Re: Nonsense spam

2010-06-25 Thread Karsten Bräckelmann
On Fri, 2010-06-25 at 10:59 -0400, Randy Ramsdell wrote: > > The current scores are actually: > > RCVD_IN_PBL 0 3.558 0 3.335 Latest 3.3.x scores. > I show these current scores which are much lower than what you have. It > this because of the spamassassin version we use or maybe I did not use > s

Re: Nonsense spam

2010-06-25 Thread Randy Ramsdell
RW wrote: > On Thu, 24 Jun 2010 15:59:24 -0400 > Michael Scheidell wrote: > > >> On 6/24/10 3:51 PM, Ned Slider wrote: >> >>> The danger comes when people use the PBL incorrectly and deep parse >>> all headers which *will* lead to copious FPs. >>> >>> Either way, I'd have no hesitation bl

Re: Nonsense spam

2010-06-25 Thread Matus UHLAR - fantomas
> On Thu, Jun 24, 2010 at 03:59:24PM -0400, Michael Scheidell wrote: > > that is why, as Ned said, you have to only use it on the LAST > > UNTRUSTED ip. (or first received header). On 25.06.10 13:27, Henrik K wrote: > What you are referring to is the EXTERNAL border (MX-border). Trusted may > not

Re: Nonsense spam

2010-06-25 Thread Henrik K
On Thu, Jun 24, 2010 at 03:59:24PM -0400, Michael Scheidell wrote: > > that is why, as Ned said, you have to only use it on the LAST > UNTRUSTED ip. (or first received header). What you are referring to is the EXTERNAL border (MX-border). Trusted may not be the same on some configurations (big IS

Re: Nonsense spam

2010-06-24 Thread RW
On Thu, 24 Jun 2010 15:59:24 -0400 Michael Scheidell wrote: > On 6/24/10 3:51 PM, Ned Slider wrote: > > The danger comes when people use the PBL incorrectly and deep parse > > all headers which *will* lead to copious FPs. > > > > Either way, I'd have no hesitation blocking outright on PBL or > >

Re: Nonsense spam

2010-06-24 Thread Michael Scheidell
On 6/24/10 3:51 PM, Ned Slider wrote: The danger comes when people use the PBL incorrectly and deep parse all headers which *will* lead to copious FPs. Either way, I'd have no hesitation blocking outright on PBL or scoring very highly in SA. since the PBL also lists 'dialups'. and if a dial

Re: Nonsense spam

2010-06-24 Thread Yet Another Ninja
On 2010-06-24 21:51, Ned Slider wrote: Michael Scheidell wrote: On 6/24/10 1:18 PM, Randy Ramsdell wrote: Yet spamassassin scores it with a .9. I have been reluctant to block and this is compounded by spamassassin scoring it low as if it weren't as accurate as you state. again, look at

Re: Nonsense spam

2010-06-24 Thread Ned Slider
Michael Scheidell wrote: On 6/24/10 1:18 PM, Randy Ramsdell wrote: Yet spamassassin scores it with a .9. I have been reluctant to block and this is compounded by spamassassin scoring it low as if it weren't as accurate as you state. again, look at the circumstances. the SA scoring migh

Re: Nonsense spam

2010-06-24 Thread Michael Scheidell
On 6/24/10 1:18 PM, Randy Ramsdell wrote: Yet spamassassin scores it with a .9. I have been reluctant to block and this is compounded by spamassassin scoring it low as if it weren't as accurate as you state. again, look at the circumstances. the SA scoring might be crippled due to the

Re: Nonsense spam

2010-06-24 Thread Randy Ramsdell
Michael Scheidell wrote: > On 6/24/10 12:07 PM, Randy Ramsdell wrote: >> Anyone receiving these? It is either a borked spam script or they are >> probing. They come in with different headers and different body each >> time so I am not sure how to mark or block them. Any suggestions would >> be appr

Re: Nonsense spam

2010-06-24 Thread Michael Scheidell
On 6/24/10 12:07 PM, Randy Ramsdell wrote: Anyone receiving these? It is either a borked spam script or they are probing. They come in with different headers and different body each time so I am not sure how to mark or block them. Any suggestions would be appreciated. http://pastebin.com/kQJ0SPt