Re: DNS again

2016-06-03 Thread Andy Balholm
isunderstood the question > ==John ff > On 3 Jun 2016, at 17:23, Andy Balholm <mailto:a...@balholm.com>> wrote: > Where is your mail server hosted. URIBL blocks queries from some cloud > providers (including DigitalOcean) unless you have a subscription. For a > while I h

Re: DNS again

2016-06-03 Thread Andy Balholm
I was using unbound as a local resolver. All queries were going to 127.0.0.1, and there was no forwarding set up. Andy

Re: DNS again

2016-06-03 Thread Andy Balholm
Where is your mail server hosted. URIBL blocks queries from some cloud providers (including DigitalOcean) unless you have a subscription. For a while I had a mail server hosted on DO, and I was paying more for my URIBL subscription than for my hosting. Andy

Re: spamass-milter: orphaned?

2016-06-01 Thread Andy Balholm
I have gotten a few responses now on the spamass-milter mailing list, but none of them is from a project member or maintainer. I have put a copy of the spamass-milter source at https://github.com/andybalholm/spamass-milter. Feel free to file issues or pull requests there. If/when a spamass-milt

Re: spamass-milter: orphaned?

2016-05-26 Thread Andy Balholm
Yes, I eventually discovered -a in the help text. But it’s not in the man page. I sent a mail to the spamass-milt mailing list (and the maintainers) first, and got no response. It was the first post to that list since September 2014. Andy

Re: spamass-milter: orphaned?

2016-05-26 Thread Andy Balholm
I know about the 0.4.0 release in 2014 (almost two years ago). But nothing has happened since then, except the filing of a couple of issues that have not been responded to. The only real issue I have run into is that the -a flag is not documented on the man page. If it looked like the project w

Re: spamass-milter: orphaned?

2016-05-26 Thread Andy Balholm
Where are those updates? There is nothing less than 20 months old at http://cvs.savannah.gnu.org/viewvc/spamass-milt/?root=spamass-milt Is this the Fedora changelog? It talks about upstream, and mentions Fedora 22. Andy

Re: spamass-milter: orphaned?

2016-05-26 Thread Andy Balholm
> ...some other headers to be pushed to mail SA generates What do you mean? Andy

spamass-milter: orphaned?

2016-05-26 Thread Andy Balholm
Spamass-milter or spamass-milt (http://savannah.nongnu.org/projects/spamass-milt/) seems to be the de-facto standard for using SpamAssassin as a milter for Sendmail or Postfix, but it is woefully under-maintained. (The security problem mentioned on https://wiki.apache.org/spamassassin/Integrate

Re: rule for repeated tracking numbers

2014-08-07 Thread Andy Balholm
On Aug 7, 2014, at 10:28 AM, Philip Prindeville wrote: > (1) putting that many domains on a single host is just begging for that host > to have a catastrophic failure (as opposed to putting that many domains on a > local (re)director which servers as a proxy, a la mod_proxy_html mode…) Judgi

Re: rule for repeated tracking numbers

2014-08-07 Thread Andy Balholm
This particular spammer just re-did the format of their emails, probably to get around the rules that we’re working on. Do they read the spamassassin-users list? (I can tell it’s the same spammer, since the return address in Dundrum, Ireland, is the same as some of the earlier ones, and the styl

Re: Spam Assassin - does it work or not? - LONG HEADERS URL

2014-08-07 Thread Andy Balholm
On Aug 7, 2014, at 9:30 AM, Andy wrote: > I have no idea whether I have shell access. I don't even know what that > is. Sorry. Shell access means being able to log into their server and get a command prompt, so that you can do configuration that isn’t supported by their control panel. Lookin

Re: rule for repeated tracking numbers

2014-08-06 Thread Andy Balholm
On Aug 6, 2014, at 2:00 PM, Axb wrote: > Suggest you use a local DNS resolver instead of some third party which is > getting in your way. Good idea. I installed unbound, and configured it to not use Google’s nameservers (which were the ones that were blocked). Now uribl seems to be working.

Re: rule for repeated tracking numbers

2014-08-06 Thread Andy Balholm
On Aug 6, 2014, at 12:00 PM, John Hardin wrote: > Can some fresh samples be posted to pastebin? http://pastebin.com/DWiTYmPN is my complete collection of 24 spams with this pattern received this week. Collect them all!

Re: rule for repeated tracking numbers

2014-08-05 Thread Andy Balholm
On Aug 5, 2014, at 11:16 AM, John Hardin wrote: > It can hit on embedded phone numbers, which are, strictly speaking, valid > hexadecimal strings... > I suspect it's hitting on all those dates as well, and needs some more > tightening. In the spams I’m looking at, all the hex strings are 32 c

Re: rule for repeated tracking numbers

2014-08-05 Thread Andy Balholm
On Aug 5, 2014, at 10:48 AM, John Hardin wrote: > Unfortunately the masscheck pages' links to SVN got broken in the recent > rebuild. > > That rule lives here: > > https://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf?view=log > > It should be part of th

Re: rule for repeated tracking numbers

2014-08-05 Thread Andy Balholm
On Aug 5, 2014, at 10:31 AM, John Hardin wrote: > > There's already a rule for this sort of thing in the sandbox. > > http://ruleqa.spamassassin.org/20140804-r1615505-n/HEXHASH_WORD/detail How do I find the actual rule that the page is about?

Re: Pattern SPAM seen today with full-name ending with dot-digits.

2014-08-05 Thread Andy Balholm
On Aug 5, 2014, at 10:16 AM, Philip Prindeville wrote: > Saw the following SPAM: > > http://pastebin.com/eLm1iRpN That’s the same group of spams that I just posted a rule for, but I’m looking at the repeated numbers in the last paragraph.

rule for repeated tracking numbers

2014-08-05 Thread Andy Balholm
The last few days, I’ve been getting a lot of spams that have a similar pattern. They are plain-text messages, and each one ends with a paragraph from a restaurant review (apparently to confuse bayesian filters), with some numbers inserted. There is an 8-digit decimal number and a 32-digit hex o