Re: Any other tuning tricks or is this it?

2008-10-17 Thread Andy Sutton
On Fri, 2008-10-17 at 08:44 -0500, Len Conrad wrote: > "Swap: " is a blank line Is swap enabled? (swapon -a) It should have something on the line if nothing is used like: Swap: 4000176k total,0k used, 4000176k free, 415556k cached -- -Andy But remember, the brick walls are there

Re: New free blacklist: BRBL - Barracuda Reputation Block List

2008-09-21 Thread Andy Sutton
On Sat, 2008-09-20 at 23:51 -0700, Jeff Chan wrote: > Haven't tried it myself but thought it may be of interest. I wonder if it will include the barracuda devices that are set to backscatter? -- -Andy Philosophy is a battle against the bewitchment of our intelligence by means of language. - Lu

Re: RulesDuJour & Tripwire Issue

2008-08-28 Thread Andy Sutton
On Wed, 2008-08-27 at 23:05 -0500, Curtis LaMasters wrote: > @Andy - I was able to parse the script that you sent me to which had > neither my problem nor my solution Actually it DID contain your problem AND the solution: # Version 1.31 NOTICE! Rules du jour is no longer being maintained. As the

Re: Spamtraps

2007-09-18 Thread Andy Sutton
On Tue, 2007-09-18 at 17:41 +0300, Jari Fredriksson wrote: > It may take a couple of years for a trap to activate, but eventually > they will. > I'm not an expert on this, so looking forward to better methods as > well in this thread. One thing I chuckle at is that spammers fat finger addresses l

Re: Posioned MX is a bad idea [Was: Email forwarding and RBL trouble]

2007-08-27 Thread Andy Sutton
On Mon, 2007-08-27 at 12:59 -0700, Marc Perkel wrote: > I've not run into a single instance where a legit server only tried > the lowest MX. However, if I did there's a simple solution. If the > fake lowest MX points to an IP on the same server as the working MX > then you can use iptables to block

Re: BOTNET Exceptions for Today

2007-08-21 Thread Andy Sutton
On Tue, 2007-08-21 at 13:42 -0700, John Rudd wrote: > b) Botnet gets 0% false positives at one of my services (not just > "borked DNS == bad", as you're suggesting, but actual "everything that > triggered botnet was actually spam"). And, yes, I actually check I never suggested that. My thoughts

RE: BOTNET Exceptions for Today

2007-08-21 Thread Andy Sutton
On Tue, 2007-08-21 at 13:08 -0700, Bret Miller wrote: > When I see on the list that many people run botnet with ZERO false > positives, I have to ask myself, "how? Anyone who claims that isn't really looking at the email they are blocking, or don't believe borked DNS qualify as a FP. > "we can't

Re: Bouncing emails from certain countries

2007-08-21 Thread Andy Sutton
On Mon, 2007-08-20 at 10:13 -0700, John D. Hardin wrote: > That's kind of an extreme solution, and generally considered bad > practice. Yup - Be prepared for false positive hits if you use this method. I rented a server that just happened to be on a netblock in Germany. US websites/email thoug

Re: not everyone is happy with SA

2007-07-19 Thread Andy Sutton
On Thu, 2007-07-19 at 21:35 +0200, Per Jessen wrote: > Well, provided the objective is to avoid spam, it still might work > well for that individual user. Avoid? For whom? The objective should be to reduce or eliminate spam, not pass filtering costs off on others. The "individual user" didn't s

Re: not everyone is happy with SA

2007-07-19 Thread Andy Sutton
On Thu, 2007-07-19 at 19:37 +0200, Per Jessen wrote: > I think CR can perhaps work quite well for an individual user with the > technical insight & time to spare, but such individual users are only > an small part of the picture. No it doesn't. It foists the recipients burden on others, usually

Re: Spam PDF

2007-06-29 Thread Andy Sutton
On Fri, 2007-06-29 at 12:58 +0200, Claude Frantz wrote: > I was able to decode to plain text using the following commands: > > cat report.pdf | acroread -toPostScript -level2 -saveVM | ps2ascii > > Finally, very simple. Don't forget to filter escapes, or you might get a .pdf that includes some