Re: Bayes, Manual and Auto Learning Strategies

Well... I just turned on autolearn for a moment, deleted the bayes_* files on the test account I use, and sent myself a message from my usual outside account. And new bayes_* files were created. So I was wrong, and I win. More options. So now I can proceed to the "what does this mean?" phase.

Re: Bayes, Manual and Auto Learning Strategies

On 07/02/2014 08:00 AM, Steve Bergman wrote: On 07/02/2014 12:52 AM, Axb wrote: Site wide bayes works VERY well even under such ugly conditions as traffic with multiple languages, for ham as well as spam. Please tell me more. This goes against Paul Graham's orginal advice, IIRC. And it goes

Re: Bayes, Manual and Auto Learning Strategies

On Wed, 2 Jul 2014, Steve Bergman wrote: On 07/01/2014 11:14 PM, John Hardin wrote: Autolearn trains the bayes database. The bayes data is stored wherever you configured it to be stored, in a DBM database or SQL or redis, and it's per-user if you configure per-user Bayes databases and sca

Re: Bayes, Manual and Auto Learning Strategies

On 07/02/2014 12:52 AM, Axb wrote: Site wide bayes works VERY well even under such ugly conditions as traffic with multiple languages, for ham as well as spam. Please tell me more. This goes against Paul Graham's orginal advice, IIRC. And it goes against intuition. Then again. Bayesian stat

Re: Bayes, Manual and Auto Learning Strategies

On 07/02/2014 07:37 AM, Steve Bergman wrote: Lets turn this around? Can you prove autolearn was ever done to memory? I'm not really interested in proving anything. I'm interested in being convinced that autolearn is individual file-based when spamc is run as the individual user. It's in th

Re: Bayes, Manual and Auto Learning Strategies

Lets turn this around? Can you prove autolearn was ever done to memory? I'm not really interested in proving anything. I'm interested in being convinced that autolearn is individual file-based when spamc is run as the individual user. I'm not quite sure how that would affect my strategy.

Re: Bayes, Manual and Auto Learning Strategies

On 07/02/2014 07:19 AM, Steve Bergman wrote: On 07/01/2014 11:49 PM, Karsten Bräckelmann wrote: Those do not tell you about using file or SQL based databases? They do. But not specifically with respect to autolearn. You never thought about googling for "spamassassin per user" and friends?

Re: Bayes, Manual and Auto Learning Strategies

On 07/01/2014 11:14 PM, John Hardin wrote: Autolearn trains the bayes database. The bayes data is stored wherever you configured it to be stored, in a DBM database or SQL or redis, and it's per-user if you configure per-user Bayes databases and scan emails using different usernames (vs. a glob

Re: Bayes, Manual and Auto Learning Strategies

On 07/01/2014 11:49 PM, Karsten Bräckelmann wrote: Those do not tell you about using file or SQL based databases? They do. But not specifically with respect to autolearn. You never thought about googling for "spamassassin per user" and friends? You never checked the SA wiki? I have, inde

Re: getting tons of SPAM

On 07/01/2014 11:15 PM, Daniel Staal wrote: You probably can. ;) But I'm sure Windstream didn't get you every piece of mail immediately after it was sent - just as soon as they could after they got it. Yeah. I'm conservatively holding myself to higher standards than is perhaps warranted. Bu

Re: Bayes, Manual and Auto Learning Strategies

On Tue, 2014-07-01 at 22:40 -0500, Steve Bergman wrote: > On 07/01/2014 10:21 PM, Karsten Bräckelmann wrote: > > > > http://spamassassin.apache.org/doc/Mail_SpamAssassin_Conf.html > > http://spamassassin.apache.org/doc/Mail_SpamAssassin_Plugin_AutoLearnThreshold.html > > I've read those over and o

Re: getting tons of SPAM

On 07/01/2014 11:09 PM, John Hardin wrote: FWIW, I did not say, and did not have in mind a web-email form when I made my suggestion. I had in mind a more-direct interface to the trouble ticket management system. Of course, I may be assuming a more-sophisticated operation than is the case. Jo

Re: getting tons of SPAM

--As of July 1, 2014 9:40:05 PM -0500, Steve Bergman is alleged to have said: 95+% of the time, email is immediate, true. More like 99%+ of the time. When it's not, I hear about it. But it is not uncommon for mail to be delayed for hours or days either, It's uncommon enough that when it d

Re: Bayes, Manual and Auto Learning Strategies

On Tue, 2014-07-01 at 22:18 -0500, Steve Bergman wrote: > On 07/01/2014 09:53 PM, Karsten Bräckelmann wrote: > > > Frankly, it appears you don't understand what auto-learning is. > > So please specify, explicitly, what it is. I asked some specific > questions about it. And I'm very interested in

Re: Bayes, Manual and Auto Learning Strategies

On Tue, 1 Jul 2014, Steve Bergman wrote: On 07/01/2014 10:21 PM, Karsten Bräckelmann wrote: http: //spamassassin.apache.org/doc/Mail_SpamAssassin_Conf.html http: //spamassassin.apache.org/doc/Mail_SpamAssassin_Plugin_AutoLearnThreshold.html I've read those over and over. It never says any

Re: getting tons of SPAM

On Tue, 1 Jul 2014, Steve Bergman wrote: I'm not at all sure what you're talking about regarding email vs web form reliability. What are the links in that chain? The email client can malfunction in some way. But then again, so can a browser. The sending server can malfunction in some way. But

Re: Bayes, Manual and Auto Learning Strategies

On 07/01/2014 10:21 PM, Karsten Bräckelmann wrote: http://spamassassin.apache.org/doc/Mail_SpamAssassin_Conf.html http://spamassassin.apache.org/doc/Mail_SpamAssassin_Plugin_AutoLearnThreshold.html I've read those over and over. It never says anything about where the data is maintained, or

Re: getting tons of SPAM

On 07/01/2014 10:11 PM, Daniel Reynolds wrote: It seems to me that grey listing could be useful for small non time critical email servers, such as hobbyist setups, but for business, grey listing is not the way to go. Indeed. We should always remember that our workloads are *not* the only ones

Re: Bayes, Manual and Auto Learning Strategies

On Tue, 2014-07-01 at 20:53 -0500, Steve Bergman wrote: > On 07/01/2014 07:32 PM, Karsten Bräckelmann wrote: > > > That's pretty bad practice. Fundamentally, you are implementing a custom > > auto-learn flavor, overruling the SA configurable auto-learn behavior > > BTW, that reminds me of a quest

Re: Bayes, Manual and Auto Learning Strategies

On 07/01/2014 09:53 PM, Karsten Bräckelmann wrote: Frankly, it appears you don't understand what auto-learning is. So please specify, explicitly, what it is. I asked some specific questions about it. And I'm very interested in the answers. Is auto-learn still system-wide? I'd need it to a

Re: getting tons of SPAM

It seems to me that grey listing could be useful for small non time critical email servers, such as hobbyist setups, but for business, grey listing is not the way to go. On Jul 1, 2014 10:48 PM, "Steve Bergman" wrote: > I said: > > > Have fun in your ivory tower. > > > Please permit me to retroac

Re: Bayes, Manual and Auto Learning Strategies

On Tue, 2014-07-01 at 20:36 -0500, Steve Bergman wrote: > On 07/01/2014 07:32 PM, Karsten Bräckelmann wrote: > > > > That's pretty bad practice. Fundamentally, you are implementing a custom > > auto-learn flavor, overruling the SA configurable auto-learn behavior > > SA's autolearn behavior doesn'

Re: getting tons of SPAM

I said: > Have fun in your ivory tower. Please permit me to retroactively back this line out of my previous post. The smiley on the next line was intended to cover it. But it just came out sounding nasty. My amigdala's been acting up lately. ;-) -Steve

Re: getting tons of SPAM

95+% of the time, email is immediate, true. More like 99%+ of the time. When it's not, I hear about it. But it is not uncommon for mail to be delayed for hours or days either, It's uncommon enough that when it does happen I get a phone call about a user "not being able to receive email".

Re: getting tons of SPAM

--As of July 1, 2014 7:39:43 PM -0500, Steve Bergman is alleged to have said: On 07/01/2014 05:07 PM, motty cruz wrote: If it needs to be *instant*, have them visit a web page to enter service requests. Because there's not way that web-based email forms can be abused. Please. The whole del

Re: Bayes, Manual and Auto Learning Strategies

On 07/01/2014 07:32 PM, Karsten Bräckelmann wrote: That's pretty bad practice. Fundamentally, you are implementing a custom auto-learn flavor, overruling the SA configurable auto-learn behavior BTW, that reminds me of a question I had been meaning to ask on the list. Autolearn. There's very

Re: Bayes, Manual and Auto Learning Strategies

On 07/01/2014 07:32 PM, Karsten Bräckelmann wrote: That's pretty bad practice. Fundamentally, you are implementing a custom auto-learn flavor, overruling the SA configurable auto-learn behavior SA's autolearn behavior doesn't make much sense. I have no confidence in it. This method shields

Re: Funky HARP Spam

On Jun 27, 2014, at 12:34 PM, Philip Prindeville wrote: > > On Jun 27, 2014, at 7:30 AM, RW wrote: > >> >> As I mentioned before, the real violation is in the previous mime >> section, which claims 7bit, but contains octets with the high-bit set. > > > Yup. Just submitted a patch for th

Re: getting tons of SPAM

On 07/01/2014 05:07 PM, motty cruz wrote: If it needs to be *instant*, have them visit a web page to enter service requests. Because there's not way that web-based email forms can be abused. Please. The whole delay thing is about the ridiculous greylisting kluge. There are plenty of other sp

Bayes, Manual and Auto Learning Strategies (was: Re: getting tons of SPAM)

On Tue, 2014-07-01 at 18:43 -0500, Steve Bergman wrote: > On 07/01/2014 06:09 PM, RW wrote: > > I'm sceptical about the use of Dovecot-Antispam with Spamassassin. > > The problem is that it trains on SpamAssassin errors rather than Bayes > > errors. It may be possible to get sufficient spam this wa

Re: getting tons of SPAM

On Tue, 2014-07-01 at 12:33 -0700, motty cruz wrote: > I trained SA with about 700 SPAM emails and with about 258 HAM > emails. > X-Spam-Status: No, score=0.003 tagged_above=-999 required=5.3 > tests=[DKIM_SIGNED=0.001, HTML_IMAGE_RATIO_06=0.001, > HTML_MESSAGE=0.001, T_DKIM_INVALID=0.01, >

Re: getting tons of SPAM

On 07/01/2014 06:09 PM, RW wrote:> > I'm sceptical about the use of Dovecot-Antispam with Spamassassin. > The problem is that it trains on SpamAssassin errors rather than Bayes > errors. It may be possible to get sufficient spam this way, but ham > is learned very slowly through avoidable FPs. >

Re: getting tons of SPAM

On 07/01/2014 05:35 PM, Antony Stone wrote: This may be true, but in the example that you give, tech support should really have provided a better (ie: more reliable) mechanism for contact than email if the customer is entitled to (expect) a prompt response. There are multiple methods. But cust

Re: getting tons of SPAM

On Tue, 01 Jul 2014 14:06:14 -0500 Steve Bergman wrote: > What SA really needs if for its own Bayesian filter to kick in. But > to be used at all, you need at least 200 ham and 200 spam messages > registered with it. > > i.e. if you have to have a way to train the filter. I don't really > have

Re: getting tons of SPAM

On Wednesday 02 July 2014 at 00:12:07, Steve Bergman wrote: > In short... try to explain that email isn't an instant messaging system > to a customer with a dead fryer at 11AM emailing for a tech to help > before the lunch crowd arrives. That's how email is used in the real > world. And no amount

Re: getting tons of SPAM

On 07/01/2014 04:31 PM, Martin Gregorie wrote: I know what can happen, and also that those complaints can arise from a total misunderstanding of what e-mail is designed to do: that it is *not* an instant messaging medium but it is a reliable one despite delivering over sometimes flaky networks

Re: getting tons of SPAM

Today I build a new Spam filter with latest release, I leave all default configuration except a few changes, for now seem to be doing better at blocking really spammy emails. Thanks for all your help, On Tue, Jul 1, 2014 at 2:39 PM, John Hardin wrote: > On Tue, 1 Jul 2014, Martin Gregorie wro

Re: getting tons of SPAM

On Tue, 1 Jul 2014, Martin Gregorie wrote: On Tue, 2014-07-01 at 15:37 -0500, Steve Bergman wrote: On 07/01/2014 03:29 PM, Martin Gregorie wrote: On Tue, 2014-07-01 at 19:17 +, Jeremy McSpadden wrote: No mention of RBLs or greylisting ... Quite. When my ISP switched on greylisting my

Re: getting tons of SPAM

On Tue, 2014-07-01 at 15:37 -0500, Steve Bergman wrote: > > On 07/01/2014 03:29 PM, Martin Gregorie wrote: > > On Tue, 2014-07-01 at 19:17 +, Jeremy McSpadden wrote: > >> No mention of RBLs or greylisting ... > >> > > Quite. > > > > When my ISP switched on greylisting my mail immediately went

Re: getting tons of SPAM

On 07/01/2014 04:00 PM, motty cruz wrote: yes I guest I could change the variable delay, I will do a quick search to see how would affect users. some users are very sensitive to this issues. What mail server and version of it are you using? There was a good suggestion made about postscreen, e

Re: Bayer Filter Not Working

On Tue, 01 Jul 2014 09:37:17 +0200 Herbert J. Skuhra wrote: > Den 25.06.2014 00:42, skrev Bruce Sackett: > > I apologize, I’m sure it’s been covered, but I have not been > > successful finding results in searches on the web or through the > > history of the list. I get no BAYES results in the hea

Re: getting tons of SPAM

yes I guest I could change the variable delay, I will do a quick search to see how would affect users. some users are very sensitive to this issues. Thanks a bunch, On Tue, Jul 1, 2014 at 1:37 PM, Steve Bergman wrote: > > > On 07/01/2014 03:29 PM, Martin Gregorie wrote: > >> On Tue, 2014-07-0

Re: getting tons of SPAM

On 07/01/2014 03:29 PM, Martin Gregorie wrote: On Tue, 2014-07-01 at 19:17 +, Jeremy McSpadden wrote: No mention of RBLs or greylisting ... Quite. When my ISP switched on greylisting my mail immediately went from a spam:ham ratio of 80:20 to one of 20:80 But the variable delay, which

Re: getting tons of SPAM

On Tue, 2014-07-01 at 19:17 +, Jeremy McSpadden wrote: > No mention of RBLs or greylisting ... > Quite. When my ISP switched on greylisting my mail immediately went from a spam:ham ratio of 80:20 to one of 20:80, which pretty much where it has stayed ever since. The soam:ham ratio is reporte

Re: getting tons of SPAM

On 07/01/2014 02:33 PM, motty cruz wrote: I trained SA with about 700 SPAM emails and with about 258 HAM emails. In case I missed this, are you the single user, or does this server handle many mail accounts? I have many, and took the conservative approach of giving each user their own filedb

Re: getting tons of SPAM

On 07/01/2014 02:23 PM, Axb wrote: nor, if using Postfix, postscreen Indeed. I've looked at that. It's probably better than the sleep. But it's not yet an option for us. And at 7000 emails per day or whatever we get, I'm not sure there's that much difference. (There may be. I haven't looke

Re: getting tons of SPAM

Hello Jeremy, I have the following rbl main.cfg in postfix: reject_rbl_client b.barracudacentral.org, reject_rbl_client zen.spamhaus.org, reject_rbl_client bl.spamcop.net, reject_rbl_client all.spamrats.com RBL are very nice, helping me block lots of SPAM but a lot of spam are

Re: getting tons of SPAM

nor, if using Postfix, postscreen On 07/01/2014 09:17 PM, Jeremy McSpadden wrote: No mention of RBLs or greylisting ... -- Jeremy McSpadden Flux Labs | http://www.fluxlabs.net | Endless Solutions Office : 850-250-5590x501 | Cell : 850-890-2543 | Fax : 850-254-2955 O

Re: getting tons of SPAM

No mention of RBLs or greylisting ... -- Jeremy McSpadden Flux Labs | http://www.fluxlabs.net | Endless Solutions Office : 850-250-5590x501 | Cell : 850-890-2543 | Fax : 850-254-2955 On Jul 1, 2014, at 2:06 PM, "Steve Bergman" mailto:sbergma...@gmail.com>> wrote: Hey

Re: getting tons of SPAM

Hey motty cruz, I just moved our 100 users over from our ISP's mail servers to our own. Apparently, the ISP's mail servers were doing remarkably well. Because it turns out that we get some 5000 spams a day, and users were getting essentially no spam. Then I upgraded us to a new OS on our Deb

Re: pyzor: check failed: internal error (strace to the rescue)

OK. So I replaced pyzor with a dash script to run it under strace and log the output to to a file. What it was complaining about was (drum roll, please) the permissions on /home/pyzor/servers. Which is odd, because I'm pretty sure I set that file to be world readable and world writable for test

Re: getting tons of SPAM

maybe I missed your questions, was this your questions " Did you use default configs for spamassassin and amavis?" because if it is, I replied immediately, here is my response again, "yes I was using default configurations except for language scores I added some time ago. " Thanks, On Tue, Jul

Re: getting tons of SPAM

On 27.06.14 07:50, motty cruz wrote: X-Quarantine-ID: <4QFxoaNchYOk> X-Virus-Scanned: amavisd-new at fqdn.com X-Amavis-Alert: BAD HEADER SECTION, MIME error: error: unexpected end of header On Fri, Jun 27, 2014 at 8:16 AM, Matus UHLAR - fantomas wrote: This might explain much. seems

Re: getting tons of SPAM

Hello, I am trying to manipulate spamassassin scores, I am getting lots of SPAM with very low score. X-Virus-Scanned: amavisd-new at fqdn.com X-Spam-Flag: NO X-Spam-Score: 0.003 X-Spam-Level: X-Spam-Status: No, score=0.003 tagged_above=-999 required=5.3 tests=[DKIM_SIGNED=0.001, HTML_IMAGE

Re: pyzor: check failed: internal error, python traceback seen in response

On 07/01/2014 02:57 PM, Steve Bergman wrote: On 06/30/2014 02:15 PM, Axb wrote: As you don't mention what gue you use with SA it's hard to guess where your Pyzor config files should be. I guess I'm not quite sure what gue I am using with SA. Where would I find that? phatfingers meant "glue"

Re: pyzor: check failed: internal error, python traceback seen in response

On 06/30/2014 02:15 PM, Axb wrote: As you don't mention what gue you use with SA it's hard to guess where your Pyzor config files should be. I guess I'm not quite sure what gue I am using with SA. Where would I find that?

Re: pyzor: check failed: internal error, python traceback seen in response

pyzor 1:0.5.0-0ubuntu2 ancient, buggy, EOL version Interestingly, pyzor 0.7.0 (the latest stable version) gives the same error. And SA is not preserving the diagnostic output from it for the admin to view, even with debuging turned on in both packages. Looks like the bugs are in Spamassas

Re: pyzor: check failed: internal error, python traceback seen in response

Hmmm... My original question was "where's the traceback". Not whether this or that project chooses to abandon its stable releases. Ubuntu 10.04 LTS Server is supported until May 2015. And similar time-frame releases of SA and Pyzor are supported until 2020 in RHEL/Scientific Linux/Centos. I'

Changes in Spamhaus DBL DNSBL return codes

As per: http://www.spamhaus.org/news/article/713/ Return CodesTypeNote 127.0.1.2 spam domain 127.0.1.3 spammed redirector / url shortener (Phased out on January 7th, 2015) 127.0.1.4 phish domain 127.0.1.5 malware domain 127.0

Re: Bayer Filter Not Working

Den 25.06.2014 00:42, skrev Bruce Sackett: I apologize, I’m sure it’s been covered, but I have not been successful finding results in searches on the web or through the history of the list. I get no BAYES results in the headers, so I don’t see any working. The part that gets me is below: Jun 2

Re: pyzor: check failed: internal error, python traceback seen in response

On 06/30/2014 08:58 PM, Steve Bergman wrote: I'm getting: "pyzor: check failed: internal error, python traceback seen in response" I'm running Ubuntu 10.04 on the server, with the Ubuntu provided packages. On 30.06.14 21:15, Axb wrote: time to update... pyzor 1:0.5.0-0ubuntu2 ancient,