Re: Honeypot email addresses

2014-12-04 Thread Philip Prindeville
On Dec 4, 2014, at 2:30 PM, Dave Pooser wrote: > On 12/4/14, 3:10 PM, "Philip Prindeville" > wrote: > >> Not necessarily. If I post to a list with this address, and wait 60 >> days, I can assume that 99.999% of email that comes back after that date >> is not related to the original posting. >

Re: ancient perl versions

2014-12-04 Thread Noel Butler
On 05/12/2014 14:40, Dave Pooser wrote: > On 12/4/14 10:27 PM, "Nick Edwards" wrote: > It's also not wrapping the text at all. it wraps fine here Look at the last roundcube post, the one sent at 01:06 GMT. The line of quoted text runs 273 columns without a linewrap. What client are you usin

Re: ancient perl versions

2014-12-04 Thread Dave Pooser
On 12/4/14 10:27 PM, "Nick Edwards" wrote: >> It's also not wrapping the text at all. > it wraps fine here Look at the last roundcube post, the one sent at 01:06 GMT. The line of quoted text runs 273 columns without a linewrap. -- Dave Pooser Cat-Herder-in-Chief, Pooserville.com

Re: ancient perl versions

2014-12-04 Thread Nick Edwards
On 12/5/14, Ted Mittelstaedt wrote: > > > On 12/4/2014 6:24 PM, Noel Butler wrote: >> On Thu, 2014-12-04 at 20:22 -0600, Dave Pooser wrote: >>> > strange, it indicates 12pt, and looks same size when returned on list >>> > as >>> >everyone elses, something must be a miss, hows this one? it's from

Re: ancient perl versions

2014-12-04 Thread Ted Mittelstaedt
On 12/4/2014 6:24 PM, Noel Butler wrote: On Thu, 2014-12-04 at 20:22 -0600, Dave Pooser wrote: > strange, it indicates 12pt, and looks same size when returned on list as >everyone elses, something must be a miss, hows this one? it's from >evolution That one looked significantly larger in my

Re: ancient perl versions

2014-12-04 Thread Noel Butler
On Thu, 2014-12-04 at 20:22 -0600, Dave Pooser wrote: > > strange, it indicates 12pt, and looks same size when returned on list as > >everyone elses, something must be a miss, hows this one? it's from > >evolution > > That one looked significantly larger in my mail client (Outlook 2011 for > Maci

Re: ancient perl versions

2014-12-04 Thread Dave Pooser
> strange, it indicates 12pt, and looks same size when returned on list as >everyone elses, something must be a miss, hows this one? it's from >evolution That one looked significantly larger in my mail client (Outlook 2011 for Macintosh). Looking at source, your previous had 'font-size: 10pt' and

Re: ancient perl versions

2014-12-04 Thread Noel Butler
On Thu, 2014-12-04 at 17:45 -0800, jdow wrote: > Clipped from the quoted message: > > body style=3D'font-size: 10pt' > > 12 pt would be better. Everybody else seems to come through with 12pt or > larger > font - or else plain text, which sane people prefer. (I may have to read HTML > format.

Re: ancient perl versions

2014-12-04 Thread jdow
On 2014-12-04 17:06, Noel Butler wrote: On 05/12/2014 06:19, jdow wrote: Speaking of footnotes, I don't have teeny tiny eyes for reading teeny tiny print. Could you please use a slightly larger font? The world is not uniformly made up of hairy chested (lose me right there) 20-40 year old (lo

Re: hacked sites/ costco.com JJ

2014-12-04 Thread David F. Skoll
On Thu, 04 Dec 2014 23:40:39 +0100 Axb wrote: > uri__URI_COSTCO /costco\.com/i > uri __URI_PHPASKC /\.php\?c\=/ > meta AXB_URI_COSTCO_JJ (__URI_COSTCO && __URI_PHPASKC) > score AXB_URI_COSTCO_JJ 10.0 I've seen variants purportedly from Kroger, Target and Best Buy. We're ha

Re: SOUGHT 2.0

2014-12-04 Thread Benny Pedersen
On 4. dec. 2014 22.42.42 Axb wrote: To be able to create usable rules, several times/day I need feeds to spit *at least* +150k/day. As I don't have the data So not possible to make it run decentraly ? This imho another precompiled problem

Re: ancient perl versions

2014-12-04 Thread Noel Butler
On 05/12/2014 06:19, jdow wrote: > Speaking of footnotes, I don't have teeny tiny eyes for reading teeny tiny > print. Could you please use a slightly larger font? The world is not > uniformly made up of hairy chested (lose me right there) 20-40 year old (lose > me there, too) wunderkinds.

Re: SOUGHT 2.0

2014-12-04 Thread Ian Zimmerman
On Thu, 04 Dec 2014 22:41:13 +0100, Axb wrote: Axb> To be able to create usable rules, several times/day I need feeds Axb> to spit *at least* +150k/day. As I don't have the data 150k of what? Bytes? Emails? Tokens? -- Please *no* private copies of mailing list or newsgroup messages. Rul

Re: ancient perl versions

2014-12-04 Thread jdow
On 2014-12-04 13:29, Bob Proulx wrote: jdow wrote: footnotes: Speaking of footnotes, I don't have teeny tiny eyes for reading teeny tiny print. Could you please use a slightly larger font? The world is not uniformly made up of hairy chested (lose me right there) 20-40 year old (lose me there,

Re: hacked sites/ costco.com JJ

2014-12-04 Thread Axb
On 12/04/2014 07:08 PM, Axb wrote: On 12/04/2014 07:05 PM, Kevin A. McGrail wrote: On 12/4/2014 1:03 PM, Axb wrote: Costco.com currently offers shipping in the United States only. We are not able to deliver to PO boxes, APO (military) boxes, FPO (foreign) boxes, freight forwarders, hotels, Cos

Re: SOUGHT 2.0

2014-12-04 Thread Axb
On 12/04/2014 10:30 PM, Bob Proulx wrote: Axb wrote: It's been more than a month since my first "SOUGHT 2.0" msg. A few have shown interest but as there hasn't been the flood of enthusiasm and stuff getting done which I hoped for so I've dropped the idea of getting a public autogenerated rule s

Re: SOUGHT 2.0

2014-12-04 Thread Bob Proulx
Axb wrote: > It's been more than a month since my first "SOUGHT 2.0" msg. > > A few have shown interest but as there hasn't been the flood of enthusiasm > and stuff getting done which I hoped for so I've dropped the idea of getting > a public autogenerated rule set / sa-update channel going. Good

Re: Honeypot email addresses

2014-12-04 Thread Dave Pooser
On 12/4/14, 3:10 PM, "Philip Prindeville" wrote: >Not necessarily. If I post to a list with this address, and wait 60 >days, I can assume that 99.999% of email that comes back after that date >is not related to the original posting. > >Further, after 15 days, anything which doesn't also copy the

Re: ancient perl versions

2014-12-04 Thread Bob Proulx
jdow wrote: > >footnotes: > > Speaking of footnotes, I don't have teeny tiny eyes for reading teeny tiny > print. Could you please use a slightly larger font? The world is not > uniformly made up of hairy chested (lose me right there) 20-40 year old > (lose me there, too) wunderkinds. Thank you in

Re: Argument "perl_version" isn't numeric

2014-12-04 Thread Bob Proulx
John Hardin wrote: > Bob Proulx wrote: > >But, but, but... It also failed lint and produced cron noise on my > >perl 5.20.1 system too. Running spamassassin 3.4.0. That is later > >than perl 5.18 and it definitely produced the warning message. > > That's two separate issues. The perl RE lint *e

Re: Honeypot email addresses

2014-12-04 Thread Philip Prindeville
On 12/04/2014 05:32 AM, Reindl Harald wrote: Am 03.12.2014 um 23:56 schrieb Philip Prindeville: On 11/21/2014 09:49 AM, David F. Skoll wrote: On Fri, 21 Nov 2014 08:43:22 -0800 (PST) John Hardin wrote: On a public mailng list isn't a great place to discuss such tactics... I suspect spamme

Re: ancient perl versions

2014-12-04 Thread jdow
On 2014-12-03 15:55, Noel Butler wrote: On 04/12/2014 00:28, Greg Troxel wrote: ... footnotes: I use slackware, yes its releases come with latest versions of most things, and updates move with upstreams due to slackwares philosophy and releases are maintained for usually 5 or more years, but e

Re: Argument "perl_version" isn't numeric

2014-12-04 Thread jdow
On 2014-12-03 15:39, Noel Butler wrote: On 03/12/2014 21:57, Kevin A. McGrail wrote: Sure, if that was truly the case nor would I, but if you are running that old perl, there is plenty of stuff thats outdated, and not all of the goodness gets backports, not just with perl, but with most other t

Re: SOUGHT 2.0

2014-12-04 Thread Benny Pedersen
On 4. dec. 2014 18.50.41 Axb wrote: It's been more than a month since my first "SOUGHT 2.0" msg. +1 A few have shown interest but as there hasn't been the flood of enthusiasm and stuff getting done which I hoped for so I've dropped the idea of getting a public autogenerated rule set / sa-up

Re: message sent to list yesterday

2014-12-04 Thread Joe Quinn
On 12/4/2014 1:40 PM, listsb-spamassas...@bitrate.net wrote: On Dec 04, 2014, at 12.18, Joe Quinn wrote: On 12/4/2014 11:17 AM, listsb-spamassas...@bitrate.net wrote: hi- i sent a message to the list yesterday, but have not yet seen it appear. can someone check? my logs indicate successful

Re: message sent to list yesterday

2014-12-04 Thread listsb-spamassassin
> On Dec 04, 2014, at 12.18, Joe Quinn wrote: > > On 12/4/2014 11:17 AM, listsb-spamassas...@bitrate.net wrote: >> hi- >> >> i sent a message to the list yesterday, but have not yet seen it appear. >> can someone check? my logs indicate successful delivery to >> mx1.us.apache.org: >> >> Dec

Re: SOUGHT 2.0

2014-12-04 Thread Andrea Venturoli
On 12/04/14 18:49, Axb wrote: A few have shown interest but as there hasn't been the flood of enthusiasm and stuff getting done which I hoped for so I've dropped the idea of getting a public autogenerated rule set / sa-update channel going. Hello. With the risk of sounding stupid... I would

Re: Argument "perl_version" isn't numeric

2014-12-04 Thread John Hardin
On Thu, 4 Dec 2014, Bob Proulx wrote: John Hardin wrote: Bob Proulx wrote: There have been multiple facets to this problem. The first was a rule update that produced warnings that produced email from every cron run sa-update / sa-learn run if run on recent released spamassassin 3.4.0 but not

Re: hacked sites/ costco.com JJ

2014-12-04 Thread Axb
On 12/04/2014 07:05 PM, Kevin A. McGrail wrote: On 12/4/2014 1:03 PM, Axb wrote: Costco.com currently offers shipping in the United States only. We are not able to deliver to PO boxes, APO (military) boxes, FPO (foreign) boxes, freight forwarders, hotels, Costco Warehouses, international addres

Re: hacked sites/ costco.com JJ

2014-12-04 Thread Kevin A. McGrail
On 12/4/2014 1:03 PM, Axb wrote: Costco.com currently offers shipping in the United States only. We are not able to deliver to PO boxes, APO (military) boxes, FPO (foreign) boxes, freight forwarders, hotels, Costco Warehouses, international addresses, or a few limited geographic areas within

hacked sites/ costco.com JJ

2014-12-04 Thread Axb
Costco.com currently offers shipping in the United States only. We are not able to deliver to PO boxes, APO (military) boxes, FPO (foreign) boxes, freight forwarders, hotels, Costco Warehouses, international addresses, or a few limited geographic areas within the U.S. If a product is availa

SOUGHT 2.0

2014-12-04 Thread Axb
It's been more than a month since my first "SOUGHT 2.0" msg. A few have shown interest but as there hasn't been the flood of enthusiasm and stuff getting done which I hoped for so I've dropped the idea of getting a public autogenerated rule set / sa-update channel going. If I can get enough d

Re: Argument "perl_version" isn't numeric

2014-12-04 Thread Bob Proulx
John Hardin wrote: > Bob Proulx wrote: > > There have been multiple facets to this problem. The first was a rule > > update that produced warnings that produced email from every cron run > > sa-update / sa-learn run if run on recent released spamassassin 3.4.0 > > but not the development trunk ver

Re: message sent to list yesterday

2014-12-04 Thread Joe Quinn
On 12/4/2014 11:17 AM, listsb-spamassas...@bitrate.net wrote: hi- i sent a message to the list yesterday, but have not yet seen it appear. can someone check? my logs indicate successful delivery to mx1.us.apache.org: Dec 3 17:48:24 mta postfix/smtp[10226]: 3jtFgN6Dfmz9s2b: to=, relay=mx1.u

Re: Honeypot email addresses

2014-12-04 Thread Dave Funk
On Thu, 4 Dec 2014, Noel Butler wrote: On 04/12/2014 00:54, Christian Grunfeld wrote: "It would be very rare, and if so you would ever more rare CC the entire list of addresses on your spam message - sure this was a lot more common in years gone by, but I've not seen any such

Re: message sent to list yesterday

2014-12-04 Thread Kevin A. McGrail
The infra team is busy with the emergency issues re: SVN and they would be the only ones who could help. Suggest you just resend and cc me off list. If you are discussing spam and have included real spam samples, you'll likely want to put that info in pastebin and link to it. If you mention

Re: Multiple subject headers - most blank

2014-12-04 Thread Bertrand Caplet
> I've seen a number of spam messages come through with multiple header > lines ... some of them are blank. > > Subject: > > =?ISO-8859-1?Q?=20The=20Hotte?==?ISO-8859-1?Q?st=20Sm?==?ISO-8859-1?Q?ar?==?ISO-8859-1?Q?tpho?==?ISO

Multiple subject headers - most blank

2014-12-04 Thread Gibbs, David
Folks: I've seen a number of spam messages come through with multiple header lines ... some of them are blank. Subject: =?ISO-8859-1?Q?=20The=20Hotte?

message sent to list yesterday

2014-12-04 Thread listsb-spamassassin
hi- i sent a message to the list yesterday, but have not yet seen it appear. can someone check? my logs indicate successful delivery to mx1.us.apache.org: Dec 3 17:48:24 mta postfix/smtp[10226]: 3jtFgN6Dfmz9s2b: to=, relay=mx1.us.apache.org[140.211.11.136]:25, delay=56, delays=0.45/0.02/30/

Re: Argument "perl_version" isn't numeric

2014-12-04 Thread John Hardin
On Wed, 3 Dec 2014, Bob Proulx wrote: There have been multiple facets to this problem. The first was a rule update that produced warnings that produced email from every cron run sa-update / sa-learn run if run on recent released spamassassin 3.4.0 but not the development trunk version. That w

Re: Argument "perl_version" isn't numeric

2014-12-04 Thread Bob Proulx
Jim Clausing wrote: > What I haven't noticed anyone else mention is that I was getting that error > message even though the perl on my Ubuntu 14.04 system is 5.18.2. You left off your spamassassin version. I assume 3.4.0? On my Debian sid system. (But never use Unstable for a production system.

Re: Argument "perl_version" isn't numeric

2014-12-04 Thread Kevin A. McGrail
On 12/3/2014 6:39 PM, Noel Butler wrote: On 03/12/2014 21:57, Kevin A. McGrail wrote: Sure, if that was truly the case nor would I, but if you are running that old perl, there is plenty of stuff thats outdated, and not all of the goodness gets backports, not just with perl, but with most oth

Re: different results when using --debug

2014-12-04 Thread btb
On 2014.12.03 05.45, Mark Martinec wrote: > listsb-spamassas...@bitrate.net wrote: >> i was testing with a sample message, and noticed that when running >> manually with --debug, there seem to be numerous differences in the >> results, such as scores for the same tests differing, visual ordering >>

Re: ancient perl versions

2014-12-04 Thread Noel Butler
On 04/12/2014 00:28, Greg Troxel wrote: > I am really boggled by people wanting to run LTS versions of code with > old versions of tools and expecting to run newer versions of other > things. > > More constructively, it's perfectly possible to build newer perl in a > different prefix. Just be

Re: Argument "perl_version" isn't numeric

2014-12-04 Thread Noel Butler
On 03/12/2014 21:57, Kevin A. McGrail wrote: >> Sure, if that was truly the case nor would I, but if you are running that >> old perl, there is plenty of stuff thats outdated, and not all of the >> goodness gets backports, not just with perl, but with most other things. > I can't fight every

Re: ancient perl versions

2014-12-04 Thread Ted Mittelstaedt
On 12/3/2014 6:28 AM, Greg Troxel wrote: I am really boggled by people wanting to run LTS versions of code with old versions of tools and expecting to run newer versions of other things. Microsoft thinks like you do, that's why Internet Explorer 8 was the last version of IE to run on Windo

Re: Honeypot email addresses

2014-12-04 Thread Reindl Harald
Am 03.12.2014 um 02:32 schrieb LuKreme: another recent example: Spamhaus blocked GMX/1&1/Web.de completly *by a mistake*, no problem in case of scoring, a ruined weekend if we had used it as only source The extremely occasional mistaken black is more than made up for by the vast quantities o

Re: Argument "perl_version" isn't numeric

2014-12-04 Thread Ted Mittelstaedt
On 12/3/2014 7:38 AM, Jim Clausing wrote: What I haven't noticed anyone else mention is that I was getting that error message even though the perl on my Ubuntu 14.04 system is 5.18.2. No, they mentioned it - the problem is that the proposed "fix" to allow inclusion of the new fancy rules on

Re: Honeypot email addresses

2014-12-04 Thread Ted Mittelstaedt
On 12/2/2014 5:32 PM, LuKreme wrote: I have *never* considered Barracuda to be reliable. At least they have stopped their practice of listing my server and then sending me spam offering to sell me their crapware to keep it off blacklists for per month. I think there's a direct corre

Re: ancient perl versions

2014-12-04 Thread jdow
I'm only expecting new rules sets to work, sir. I still run a lamentably antique version of SA with my middle aged version of perl. {o.o} On 2014-12-03 06:28, Greg Troxel wrote: I am really boggled by people wanting to run LTS versions of code with old versions of tools and expecting to run n

Re: Honeypot email addresses

2014-12-04 Thread Reindl Harald
Am 03.12.2014 um 23:56 schrieb Philip Prindeville: On 11/21/2014 09:49 AM, David F. Skoll wrote: On Fri, 21 Nov 2014 08:43:22 -0800 (PST) John Hardin wrote: On a public mailng list isn't a great place to discuss such tactics... I suspect spammers are dumb and will just vacuum up any address

Re: Honeypot email addresses

2014-12-04 Thread Noel Butler
read my reply to Chris, its rather simple - if you care (and we have some pretty damn illiterate users, if they can get it right, anyone can) Oh additional point, it also helps if your CSR's also have a clue, and sound confident when talking to users, if they sound hesitant u's and ars

Re: Honeypot email addresses

2014-12-04 Thread Noel Butler
On 04/12/2014 00:54, Christian Grunfeld wrote: > "It would be very rare, and if so you would ever more rare CC the entire > list of addresses on your spam message - sure this was a lot more common in > years gone by, but I've not seen any such evidence of it in almost 10 years, > and if

Re: Honeypot email addresses

2014-12-04 Thread Philip Prindeville
On 11/21/2014 09:49 AM, David F. Skoll wrote: On Fri, 21 Nov 2014 08:43:22 -0800 (PST) John Hardin wrote: On a public mailng list isn't a great place to discuss such tactics... I suspect spammers are dumb and will just vacuum up any address they can find. Also, the scammers who sell CDs wit