Re: Seeing "check: exceeded time limit in ..." and need to resolve it

2021-11-16 Thread Henrik K
On Tue, Nov 16, 2021 at 01:08:16PM -0700, Philip Prindeville wrote: > > Or http.sh points to an NS that's offline... Your resolver shoukd time out _way_ sooner than some minutes. > Can the async lookup be back-ported? No, and there will be no new 3.4 releases.

Re: Seeing "check: exceeded time limit in ..." and need to resolve it

2021-11-16 Thread Philip Prindeville
> On Nov 16, 2021, at 3:30 AM, Martin Gregorie wrote: > > On Mon, 2021-11-15 at 17:12 -0700, Philip Prindeville wrote: >> >> >>> On Nov 15, 2021, at 5:06 PM, Greg Troxel wrote: >>> >>> >>> Philip Prindeville writes: >>> Ah, the rule _eval_tests_type11_pri0_set1() took 4:20. >

Re: Seeing "check: exceeded time limit in ..." and need to resolve it

2021-11-16 Thread Philip Prindeville
> On Nov 15, 2021, at 11:12 PM, Henrik K wrote: > > On Mon, Nov 15, 2021 at 04:25:55PM -0700, Philip Prindeville wrote: >> >> >>> On Nov 12, 2021, at 10:35 PM, Henrik K wrote: >>> >>> On Fri, Nov 12, 2021 at 07:49:00PM -0800, John Hardin wrote: What would be helpful here would b

Re: Seeing "check: exceeded time limit in ..." and need to resolve it

2021-11-16 Thread Philip Prindeville
Replies... some duplication of conversation on "mimedefang". > On Nov 15, 2021, at 10:34 PM, Bill Cole > wrote: > > On 2021-11-15 at 18:08:20 UTC-0500 (Mon, 15 Nov 2021 16:08:20 -0700) > Philip Prindeville > is rumored to have said: > >>> On Nov 12, 2021, at 8:49 PM, John Hardin wrote: >>>

Re: MIME_BASE64_TEXT only on us-ascii

2021-11-16 Thread Bowie Bailey
On 11/16/2021 7:34 AM, Philipp Ewald wrote: We support utf-8 Mails and we got Mails utf-8 base64 coded. This should be a reason too to set spam rating. Sorry i dont get it. have a nice day. The point is this: UTF-8 emails SHOULD be base64 encoded. ASCII emails SHOULD NOT be base64 encoded

Re: SHOPIFY_IMG_NOT_RCVD_SFY but from Shopify

2021-11-16 Thread Matt Corallo
On 11/16/21 00:26, Bill Cole wrote: On 2021-11-15 at 20:06:22 UTC-0500 (Mon, 15 Nov 2021 20:06:22 -0500) Matt Corallo is rumored to have said: Full headers follow, but it seems the shopify detection in the above isn't quite correct; Return-path: Envelope-to: vmstfp...@mattcorallo.com De

Re: SHOPIFY_IMG_NOT_RCVD_SFY but from Shopify

2021-11-16 Thread John Hardin
On Tue, 16 Nov 2021, Bill Cole wrote: On 2021-11-15 at 20:06:22 UTC-0500 (Mon, 15 Nov 2021 20:06:22 -0500) Matt Corallo is rumored to have said: Full headers follow, but it seems the shopify detection in the above isn't quite correct; Return-path: Envelope-to: vmstfp...@mattcorallo.com D

Re: SHOPIFY_IMG_NOT_RCVD_SFY but from Shopify

2021-11-16 Thread John Hardin
On Mon, 15 Nov 2021, Matt Corallo wrote: Full headers follow, but it seems the shopify detection in the above isn't quite correct; Thanks for the report, will fix. -- John Hardin KA7OHZhttp://www.impsec.org/~jhardin/ jhar...@impsec.org pgpk -a jh

Re: Seeing "check: exceeded time limit in ..." and need to resolve it

2021-11-16 Thread John Hardin
On Mon, 15 Nov 2021, Philip Prindeville wrote: On Nov 12, 2021, at 8:49 PM, John Hardin wrote: On Fri, 12 Nov 2021, Philip Prindeville wrote: I got the message, saved it to a flat file, and ran "spamassassin -t -D rules < netdev.eml" and saw: ... Nov 12 11:45:38.048 [36367] dbg: rules:

Re: Seeing "check: exceeded time limit in ..." and need to resolve it

2021-11-16 Thread Dave Wreski
For that matter how many know about 'apropos'? And, even if they do, they may not discover 'locate' because 'apropos search' doesn't find either 'updatedb' or 'locate'. You have to enter 'apropos find' to discover that 'locate' exists, and even then you could get side tracked into trying to use

Re: Seeing "check: exceeded time limit in ..." and need to resolve it

2021-11-16 Thread Martin Gregorie
On Tue, 2021-11-16 at 08:33 -0500, Bill Cole wrote: > > Worth noting: locate & updatedb aren't always installed. > Fair comment: they're a standard part of Fedora. IIRC they are also part of the RaspberryPi OS distro, so are likely to be included in Debian and most of its clones. But: how many "

Re: Seeing "check: exceeded time limit in ..." and need to resolve it

2021-11-16 Thread Henrik K
On Tue, Nov 16, 2021 at 08:33:56AM -0500, Bill Cole wrote: > On 2021-11-16 at 05:30:25 UTC-0500 (Tue, 16 Nov 2021 10:30:25 +) > Martin Gregorie > is rumored to have said: > > > Of course, other Linux distros may put it somewhere else, so use > > 'locate' and, if it doesn't find 'txrep', run '

Re: Seeing "check: exceeded time limit in ..." and need to resolve it

2021-11-16 Thread Bill Cole
On 2021-11-16 at 05:30:25 UTC-0500 (Tue, 16 Nov 2021 10:30:25 +) Martin Gregorie is rumored to have said: > Of course, other Linux distros may put it somewhere else, so use > 'locate' and, if it doesn't find 'txrep', run 'sudo updatedb' and try > again. > > Not trying to teach you to suck egg

Re: MIME_BASE64_TEXT only on us-ascii

2021-11-16 Thread Philipp Ewald
We support utf-8 Mails and we got Mails utf-8 base64 coded. This should be a reason too to set spam rating. Sorry i dont get it. have a nice day. On 11/16/21 1:00 PM, Reindl Harald wrote: Am 16.11.21 um 12:47 schrieb Philipp Ewald: Why should a uft-8 base64 coded Mail should contain less

Emotet seems to be back...

2021-11-16 Thread Pedro David Marco
heads  up!!! Sorry for the semi off-topic...  but just in case this may help... Encripted zip files witth dangerous ofuscated macros inside calling our beloved powershell... Pedro

Re: MIME_BASE64_TEXT only on us-ascii

2021-11-16 Thread Philipp Ewald
Why should a uft-8 base64 coded Mail should contain less spam? When user get compromised we look into Spammails that was sent. many of that mails was UTF-8 base64 coded and some mail with us-ascii Guess with mail got through spamassassin? RIGHT. base64 coded male with charset utf-8. Contain

Re: MIME_BASE64_TEXT only on us-ascii

2021-11-16 Thread Martin Gregorie
On Tue, 2021-11-16 at 11:32 +0100, Philipp Ewald wrote: > This is correct. But why is us-ascii requeired for this rule? Are > spammer only in US? > No, its because the base character set for e-mail bodies is USASCII.  Base64 encoding is a way of making sure that attachments using other charsets (

Re: MIME_BASE64_TEXT only on us-ascii

2021-11-16 Thread Philipp Ewald
My problem is that this rule is useless, while I can set the charset to utf-8 and spamassassin ignores this rule I got many SPAMS passed through because 1 scorepoint was missing, because charset was set to "utf-8" Mail with: Content-Type: text/html; charset="us-ascii" getting

Re: Seeing "check: exceeded time limit in ..." and need to resolve it

2021-11-16 Thread Martin Gregorie
On Mon, 2021-11-15 at 17:12 -0700, Philip Prindeville wrote: > > > > On Nov 15, 2021, at 5:06 PM, Greg Troxel wrote: > > > > > > Philip Prindeville writes: > > > > > Ah, the rule _eval_tests_type11_pri0_set1() took 4:20. > > > > > > Why can't I even find the rule? > > try "locate txrep" O