Re: Supporting 3.3 and 3.2?

2011-03-03 Thread Karsten Bräckelmann
On Fri, 2011-03-04 at 03:36 +0100, Karsten Bräckelmann wrote: > On Thu, 2011-03-03 at 15:52 -1000, Warren Togami Jr. wrote: > > Could we please make an official project statement that 3.2.x is > > unsupported and people should really update to 3.3.x? > That said, personally, with various Open So

Re: Supporting 3.3 and 3.2?

2011-03-03 Thread Karsten Bräckelmann
Sorry for replying to self. On Fri, 2011-03-04 at 03:36 +0100, Karsten Bräckelmann wrote: > > Could we please make an official project statement that 3.2.x is > > unsupported and people should really update to 3.3.x? > > There is no such decision yet. The 3.2 branch as-is is not unsupported, > j

Supporting 3.3 and 3.2? (was: Re: low score for ($1.5Million))

2011-03-03 Thread Karsten Bräckelmann
On Thu, 2011-03-03 at 15:52 -1000, Warren Togami Jr. wrote: > On 3/3/2011 3:06 PM, Karsten Bräckelmann wrote: > > Note though, that your score is on SA 3.3.x, while the OP uses SA 3.2.x. > > Yes, I can tell this from the scores. :) > > > > Major changes between these version are clearly reflected

Re: low score for ($1.5Million)

2011-03-03 Thread Warren Togami Jr.
On 3/3/2011 3:06 PM, Karsten Bräckelmann wrote: On Fri, 2011-03-04 at 01:53 +0100, Mikael Syska wrote: I get the following hits: Content analysis details: (19.1 points, 5.0 required) Note though, that your score is on SA 3.3.x, while the OP uses SA 3.2.x. Yes, I can tell this from the scores

Re: low score for ($1.5Million)

2011-03-03 Thread Karsten Bräckelmann
On Fri, 2011-03-04 at 01:53 +0100, Mikael Syska wrote: > I get the following hits: > Content analysis details: (19.1 points, 5.0 required) Note though, that your score is on SA 3.3.x, while the OP uses SA 3.2.x. Yes, I can tell this from the scores. :) Major changes between these version are cl

Re: low score for ($1.5Million)

2011-03-03 Thread Karsten Bräckelmann
On Thu, 2011-03-03 at 19:40 -0500, Dennis German wrote: > Can someone comment on the low score assigned to the email located at > > http://www.cccu.us/hundredThousand.txt > > X-Spam-testscores: AWL=1.086,BAYES_00=-2.599,HTML_MESSAGE=0.001, > MILLION_USD=1.528 > > Is my bayes "broken"? I'd

Re: low score for ($1.5Million)

2011-03-03 Thread Adam Katz
On 03/03/2011 04:40 PM, Dennis German wrote: > Can someone comment on the low score assigned to the email located at > > http://www.cccu.us/hundredThousand.txt > > X-Spam-testscores: AWL=1.086,BAYES_00=-2.599,HTML_MESSAGE=0.001, > MILLION_USD=1.528 > > Is my bayes "broken"? Not "broken" so

Re: low score for ($1.5Million)

2011-03-03 Thread Mikael Syska
Hi, I get the following hits: Content analysis details: (19.1 points, 5.0 required) pts rule name description -- -- -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, low

low score for ($1.5Million)

2011-03-03 Thread Dennis German
Can someone comment on the low score assigned to the email located at http://www.cccu.us/hundredThousand.txt X-Spam-testscores: AWL=1.086,BAYES_00=-2.599,HTML_MESSAGE=0.001, MILLION_USD=1.528 Is my bayes "broken"?

Re: pharmaceuticals through faked Twitter

2011-03-03 Thread Benny Pedersen
On Thu, 3 Mar 2011 19:53:47 +0100, Mark Martinec >> > full __L_DKIM_VALID_TWITTER eval:check_dkim_valid(twitter.com) > I don't want to whitelist valid mail from twitter - too much junk there. lets hope it only be there, so far i have seen more problems with yahoo here is only useing whitelist

Re: new rules - where do i activate them?

2011-03-03 Thread Karsten Bräckelmann
On Thu, 2011-03-03 at 09:55 -0800, an anonymous Nabble user wrote: > > Even worse, you outright ignored my post explaining this. Despite the > > fact, you actually replied to it. And quoted it in full below. > > Quite the opposite, I took your advice - even though it might look to you as > if I di

Re: Should Emails Have An Expiration Date

2011-03-03 Thread J.D. Falk
On Feb 28, 2011, at 1:57 PM, Jay Plesset wrote: > How about something that doesn't depend on the SENDER setting something? > I've set my system up to automatically "empty the trash" after 30 days, and > dump the "spam" folder after 2 weeks. I could easily set up an "archive" > folder for my u

Re: pharmaceuticals through faked Twitter

2011-03-03 Thread Mark Martinec
Benny, > > full __L_DKIM_VALID_TWITTER eval:check_dkim_valid(twitter.com) > > why not check_dkim_invalid(foo) ? There is not such eval rule 'check_dkim_invalid'. Even if it were, it would be misleading: a bad signature is supposed to be indistinguishable from a missing signature. > if its val

Re: new rules - where do i activate them?

2011-03-03 Thread Martin Gregorie
On Thu, 2011-03-03 at 09:55 -0800, tr_ust wrote: > I've already looked at the sun messaging logs > and there's no indication of SA scanning the emails. > On my Linux system spamd logs summaries of each scan to /var/log/maillog by default. Spamassassin doesn't seem to do this. Martin

Re: pharmaceuticals through faked Twitter

2011-03-03 Thread Benny Pedersen
On Thu, 3 Mar 2011 12:54:09 -0500, Michael Scheidell wrote: > On 3/3/11 12:43 PM, Benny Pedersen wrote: >> why not check_dkim_invalid(foo) ? >> > because if you, your isp, them, their isp, your dns provider, their dns > provider have a problem, and you can't look up the public key, you just > bl

Re: new rules - where do i activate them?

2011-03-03 Thread John Hardin
On Thu, 3 Mar 2011, tr_ust wrote: Also, I seriously doubt you tested your rules "with a real email" as you said. Notice the NO_RELAYS rule hit for an example. The sample was either severely damaged, or a very bad copy-n-paste from a source that just does not resemble a raw mail. Like I said I

Re: new rules - where do i activate them?

2011-03-03 Thread tr_ust
>You are *still* running with network tests disabled. Again, there's >almost certainly no need for these custom rules and playing whack-a-mole >with new URIs, if you enable network tests. URIBL and SURBL will do a >better job at catching them early than you ever could do on your own. It's not "w

Re: pharmaceuticals through faked Twitter

2011-03-03 Thread Michael Scheidell
On 3/3/11 12:43 PM, Benny Pedersen wrote: why not check_dkim_invalid(foo) ? because if you, your isp, them, their isp, your dns provider, their dns provider have a problem, and you can't look up the public key, you just blacklisted them. -- Michael Scheidell, CTO o: 561-999-5000 d: 561-948

Re: pharmaceuticals through faked Twitter

2011-03-03 Thread Benny Pedersen
On Thu, 3 Mar 2011 15:38:01 +0100, Mark Martinec wrote: > full __L_DKIM_VALID_TWITTER eval:check_dkim_valid(twitter.com) why not check_dkim_invalid(foo) ? if its valid, use def_whitelist_from_dkim *@twitter.com or whitelist_from_dkim f...@twitter.com if bigger whitelist score is needed > he

Re: new rules - where do i activate them?

2011-03-03 Thread Karsten Bräckelmann
On Thu, 2011-03-03 at 07:59 -0800, an anonymous Nabble user wrote: > For the first time I finally feel like I'm getting closer to getting this > thing to work - THANKS EVERYONE FOR ALL THE HELP! I did a test with a real > email this time that included a blocked uri and the it actually scored it! C

Re: new rules - where do i activate them?

2011-03-03 Thread tr_ust
For the first time I finally feel like I'm getting closer to getting this thing to work - THANKS EVERYONE FOR ALL THE HELP! I did a test with a real email this time that included a blocked uri and the it actually scored it! Content analysis details: (24.7 points, 5.0 required) pts rule name

pharmaceuticals through faked Twitter

2011-03-03 Thread Mark Martinec
Just in case one would like to attach additional spam score to faked twitter messages with original twitter text, faked signatures, and actual URL links to spam sites, here are the rules (for SA 3.3.*, DKIM plugin enabled): full __L_DKIM_VALID_TWITTER eval:check_dkim_valid(twitter.com) header __