Re: Razor and ~500k mail/day

Matt Kettler wrote: Daryl C. W. O'Shea wrote: Ryan Castellucci wrote: I actualy emailed cloudmark about this for our installation that processes 30k emails to pay, and I got a reply saying that it was fine to use thier servers for free. I'd email them and ask. Was this before or after the new lic

Re: EFF Newsletter as SPAM

-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 On Apr 4, 2005 11:08 AM, Matt Kettler <[EMAIL PROTECTED]> wrote: > As for pyzor, that's strange. Pyzor is supposed to be spam-only. Sounds > like somebody, or probably many somebodies, have a "spamtrap" that > reports everything sent to it to pyzor,

Re: EFF Newsletter as SPAM

On Tuesday, April 5, 2005, 9:26:45 PM, Rod Begbie wrote: > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA256 > On Apr 4, 2005 11:08 AM, Matt Kettler <[EMAIL PROTECTED]> wrote: >> As for pyzor, that's strange. Pyzor is supposed to be spam-only. > Sounds >> like somebody, or probably many somebodies

Re: EFF Newsletter as SPAM

On Tue, Apr 05, 2005 at 10:31:57PM -0700, Jeff Chan wrote: > On Tuesday, April 5, 2005, 9:26:45 PM, Rod Begbie wrote: > > -BEGIN PGP SIGNED MESSAGE- > > Hash: SHA256 > > > On Apr 4, 2005 11:08 AM, Matt Kettler <[EMAIL PROTECTED]> wrote: > >> As for pyzor, that's strange. Pyzor is supposed

Re: EFF Newsletter as SPAM

At 12:26 AM 4/6/2005, Rod Begbie wrote: Last time I looked, EFF allowed people to sign-up for newsletters without verifying the email address first. It's not inconceivable that they are, therefore, sending unsolicited emails to people who didn't sign up. Agreed. The EFF is not well known for being

Pyzor?

Hi, In addition to successfully using DCC and Razor2, I'm trying to use Pyzor but I never get any score from it. I've installed Pyzor 0.4.0 (the last version). When running `spamassassin --lint -D` I get the following relevant output: debug: executable for pyzor was found at /usr/bin/pyzor deb

Bayes_99

Dear List, I had Spamassassin 3.0.2 running on a FC3 with qmail and simscan. Everything is running fine, and i notice that almost every mail which is scanned are marked as spam. All incoming has the 4.1 BAYES_99 below are 2 examples where by they are actually legit emails not spams. How can i so

RE: Bayes_99

Your Bayes is corrupted. rm .spamassassin/bayes* will wipe out your current database and let you start again, which will require 200 spams and 200 hams. Be careful in your training! - dan -- Dan Kohn -Orig

Re: Bayes_99

Your Bayes is corrupted. rm .spamassassin/bayes* will wipe out your current database and let you start again, which will require 200 spams and 200 hams. Be careful in your training! I had followed your instruction. Now I am getting BAYES_50, BAYES_60 and BAYES_99. The number of BAYES_99 has redu

Re: Update on Autolearn, SA/SA-milter ID problem, etc

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Don Levey wrote: [snip] | The latest in my quest to get SA to work properly... | | I've made sure that the whitelist and Bayes DB can be written to and be read | by 'spamassassin'. I've set the '-u spamassassin' flag for both the | /etc/sysconfig/spama

Re: Bayes_99

List wrote: I did a spamassassin -D --lint and notice an error:- debug: bayes corpus size: nspam = 230, nham = 397 debug: tokenize: header tokens for *F = "U*ignore D*compiling.spamassassin.taint.org D*spamassassin.taint.org D*taint.org D*org" debug: tokenize: header tokens for *m = " 1112781784

Re: Spamassassin only autolearning ham, not spam after upgrade to 3.0.2

Kelly Corbin wrote: I have 4 machines configured identically (with the exception of the -m option due to differences in resources on each machine) with SpamAssassin and spamass-milter. I recently upgraded to 3.0.2 from 2.64 and everything seems to be working pretty good with the exception of one m

Re: Bayes_99

List wrote: I did a spamassassin -D --lint and notice an error:- debug: bayes corpus size: nspam = 230, nham = 397 debug: tokenize: header tokens for *F = "U*ignore D*compiling.spamassassin.taint.org D*spamassassin.taint.org D*taint.org D*org" debug: tokenize: header tokens for *m = " 1112781784

Extra Sare Rules for meds?

I realize this isnt exactly a SA question but i figured theres enough people on this list using sare rules to give some feedback. I work in a hospital where we obviously receive a lot of legit emails with drug names in them. However, we also receive a lot of spam with drug names in them as we

RE: Extra Sare Rules for meds?

>-Original Message- >From: Jim Maul [mailto:[EMAIL PROTECTED] >Sent: Wednesday, April 06, 2005 10:39 AM >To: SA Users List >Subject: Extra Sare Rules for meds? > > >I realize this isnt exactly a SA question but i figured theres enough >people on this list using sare rules to give some fe

Re: Extra Sare Rules for meds?

At 10:38 AM 4/6/2005, Jim Maul wrote: I realize this isnt exactly a SA question but i figured theres enough people on this list using sare rules to give some feedback. I work in a hospital where we obviously receive a lot of legit emails with drug names in them. However, we also receive a lot

Re: Extra Sare Rules for meds?

Chris Santerre wrote: -Original Message- From: Jim Maul [mailto:[EMAIL PROTECTED] Sent: Wednesday, April 06, 2005 10:39 AM To: SA Users List Subject: Extra Sare Rules for meds? I realize this isnt exactly a SA question but i figured theres enough people on this list using sare rules to giv

Annoying Job Offer spam

Is it just us or is there a flood of spams subject job offer, is there any of the rulesets that take care of this ? Ron -- Ron McKeating Senior IT Services Specialist Computing Services Loughborough University 01509 222329

Re: Annoying Job Offer spam

On Wednesday, April 6, 2005, 8:12:51 AM, Ron McKeating wrote: > Is it just us or is there a flood of spams subject job offer, is there > any of the rulesets that take care of this ? I'm not getting any of those, but I am seeing a lot of stock spams. Jeff C. -- Jeff Chan mailto:[EMAIL PROTECTED]

Re: Annoying Job Offer spam

On Wednesday 06 April 2005 16:33, Jeff Chan typed: > I'm not getting any of those, but I am seeing a lot of stock > spams. Ditto, but pretty much all of them are hitting high bayes + other local rules aimed at stock stuff. The stox guy morphed, but the morph was so trivial it was funny.

RE: Bayes_99

However, if you've blown away your Bayes db, you should be seeing nspam=0 and nham=0 (or at least low numbers). I believe you may SpamAssassin running as a different user and are not blowing away the right files. - dan -- Dan Kohn

Re: Extra Sare Rules for meds?

Jim Maul wrote: > > Well, honestly im not even sure about that. I guess what i need to do > is start capturing some of the emails (both ham and spam) we receive > with drug names and do some trial runs with some of the antidrug and > obfu rules to see what the results are. Does anyone know if th

Re: Annoying Job Offer spam

Ron McKeating wrote: Is it just us or is there a flood of spams subject job offer, is there any of the rulesets that take care of this ? Ron I see a few of them in my quarantine. They're all about the selling of raw minerals or something.They're all hitting BAYES_99, Razor2, and various

Re: Annoying Job Offer spam

Hi On Wed, Apr 06, 2005 at 04:12:51PM +0100, Ron McKeating wrote: > Is it just us or is there a flood of spams subject job offer, is there > any of the rulesets that take care of this ? It's not just you. I had over 3500 spams sent here since midnight with subjects of either "Zeta (munged) Trade"

RE: Annoying Job Offer spam

We're seeing a lot of those here too, usually with a 2 word subject line, (?:job|employment|...)[ _\-](?:opportunity|availability|offer|invitation|...) I haven't had a chance to write a rule to manage them, but I reckon this will be the basis for it. Hth R > -Original Message- > From

RE: Extra Sare Rules for meds?

When I worked on this, I basically took the anti_drug ruleset, and added a check to ensure that the rules only fire on obfuscated versions of the name. This can be done using negative lookahead in the rule Header SAMPLE_RULE Subject =~ /(?!viagra)v[1i][a4]gr[4a]/i As an example (and only an examp

RE: Extra Sare Rules for meds?

One method would be to write some negative scoring rules based on where the hams come from. They could override the SARE rules. --Chris >-Original Message- >From: Gray, Richard [mailto:[EMAIL PROTECTED] >Sent: Wednesday, April 06, 2005 12:32 PM >To: Jim Maul; SA Users List >Subject: RE: E

RE: Annoying Job Offer spam

I know the feeling. Stock spam seems to be the number 1 FN at the minute, but we relay for an investment firm so we have to be careful about how we handle it. They are forced to obfuscate the disclaimer at the bottom of the message, and there are some good words to match on inside that. That's th

counting occurrances

Hello, I have been googling for a few days trying to find a way to count the number of matches and score accordingly. Let's say for example I have something against the letter A. I would like to write a rule that scores 0.01 for every letter A matched in a given text. So, 5 A-s would score 0.

Re: counting occurrances

Chris Conn wrote: > Hello, > > I have been googling for a few days trying to find a way to count the > number of matches and score accordingly. > > Let's say for example I have something against the letter A. I would > like to write a rule that scores 0.01 for every letter A matched in a > given

Re: Extra Sare Rules for meds?

Gray, Richard wrote: >When I worked on this, I basically took the anti_drug ruleset, and added >a check to ensure that the rules only fire on obfuscated versions of the >name. This can be done using negative lookahead in the rule > >Header SAMPLE_RULE Subject =~ /(?!viagra)v[1i][a4]gr[4a]/i > >As

Re: Spamassassin only autolearning ham, not spam after upgrade to 3.0.2

Here's my auto-learn lines from the machine that doesn't work: debug: auto-learn: currently using scoreset 3, recomputing score based on scoreset 1. debug: auto-learn: message score: 23.316, computed score for autolearn: 24.06 debug: auto-learn? ham=0.1, spam=10, body-points=16.82, head-points=9.84

Fwd: HELLO

Has anyone been getting these emails? I have received thirteen today on non existent accounts. Begin forwarded message: From: [EMAIL PROTECTED] Date: April 6, 2005 1:03:10 PM CDT To: [EMAIL PROTECTED] Subject: HELLO ALERT! This e-mail, in its original form, contained one or more attached files

ham / spam + autolearn + cron for every user ?

Hi, I have a small question. I finally got postfix working with spamassassin and imap and anomy. I have everything working except bays. I know how to do the learning for spam and ham ... (or a good idea anyway :-). My problem is I am not 100% sure how to have it update for each user. I am ru

it's getting worse again

I'm using SA since... well, a long time ago, and one thing that i noticed was a pattern in the way its efficiency varies: it's pretty good soon after a new release, then it gets continuously worse; then a new release and all of a sudden it's good again, then it starts "decaying" again... Well, it'

Re: Spamassassin only autolearning ham, not spam after upgrade to 3.0.2

Kelly Corbin wrote: Here's my auto-learn lines from the machine that doesn't work: debug: auto-learn: currently using scoreset 3, recomputing score based on scoreset 1. debug: auto-learn: message score: 23.316, computed score for autolearn: 24.06 debug: auto-learn? ham=0.1, spam=10, body-points=1

Re: it's getting worse again

On 4/6/2005 8:29 PM +0100, Florin Andrei wrote: I guess something has to change. "Then change it yourself" type of advices will go straight to /dev/null, thank you, because as far as SA is concerned, i'm just a user. I am merely pointing out the problem. Users should complain at their systems admin

RE: it's getting worse again

Florin Andrei wrote: > I'm using SA since... well, a long time ago, and one thing that i > noticed was a pattern in the way its efficiency varies: it's pretty > good soon after a new release, then it gets continuously worse; then > a new release and all of a sudden it's good again, then it starts >

RE: it's getting worse again

Niek wrote: > On 4/6/2005 8:29 PM +0100, Florin Andrei wrote: >> I guess something has to change. "Then change it yourself" type of >> advices will go straight to /dev/null, thank you, because as far as >> SA is concerned, i'm just a user. I am merely pointing out the >> problem. > > Users should c

RE: it's getting worse again

On Wed, 6 Apr 2005 15:08:31 -0400, Don Levey wrote > Niek wrote: > > On 4/6/2005 8:29 PM +0100, Florin Andrei wrote: > >> I guess something has to change. "Then change it yourself" type of > >> advices will go straight to /dev/null, thank you, because as far as > >> SA is concerned, i'm just a user

Re: it's getting worse again

Florin Andrei wrote: > I'm using SA since... well, a long time ago, and one thing that i > noticed was a pattern in the way its efficiency varies: it's pretty > good soon after a new release, then it gets continuously worse; then > a new release and all of a sudden it's good again, then it starts >

[OT] Re: it's getting worse again

On 4/6/2005 9:45 PM +0100, David Brodbeck wrote: Users should complain at their systems administrators. Niek Someone can be a sysadmin, and not be a programmer. While the skill sets overlap, they're not necessarily one and the same. Perhaps he meant user as in consumer? -Don I assumed that's w

[OT] Leaving SURBL ( I forgot to post this here.)

Greetings Everyone, As of today, I am leaving SURBL for private reasons. SURBL continues to be one of the best antispam measures. I will be forming my own public URI lists. One black and one gray. But they will not be affiliated with SURBL. (So I'll most likely be begging for mirrors later!

Re: Spamassassin only autolearning ham, not spam after upgrade to 3.0.2

That did the trick! I just copied over the databases from one of the good machines and right away it started doing the autolearn=spam. Thanks for all your help. Kelly Kevin Peuhkurinen wrote: Kelly Corbin wrote: Here's my auto-learn lines from the machine that doesn't work: debug: auto-learn: cu

RE: it's getting worse again

On Wed, 2005-04-06 at 15:45 -0400, David Brodbeck wrote: > OT: While it's not necessary to be an expert programmer to be a system > administrator, you'll end up doing a lot of extra work if you don't have at > least some minimal programming skills. One of the joys of UNIX system > administration i

Re: Extra Sare Rules for meds?

I think I would second everone else's suggestion that you need to test-run this and see. There is Matt's stock antidrug stuff, and as you note we have a few more SARE rules of our own. I know that none of us SARE types have access to a corpus with any significant legit medical traffic, so I'm sur

Re: Extra Sare Rules for meds?

At a guess the table obfuscation stuff will have to be handled after table removal, assuming the rendered text ends up looking like the visible text. (I haven't checked to see if it does.) At that point I'd probably go with metas on number of different drugs or other key phrases, since probably th

Re: Spamassassin only autolearning ham, not spam after upgrade to 3.0.2

Kelly Corbin wrote: > > What is this 'learned-points'? That's what score the BAYES_* rules would have given this message based on existing learning. This is basically used to prevent SA from automatically learning anything that noticeably contradicts the existing training. > Is my database po

Re: Extra Sare Rules for meds?

Jim Maul wrote: Chris Santerre wrote: -Original Message- From: Jim Maul [mailto:[EMAIL PROTECTED] Sent: Wednesday, April 06, 2005 10:39 AM To: SA Users List Subject: Extra Sare Rules for meds? I realize this isnt exactly a SA question but i figured theres enough people on this list using s

Re: Extra Sare Rules for meds?

Loren Wilton wrote: >At a guess the table obfuscation stuff will have to be handled after table >removal, assuming the rendered text ends up looking like the visible text. >(I haven't checked to see if it does.) At that point I'd probably go with >metas on number of different drugs or other key p