Echoe via mail.mail.rss.rogers.com?

2010-09-08 Thread John Hardin
Is anybody else seeing their list posts echoed back to them via mail.mail.rss.rogers.com? -- John Hardin KA7OHZhttp://www.impsec.org/~jhardin/ jhar...@impsec.orgFALaholic #11174 pgpk -a jhar...@impsec.org key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E

Re: sa-update 3.3 daily changes

2010-09-08 Thread John Hardin
On Wed, 8 Sep 2010, RW wrote: On Wed, 8 Sep 2010 09:51:43 -0700 (PDT) John Hardin wrote: On Wed, 8 Sep 2010, Tony Finch wrote: sa-update for version 3.3 is usually very quiet - last update 4 July; previous one 12 June. We have been getting daily updates since Saturday morning. Is this expec

Re: Checking envelope sender

2010-09-08 Thread Steve Freegard
On 08/09/10 16:10, Mike Bro wrote: Thanks for your interest in this topic. The part of mail.log and the qf file is at: http://pastebin.com/0QzqLxs1 This particular example has been marked as spam, but the sender's information didn't play a role in this classification. Re: Joseph Brennan: Why d

Re: sa-update 3.3 daily changes

2010-09-08 Thread RW
On Wed, 8 Sep 2010 09:51:43 -0700 (PDT) John Hardin wrote: > On Wed, 8 Sep 2010, Tony Finch wrote: > > > sa-update for version 3.3 is usually very quiet - last update 4 > > July; previous one 12 June. We have been getting daily updates > > since Saturday morning. Is this expected? > > It's expe

Re: sa-update 3.3 daily changes

2010-09-08 Thread Tony Finch
On Wed, 8 Sep 2010, John Hardin wrote: > > It's expected and very welcome. It means the age-limited nightly masscheck > corpora have once again gotten large enough that the score generator can > safely publish updated rules and scores on a regular basis. Ah, good news :-) Tony. -- f.anthony.n.fi

Re: Checking envelope sender

2010-09-08 Thread John Hardin
On Wed, 8 Sep 2010, Mike Bro wrote: I cannot afford rejecting all null senders as those could be legitimate Delivery Status Notification messages. What I am looking is a pattern for line: MAIL FROM: <"do not mock at your poetenncy - bujyj vjaqrra ppislls" <>> while I want to allow: MAIL FROM: <

Re: sa-update 3.3 daily changes

2010-09-08 Thread John Hardin
On Wed, 8 Sep 2010, Tony Finch wrote: sa-update for version 3.3 is usually very quiet - last update 4 July; previous one 12 June. We have been getting daily updates since Saturday morning. Is this expected? It's expected and very welcome. It means the age-limited nightly masscheck corpora hav

Re: spam CAUGHT, now how to catch spammer

2010-09-08 Thread John Hardin
On Tue, 7 Sep 2010, jdow wrote: From: "John Hardin" Sent: Tuesday, 2010/September/07 10:02 On Tue, 7 Sep 2010, Per Jessen wrote: > John Hardin wrote: > > > > Sorry to mislead. SPAM was caught by spamassassin. > > > How can I get this guy stopped? > > > IP addresses are: 67.50.37.35,.3

Re: unblacklist_from_rcvd

2010-09-08 Thread William Taylor
On Sep 7, 2010, at 6:36 PM, Matt Kettler wrote: > On 9/7/2010 7:11 PM, William Taylor wrote: >> I want to be able to only allow a certain email to be sent from one of >> several hosts. >> >> Currently im doing something like: >> >> blacklist_from sa...@foo.com >> whitelist_from_rcvd sa..

Re: Checking envelope sender

2010-09-08 Thread Bernd Petrovitsch
Hi! On Mit, 2010-09-08 at 16:45 +0100, Mike Bro wrote: [...] > You wrote: > > The .qf file is not visible to SpamAssassin. SA only looks at the email > > and headers. If you want to reject/score based on the envelope sender, > > you will need to either do it at the MTA level or find out if sendm

Re: Checking envelope sender

2010-09-08 Thread Bowie Bailey
On 9/8/2010 11:45 AM, Mike Bro wrote: > Hi Bowie, > > You wrote: >> The .qf file is not visible to SpamAssassin. SA only looks at the email >> and headers. If you want to reject/score based on the envelope sender, >> you will need to either do it at the MTA level or find out if sendmail >> puts

Re: Checking envelope sender

2010-09-08 Thread Mike Bro
Hi Bowie, You wrote: > The .qf file is not visible to SpamAssassin.  SA only looks at the email > and headers.  If you want to reject/score based on the envelope sender, > you will need to either do it at the MTA level or find out if sendmail > puts the information into a header that SA can see.

Re: scantime=249.2; scantime=175.0; scantime=190.9; scantime=68.9

2010-09-08 Thread Matus UHLAR - fantomas
> On Mon, 6 Sep 2010 13:20:56 +0200 > Matus UHLAR - fantomas wrote: > > using clamav directly, without SA, is more effective. ClamAV plugin > > seems to be OK for checking for things like phishes or strustured > > data like credit card numbers, in which case it may cause false > > positives. On 0

Re: Checking envelope sender

2010-09-08 Thread Bowie Bailey
On 9/8/2010 11:10 AM, Mike Bro wrote: > Thanks for your interest in this topic. The part of mail.log and the > qf file is at: > http://pastebin.com/0QzqLxs1 > > This particular example has been marked as spam, but the sender's > information didn't play a role in this classification. > > Re: Joseph

Re: Checking envelope sender

2010-09-08 Thread Mike Bro
Thanks for your interest in this topic. The part of mail.log and the qf file is at: http://pastebin.com/0QzqLxs1 This particular example has been marked as spam, but the sender's information didn't play a role in this classification. Re: Joseph Brennan: > Why doesn't sendmail reject it like it do

sa-update 3.3 daily changes

2010-09-08 Thread Tony Finch
sa-update for version 3.3 is usually very quiet - last update 4 July; previous one 12 June. We have been getting daily updates since Saturday morning. Is this expected? Tony. -- f.anthony.n.finchhttp://dotat.at/ HUMBER THAMES DOVER WIGHT PORTLAND: NORTH BACKING WEST OR NORTHWEST, 5 TO 7, DECR