RE: USPS Spam

2013-09-03 Thread Andrew Talbot
Just wanted to throw in my two cents here - I have spoken to USPS about this and they said that they never send out these messages unless the client requests them, and that it should be safe to completely block messages like this. The same cannot be said about UPS and FexEx, by the way. > ---

SUBJ_ALL_CAPS

2013-08-20 Thread Andrew Talbot
Hey all - Does anybody know how long the string needs to be to trigger SUBJ_ALL_CAPS? I know it has to be multi-word and over a certain length. Was wondering the specific length. Thanks in advance J

Whitelisting subdomains?

2013-08-14 Thread Andrew Talbot
Hey, all - I'm trying to whitelist all our internal subdomains but I can't seem to get it to work. We have so many of them that it's impractical to do them individually. For instance, we have _...@logs.domain.com, @admin-sql.domani.com etc. etc. etc. I was thinking that whitelist_from *

RE: PayPal spam filter?

2013-06-27 Thread Andrew Talbot
I just had to weigh in here to say that we have DCC_CHECK scored up to a 4, and all of these kinds of spam messages get caught by that because they always hit at least another 1 point worth of rules. Also, those two rules require plugins, I believe. > -Original Message- > From: Juer

RE: "Chain" rules?

2013-06-24 Thread Andrew Talbot
PM > To: users@spamassassin.apache.org > Subject: Re: "Chain" rules? > > On Mon, 24 Jun 2013, Andrew Talbot wrote: > > > Is there a way to "chain" rules together such that one rule will only > > fire if another is hit? > > > > Specifically, w

"Chain" rules?

2013-06-24 Thread Andrew Talbot
Hey all - Is there a way to "chain" rules together such that one rule will only fire if another is hit? Specifically, we have a client that is getting hit with a bunch of messages that are just links, but the links contain sex words. We want to do a body scan for a list of sex words if and

RE: Rule to scan for .html attachments?

2013-05-31 Thread Andrew Talbot
3 3:38 PM > To: users@spamassassin.apache.org > Subject: Re: Rule to scan for .html attachments? > > On Fri, 2013-05-31 at 14:45 -0400, Andrew Talbot wrote: > > I need it to fire on any HTML attachment. The modules are enabled. I > > can get it to pick up text/html, remember,

RE: Rule to scan for .html attachments?

2013-05-31 Thread Andrew Talbot
HTML files attached. > -Original Message- > From: Martin Gregorie [mailto:mar...@gregorie.org] > Sent: Friday, May 31, 2013 2:35 PM > To: users@spamassassin.apache.org > Subject: Re: Rule to scan for .html attachments? > > On Fri, 2013-05-31 at 14:10 -0400, Andrew Tal

RE: Rule to scan for .html attachments?

2013-05-31 Thread Andrew Talbot
t; Subject: Re: Rule to scan for .html attachments? > > On Fri, 31 May 2013 14:10:36 -0400 > Andrew Talbot wrote: > > > That didn't work :( > > What didn't work? Oh... you top-posted. > > Anyway... you might need a "full" rule, which can be ex

Re: Rule to scan for .html attachments?

2013-05-31 Thread Andrew Talbot
Didn't work with mime_header (or mimeheader) with either rule. On Fri, May 31, 2013 at 12:23 PM, Axb wrote: > On 05/31/2013 05:51 PM, Andrew Talbot wrote: > >> Hey all - >> >> I'm trying to set up a custom rule that scores HTML attachments. >> >>

Re: Rule to scan for .html attachments?

2013-05-31 Thread Andrew Talbot
That didn't work :( On Fri, May 31, 2013 at 12:40 PM, Martin Gregorie wrote: > On Fri, 2013-05-31 at 11:51 -0400, Andrew Talbot wrote: > > I'm trying to set up a custom rule that scores HTML attachments. > > > ..snippage.. > > > I found this : > heade

Rule to scan for .html attachments?

2013-05-31 Thread Andrew Talbot
Hey all - I'm trying to set up a custom rule that scores HTML attachments. The problem I'm running across is that using a rule like this one: mimeheader HTML_ATTACH Content-Type =~ /^text\/html/i Will flag all messages that come in as HTML (vs. plain text). I found this : header HTML_ATTACH_RUL

Re: Bayes + DCC / Bayes as a false-positive killer

2013-05-29 Thread Andrew Talbot
9, 2013 at 3:13 AM, Matus UHLAR - fantomas wrote: > On 28.05.13 16:43, Andrew Talbot wrote: > >> That said, I'm wondering if it's redundant to run DCC and Bayes at the >> same >> time? From what I understand, DCC is a subscription-based service, so it >> would

Re: Bayes + DCC / Bayes as a false-positive killer

2013-05-29 Thread Andrew Talbot
ure. Bayes performs beautifully in my test environment. I just need to find that extra "WOW" factor. I thought that saving the cost on DCC would be it but ... That didn't seem to make a difference. Go figure. On Wed, May 29, 2013 at 8:02 AM, RW wrote: > On Tue, 28 May 201

Re: Bayes + DCC / Bayes as a false-positive killer

2013-05-29 Thread Andrew Talbot
;ve got no idea. I just work here, Dave! :) Thank you for your response. On Tue, May 28, 2013 at 8:12 PM, Dave Warren wrote: > On 2013-05-28 13:43, Andrew Talbot wrote: > >> As some of you may have known from talking with me over the past few >> weeks, I've been having a diffic

Bayes + DCC / Bayes as a false-positive killer

2013-05-28 Thread Andrew Talbot
Hey all - I've got two questions: 1- We're running Bayes and DCC on our server, and we've just been running Bayes locally to see how well it works. It's been about three weeks now so I finally really started poring over the results. One thing I noticed that I thought was a particularly interest

Bayes autolearning: logarithmic?

2013-05-22 Thread Andrew Talbot
Hey all - I set up Bayes with autolearning a few weeks ago. It took forever to get started, but now it seems like the learning speed has accelerated. Is the autolearning supposed to accelerate? I can't help but feel like it may just be feeding itself it's own data or something.

RE: Default Bayes Database

2013-05-10 Thread Andrew Talbot
. So here goes!! Thanks for all your help. > -Original Message- > From: Karsten Bräckelmann [mailto:guent...@rudersport.de] > Sent: Wednesday, May 08, 2013 8:18 PM > To: users@spamassassin.apache.org > Subject: Re: Default Bayes Database > > On Wed, 2013-05-08 at 14

RE: Default Bayes Database

2013-05-08 Thread Andrew Talbot
ing. > -Original Message- > From: Axb [mailto:axb.li...@gmail.com] > Sent: Wednesday, May 08, 2013 1:32 PM > To: users@spamassassin.apache.org > Subject: Re: Default Bayes Database > > On 05/08/2013 07:26 PM, Andrew Talbot wrote: > > Hey all - > > >

Default Bayes Database

2013-05-08 Thread Andrew Talbot
Hey all - I remember seeing somewhere that there was a default Bayes database for Bayes to start using right away, but can't seem to find that information again on the Wiki or in my notes. Can someone please help?

RE: Bayes Autolearning

2013-05-01 Thread Andrew Talbot
0 > Steve Freegard wrote: > > > On 01/05/13 19:40, Andrew Talbot wrote: > > > Hi, Seve - > > > > > > Thanks for your response. Is that just for performance reasons? > > > > > > > Performance is one of the things that bayes_auto_learn_on_er

RE: Bayes Autolearning

2013-05-01 Thread Andrew Talbot
On 01/05/13 19:14, Axb wrote: > > On 05/01/2013 08:01 PM, Andrew Talbot wrote: > > > >> Any suggestions any of you have for a Bayes newbie - about what I > >> just asked or otherwise - would be very much appreciated. > > > > I advocate autolearning as it has al

RE: Bayes Autolearning

2013-05-01 Thread Andrew Talbot
sassin.apache.org > Subject: Re: Bayes Autolearning > > On 05/01/2013 08:01 PM, Andrew Talbot wrote: > > > Any suggestions any of you have for a Bayes newbie - about what I just > > asked or otherwise - would be very much appreciated. > > I advocate autolearning as it h

Bayes Autolearning

2013-05-01 Thread Andrew Talbot
Hey All - I'm about to set up Bayes on one of our mail servers. A lot of the documentation says that I need to manually sift through a few hundred messages and classify them to 'teach' the filter, and it sounds like I may need to do that on an ongoing basis. That is not a very plausible so

RE: More longer rules or fewer shorter ones?

2013-04-26 Thread Andrew Talbot
at 18:45 -0400, Andrew Talbot wrote: > I like your point about the portmanteau rules (and I award you two > Points for using one of my favorite words in a new - yet appropriate - > manner!). > :-) > I never thought about scoring each rule as a 0.001 or something really > l

Re: More longer rules or fewer shorter ones?

2013-04-25 Thread Andrew Talbot
longer rules or fewer shorter ones? On Wed, 2013-04-24 at 12:32 -0400, Andrew Talbot wrote: > I have my customized deployment split up into a bunch of separate CF > files (by category) and I have those further split up into rules based > on score. > I also use very long rules,

RE: More longer rules or fewer shorter ones?

2013-04-24 Thread Andrew Talbot
-Original Message- From: John Hardin [mailto:jhar...@impsec.org] Sent: Wednesday, April 24, 2013 1:53 PM To: users@spamassassin.apache.org Subject: RE: More longer rules or fewer shorter ones? On Wed, 24 Apr 2013, Andrew Talbot wrote: > John, > > Thanks for your prompt response! >

RE: More longer rules or fewer shorter ones?

2013-04-24 Thread Andrew Talbot
M To: users@spamassassin.apache.org Subject: Re: More longer rules or fewer shorter ones? On Wed, 24 Apr 2013, Andrew Talbot wrote: > Hey, all - > > I have my customized deployment split up into a bunch of separate CF > files (by category) and I have those further split up into rules

More longer rules or fewer shorter ones?

2013-04-24 Thread Andrew Talbot
Hey, all - I have my customized deployment split up into a bunch of separate CF files (by category) and I have those further split up into rules based on score. So, I have a bunch of stuff like: header RULE_1 Subject =~ /\b(this|that|theother|blah|blah)/i score RULE_1 1 describe RULE_