable software, because
_everything_ configurable will go wrong if miscongured.
excactly, spamassassin without any rules and plugins
"Clunk Werclick" wrote:
| On Mon, 2009-09-14 at 12:24 +0100, --[ UxBoD ]-- wrote:
| > - "Clunk Werclick" wrote:
| >
| > | On Mon, 2009-09-14 at 11:46 +0200, Matus UHLAR - fantomas wrote:
| > | > > > On 12-Sep-2009, at 10:27, Clunk Werclick wrote:
| > | > > > > I disagree. It can do as
On Mon, 2009-09-14 at 12:24 +0100, --[ UxBoD ]-- wrote:
> - "Clunk Werclick" wrote:
>
> | On Mon, 2009-09-14 at 11:46 +0200, Matus UHLAR - fantomas wrote:
> | > > > On 12-Sep-2009, at 10:27, Clunk Werclick wrote:
> | > > > > I disagree. It can do as much harm as good. My own view and
> | > >
- "Matus UHLAR - fantomas" wrote:
| > > > > On 12-Sep-2009, at 10:27, Clunk Werclick wrote:
| > > > > > I disagree. It can do as much harm as good. My own view and
| > > > > > observation from the past have rendered it pointless in my
| context. It
| > > > > > adds latency, is easily poisoned
- "Clunk Werclick" wrote:
| On Mon, 2009-09-14 at 11:46 +0200, Matus UHLAR - fantomas wrote:
| > > > On 12-Sep-2009, at 10:27, Clunk Werclick wrote:
| > > > > I disagree. It can do as much harm as good. My own view and
| > > > > observation from the past have rendered it pointless in my
| con
> > > > On 12-Sep-2009, at 10:27, Clunk Werclick wrote:
> > > > > I disagree. It can do as much harm as good. My own view and
> > > > > observation from the past have rendered it pointless in my context. It
> > > > > adds latency, is easily poisoned and rarely makes much difference to
> > > > > the
On Mon, 2009-09-14 at 11:46 +0200, Matus UHLAR - fantomas wrote:
> > > On 12-Sep-2009, at 10:27, Clunk Werclick wrote:
> > > > I disagree. It can do as much harm as good. My own view and
> > > > observation from the past have rendered it pointless in my context. It
> > > > adds latency, is easily p
>> On 12-Sep-2009, at 10:27, Clunk Werclick wrote:
>
> Interestingly, It is fair to say that Jari's
> follow up *did* show Bayes giving it 5 points. This was
> then destroyed by AWL dropping
> 4.1 off of it:
>
> 5.0 BAYES_99 BODY: Bayesian spam probability is 99 to 100%
> -4.1 AWL: From: address
> Interestingly, It is fair to say that Jari's follow up *did*
> show Bayes giving it 5 points. This was then destroyed by AWL dropping
> 4.1 off of it:
>
AWL, which is simply an averager, can get badly off target with some
mixes of ham/spam. It did with my mail feed, so I disabled it.
Martin
- "Clunk Werclick" wrote:
| On Sun, 2009-09-13 at 16:37 -0600, LuKreme wrote:
| > On 12-Sep-2009, at 10:27, Clunk Werclick wrote:
| > > I disagree. It can do as much harm as good. My own view and
| > > observation
| > > from the past have rendered it pointless in my context. It adds
| > >
> > I was somewhat surprised that this failed to score;
> >
> > http://pastebin.com/m4c75e3ac
> >
> > Log excerpt;
> > Sat Sep 12 05:08:57 2009 [7319] info: spamd: result: . 0 -
> > HTML_MESSAGE,UNPARSEABLE_RELAY
> > scantime=0.3,size=5400,required_score=5.0,rhost=localhost,raddr=127.0.0.1,rport=
> > On 12-Sep-2009, at 10:27, Clunk Werclick wrote:
> > > I disagree. It can do as much harm as good. My own view and
> > > observation from the past have rendered it pointless in my context. It
> > > adds latency, is easily poisoned and rarely makes much difference to
> > > the score. I do appreci
> On Sun, 2009-09-13 at 22:54 +0200, Benny Pedersen wrote:
> > remember this is public maillist, dont shuth the help you get
> >
> > why not set the reply-to to supp...@microsoft.com ? no i dont like the
> > idear but you are on public maillist and want the answer to come there
> > not in priv
On Sun, 2009-09-13 at 16:37 -0600, LuKreme wrote:
> On 12-Sep-2009, at 10:27, Clunk Werclick wrote:
> > I disagree. It can do as much harm as good. My own view and
> > observation
> > from the past have rendered it pointless in my context. It adds
> > latency,
> > is easily poisoned and rarely
On Sun, 2009-09-13 at 22:54 +0200, Benny Pedersen wrote:
> On søn 13 sep 2009 07:57:59 CEST, Clunk Werclick wrote
>
> > **PLEASE READ THE REST OF THE THREAD TO ANSWER YOU QUESTION**
> >> are you using sa-update ?
> > Yes, every night.
>
> remember this is public maillist, dont shuth the help you
On Sun, 2009-09-13 at 20:57 +0100, RW wrote:
> On Sun, 13 Sep 2009 14:19:35 +0100
> Clunk Werclick wrote:
>
> > On Sun, 2009-09-13 at 14:06 +0100, RW wrote:
> > > On Sun, 13 Sep 2009 06:56:27 +0100
> > > Clunk Werclick wrote:
> > >
> > {trimmed down to the relevant point you make}
> > > Adding
67 matches
Mail list logo
