Re: problems running pyzor

2011-03-25 Thread Mark Hedges
Sorry, I was out in left field. --mark--

Re: problems running pyzor

2011-03-25 Thread Karsten Bräckelmann
On Fri, 2011-03-25 at 12:47 -0700, Mark Hedges wrote: > The regexp in Mail::SpamAssassin::Plugin::Pyzor doesn't make sense to me: [...] > ... there are no tabs in the output from the pyzor server. > It seems like it will never match. Which means pyzor > doesn't work at all for anyone anymore. Log

problems running pyzor

2011-03-25 Thread Mark Hedges
When running the learn process, pyzor fails. It seems to work fine when I try it from the command line using any regular user or the user spamd runs as: $ pyzor -d check < /tmp/lame.mbox downloading servers from http://pyzor.sourceforge.net/cgi-bin/inform-servers-0-3-x sending: 'User: anonymous

Re: URIBL_RHS_DOB false positives?

2011-03-25 Thread Daniel McDonald
On 3/25/11 10:42 AM, "Alex" wrote: > Hi, > >>> But it seems like there is a reset in the URIBL_RHS_DOB database or >>> something. >>> >>> A lot of domains that are not new domains are now listed. >> >> It appears to be hitting on a lot of mail today: >> $ grep DOB /var/log/mail/info.log | cut

Re: URIBL_RHS_DOB false positives?

2011-03-25 Thread Alex
Hi, >> But it seems like there is a reset in the URIBL_RHS_DOB database or >> something. >> >> A lot of domains that are not new domains are now listed. > > It appears to be hitting on a lot of mail today: > $ grep DOB /var/log/mail/info.log | cut -d\  -f 1,2 | uniq -c >    119 Mar 20 >    174 Mar

Re: URIBL_RHS_DOB false positives?

2011-03-25 Thread Michael Scheidell
On 3/24/11 7:05 PM, McDonald, Dan wrote: Scrolling through these 300, Most of them look like spam anyway... I doubt I will touch it. then again, if most of all email is spam (95%), then that logic says use the rbl: blocked.secnap.net and score it with a 3.0. (google before you use it) Its a

Re: Amazon S3 triggering FPs with SPOOF_COM* rules

2011-03-25 Thread Michael Scheidell
On 3/24/11 8:44 PM, Jason Haar wrote: Hi there Apparently when you use sharethis.com (who use S3 for hosting services) to send out links, the links look like hXXp://img.sharethis.com*DOT* s3.amazonaws.com I imagine from this that ANY .com domain using Amazon S3 services would create similar U

Re: fake URL's in mail

2011-03-25 Thread Matus UHLAR - fantomas
> On 23/03/2011 4:36 PM, Adam Katz wrote: >> That would require an ENORMOUS whitelist and very close attention to its >> upkeep. I do not see this as practical without using a URIBL-style >> mechanism (which would also require high maintenance). >> Even with such a >> mechanism in place, it undul

Re: fake URL's in mail

2011-03-25 Thread Matus UHLAR - fantomas
> >> On 03/21/2011 09:37 AM, Matus UHLAR - fantomas wrote: > > Does anyone successfully use plugin or at least rules that > > catch fake URLs? > On 03/23/2011 11:43 AM, Matus UHLAR - fantomas wrote: > > I know about the problem with "legal" mail and spoofed URL's. That's > > why I asked ab

Re: FozzyOcr logging

2011-03-25 Thread polloxx
For future readers: rsyslog has it all: http://www.rsyslog.com/doc/imfile.html On Thu, Mar 24, 2011 at 5:07 PM, polloxx wrote: > Dear, > > Is it possible to log FuzzyOcr logs to syslog? As default config is > using focr_logfile. > > Thx, > P. >