Re: APOSTROPHE_TOCC score

2018-03-06 Thread David Jones
On 03/05/2018 06:57 PM, John Hardin wrote: On Mon, 5 Mar 2018, Alex wrote: Hi, On Mon, Mar 5, 2018 at 5:59 PM, John Hardin wrote: On Mon, 5 Mar 2018, Alex wrote: To: =?utf-8?Q?DermotO=27reilly?= *  2.6 APOSTROPHE_TOCC To or CC address contains an apostrophe 2.6 points for this is just un

Re: Spam from compromised accounts scoring just under block threshold

2018-03-06 Thread John Hardin
On Mon, 5 Mar 2018, Amir Caspi wrote: On Mar 5, 2018, at 11:13 PM, John Hardin wrote: *before* the @ sign. It may be perfectly valid to do that, but if it happens more often in spam than in legitimate mail it is useful to us. I’m seeing a lot of spam lately with usernames like “bob.from.s

Re: APOSTROPHE_TOCC score

2018-03-06 Thread John Hardin
On Tue, 6 Mar 2018, David Jones wrote: On 03/05/2018 06:57 PM, John Hardin wrote: On Mon, 5 Mar 2018, Alex wrote: Hi, On Mon, Mar 5, 2018 at 5:59 PM, John Hardin wrote: On Mon, 5 Mar 2018, Alex wrote: To: =?utf-8?Q?DermotO=27reilly?= *  2.6 APOSTROPHE_TOCC To or CC address contains an a

Re: APOSTROPHE_TOCC score

2018-03-06 Thread RW
On Tue, 6 Mar 2018 08:47:35 -0800 (PST) John Hardin wrote: > On Tue, 6 Mar 2018, David Jones wrote: > > In this case these were really bad spam so the APOSTROPHE_TOCC is > > just riding on the back of other rules, BLs, and high Bayes > > scores. > > What I generally look at is the detailed rul

Re: APOSTROPHE_TOCC score

2018-03-06 Thread John Hardin
On Tue, 6 Mar 2018, RW wrote: On Tue, 6 Mar 2018 08:47:35 -0800 (PST) John Hardin wrote: On Tue, 6 Mar 2018, David Jones wrote: In this case these were really bad spam so the APOSTROPHE_TOCC is just riding on the back of other rules, BLs, and high Bayes scores. What I generally look at is

Re: APOSTROPHE_TOCC score

2018-03-06 Thread David Jones
On 03/06/2018 12:54 PM, John Hardin wrote: On Tue, 6 Mar 2018, RW wrote: On Tue, 6 Mar 2018 08:47:35 -0800 (PST) John Hardin wrote: On Tue, 6 Mar 2018, David Jones wrote: In this case these were really bad spam so the APOSTROPHE_TOCC is just riding on the back of other rules, BLs, and high

Re: APOSTROPHE_TOCC score

2018-03-06 Thread John Hardin
On Tue, 6 Mar 2018, David Jones wrote: On 03/06/2018 12:54 PM, John Hardin wrote: On Tue, 6 Mar 2018, RW wrote: On Tue, 6 Mar 2018 08:47:35 -0800 (PST) John Hardin wrote: On Tue, 6 Mar 2018, David Jones wrote: In this case these were really bad spam so the APOSTROPHE_TOCC is just riding

Re: DecodeShortURLs database breaks with setuid spamd

2018-03-06 Thread RW
On Mon, 5 Mar 2018 19:27:02 -0700 Amir Caspi wrote: > Hi all, > > Just FYI, for those of you who use DecodeShortURLs.pm ... it > appears that, if you are running in a per-user setup (i.e., running > spamd as root such that it does a setuid when invoked from > spamc, and/or allowing individ

Re: DecodeShortURLs database breaks with setuid spamd

2018-03-06 Thread Amir Caspi
On Mar 6, 2018, at 5:19 PM, RW wrote: > > Or probably more commonly when running the spamassassin perl script as > an ordinary user for test purposes. Right, if the DB is owned by that user, then they would see the rule fire with spamassassin and might assume it's all good for everyone. If th