Re: Looking for assist on a rule

2017-11-01 Thread John Hardin
On Wed, 1 Nov 2017, Gary Smith wrote: We have recently seen a huge uptick in spam from a bunch of different TLD's. Bayes has been a little whacky with them as well. Our install is 3.3.1 (we're going to be replacing it soon). I'm looking to implement a rule that will assign a higher score to

Re: very basic SA-Learn performance question: is 90 seconds or so per token really, really slow or roughly normal?

2017-11-01 Thread David Gessel
Oh, I wiped the bayes data and started over already once, it isn't (or shouldn't be) that big a deal. Disk performance: seems OK to me. # diskinfo -t /dev/aacd0 /dev/aacd0 512 # sectorsize 73295462400 # mediasize in bytes (68G) 143155200 # mediasi

Re: very basic SA-Learn performance question: is 90 seconds or so per token really, really slow or roughly normal?

2017-11-01 Thread David Jones
On 11/01/2017 04:40 PM, David Gessel wrote: Bill, Thanks for the advice. I'm not too worried about the permissions config, though I will make the mods once I get performance up to the point where bayes is usable at all - I wouldn't want to lose all those sweet, sweet tokens to some unauthori

Re: very basic SA-Learn performance question: is 90 seconds or so per token really, really slow or roughly normal?

2017-11-01 Thread David Gessel
Bill, Thanks for the advice. I'm not too worried about the permissions config, though I will make the mods once I get performance up to the point where bayes is usable at all - I wouldn't want to lose all those sweet, sweet tokens to some unauthorized write premission. -David Origi

RE: Looking for assist on a rule

2017-11-01 Thread Gary Smith
Bowie (and the rest that answered), Thanks for the follow up. I went with your suggestion of adding the additional addr field and fixed the ^ and it’s catching now. The multiple values on the same line were intentional. I actually have different scored for bayes inclusion and network test (

Re: Spam via sendgrid.net

2017-11-01 Thread David Jones
On 11/01/2017 02:00 PM, Pedro David Marco wrote: Hi! Is anyboy scoring emails coming via sendgrid.net ???  i get tons os spam relayed through them !! Thanks! Pedro I have them whitelist_auth'd because they honor their abuse reports. Report the spam via https://sendgrid.com/report-sp

Re: Looking for assist on a rule

2017-11-01 Thread Bowie Bailey
On 11/1/2017 2:39 PM, Gary Smith wrote: We have recently seen a huge uptick in spam from a bunch of different TLD's. Bayes has been a little whacky with them as well. Our install is 3.3.1 (we're going to be replacing it soon). I'm looking to implement a rule that will assign a higher score t

Spam via sendgrid.net

2017-11-01 Thread Pedro David Marco
Hi! Is anyboy scoring emails coming via sendgrid.net ???  i get tons os spam relayed through them !!   Thanks! Pedro

Re: Looking for assist on a rule

2017-11-01 Thread Pedro David Marco
Hi Gary, Try this..   (you are wrongly anchoring with ^) header   HS_BAD_DOMAIN  From =~ /\.(top|study|click|party|link|stream|info|trade|bid|xxx)$/i describe HS_BAD_DOMAIN  Contains one of the bad domains that commonly spams score      HS_BAD_DOMAIN  0.1 0.1 0.1 0.1 Pedro

Re: Looking for assist on a rule

2017-11-01 Thread David Jones
On 11/01/2017 01:39 PM, Gary Smith wrote: We have recently seen a huge uptick in spam from a bunch of different TLD's. Bayes has been a little whacky with them as well. Our install is 3.3.1 (we're going to be replacing it soon). I'm looking to implement a rule that will assign a higher score

Looking for assist on a rule

2017-11-01 Thread Gary Smith
We have recently seen a huge uptick in spam from a bunch of different TLD's. Bayes has been a little whacky with them as well. Our install is 3.3.1 (we're going to be replacing it soon). I'm looking to implement a rule that will assign a higher score to specific TLD's. I tried the rule below

Re: spample: Microsoft Office DDE exploit (in OpenXML attachment)

2017-11-01 Thread John Hardin
On Wed, 1 Nov 2017, Rupert Gallagher wrote: We apply a no-nonsense policy, mirroring paper mail policy. Both mail and e-mail sent to undisclosed recipients is either paid-for massmail or spam. I'll grant "largely", but there are legitimate uses for BCC. I hope you're only enforcing this poli

Re: very basic SA-Learn performance question: is 90 seconds or so per token really, really slow or roughly normal?

2017-11-01 Thread RW
On Wed, 01 Nov 2017 15:11:01 +0300 ges...@blackrosetech.com wrote: > > It is when I run it on a large mailbox that it takes what seems like > too long to complete (at least a week for 4,000 message mailbox). > I've almost certainly configured something wrong/weird. The rate is > way, way below

Re: very basic SA-Learn performance question: is 90 seconds or so per token really, really slow or roughly normal?

2017-11-01 Thread gessel
On 2017-11-01 14:31, RW wrote: On Tue, 31 Oct 2017 08:44:20 - Kevin Golding wrote: On Mon, 30 Oct 2017 22:35:08 -, David Gessel wrote: > 1) sa-learn seems really, really slow. Slow enough that spam > sometimes comes in faster. This seems far slower than the > benchmark results sugge

Re: very basic SA-Learn performance question: is 90 seconds or so per token really, really slow or roughly normal?

2017-11-01 Thread RW
On Tue, 31 Oct 2017 08:44:20 - Kevin Golding wrote: > On Mon, 30 Oct 2017 22:35:08 -, David Gessel > wrote: > > > 1) sa-learn seems really, really slow. Slow enough that spam > > sometimes comes in faster. This seems far slower than the > > benchmark results suggest is within the ran

Re: spample: Microsoft Office DDE exploit (in OpenXML attachment)

2017-11-01 Thread Rupert Gallagher
We apply a no-nonsense policy, mirroring paper mail policy. Both mail and e-mail sent to undisclosed recipients is either paid-for massmail or spam. Paper junk and e-mail junk whose origin is verifiable and within legal domain goes to the lawyer, who sues the sender and gets an economic compensa

Re: very basic SA-Learn performance question: is 90 seconds or so per token really, really slow or roughly normal?

2017-11-01 Thread David Gessel
Original Message Subject: Re: very basic SA-Learn performance question: is 90 seconds or so per token really, really slow or roughly normal? From: Matus UHLAR - fantomas To: users@spamassassin.apache.org Date: Tue Oct 31 2017 23:05:23 GMT+0300 (AST) >>> On 31.10.17 01:35, Davi

Re: spample: Microsoft Office DDE exploit (in OpenXML attachment)

2017-11-01 Thread LuKreme
On Nov 1, 2017, at 00:52, Rupert Gallagher wrote: > By local policy, we *reject* e-mail to undisclosed recipient, so this is not > a problem for us. You are rejecting legitimate mail then. -- This is my signature. There are many like it, but this one is mine.