RE: Image spam with inline jpeg image

2006-08-11 Thread Gary Funck
> -Original Message- > From: jdow [mailto:[EMAIL PROTECTED] > Sent: Wednesday, August 09, 2006 7:33 PM > Gary Funck wrote: > > Has anyone considered also supplying new rules in the > > form of rpm's available via a yum-compatible repository? > > It'd be nice to have the usual versioning an

Re: Image spam with inline jpeg image

2006-08-11 Thread jdow
From: "Bret Miller" <[EMAIL PROTECTED]> >>> Nor does it make sense to use a tool, even if supplied with SpamAssassin, >>> that is broken for performing updates. > >> what's the "broken" part? > > Well, this may not qualify as broken, but I would say it's an > undesirable behavior that, upon

RE: Image spam with inline jpeg image

2006-08-11 Thread Bret Miller
> >>> Nor does it make sense to use a tool, even if supplied > with SpamAssassin, > >>> that is broken for performing updates. > > > >> what's the "broken" part? > > > > Well, this may not qualify as broken, but I would say it's an > > undesirable behavior that, upon successful download of the new

Re: Image spam with inline jpeg image

2006-08-11 Thread John D. Hardin
On Fri, 11 Aug 2006, Kenneth Porter wrote: > --On Wednesday, August 09, 2006 7:33 PM -0700 jdow <[EMAIL PROTECTED]> > wrote: > > > For about a femto-second, perhaps. There is too much YMMV > > involved with the SARE rule sets to make it practical as > > an rpm solution. > > True, this is the re

Re: Image spam with inline jpeg image

2006-08-11 Thread Kenneth Porter
--On Wednesday, August 09, 2006 7:33 PM -0700 jdow <[EMAIL PROTECTED]> wrote: For about a femto-second, perhaps. There is too much YMMV involved with the SARE rule sets to make it practical as an rpm solution. True, this is the real problem with packaging SARE: There's no clear separation of

RE: Image spam with inline jpeg image

2006-08-11 Thread Kenneth Porter
--On Wednesday, August 09, 2006 3:54 PM -0500 Logan Shaw <[EMAIL PROTECTED]> wrote: This is purely a philosophical argument, but something seems wrong about the idea of using a package manager to manage volatile data files in /var. The problem is not the use of the package manager but the pla

Re: Image spam with inline jpeg image

2006-08-11 Thread jdow
From: "Justin Mason" <[EMAIL PROTECTED]> jdow writes: From: "Jim Maul" <[EMAIL PROTECTED]> > Bowie Bailey wrote: > >> It doesn't really matter to me who supports which pieces as long as >> they all work. >> >> Someone may be able to fix sa-update so that it can take over from >> RDJ, but a

Re: Image spam with inline jpeg image

2006-08-11 Thread jdow
From: "Logan Shaw" <[EMAIL PROTECTED]> On Fri, 11 Aug 2006, Justin Mason wrote: jdow writes: Nor does it make sense to use a tool, even if supplied with SpamAssassin, that is broken for performing updates. what's the "broken" part? Well, this may not qualify as broken, but I would say i

Re: Image spam with inline jpeg image

2006-08-11 Thread DAve
Theo Van Dinter wrote: On Fri, Aug 11, 2006 at 11:56:00AM -0400, DAve wrote: I think a status report would be a good option as well. SA already asks you for your admins email address at install time. Sending a report of what happened during the sa-update process would be very, very valuable.

Re: Image spam with inline jpeg image

2006-08-11 Thread Theo Van Dinter
On Fri, Aug 11, 2006 at 11:56:00AM -0400, DAve wrote: > I think a status report would be a good option as well. SA already asks > you for your admins email address at install time. Sending a report of > what happened during the sa-update process would be very, very valuable. Hrm. I'd say feel f

Re: Image spam with inline jpeg image

2006-08-11 Thread DAve
Bret Miller wrote: Bret Miller writes: On Fri, 11 Aug 2006, Justin Mason wrote: jdow writes: Nor does it make sense to use a tool, even if supplied with SpamAssassin, that is broken for performing updates. what's the "broken" part? Well, this may not qualify as broken, but I would say it's

Re: Image spam with inline jpeg image

2006-08-11 Thread Theo Van Dinter
On Fri, Aug 11, 2006 at 10:14:46AM -0500, Logan Shaw wrote: > What happens if the new set is broken? There's no easy way > to revert to the last known good state. sa-update lint checks the new files in a separate temp area before installing them into the real directory. Only if lint succeeds (wh

RE: Image spam with inline jpeg image

2006-08-11 Thread Bret Miller
> Bret Miller writes: > > > On Fri, 11 Aug 2006, Justin Mason wrote: > > > > jdow writes: > > > > > > >> Nor does it make sense to use a tool, even if supplied > > > with SpamAssassin, > > > >> that is broken for performing updates. > > > > > > > what's the "broken" part? > > > > > > Well, this may

Re: Image spam with inline jpeg image

2006-08-11 Thread Justin Mason
Bret Miller writes: > > On Fri, 11 Aug 2006, Justin Mason wrote: > > > jdow writes: > > > > >> Nor does it make sense to use a tool, even if supplied > > with SpamAssassin, > > >> that is broken for performing updates. > > > > > what's the "broken" part? > > > > Well, this may not qualify as broke

RE: Image spam with inline jpeg image

2006-08-11 Thread Bret Miller
> On Fri, 11 Aug 2006, Justin Mason wrote: > > jdow writes: > > >> Nor does it make sense to use a tool, even if supplied > with SpamAssassin, > >> that is broken for performing updates. > > > what's the "broken" part? > > Well, this may not qualify as broken, but I would say it's an > undesirable

Re: Image spam with inline jpeg image

2006-08-11 Thread Logan Shaw
On Fri, 11 Aug 2006, Justin Mason wrote: jdow writes: Nor does it make sense to use a tool, even if supplied with SpamAssassin, that is broken for performing updates. what's the "broken" part? Well, this may not qualify as broken, but I would say it's an undesirable behavior that, upon su

Re: Image spam with inline jpeg image

2006-08-11 Thread Justin Mason
jdow writes: > From: "Jim Maul" <[EMAIL PROTECTED]> > > > Bowie Bailey wrote: > > > >> It doesn't really matter to me who supports which pieces as long as > >> they all work. > >> > >> Someone may be able to fix sa-update so that it can take over from > >> RDJ, but as of now, that is not possib

Re: Image spam with inline jpeg image

2006-08-10 Thread Daryl C. W. O'Shea
On 8/11/2006 12:02 AM, jdow wrote: From: "Jim Maul" <[EMAIL PROTECTED]> Bowie Bailey wrote: It doesn't really matter to me who supports which pieces as long as they all work. Someone may be able to fix sa-update so that it can take over from RDJ, but as of now, that is not possible without c

Re: Image spam with inline jpeg image

2006-08-10 Thread jdow
From: "Jim Maul" <[EMAIL PROTECTED]> Bowie Bailey wrote: It doesn't really matter to me who supports which pieces as long as they all work. Someone may be able to fix sa-update so that it can take over from RDJ, but as of now, that is not possible without configuring about 62 sa-update channe

RE: Image spam with inline jpeg image

2006-08-10 Thread Dave Koontz
Perhaps it could be as simple as only updating existing rules for your installation? In other words, you would have to download the CF file and install it first (but you would do this anyways to test!!!). Then sa-update could simply parse your rules directory and update rules found there accordin

Re: Image spam with inline jpeg image

2006-08-10 Thread Stuart Johnston
Bowie Bailey wrote: Michael Scheidell wrote: From: Bowie Bailey [mailto:[EMAIL PROTECTED] Possibly. It depends on the overhead involved in setting up the channels. Plus, not all of us want ALL 62 files! Some of the *[0-3] files say to use 70_abcd0.cf , or _1, or_2, or_3. Would need tome cf

RE: Image spam with inline jpeg image

2006-08-10 Thread Bowie Bailey
Michael Scheidell wrote: > From: Bowie Bailey [mailto:[EMAIL PROTECTED] > > > > Possibly. It depends on the overhead involved in setting up the channels. > > Plus, not all of us want ALL 62 files! > > Some of the *[0-3] files say to use 70_abcd0.cf , or _1, or_2, or_3. > > Would need tome cf f

RE: Image spam with inline jpeg image

2006-08-10 Thread Michael Scheidell
> -Original Message- > From: Bowie Bailey [mailto:[EMAIL PROTECTED] > Sent: Thursday, August 10, 2006 2:45 PM > To: users@spamassassin.apache.org > Subject: RE: Image spam with inline jpeg image > > Possibly. It depends on the overhead involved in setting up >

RE: Image spam with inline jpeg image

2006-08-10 Thread Bowie Bailey
Jim Maul wrote: > Bowie Bailey wrote: > > > It doesn't really matter to me who supports which pieces as long as > > they all work. > > > > Someone may be able to fix sa-update so that it can take over from > > RDJ, but as of now, that is not possible without configuring about > > 62 sa-update ch

Re: Image spam with inline jpeg image

2006-08-10 Thread Jim Maul
Bowie Bailey wrote: It doesn't really matter to me who supports which pieces as long as they all work. Someone may be able to fix sa-update so that it can take over from RDJ, but as of now, that is not possible without configuring about 62 sa-update channels (one for each ruleset RDJ manages).

RE: Image spam with inline jpeg image

2006-08-10 Thread Bowie Bailey
Jim Maul wrote: > Bowie Bailey wrote: > > Bret Miller wrote: > > > > > On Wed, 9 Aug 2006, Gary Funck wrote: > > > > > > Has anyone considered also supplying new rules in the > > > > > > form of rpm's available via a yum-compatible repository? > > > > > > It'd be nice to have the usual versioning a

Re: Image spam with inline jpeg image

2006-08-10 Thread Jim Maul
Bowie Bailey wrote: Bret Miller wrote: On Wed, 9 Aug 2006, Gary Funck wrote: Has anyone considered also supplying new rules in the form of rpm's available via a yum-compatible repository? It'd be nice to have the usual versioning and logging support as well as a central update facility. This c

RE: Image spam with inline jpeg image

2006-08-10 Thread Bowie Bailey
Bret Miller wrote: > > > On Wed, 9 Aug 2006, Gary Funck wrote: > > > > Has anyone considered also supplying new rules in the > > > > form of rpm's available via a yum-compatible repository? > > > > It'd be nice to have the usual versioning and logging > > > > support as well as a central update fac

RE: Image spam with inline jpeg image

2006-08-10 Thread Bret Miller
> > On Wed, 9 Aug 2006, Gary Funck wrote: > > > Has anyone considered also supplying new rules in the > > > form of rpm's available via a yum-compatible repository? > > > It'd be nice to have the usual versioning and logging > > > support as well as a central update facility. This > > > could be d

RE: Image spam with inline jpeg image

2006-08-10 Thread Benny Pedersen
On Wed, August 9, 2006 22:01, Gary Funck wrote: > could be done as a gateway to sa-update, perhaps > providing the updates in other package formats as well. rpm packages does not install sa-update ? i know yum, but dont make it the better sa-update :-) it was worse enogh with rulesdujour -- Ben

Re: Image spam with inline jpeg image

2006-08-09 Thread jdow
From: "Gary Funck" <[EMAIL PROTECTED]> Theo wrote (in part): sa-update is a generic tool that lets users download "channels" (ie: bundles of rules/plugins) from anywhere that decides to publish them (requires a certain setup, etc.) At the moment, the only published channel that I know of

Re: Image spam with inline jpeg image

2006-08-09 Thread jdow
From: "Theo Van Dinter" <[EMAIL PROTECTED]> There's nothing stoping the SARE folks from publishing a single or a bunch of channels and getting rid of RDJ in favor of sa-update if they wanted to... There are some benefits either way I suppose, and I'm biased towards sa-update of course. :| Um,

RE: Image spam with inline jpeg image

2006-08-09 Thread Bowie Bailey
Logan Shaw wrote: > On Wed, 9 Aug 2006, Gary Funck wrote: > > Has anyone considered also supplying new rules in the > > form of rpm's available via a yum-compatible repository? > > It'd be nice to have the usual versioning and logging > > support as well as a central update facility. This > > coul

RE: Image spam with inline jpeg image

2006-08-09 Thread Logan Shaw
On Wed, 9 Aug 2006, Gary Funck wrote: Has anyone considered also supplying new rules in the form of rpm's available via a yum-compatible repository? It'd be nice to have the usual versioning and logging support as well as a central update facility. This could be done as a gateway to sa-update, p

RE: Image spam with inline jpeg image

2006-08-09 Thread Gary Funck
Theo wrote (in part): > > sa-update is a generic tool that lets users download > "channels" (ie: bundles > of rules/plugins) from anywhere that decides to publish them > (requires a > certain setup, etc.) At the moment, the only published > channel that I know > of is updates.spamassassin.org

Re: Image spam with inline jpeg image

2006-08-09 Thread Spamassassin List
- Original Message - From: "Gary Funck" <[EMAIL PROTECTED]> To: Sent: Thursday, August 10, 2006 12:04 AM Subject: RE: Image spam with inline jpeg image Menno wrote: Ramprasad wrote: > > But still this mail is getting thru > http://ecm.netcore.co.in/tmp

Re: Image spam with inline jpeg image

2006-08-09 Thread Theo Van Dinter
On Wed, Aug 09, 2006 at 09:58:19AM -0700, Richard wrote: > > rules_du_jour was done when sa-update did not exists > > are you implying that sa-update replaces rules-du-jour? That depends on what you mean by "replaces". > i though sa-update updates the SA distro's bundled rules, but NOT any > add

Re: Image spam with inline jpeg image

2006-08-09 Thread DAve
Richard wrote: -BEGIN PGP SIGNED MESSAGE- Hash: RIPEMD160 hi, can the rules_du_jour script be config'd to pickup plugin updates as well? i'd guess more than just an add to "TRUSTED_RULESETS" everyone likes to have sa-update ruledujour now :-) i'm sorry, i don't understand that sente

Re: Image spam with inline jpeg image

2006-08-09 Thread Richard
-BEGIN PGP SIGNED MESSAGE- Hash: RIPEMD160 hi, >> can the rules_du_jour script be config'd to pickup plugin updates as well? >> i'd guess more than just an add to "TRUSTED_RULESETS" > > everyone likes to have sa-update ruledujour now :-) i'm sorry, i don't understand that sentence. > r

Re: Image spam with inline jpeg image

2006-08-09 Thread Benny Pedersen
On Wed, August 9, 2006 16:39, Richard wrote: > > can the rules_du_jour script be config'd to pickup plugin updates as well? > i'd guess more than just an add to "TRUSTED_RULESETS" everyone likes to have sa-update ruledujour now :-) rules_du_jour was done when sa-update did not exists -- Benny

RE: Image spam with inline jpeg image

2006-08-09 Thread Gary Funck
Menno wrote: > Ramprasad wrote: > > > > But still this mail is getting thru > > http://ecm.netcore.co.in/tmp/imagespam.txt > > > I tested your mail here with the latest imageinfo.pm and it comes through > indeed. The exact same one in .gif (same text, same background) > was detected > though. It wa

Re: Image spam with inline jpeg image

2006-08-09 Thread MennovB
Ramprasad wrote: > > But still this mail is getting thru > http://ecm.netcore.co.in/tmp/imagespam.txt > I tested your mail here with the latest imageinfo.pm and it comes through indeed. The exact same one in .gif (same text, same background) was detected though. It was even my first and only i

Re: Image spam with inline jpeg image

2006-08-09 Thread Ramprasad
> http://www.rulesemporium.com/plugins.htm#imageinfo > > Updates: > - added optimization changes by Theo Van Dinter > - added jpeg support > - added function image_named() > - added function image_size_exact() > - added function image_size_range() > - added function image_to_text_ratio() > > >

Re: Image spam with inline jpeg image

2006-08-09 Thread Richard
-BEGIN PGP SIGNED MESSAGE- Hash: RIPEMD160 > Are you using the updated version OR the one originally posted? > > http://www.rulesemporium.com/plugins.htm#imageinfo can the rules_du_jour script be config'd to pickup plugin updates as well? i'd guess more than just an add to "TRUSTED_RULE

Re: Image spam with inline jpeg image

2006-08-09 Thread Dhawal Doshy
Ramprasad wrote: All my rulesets and the LARGO rules are for catching inline png and inline gif. Now I am getting stock spams with images like --=_NextPart_001_000C_01C6BBE8.11C02650-- --=_NextPart_000_000B_01C6BBE8.11BB4450 Content-Type: image/jpeg; name="militarism.jpg" Content-T