Unicode right to left HTML override obsfucation

2005-11-18 Thread Sean Doherty
Is there any rules available for catching messages that use the unicode right to left override in HTML to reverse text (sample attached)? For instance 'H‬olle‮ W#8236;dlro‮' would render as 'Hello World' I've seen a couple of these sneak thru recently. I don't want to create a rule to just look

Re: SA 3.01 scoring very low

2004-11-04 Thread Sean Doherty
On Thu, 2004-11-04 at 15:04, Dave Goodrich wrote: > > Check out trusted_network section of Mail::SpamAssassin::Conf > > i.e no RBL tests on trusted networks. > "If you're running with DNS checks enabled, SpamAssassin includes code > to infer your trusted networks on the fly, so this may not be ne

Re: SA 3.01 scoring very low

2004-11-04 Thread Sean Doherty
On Thu, 2004-11-04 at 14:14, Dave Goodrich wrote: > Sean Doherty wrote: > > On Wed, 2004-11-03 at 21:40, Dave Goodrich wrote: > > > >>Good afternoon, > >> > >>I just finished testing an upgrade of SA to 3.01 and my scores fell > >>through the fl

Re: {SPAM} SA 3.01 scoring very low

2004-11-04 Thread Sean Doherty
On Wed, 2004-11-03 at 21:52, Matt Kettler wrote: > At 04:40 PM 11/3/2004, Dave Goodrich wrote: > >Good afternoon, > > > >I just finished testing an upgrade of SA to 3.01 and my scores fell > >through the floor. Read the docs, tried to use the Wiki, followed everyone > >else's upgrade on the list.

Re: SA 3.01 scoring very low

2004-11-04 Thread Sean Doherty
On Wed, 2004-11-03 at 21:40, Dave Goodrich wrote: > Good afternoon, > > I just finished testing an upgrade of SA to 3.01 and my scores fell > through the floor. Read the docs, tried to use the Wiki, followed > everyone else's upgrade on the list. Not sure just what went wrong. > X-Spam-Checker-

Re: AWL and ABL Re: trusted_networks and ALL_TRUSTED

2004-11-02 Thread Sean Doherty
On Tue, 2004-11-02 at 15:16, George Georgalis wrote: > >> The setup I use routes mail at the tcp level, it's basically impossible > >> for a message to reach spam assassin if it's from a trusted network. > >So why not set trusted_networks to 127.0.0.1. That way you can > >be certain that the rule

Re: AWL and ABL Re: trusted_networks and ALL_TRUSTED

2004-11-02 Thread Sean Doherty
On Tue, 2004-11-02 at 12:50, George Georgalis wrote: > >Do you mean -0.001? Why would you want to penalise mail > >coming thru a trusted path? > > It really doesn't matter to me what the score is, I just want to disable > the test. > http://bugzilla.spamassassin.org/show_bug.cgi?id=3406 > > My /

Re: AWL and ABL Re: trusted_networks and ALL_TRUSTED

2004-11-02 Thread Sean Doherty
On Mon, 2004-11-01 at 20:37, George Georgalis wrote: > skip_rbl_checks 1 > use_bayes 0 > > noautolearn 1 > use_auto_whitelist 0 > score AWL 0.001 > > trusted_networks 192.168. > score ALL_TRUSTED 0.001 Do you mean -0.001? Why would you want to penalise mail coming thru a trusted path?

Re: trusted_networks and ALL_TRUSTED

2004-11-02 Thread Sean Doherty
On Mon, 2004-11-01 at 19:28, Justin Mason wrote: > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA1 > > > Jim Maul writes: > > This is exactly how i have my system setup. I have a 192.168 IP > > assigned to my server. It has no public IP assigned to it. However, i > > have a router/firewall i

Re: trusted_networks and ALL_TRUSTED

2004-11-02 Thread Sean Doherty
On Mon, 2004-11-01 at 18:24, Matt Kettler wrote: > At 01:07 PM 11/1/2004, Sean Doherty wrote: > > > so the *next* step must be the external MX. > > > >My 10.x server is inside a firewall which NATs port 25 so this > >conclusion is not correct. I imagine that my set

Re: trusted_networks and ALL_TRUSTED

2004-11-01 Thread Sean Doherty
Justin, > > - if any addresses of the 'by' host is in a reserved network range, > > then it's trusted > > > > However, I would have thought that this would imply that the 10.0.0.53 > > host is trusted and not any servers connecting to it. > > The problem is that 10.x is a private net, there

trusted_networks and ALL_TRUSTED

2004-11-01 Thread Sean Doherty
Hi, I'm looking for some clarification on trusted_networks, the ALL_TRUSTED rule, and in particular how trusted_networks are inferred if not specified in local.cf. Since upgrading to 3.0.1 I have seen an increase in false negatives, which would have otherwise been caught if not for the ALL_TRU

dccifd question

2004-10-08 Thread Sean Doherty
Hi, Spamassassins DCC configuration option "use_dcc" specifies whether to use DCC or not. However, it appears that Spamassassin will perform a dcc check if dccifd is available (if the socket specified under dcc_dccifd_pathor exists) or use_dcc is set to 1. The same logic is in both 2.64 and 3