Apache SpamAssassin Looking for Student Developers and Project Ideas for Google Summer of Code 2019

2019-03-13 Thread Sidney Markowitz
their break from school. Please help spread the word, review bugzilla, and post about great project ideas that might be appropriate for a student developer with an Apache mentor guiding them. As examples, here is one project that has already been picked up for this year, but gives an idea of

Apache SpamAssassin Looking for Student Developers and Project ,Ideas for Google Summer of Code 2018

2018-01-19 Thread Sidney Markowitz
break from school. Please help spread the word, review bugzilla, and post about great project ideas that might be appropriate for a student developer with an Apache mentor guiding them. For example, due to a hiccup with missing a deadline, this proposal in 2015 wasn't able to be done (

Re: Ideas for blocking 'list' spam

2015-09-01 Thread Olivier Coutu
Le 2015-09-01 11:34, Alex a écrit : Hi all, I'm having a problem with "buy my list" spam and hoped someone could help me with ideas of how to best block them. Here's an example: http://pastebin.com/01C1DDmq Even a few days later, and the sending IP isn't black

Re: Ideas for blocking 'list' spam

2015-09-01 Thread Kris Deugau
Alex wrote: > Hi all, > > I'm having a problem with "buy my list" spam and hoped someone could > help me with ideas of how to best block them. > > Here's an example: > > http://pastebin.com/01C1DDmq > > Even a few days later, and the sending I

Re: Ideas for blocking 'list' spam

2015-09-01 Thread Reindl Harald
Am 01.09.2015 um 17:34 schrieb Alex: Hi all, I'm having a problem with "buy my list" spam and hoped someone could help me with ideas of how to best block them. Here's an example: http://pastebin.com/01C1DDmq Even a few days later, and the sending IP isn't black

Ideas for blocking 'list' spam

2015-09-01 Thread Alex
Hi all, I'm having a problem with "buy my list" spam and hoped someone could help me with ideas of how to best block them. Here's an example: http://pastebin.com/01C1DDmq Even a few days later, and the sending IP isn't blacklisted anywhere. I have a couple of body ru

DOJ claims CryptoLocker 100% ineffective now - was Re: Ideas sought for blocking new variant of cryptolocker

2014-07-15 Thread Kevin A. McGrail
FYI http://www.crn.com/news/security/300073406/doj-cryptolocker-trojan-is-now-out-of-commission.htm?cid=nl_sec#

Re: Obfuscated Windows excecutables (was Re: Ideas sought for blocking new variant of cryptolocker)

2014-07-12 Thread Philip Prindeville
On Jul 10, 2014, at 5:17 PM, Joe Acquisto-j4 wrote: On 7/10/2014 at 3:35 PM, "David F. Skoll" wrote: >> On Thu, 10 Jul 2014 12:25:50 -0700 >> Ted Mittelstaedt wrote: >> >>> Fundamentally I think the problem is with attachments. >> >> No, the problem is not with attachments. An attachme

Re: Obfuscated Windows excecutables (was Re: Ideas sought for blocking new variant of cryptolocker)

2014-07-10 Thread Joe Acquisto-j4
>>> On 7/10/2014 at 3:35 PM, "David F. Skoll" wrote: > On Thu, 10 Jul 2014 12:25:50 -0700 > Ted Mittelstaedt wrote: > >> Fundamentally I think the problem is with attachments. > > No, the problem is not with attachments. An attachment actually included > in an email is no more dangerous than a

Re: Obfuscated Windows excecutables (was Re: Ideas sought for blocking new variant of cryptolocker)

2014-07-10 Thread David F. Skoll
On Thu, 10 Jul 2014 12:25:50 -0700 Ted Mittelstaedt wrote: > Fundamentally I think the problem is with attachments. No, the problem is not with attachments. An attachment actually included in an email is no more dangerous than an attachment downloaded via a link. Email attachments are far too c

Re: Obfuscated Windows excecutables (was Re: Ideas sought for blocking new variant of cryptolocker)

2014-07-10 Thread Ted Mittelstaedt
On 7/10/2014 12:12 PM, John Hardin wrote: On Thu, 10 Jul 2014, Ted Mittelstaedt wrote: On 7/10/2014 8:26 AM, David F. Skoll wrote: On Wed, 9 Jul 2014 17:44:26 -0700 (PDT) John Hardin wrote: > I'm not excusing their approach, but I'm saying there are a lot of > sources of real-world friction

Re: Obfuscated Windows excecutables (was Re: Ideas sought for blocking new variant of cryptolocker)

2014-07-10 Thread John Hardin
On Thu, 10 Jul 2014, Ted Mittelstaedt wrote: On 7/10/2014 8:26 AM, David F. Skoll wrote: On Wed, 9 Jul 2014 17:44:26 -0700 (PDT) John Hardin wrote: > I'm not excusing their approach, but I'm saying there are a lot of > sources of real-world friction that lead to suboptimal solutions like

Re: Obfuscated Windows excecutables (was Re: Ideas sought for blocking new variant of cryptolocker)

2014-07-10 Thread Dave Pooser
On 7/10/14, 1:43 PM, "Ted Mittelstaedt" wrote: >And when victim of the phish clicks on the SSL link then the browser >sends out alarm bells that the SSL certificate is compromised and not to >go there, eh? If we could rely on users to not click right through that SSL warning, we would be living

Re: Obfuscated Windows excecutables (was Re: Ideas sought for blocking new variant of cryptolocker)

2014-07-10 Thread David F. Skoll
On Thu, 10 Jul 2014 11:43:21 -0700 Ted Mittelstaedt wrote: > SO I think that using PGP was the right course of action here. Yes, of course. But they should supply the PGP *software* using a separate delivery mechanism from the PGP-encrypted *payload*. Encouraging people to rename and run execut

Re: Obfuscated Windows excecutables (was Re: Ideas sought for blocking new variant of cryptolocker)

2014-07-10 Thread Ted Mittelstaedt
On 7/10/2014 8:26 AM, David F. Skoll wrote: On Wed, 9 Jul 2014 17:44:26 -0700 (PDT) John Hardin wrote: I'm not excusing their approach, but I'm saying there are a lot of sources of real-world friction that lead to suboptimal solutions like this. I expect the desire to avoid requiring install

Re: Obfuscated Windows excecutables (was Re: Ideas sought for blocking new variant of cryptolocker)

2014-07-10 Thread John Hardin
On Thu, 10 Jul 2014, Ted Mittelstaedt wrote: Although from the pro-gunners out there now we will hear the "software doesn't kill people, users kill people" arguments claiming it's not Symantec's fault Please do not go there. -- John Hardin KA7OHZhttp://www.impsec.org/~jh

Re: Obfuscated Windows excecutables (was Re: Ideas sought for blocking new variant of cryptolocker)

2014-07-10 Thread Kevin A. McGrail
On 7/10/2014 12:31 PM, Ted Mittelstaedt wrote: You didn't read your own code of ethics. It states if you have a bias, you disclose it. David HAD a bias in his original post and DID NOT disclose it. He DID subsequently disclose that bias AFTER I had called him on it and I commend him for it. T

Re: Obfuscated Windows excecutables (was Re: Ideas sought for blocking new variant of cryptolocker)

2014-07-10 Thread Ted Mittelstaedt
You didn't read your own code of ethics. It states if you have a bias, you disclose it. David HAD a bias in his original post and DID NOT disclose it. He DID subsequently disclose that bias AFTER I had called him on it and I commend him for it. This is the problem with codes of ethics - it's e

Re: Obfuscated Windows excecutables (was Re: Ideas sought for blocking new variant of cryptolocker)

2014-07-10 Thread Ted Mittelstaedt
On 7/9/2014 5:18 PM, David F. Skoll wrote: On Wed, 09 Jul 2014 14:44:27 -0700 Ted Mittelstaedt wrote: David DID NOT say that. He said that "he was shocked to discover" Why are you assuming he is under NDA or he is an employee of this company? Let me clarify the situation: 1) I'm the owne

Re: Obfuscated Windows excecutables (was Re: Ideas sought for blocking new variant of cryptolocker)

2014-07-10 Thread Kevin A. McGrail
I believe strongly that ALL IT admins would be well guided by reading the SAGE ethics guide http://www.pccc.com/base.cgim?template=sage_code_of_ethics Can't recommend it highly enough and I think it would guide well in this gray areas on how to handle things. I didn't like that a poster wi

Re: Obfuscated Windows excecutables (was Re: Ideas sought for blocking new variant of cryptolocker)

2014-07-10 Thread David F. Skoll
On Wed, 9 Jul 2014 17:44:26 -0700 (PDT) John Hardin wrote: > I'm not excusing their approach, but I'm saying there are a lot of > sources of real-world friction that lead to suboptimal solutions like > this. I expect the desire to avoid requiring installation (and > maintenance!) of PGP/GPG by th

Re: Ideas sought for blocking new variant of cryptolocker

2014-07-10 Thread Kevin A. McGrail
On 7/8/2014 10:41 PM, David F. Skoll wrote: On Tue, 08 Jul 2014 21:03:35 -0400 "Kevin A. McGrail" wrote: So this sounds like you are searching the entire email for this string which just sounds inefficient especially if they use some big attachments. It's not too bad because the regex is simp

Re: Obfuscated Windows excecutables (was Re: Ideas sought for blocking new variant of cryptolocker)

2014-07-09 Thread Mauricio Tavares
On Wed, Jul 9, 2014 at 5:44 PM, Ted Mittelstaedt wrote: > > > On 7/9/2014 11:37 AM, Mauricio Tavares wrote: >> >> On Wed, Jul 9, 2014 at 2:23 PM, Ted Mittelstaedt wrote: >>> >>> >>> First of all why do people insist on hiding names of companies that >>> do stuff like this? It just makes it look

Re: Obfuscated Windows excecutables (was Re: Ideas sought for blocking new variant of cryptolocker)

2014-07-09 Thread John Hardin
On Wed, 9 Jul 2014, Ted Mittelstaedt wrote: You are an administrator. YOU ARE PAID BY CLUELESS USERS TO PROTECT THEM AND THEIR DATA, DAMMIT. ...unless it involves some actual, you know, effort on their part. And in this instance, Large DP Company *is* doing something proactive to protec

Re: Obfuscated Windows excecutables (was Re: Ideas sought for blocking new variant of cryptolocker)

2014-07-09 Thread David F. Skoll
On Wed, 09 Jul 2014 14:44:27 -0700 Ted Mittelstaedt wrote: > David DID NOT say that. He said that "he was shocked to discover" > Why are you assuming he is under NDA or he is an employee of this > company? Let me clarify the situation: 1) I'm the owner of Roaring Penguin, so my boss is unlikel

Re: Obfuscated Windows excecutables (was Re: Ideas sought for blocking new variant of cryptolocker)

2014-07-09 Thread Ted Mittelstaedt
On 7/9/2014 11:37 AM, Mauricio Tavares wrote: On Wed, Jul 9, 2014 at 2:23 PM, Ted Mittelstaedt wrote: First of all why do people insist on hiding names of companies that do stuff like this? It just makes it look like your manufacturing an event that doesn't exist, it destroys your credibili

Re: Obfuscated Windows excecutables (was Re: Ideas sought for blocking new variant of cryptolocker)

2014-07-09 Thread Mauricio Tavares
On Wed, Jul 9, 2014 at 2:23 PM, Ted Mittelstaedt wrote: > > First of all why do people insist on hiding names of companies that > do stuff like this? It just makes it look like your manufacturing > an event that doesn't exist, it destroys your credibility. > You mean besides NDAs and polici

Re: Obfuscated Windows excecutables (was Re: Ideas sought for blocking new variant of cryptolocker)

2014-07-09 Thread Ted Mittelstaedt
First of all why do people insist on hiding names of companies that do stuff like this? It just makes it look like your manufacturing an event that doesn't exist, it destroys your credibility. Secondly, if you think that this is an example of "badness" on Windows security best practices you sim

Obfuscated Windows excecutables (was Re: Ideas sought for blocking new variant of cryptolocker)

2014-07-09 Thread David F. Skoll
On Wed, 09 Jul 2014 05:44:34 +0200 Karsten Bräckelmann wrote: > If you deliberately try to sneak past sensible security measures, you > should not be surprised to be blocked. The attempt by an honest user > to disguise any $file (he did it on purpose, so he knows there's > issues with that) is in

Re: Ideas sought for blocking new variant of cryptolocker

2014-07-08 Thread Karsten Bräckelmann
On Tue, 2014-07-08 at 22:41 -0400, David F. Skoll wrote: > On Tue, 08 Jul 2014 21:03:35 -0400, Kevin A. McGrail wrote: > > > So this sounds like you are searching the entire email for this > > string which just sounds inefficient especially if they use some big > > attachments. > > It's not too b

Re: Ideas sought for blocking new variant of cryptolocker

2014-07-08 Thread David F. Skoll
On Tue, 08 Jul 2014 21:03:35 -0400 "Kevin A. McGrail" wrote: > So this sounds like you are searching the entire email for this > string which just sounds inefficient especially if they use some big > attachments. It's not too bad because the regex is simple. > Since I'm guessing you are using M

Re: Ideas sought for blocking new variant of cryptolocker

2014-07-08 Thread Kevin A. McGrail
On 7/7/2014 5:34 PM, David F. Skoll wrote: Replying to myself... full MSDOGEXE /\n\nTV[opqr]/ Seems to work. :) So this sounds like you are searching the entire email for this string which just sounds inefficient especially if they use some big attachments. Since I'm guessing you are usin

Re: Ideas sought for blocking new variant of cryptolocker

2014-07-07 Thread David F. Skoll
Replying to myself... > full MSDOGEXE /\n\nTV[opqr]/ Seems to work. :) Regards, David.

Ideas sought for blocking new variant of cryptolocker

2014-07-07 Thread David F. Skoll
hes this regex: ^TV[opqr] but we only want to match that at the very beginning of the B64-encoded body. Any ideas how to do this with a full rule? Would: full MSDOGEXE /\n\nTV[opqr]/ do the trick? Regards, David.

OT: Christmas Gift ideas

2009-12-02 Thread rich...@buzzhost.co.uk
This is top of my list.. http://www.amazon.co.uk/Constant-Contact-Guide-email-Marketing/dp/0470503416/ref=sr_1_1?ie=UTF8&s=books&qid=1259777127&sr=8-1

Bad Ideas in anti-phishing #1353

2009-05-15 Thread John Hardin
This just snuck into my inbox: On Fri, 15 May 2009, StrongWebmail wrote: StrongWebmail launches the world's first email account that can't be hacked. Nobody gets in unless he gets a phone call. {snip} A new service is putting an end to this nightmare. StrongWebmail.com is the first email ac

RE: Ideas to Identify Base64-encoded Spam?

2007-01-28 Thread Rich Shepard
On Sun, 28 Jan 2007, Giampaolo Tomassoni wrote: Yes, they are. But I see often legitimate messages like this. They are probably used when sending something to somebody while having a voice conversation with him/her. I did it, too. Giampaolo, In which case, nothing is lost if the message doe

RE: Ideas to Identify Base64-encoded Spam?

2007-01-28 Thread Giampaolo Tomassoni
From: Rich Shepard [mailto:[EMAIL PROTECTED] > > On Sun, 28 Jan 2007, John D. Hardin wrote: > > > Please don't ask SA to become an antivirus or attachment file type > > security policy enforcement tool. There are already very effective tools > > to do perform those tasks. > >We run only linu

Re: Ideas to Identify Base64-encoded Spam?

2007-01-28 Thread Rich Shepard
On Sun, 28 Jan 2007, John D. Hardin wrote: Please don't ask SA to become an antivirus or attachment file type security policy enforcement tool. There are already very effective tools to do perform those tasks. We run only linux here, so I ignore Microsoft virii and the like. But, when I get

Re: Ideas to Identify Base64-encoded Spam?

2007-01-28 Thread John D. Hardin
On Sun, 28 Jan 2007, Rich Shepard wrote: >The past couple of days has seen the arrival of a new mutant > species of spam: the empty message with a Windows .exe attachment > that is base64 encoded. SpamAssassin is giving them scores of 0.0. Please don't ask SA to become an antivirus or attachm

RE: Ideas to Identify Base64-encoded Spam?

2007-01-28 Thread Giampaolo Tomassoni
From: Rich Shepard [mailto:[EMAIL PROTECTED] > >With your help the amount of spam getting past the various > filters in my > inbox (and that of my fiancee) has dropped dramatically. I appreciate > learning from all of you. > >The past couple of days has seen the arrival of a new mutant s

RE: Ideas to Identify Base64-encoded Spam?

2007-01-28 Thread Giampaolo Tomassoni
From: Rich Shepard [mailto:[EMAIL PROTECTED] > >With your help the amount of spam getting past the various > filters in my > inbox (and that of my fiancee) has dropped dramatically. I appreciate > learning from all of you. > >The past couple of days has seen the arrival of a new mutant s

Ideas to Identify Base64-encoded Spam?

2007-01-28 Thread Rich Shepard
With your help the amount of spam getting past the various filters in my inbox (and that of my fiancee) has dropped dramatically. I appreciate learning from all of you. The past couple of days has seen the arrival of a new mutant species of spam: the empty message with a Windows .exe attachme

Some ideas to test the To or the cc-lines ...

2006-12-08 Thread Wolfgang Uhr
Hello In those lines you find comma separated E-Mails containing and normally thoose line contains my own e-Mail Adress. a) But sometimes this list contains not only my adress but an known spam-trap-adress too. For example let the spam be adressed to [EMAIL PROTECTED] and [EMAIL PROTECTED] and le

RE: Ideas

2006-10-11 Thread Robert Swan
: Ideas From: "Giampaolo Tomassoni" <[EMAIL PROTECTED]> > OMG, listen. > > > We setup regular mail server for companies (mostly exchange servers). Once > we setup the mail server I want to send an e-mail from that new mail server > to [EMAIL PROTECTED] I w

Re: R: Ideas

2006-10-11 Thread Jonas Eckerman
Giampaolo Tomassoni wrote: Anybody running something like this? Yep. Using MIMEDefang. I have a special address for this. Mails sent (and accepted) to that address are fed though SpamAssassin (with autolearning turned off) and a return mail with the results are generated and sent. This is

Re: Ideas

2006-10-11 Thread Michael Grant
ack to the sender with all of the processed info in it like below, any ideas?? Thanks in advance Robert Content analysis details: (1.2 points, -5.0 required) pts rule name description -- ---

Re: Ideas

2006-10-10 Thread jdow
From: "Giampaolo Tomassoni" <[EMAIL PROTECTED]> OMG, listen. We setup regular mail server for companies (mostly exchange servers). Once we setup the mail server I want to send an e-mail from that new mail server to [EMAIL PROTECTED] I want that email run through all the Spamassasin tests the

Re: Ideas

2006-10-10 Thread jdow
ost without exception are forged in spams. {`,'}Bad BAD idea Robert. - Original Message - From: "Robert Swan" <[EMAIL PROTECTED]> To: "SpamAssassin Users" Sent: Tuesday, October 10, 2006 12:42 Subject: Ideas Hi everyone, I am trying to setup a SPAM serve

Re: Ideas

2006-10-10 Thread Loren Wilton
Yes, right. But the abuser would simply forward an a-mail with sa scores to the fake originator of the triggering e-mail. I think that would be mostly useless to spammers. Also, if the '[EMAIL PROTECTED]' address is not too widely disclosed, there shouldn't be chance. Finally, if it becames to b

Re: Ideas

2006-10-10 Thread Loren Wilton
y how to do it.           Loren   - Original Message - From: Robert Swan To: SpamAssassin Users Sent: Tuesday, October 10, 2006 1:31 PM Subject: RE: Ideas OMG, listen.   We setup regular mail server for companies (mostly exchange servers). Once we setu

Re: Ideas

2006-10-10 Thread Jay Chandler
On Oct 10, 2006, at 4:53 PM, Clifton Royston wrote:On Tue, Oct 10, 2006 at 04:31:54PM -0400, Robert Swan wrote:    OMG, listen.   We setup regular mail server for companies (mostly exchange servers).   Once we setup the mail server I want to send an e-mail from that new   mail server to [1][EMAIL P

Re: Ideas

2006-10-10 Thread Clifton Royston
On Tue, Oct 10, 2006 at 04:31:54PM -0400, Robert Swan wrote: >OMG, listen. > >We setup regular mail server for companies (mostly exchange servers). >Once we setup the mail server I want to send an e-mail from that new >mail server to [EMAIL PROTECTED] I want that email run >thr

RE: Ideas

2006-10-10 Thread Coffey, Neal
Giampaolo Tomassoni wrote: > Yes, right. But the abuser would simply forward an a-mail with sa > scores to the fake originator of the triggering e-mail. I think that > would be mostly useless to spammers. To spammers, probably not. To mailbombers and other ne'er-do-wells, it's perfect. > Also, i

R: Ideas

2006-10-10 Thread Giampaolo Tomassoni
> > this domain and SPAM server would be used only for this purpose > > If it's on the Internet, you cannot guarantee this. Spammers and other > evildoers are constantly scanning for abusable servers. It will be > found quickly, and as soon as someone finds out how to abuse it, it will > be abus

R: Ideas

2006-10-10 Thread Giampaolo Tomassoni
sSubject: RE: Ideas   Wait...what?   You want to setup a server that sends spam?   Why not just make an email address, stick it on the usenet and post to a few sites, have it get normal spam, and just test that one address?   Thanks,

RE: Ideas

2006-10-10 Thread Chris Santerre
Chris -Original Message-From: Robert Swan [mailto:[EMAIL PROTECTED]Sent: Tuesday, October 10, 2006 4:32 PMTo: SpamAssassin UsersSubject: RE: Ideas OMG, listen.   We setup regular mail server for companies (mostly exchange servers). Once we setup the mail server I want to send

RE: Ideas

2006-10-10 Thread Coffey, Neal
Robert Swan wrote: > Once we setup the mail server I want to send an e-mail from that > new mail server to [EMAIL PROTECTED] I want that email > run through all the Spamassasin tests then sent back to me with all > the rules that were triggered etc in the body.. Then mail sent to "[EMAIL PROTECT

RE: Ideas

2006-10-10 Thread Toll, Eric
So, what is so hard about that? Just setup a server with SA, then $sa_tag_level_deflt  = -100.0;  Then pop out your emails to yourself.       From: Robert Swan [mailto:[EMAIL PROTECTED] Sent: Tuesday, October 10, 2006 4:32 PMTo: SpamAssassin UsersSubject: RE: Ideas

RE: Ideas

2006-10-10 Thread Robert Swan
[mailto:[EMAIL PROTECTED] Sent: Tuesday, October 10, 2006 4:18 PM To: Robert Swan; SpamAssassin Users Subject: RE: Ideas   Wait...what?   You want to setup a server that sends spam?   Why not just make an email address, stick it on the usenet and post to a few sites, have

R: Ideas

2006-10-10 Thread Giampaolo Tomassoni
ce he would say instead of goodbyepeace my brother. From: Giampaolo Tomassoni [mailto:[EMAIL PROTECTED] Sent: Tuesday, October 10, 2006 3:53 PMTo: SpamAssassin UsersSubject: R: Ideas     Hi everyone, I am trying to setup a SPAM server to process inc

RE: Ideas

2006-10-10 Thread Chris Santerre
www.uribl.com -Original Message-From: Robert Swan [mailto:[EMAIL PROTECTED]Sent: Tuesday, October 10, 2006 3:56 PMTo: SpamAssassin UsersSubject: RE: Ideas I am trying to setup a SPAM server to test e-mail servers, whether they are setup correctly or not..we do mail server setups

RE: Ideas

2006-10-10 Thread Robert Swan
peace my brother. From: Giampaolo Tomassoni [mailto:[EMAIL PROTECTED] Sent: Tuesday, October 10, 2006 3:53 PM To: SpamAssassin Users Subject: R: Ideas     Hi everyone, I am trying to setup a SPAM server to process incoming email and then send it back to the original

R: Ideas

2006-10-10 Thread Giampaolo Tomassoni
  Hi everyone, I am trying to setup a SPAM server to process incoming email and then send it back to the original sender.     You are going to do a spam server yourself: often the source e-mail is forged or is the somebody else's account...   Spam messages often ask the user to c

Ideas

2006-10-10 Thread Robert Swan
“processed” e-mail back to the sender with all of the processed info in it like below, any ideas??     Thanks in advance   Robert    Content analysis details:   (1.2 points, -5.0 required)    pts rule name  description

Re: Please sanity check these ideas for rules.

2006-09-09 Thread mouss
Kris Deugau wrote: mouss wrote: It even happens to me from time to time (delete the subject to replace it, then see an error in the body, switch to correct the body, then forget that the subject was deleted). *blink* What happened to the "New Message" button (or whatever it's been (re)l

Re: Please sanity check these ideas for rules.

2006-09-05 Thread Kris Deugau
mouss wrote: It even happens to me from time to time (delete the subject to replace it, then see an error in the body, switch to correct the body, then forget that the subject was deleted). *blink* What happened to the "New Message" button (or whatever it's been (re)labelled this week)

Re: Please sanity check these ideas for rules.

2006-09-05 Thread Kelson
mouss wrote: (counter) examples are available on this list (see a message sent on 2006/07/27) and on other lists. I've also seen many corportae mail with empty subject (forgotten, or considered irrelevant by the sender). It even happens to me from time to time (delete the subject to replace it,

Re: Please sanity check these ideas for rules.

2006-09-02 Thread mouss
Michael W Cocke wrote: I've got every ruleset & blacklist available and I'm still getting buried - the bayes poison in all of the recent spam has wrecked that. Does anyone see a reason why I can't assume messages with blank subjects are junk? (counter) examples are available on this list (see

Re: Please sanity check these ideas for rules.

2006-08-31 Thread John D. Hardin
On Thu, 31 Aug 2006, David B Funk wrote: > My MTAs started bouncing all hotmail. ;() This is a bad thing? :) -- John Hardin KA7OHZICQ#15735746http://www.impsec.org/~jhardin/ [EMAIL PROTECTED]FALaholic #11174pgpk -a [EMAIL PROTECTED] key: 0xB8732E79 - 2D8C 34F4 6411 F507 136C

Re: Please sanity check these ideas for rules.

2006-08-31 Thread Michael W Cocke
On 31 Aug 2006 20:39:47 -, you wrote: >On Thu, 31 Aug 2006, Michael W Cocke wrote: > >> I've got every ruleset & blacklist available and I'm still getting >> buried - the bayes poison in all of the recent spam has wrecked that. >> Does anyone see a reason why I can't assume messages with blan

Re: Please sanity check these ideas for rules.

2006-08-31 Thread hamann . w
>> >> I've got every ruleset & blacklist available and I'm still getting >> buried - the bayes poison in all of the recent spam has wrecked that. >> Does anyone see a reason why I can't assume messages with blank >> subjects are junk? Also, I've got an idea about maybe doing an >> nslookup on the

Re: Please sanity check these ideas for rules.

2006-08-31 Thread David B Funk
On Thu, 31 Aug 2006, Michael W Cocke wrote: > I've got every ruleset & blacklist available and I'm still getting > buried - the bayes poison in all of the recent spam has wrecked that. > Does anyone see a reason why I can't assume messages with blank > subjects are junk? maybe add a point for mis

Re: Please sanity check these ideas for rules.

2006-08-31 Thread Rob Anderson
>>> Michael W Cocke <[EMAIL PROTECTED]> 08/31/06 12:55PM >>> I've got every ruleset & blacklist available and I'm still getting buried - the bayes poison in all of the recent spam has wrecked that. Does anyone see a reason why I can't assume messages with blank subjects are junk? Also, I've got an

Re: Please sanity check these ideas for rules.

2006-08-31 Thread Matthias Keller
Michael W Cocke wrote: I've got every ruleset & blacklist available and I'm still getting buried - the bayes poison in all of the recent spam has wrecked that. Does anyone see a reason why I can't assume messages with blank subjects are junk? Ask all my friends who regularly send me emails with

Please sanity check these ideas for rules.

2006-08-31 Thread Michael W Cocke
I've got every ruleset & blacklist available and I'm still getting buried - the bayes poison in all of the recent spam has wrecked that. Does anyone see a reason why I can't assume messages with blank subjects are junk? Also, I've got an idea about maybe doing an nslookup on the envelope sender do

Re: good ideas for spam blocking

2006-07-26 Thread Logan Shaw
On Wed, 26 Jul 2006, Paul Matthews wrote: at the moment I have the rules_du_jour script running every week and I have the script below running every night telling SpamAssassin to learn what I can from the uses junk mail folders, but I still seam to get a lot of junk mail that gets past the scanne

Re: good ideas for spam blocking

2006-07-26 Thread Marc Perkel
Create another highest MX record and point it to an IP address that doesn't go anywhere. I get rid of several hundred thousand spams a day doing that.

Re: good ideas for spam blocking

2006-07-26 Thread Matt Kettler
Paul Matthews wrote: > Hi there, > > at the moment I have the rules_du_jour script running every week and I > have the script below running every night telling SpamAssassin to learn > what I can from the uses junk mail folders, but I still seam to get a lot > of junk mail that gets past the scanner

good ideas for spam blocking

2006-07-25 Thread Paul Matthews
Hi there, at the moment I have the rules_du_jour script running every week and I have the script below running every night telling SpamAssassin to learn what I can from the uses junk mail folders, but I still seam to get a lot of junk mail that gets past the scanners, can anyone make any suggestio

Re: bayes issue - any ideas?

2005-10-09 Thread sub
019 > > > > > > bayes debug from older server:SpamAssassin version 2.63 > > debug: bayes token 'mom' => 0.999800086542622 > > debug: bayes token 'Alex' => 0.999279251170047 > > debug: bayes token 'Brunette' => 0.998683760683761 > > debug: bayes token 'nude' => 0.998560747663551 > > debug: bayes token 'brunette' => 0.998560747663551 > > debug: bayes token 'Fucks' => 0.998159362549801 > > debug: bayes token 'stupid' => 0.997909502262443 > > debug: bayes token 'Ebony' => 0.993492957746479 > > debug: bayes token 'slut' => 0.990941176470588 > > debug: bayes token 'Grant' => 0.990941176470588 > > debug: bayes token 'non' => 0.989881305839074 > > debug: bayes token 'nurse' => 0.985096774193548 > > debug: bayes token 'sk:SVifSQ,' => 0.985096774193548 > > debug: bayes token 'monster' => 0.985096774193548 > > debug: bayes token 'UD:UbhjPRQ,hVX,jP' => 0.985096774193548 > > debug: bayes token 'Mistress' => 0.978 > > debug: bayes token 'Pam' => 0.978 > > debug: bayes token 'Amateur' => 0.975545163594609 > > debug: bayes token 'Undresses' => 0.958 > > debug: bayes token 'poser' => 0.958 > > debug: bayes token 'Monster' => 0.958 > > debug: bayes token 'fuck' => 0.90580008624735 > > debug: bayes: score = 1 > > > > Any ideas? > > > > Scott > > [EMAIL PROTECTED]

Re: bayes issue - any ideas?

2005-10-06 Thread sub
> bayes debug from older server:SpamAssassin version 2.63 > > debug: bayes token 'mom' => 0.999800086542622 > > debug: bayes token 'Alex' => 0.999279251170047 > > debug: bayes token 'Brunette' => 0.998683760683761 > > debug: bayes token 'nude' => 0.998560747663551 > > debug: bayes token 'brunette' => 0.998560747663551 > > debug: bayes token 'Fucks' => 0.998159362549801 > > debug: bayes token 'stupid' => 0.997909502262443 > > debug: bayes token 'Ebony' => 0.993492957746479 > > debug: bayes token 'slut' => 0.990941176470588 > > debug: bayes token 'Grant' => 0.990941176470588 > > debug: bayes token 'non' => 0.989881305839074 > > debug: bayes token 'nurse' => 0.985096774193548 > > debug: bayes token 'sk:SVifSQ,' => 0.985096774193548 > > debug: bayes token 'monster' => 0.985096774193548 > > debug: bayes token 'UD:UbhjPRQ,hVX,jP' => 0.985096774193548 > > debug: bayes token 'Mistress' => 0.978 > > debug: bayes token 'Pam' => 0.978 > > debug: bayes token 'Amateur' => 0.975545163594609 > > debug: bayes token 'Undresses' => 0.958 > > debug: bayes token 'poser' => 0.958 > > debug: bayes token 'Monster' => 0.958 > > debug: bayes token 'fuck' => 0.90580008624735 > > debug: bayes: score = 1 > > > > Any ideas? > > > > Scott > > [EMAIL PROTECTED]

Re: bayes issue - any ideas?

2005-10-06 Thread Rick Macdougall
brunette' => 0.998560747663551 debug: bayes token 'Fucks' => 0.998159362549801 debug: bayes token 'stupid' => 0.997909502262443 debug: bayes token 'Ebony' => 0.993492957746479 debug: bayes token 'slut' => 0.990941176470588 debug: bayes tok

bayes issue - any ideas?

2005-10-06 Thread sub
debug: bayes token 'Fucks' => 0.998159362549801 debug: bayes token 'stupid' => 0.997909502262443 debug: bayes token 'Ebony' => 0.993492957746479 debug: bayes token 'slut' => 0.990941176470588 debug: bayes token 'Grant' => 0.990941176470588 debug: bayes token 'non' => 0.989881305839074 debug: bayes token 'nurse' => 0.985096774193548 debug: bayes token 'sk:SVifSQ,' => 0.985096774193548 debug: bayes token 'monster' => 0.985096774193548 debug: bayes token 'UD:UbhjPRQ,hVX,jP' => 0.985096774193548 debug: bayes token 'Mistress' => 0.978 debug: bayes token 'Pam' => 0.978 debug: bayes token 'Amateur' => 0.975545163594609 debug: bayes token 'Undresses' => 0.958 debug: bayes token 'poser' => 0.958 debug: bayes token 'Monster' => 0.958 debug: bayes token 'fuck' => 0.90580008624735 debug: bayes: score = 1 Any ideas? Scott [EMAIL PROTECTED]

Re: Any ideas on what would catch this?

2005-07-05 Thread Raymond Dijkxhoorn
Hi! I am sure that SURLB and URIBL would catch this now, but what rules would you recommend to catch this? We do not use bayes, so this is not an option right now. URIBL_AB_SURBL 0.42, URIBL_JP_SURBL 4.26, URIBL_SBL 4.26 Bye, Raymond.

Re: Any ideas on what would catch this?

2005-07-05 Thread Duncan Hill
On Tuesday 05 July 2005 15:41, [EMAIL PROTECTED] typed: > Received: from 204-161-126-200.fibertel.com.ar ([200.126.161.204]) > by xxx.atco.ca with smtp (Exim ) > id 1Dpnum-0001Yc-RY; Tue, 05 Jul 2005 07:56:46 -0600 Deny traffic from \d{1,3}-\d{1,3}-\d{1,3}-\d{1,3}\.fibertel\.com\.ar perhaps. >

Any ideas on what would catch this?

2005-07-05 Thread Martin.Carnegie
Title: Any ideas on what would catch this? I am sure that SURLB and URIBL would catch this now, but what rules would you recommend to catch this? We do not use bayes, so this is not an option right now. Thanks. Microsoft Mail Internet Headers Version 2.0 Received: from xxx.atco.com

RE: ideas on why this rule isn't working?

2005-05-26 Thread Johnson, S
Where can I get the SARE rule for this? -Original Message- From: Loren Wilton [mailto:[EMAIL PROTECTED] Sent: Thursday, May 26, 2005 12:33 PM To: users@spamassassin.apache.org Subject: Re: ideas on why this rule isn't working? > Any ideas on why this isn't working? Th

RE: ideas on why this rule isn't working?

2005-05-26 Thread Johnson, S
@spamassassin.apache.org Subject: Re: ideas on why this rule isn't working? Johnson, S wrote: > I have to admit... Some people are actually trying to help me keep bad > material out of our school district. They are attaching a > "sexually-explicit: text text text" in the subject line.

Re: ideas on why this rule isn't working?

2005-05-26 Thread Loren Wilton
> No, it's not... I wonder why this is? I'm on SA 3.0.1 as well. That rule may not have been in 3.0.1, if I recall correctly. It started as a SARE rule and moved over at some point. Maybe that was 0.1, maybe 0.2. Not very long ago though. Loren

RE: ideas on why this rule isn't working?

2005-05-26 Thread Johnson, S
No, it's not... I wonder why this is? I'm on SA 3.0.1 as well. -Original Message- From: Kevin Peuhkurinen [mailto:[EMAIL PROTECTED] Sent: Thursday, May 26, 2005 12:06 PM Cc: users@spamassassin.apache.org Subject: Re: ideas on why this rule isn't working? Johnson, S wrot

Re: ideas on why this rule isn't working?

2005-05-26 Thread Loren Wilton
> Any ideas on why this isn't working? Thanks! header ZXS_SEXUALLY_EXPLICIT Subject =~ /\bsexually-explicit/i describe ZXS_SEXUALLY_EXPLICIT bad...bad...bad... score ZXS_SEXUALLY_EXPLICIT 10 Looks good to me. Did you remember to restart spamd after you put this in a rules file s

Re: ideas on why this rule isn't working?

2005-05-26 Thread Matt Kettler
mail to the > blackhole. Any ideas on why this isn’t working? Thanks! > > > > header ZXS_SEXUALLY_EXPLICIT Subject =~ /\bsexually-explicit/i > > describe ZXS_SEXUALLY_EXPLICIT bad...bad...bad... > > score ZXS_SEXUALLY_EXPLICIT 10 Where did you add the rule? Do you use s

Re: ideas on why this rule isn't working?

2005-05-26 Thread Kevin Peuhkurinen
. Any ideas on why this isn’t working? Thanks! header ZXS_SEXUALLY_EXPLICIT Subject =~ /\bsexually-explicit/i describe ZXS_SEXUALLY_EXPLICIT bad...bad...bad... score ZXS_SEXUALLY_EXPLICIT 10 Sorry, but I have no idea why

ideas on why this rule isn't working?

2005-05-26 Thread Johnson, S
I have to admit… Some people are actually trying to help me keep bad material out of our school district.  They are attaching a “sexually-explicit: text text text” in the subject line.  So I thought that I’d write a rule to catch that and re-route the mail to the blackhole.  Any ideas on