Re: Performance on Spear Phishing?

2011-03-16 Thread Michael Scheidell
On 3/16/11 11:50 PM, Warren Togami Jr. wrote: Karsten, thanks for pointing out that this is the same guy. I had missed that. Warren Ditto. I was about to tell him how to stop spear phishing. thanks. -- Michael Scheidell, CTO o: 561-999-5000 d: 561-948-2259 ISN: 1259*1300 >*| *SECNAP N

Re: Performance on Spear Phishing?

2011-03-16 Thread Karsten Bräckelmann
On Wed, 2011-03-16 at 17:50 -1000, Warren Togami Jr. wrote: > Karsten, thanks for pointing out that this is the same guy. I had > missed that. Heh, you're welcome -- though that would be referring to my other reply to this (sub-) thread. ;) Sometimes it helps to identify patterns. Sometimes it

Re: Performance on Spear Phishing?

2011-03-16 Thread Warren Togami Jr.
On 3/16/2011 5:45 PM, Karsten Bräckelmann wrote: On Wed, 2011-03-16 at 20:30 -0700, John Hardin wrote: On Thu, 17 Mar 2011, Hamad Ali wrote: Probably I need to participate on nightly checks to improve phish and lower false positives. More masscheck participants are always welcome! No. Th

Re: Performance on Spear Phishing?

2011-03-16 Thread Karsten Bräckelmann
On Wed, 2011-03-16 at 20:30 -0700, John Hardin wrote: > On Thu, 17 Mar 2011, Hamad Ali wrote: > > Probably I need to participate on nightly checks to improve phish and > > lower false positives. > > More masscheck participants are always welcome! No. There is this thing called trust. Credibili

Re: Performance on Spear Phishing?

2011-03-16 Thread Karsten Bräckelmann
So this actually is a reply to the last post to your previous thread "how to disable network tests". Merely changing the subject and pruning the quote from the body -- surprise -- does NOT make it a new thread. On the up-side, it appears you at least did read (I mean "keep" here) the thread. Encour

Re: Performance on Spear Phishing?

2011-03-16 Thread Warren Togami Jr.
On 3/16/2011 4:08 PM, Hamad Ali wrote: Hi folks -- wondering if anyone has monitored SA's performance against phishing mails. SA is able to detect 86% of phishing emails my clients get, with 0.5% false positives on all the ham. It seems non-phish-SPAM is easier to be detected than phish (~99% for

Re: Performance on Spear Phishing?

2011-03-16 Thread John Hardin
On Thu, 17 Mar 2011, Hamad Ali wrote: Hi folks -- wondering if anyone has monitored SA's performance against phishing mails. SA is able to detect 86% of phishing emails my clients get, with 0.5% false positives on all the ham. It seems non-phish-SPAM is easier to be detected than phish (~99% f

Performance on Spear Phishing?

2011-03-16 Thread Hamad Ali
Hi folks -- wondering if anyone has monitored SA's performance against phishing mails. SA is able to detect 86% of phishing emails my clients get, with 0.5% false positives on all the ham. It seems non-phish-SPAM is easier to be detected than phish (~99% for non-phish spam). Probably I need to

Re: Per-user bayes filter DBs not accessible to mail delivered to aliases?

2011-03-16 Thread David King
I have a mailserver running postfix and spamassassin. I have a user 'user1' and an alias 'alias1', like this in /etc/aliases: >>> Two obvious things to check: 1) did you run 'newaliases' to rebuild the >>> aliases database? >> Positive. The mail is delivered to the right place, it just

Re: Very large subjects in all caps with no spaces

2011-03-16 Thread jambroo
Thanks so much for you help. I took a combination of rules approach as well - let's hope this stops them coming through. -Jamie Lawrence @ Rogers wrote: > > I use the following rule that, combined with other meta rules, catches > the majority of these > > header LW_SUBJECT_SPAMMY Subject

Re: Per-user bayes filter DBs not accessible to mail delivered to aliases?

2011-03-16 Thread RW
On Wed, 16 Mar 2011 12:24:18 -0500 David King wrote: > >> I have a mailserver running postfix and spamassassin. I have a user > >> 'user1' and an alias 'alias1', like this in /etc/aliases: > > Two obvious things to check: > > 1) did you run 'newaliases' to rebuild the aliases database? > > Posit

Re: Per-user bayes filter DBs not accessible to mail delivered to aliases?

2011-03-16 Thread David King
>> I have a mailserver running postfix and spamassassin. I have a user >> 'user1' and an alias 'alias1', like this in /etc/aliases: > Two obvious things to check: > 1) did you run 'newaliases' to rebuild the aliases database? Positive. The mail is delivered to the right place, it just doesn't get