Re: FSL_HELO_BARE_IP_2 & RCVD_NUMERIC_HELO

2013-10-18 Thread SM
At 02:56 15-10-2013, Stan Hoeppner wrote: In both cases the last two Received: headers in each message are forgeries as no SMTP transaction occurred. I'm sure this violates more than one SMTP RFC, but I doubt Gmane will change the way they do this any time soon. I don't think that there is any

Re: FSL_HELO_BARE_IP_2 & RCVD_NUMERIC_HELO

2013-10-17 Thread John Hardin
On Thu, 17 Oct 2013, Stan Hoeppner wrote: Whether Gmane is violating RFC or not isn't my concern. What is my concern is that the way they create these headers is breaking the two rules in the subject line. Apparently a fix is already in place to prevent these two rules from being applied to li

Re: FSL_HELO_BARE_IP_2 & RCVD_NUMERIC_HELO

2013-10-17 Thread Stan Hoeppner
On 10/17/2013 2:09 PM, Jonas Eckerman wrote: > I answer privately since this really isn't about SpamAssassin any more, and > SpamAssassin isn't about RFC conformance. Oh, but it does directly relate to the above two rules. And I believe this is a healthy discussion. It will educate others as to

Re: FSL_HELO_BARE_IP_2 & RCVD_NUMERIC_HELO

2013-10-17 Thread Stan Hoeppner
On 10/16/2013 3:01 AM, Jonas Eckerman wrote: >> Operators of newsgroups which mirror/archive mailing >> lists, and allow posting from a web interface, are adding forged >> Received: headers before sending an email to the respective list >> server. > > In what way are they forged? I'm to this list

Re: FSL_HELO_BARE_IP_2 & RCVD_NUMERIC_HELO

2013-10-16 Thread Jonas Eckerman
>Operators of newsgroups which mirror/archive mailing >lists, and allow posting from a web interface, are adding forged >Received: headers before sending an email to the respective list >server. In what way are they forged? Do they contain addresses that doesn't match the system adding the receiv

Re: FSL_HELO_BARE_IP_2 & RCVD_NUMERIC_HELO

2013-10-15 Thread Stan Hoeppner
On 10/15/2013 4:15 PM, David B Funk wrote: > On Mon, 14 Oct 2013, Stan Hoeppner wrote: > >> On 10/14/2013 2:47 PM, Adam Katz wrote: >>> On 10/12/2013 09:26 AM, Stan Hoeppner wrote: These two rules are adding 4.0 pts [...] Content analysis details: (4.8 points, 4.2 required) pts r

Re: FSL_HELO_BARE_IP_2 & RCVD_NUMERIC_HELO

2013-10-15 Thread David B Funk
On Mon, 14 Oct 2013, Stan Hoeppner wrote: On 10/14/2013 2:47 PM, Adam Katz wrote: On 10/12/2013 09:26 AM, Stan Hoeppner wrote: These two rules are adding 4.0 pts [...] Content analysis details: (4.8 points, 4.2 required) pts rule name description --

Re: FSL_HELO_BARE_IP_2 & RCVD_NUMERIC_HELO

2013-10-15 Thread Stan Hoeppner
On 10/12/2013 9:28 PM, John Hardin wrote: > On Sat, 12 Oct 2013, Stan Hoeppner wrote: > >> Steve, the one who wrote this regex, would you please explain your >> reasoning behind giving this rule a score so high as 2.8, > > That score was auto-assigned by masscheck, where it is doing quite well: >

Re: FSL_HELO_BARE_IP_2 & RCVD_NUMERIC_HELO

2013-10-14 Thread Stan Hoeppner
On 10/14/2013 2:47 PM, Adam Katz wrote: > On 10/12/2013 09:26 AM, Stan Hoeppner wrote: >> These two rules are adding 4.0 pts [...] >> Content analysis details: (4.8 points, 4.2 required) >> pts rule name description >> ---

Re: FSL_HELO_BARE_IP_2 & RCVD_NUMERIC_HELO

2013-10-14 Thread Adam Katz
On Sat, 12 Oct 2013, Stan Hoeppner wrote: >> and engage in discussion WRT lowering the score, eliminating the >> overlap with the other bare IP HELO rules, etc? On 10/12/2013 07:28 PM, John Hardin wrote: > It seems that 94% of the ham hits in masscheck are against list mail, > and none of the spam

Re: FSL_HELO_BARE_IP_2 & RCVD_NUMERIC_HELO

2013-10-14 Thread Adam Katz
On 10/12/2013 09:26 AM, Stan Hoeppner wrote: > These two rules are adding 4.0 pts [...] > Content analysis details: (4.8 points, 4.2 required) > pts rule name description > - > 2.8 FSL_HELO_BARE_IP_2 FSL_H

Re: FSL_HELO_BARE_IP_2 & RCVD_NUMERIC_HELO

2013-10-13 Thread Stan Hoeppner
On 10/13/2013 11:07 AM, John Hardin wrote: ... > Yes. It will take a day or two to make it through masscheck. And we've > had corpora starvation issues the last few weeks; if the ham corpus gets > thin again updates may be delayed. FSL_HELO_BARE_IP_2 3am CDT w/score 2.8 11am CDT w/score 2.4 Upd

Re: FSL_HELO_BARE_IP_2 & RCVD_NUMERIC_HELO

2013-10-13 Thread Kevin A. McGrail
On 10/13/2013 2:17 PM, John Hardin wrote: On Sun, 13 Oct 2013, Kevin A. McGrail wrote: On 10/13/2013 12:33 PM, John Hardin wrote: On Sun, 13 Oct 2013, John Hardin wrote: > And we've had corpora starvation issues the last few weeks; if the ham > corpus gets thin again updates may be delaye

Re: FSL_HELO_BARE_IP_2 & RCVD_NUMERIC_HELO

2013-10-13 Thread John Hardin
On Sun, 13 Oct 2013, Kevin A. McGrail wrote: On 10/13/2013 12:33 PM, John Hardin wrote: On Sun, 13 Oct 2013, John Hardin wrote: > And we've had corpora starvation issues the last few weeks; if the ham > corpus gets thin again updates may be delayed. Yeah, we're starved for ham again; I

Re: FSL_HELO_BARE_IP_2 & RCVD_NUMERIC_HELO

2013-10-13 Thread Kevin A. McGrail
On 10/13/2013 12:33 PM, John Hardin wrote: On Sun, 13 Oct 2013, John Hardin wrote: And we've had corpora starvation issues the last few weeks; if the ham corpus gets thin again updates may be delayed. Yeah, we're starved for ham again; I don't know how quickly this change will go out, sorry.

Re: FSL_HELO_BARE_IP_2 & RCVD_NUMERIC_HELO

2013-10-13 Thread John Hardin
On Sun, 13 Oct 2013, John Hardin wrote: And we've had corpora starvation issues the last few weeks; if the ham corpus gets thin again updates may be delayed. Yeah, we're starved for ham again; I don't know how quickly this change will go out, sorry. -- John Hardin KA7OHZ

Re: FSL_HELO_BARE_IP_2 & RCVD_NUMERIC_HELO

2013-10-13 Thread John Hardin
On Sun, 13 Oct 2013, Stan Hoeppner wrote: On 10/12/2013 9:28 PM, John Hardin wrote: On Sat, 12 Oct 2013, Stan Hoeppner wrote: Steve, the one who wrote this regex, would you please explain your reasoning behind giving this rule a score so high as 2.8, That score was auto-assigned by masschec

Re: FSL_HELO_BARE_IP_2 & RCVD_NUMERIC_HELO

2013-10-13 Thread Stan Hoeppner
On 10/12/2013 9:28 PM, John Hardin wrote: > On Sat, 12 Oct 2013, Stan Hoeppner wrote: > >> Steve, the one who wrote this regex, would you please explain your >> reasoning behind giving this rule a score so high as 2.8, > > That score was auto-assigned by masscheck, where it is doing quite well: >

Re: FSL_HELO_BARE_IP_2 & RCVD_NUMERIC_HELO

2013-10-12 Thread John Hardin
On Sat, 12 Oct 2013, Stan Hoeppner wrote: Steve, the one who wrote this regex, would you please explain your reasoning behind giving this rule a score so high as 2.8, That score was auto-assigned by masscheck, where it is doing quite well: http://ruleqa.spamassassin.org/?rule=FSL_HELO_BARE_IP

Re: FSL_HELO_BARE_IP_2 & RCVD_NUMERIC_HELO

2013-10-12 Thread John Hardin
On Sat, 12 Oct 2013, Stan Hoeppner wrote: Content analysis details: (4.8 points, 4.2 required) Why did you lower the required score? -- John Hardin KA7OHZhttp://www.impsec.org/~jhardin/ jhar...@impsec.orgFALaholic #11174 pgpk -a jhar...@impsec.org key: 0xB8732

Re: FSL_HELO_BARE_IP_2 & RCVD_NUMERIC_HELO

2013-10-12 Thread Stan Hoeppner
On 10/12/2013 1:04 PM, Benny Pedersen wrote: > Stan Hoeppner skrev den 2013-10-12 18:26: > >> FSL_HELO_BARE_IP_2 needs to have a -much- lower score, or be eliminated >> entirely, as it overlaps with at least 3 other tests, as pointed out >> previously by another user. If a message makes it throug

Re: FSL_HELO_BARE_IP_2 & RCVD_NUMERIC_HELO

2013-10-12 Thread Benny Pedersen
Stan Hoeppner skrev den 2013-10-12 18:26: FSL_HELO_BARE_IP_2 needs to have a -much- lower score, or be eliminated entirely, as it overlaps with at least 3 other tests, as pointed out previously by another user. If a message makes it through Gmane, and Debian, and then gets flagged by my "stock