Re: Rules based on number of lines?

2013-02-08 Thread Christoph (Stucki) von Stuckrad
On Thu, 07 Feb 2013, Marc Perkel wrote: > How would you write a rule to detect a message with less than 5 > lines and has a link in it? I think, I did that a few years ago with the help of the attached plugin and based on that, one rule for the lines, another stock rule for the url, and a specifi

Re: Question about TRACKER_ID

2013-02-08 Thread Martin Gregorie
On Fri, 2013-02-08 at 14:04 -0600, Mike Grau wrote: > Martin Gregorie wrote: > > On Fri, 2013-02-08 at 13:26 -0600, Mike Grau wrote: > >> Hello folks. > >> > >> In 20_body_tests.cf (SA 3.3.2) there is this rule: > >> > >> body TRACKER_ID /^[a-z0-9]{6,24}[-_a-z0-9]{12,36}[a-z0-9{6,24}\s*\z/is > >>

Re: Bayes false postive correction tuning

2013-02-08 Thread Bob Proulx
I realized that I can pull the backups for the last couple of weeks and see what is different between them. Interesting results. On 01/15: -rw--- 1 1272 Jan 15 20:04 bayes_journal -rw--- 1 43421696 Jan 15 20:03 bayes_seen -rw--- 1 5042176 Jan 15 20:03 bayes_toks 0.000

Re: Question about TRACKER_ID

2013-02-08 Thread Mike Grau
Martin Gregorie wrote: > On Fri, 2013-02-08 at 13:26 -0600, Mike Grau wrote: >> Hello folks. >> >> In 20_body_tests.cf (SA 3.3.2) there is this rule: >> >> body TRACKER_ID /^[a-z0-9]{6,24}[-_a-z0-9]{12,36}[a-z0-9{6,24}\s*\z/is >> >> What is the "\z" in the regex? >> > According to the O'Reilly Ca

Re: Question about TRACKER_ID

2013-02-08 Thread Martin Gregorie
On Fri, 2013-02-08 at 13:26 -0600, Mike Grau wrote: > Hello folks. > > In 20_body_tests.cf (SA 3.3.2) there is this rule: > > body TRACKER_ID /^[a-z0-9]{6,24}[-_a-z0-9]{12,36}[a-z0-9{6,24}\s*\z/is > > What is the "\z" in the regex? > According to the O'Reilly Camel Book, "Programming Perl", \

Question about TRACKER_ID

2013-02-08 Thread Mike Grau
Hello folks. In 20_body_tests.cf (SA 3.3.2) there is this rule: body TRACKER_ID /^[a-z0-9]{6,24}[-_a-z0-9]{12,36}[a-z0-9{6,24}\s*\z/is What is the "\z" in the regex? This rule matches "". Is that as intended? Thanks! -- Mike

Re: Who wants a lot of spam (to analyse)

2013-02-08 Thread John Hardin
On Fri, 8 Feb 2013, Marc Perkel wrote: On 2/8/2013 8:43 AM, John Hardin wrote: On Fri, 8 Feb 2013, Marc Perkel wrote: > I have some spam streams - about 200 spams per minute - that I'm willing > to share for free or sell to anyone who wants to use it to fight spam. > We would forward th

Re: Who wants a lot of spam (to analyse)

2013-02-08 Thread Marc Perkel
On 2/8/2013 8:43 AM, John Hardin wrote: On Fri, 8 Feb 2013, Marc Perkel wrote: I have some spam streams - about 200 spams per minute - that I'm willing to share for free or sell to anyone who wants to use it to fight spam. We would forward the spam to an email address you would provide to re

Re: Who wants a lot of spam (to analyse)

2013-02-08 Thread John Hardin
On Fri, 8 Feb 2013, Marc Perkel wrote: I have some spam streams - about 200 spams per minute - that I'm willing to share for free or sell to anyone who wants to use it to fight spam. We would forward the spam to an email address you would provide to receive it. Would you be willing to devote

Who wants a lot of spam (to analyse)

2013-02-08 Thread Marc Perkel
I have some spam streams - about 200 spams per minute - that I'm willing to share for free or sell to anyone who wants to use it to fight spam. We would forward the spam to an email address you would provide to receive it. We will provide it for free for: Anyone who provides spam filtering in

Re: Telling BAYES not to learn?

2013-02-08 Thread Matus UHLAR - fantomas
On Tue, 05 Feb 2013 07:20:24 -0800 Marc Perkel wrote: is there a way I can put something in a rule that would cause bayes not to learn - such as a rule that detects bayes poisoning? On 2/7/2013 6:58 AM, RW wrote: Why do you think this is a good idea? On 07.02.13 08:13, Marc Perkel wrote: Be

Re: RCVD_IN_DNSWL_HI false negatives (my solution)

2013-02-08 Thread Benny Pedersen
Lutz Petersen skrev den 2013-02-07 17:23: It can't be the job of all SpamAssassin admins to write local rules because of such a wrong whitelist-scoring. report more spam mails that originates from there ip will resolve it in dnswl, reporting forwared mails does not change there scores, if th