Check relaying MTA has valid PTR

2005-06-07 Thread Justin
this will reject legit mail as well. I would prefer SA to do the check and score appropriately. Rgds Justin And I said, "Yes, a pet rat. He's very clean and he hasn't got bubonic plague." And the policeman said, "Well that's reassuring."

Prevent 'on behalf of' showing internal but really from external domain

2016-01-11 Thread Justin Edmands
We have seen a few messages that were allowed to be sent "on be half of" a user within our network. The external users domain was able to send through our relay and sort of spoof the user. Any way to use spamassassin to prevent this sort of this?

Re: Prevent 'on behalf of' showing internal but really from external domain

2016-01-11 Thread Justin Edmands
ok thank you. we do use that so I will post to the mimedefang list. -- Justin Edmands SAGE Dining Services, Inc.® Technology Department jus...@sagedining.com (410) 339-3950 x38 From: "Kevin A. McGrail" To: "Justin Edmands" , users@spamassassin.apache.org Sent

SA on MTA and MDA

2016-10-11 Thread Justin Edmands
We have SA running via Mimedefang on our MTAs. We have Zimbra MDA to manage our mailstores. We do not currently have the MDA run SA checks on mail. We let everything be done by the MTA. Because of this, the inidivudal users preferences to "mark as spam" does not help the individual user. They will

Re: Public Corpus

2010-08-30 Thread Justin Mason
On Mon, Aug 30, 2010 at 02:03, RW wrote: > On Sun, 29 Aug 2010 17:36:36 -0700 (PDT) > joker_ft top-posted: > >> Benny Pedersen wrote: >> > >> > On søn 29 aug 2010 17:28:52 CEST, joker_ft wrote >> > >> >> Does anyone know some public corpus updates in 2010 ? or why the >> >> spam assassin public c

Re: Only running network tests when necessary - feature request

2010-10-30 Thread Justin Mason
btw, I think this is already possible using the shortcircuit plugin. Just use rule priorities to run the non-net rules first, and shortcircuit if they are sufficient. On Sat, Oct 30, 2010 at 08:05, Henrik K wrote: > On Sat, Oct 30, 2010 at 02:23:00AM -0400, dar...@chaosreigns.com wrote: >> On 10/

Re: Sought False Positives

2010-11-09 Thread Justin Mason
guys, feel free to mail me samples (offlist) of sought FPs -- ideally, as mboxes. it's easy enough to add them to the training process. --j. On Mon, Nov 8, 2010 at 22:54, mouss wrote: > Le 20/08/2010 17:12, Jan P. Kessler a écrit : >> >>  Hi, >> >> we use spamassassin with the sought ruleset si

Re: Sought False Positives

2010-11-09 Thread Justin Mason
On Tue, Nov 9, 2010 at 14:24, Bowie Bailey wrote: > On 11/8/2010 6:04 PM, Lawrence @ Rogers wrote: >> On 08/11/2010 12:06 PM, Ned Slider wrote: >>> >>> Fair enough - fortunately I've not seen any of those here so assumed >>> a genuine facebook mail had maybe slipped through into the corpus by >>>

Re: Need Volunteers for Ham Trap

2011-01-20 Thread Justin Mason
On Tue, Jan 18, 2011 at 12:59, Warren Togami Jr. wrote: > On 1/17/2011 11:46 PM, Jeff Chan wrote: >> >> So a couple points: >> >> 1.  Subscribing to lists opens up lots of grey areas including >> the above. >> >> 2.  Some of the areas are very difficult to resolve into spam or >> ham.  Some more a

Postfix/Procmail Configuration

2011-02-21 Thread Justin Gould
I'm relatively new to Postfix, SpamAssassin and what not, so this might be a silly question. I'm on SpamAssassin 3.3.1 on Debian Linux with Postfix. I've inherited this configuration from a previous administrator and am still trying to understand it. To summarize up front, the two issues I

Re: Mailspike Performance

2011-04-15 Thread Justin Mason
On Thu, Apr 14, 2011 at 22:51, Adam Katz wrote: > RCVD_IN_MSPIKE_BL has 99% overlap with the SA3.3 set and 98% with the > SA3.2 set.  That leaves 0.6758% of spam uniquely hitting this DNSBL (1% > of its 67.5822%).  RCVD_IN_SEMBLACK has the same story, resulting in > 0.5138% unique spam from its 1%

Re: Spamassasin - SQLITE as storage database

2011-05-18 Thread Justin Mason
On Wed, May 18, 2011 at 11:26, Mark Martinec wrote: > On Wednesday May 18 2011 09:42:55 monolit wrote: >> >> do you have any experience with usage of SQLITE database as storage for >> >> Spamassassin? Spamassassin uses Berkeley DB, but I need to replace it. >> >> I could not find any manual, guide

Re: Sought rules

2011-06-11 Thread Justin Mason
guys -- I'm going to make the whole question moot (in trunk at least) -- the only reason SOUGHT and SOUGHT_FRAUD were being checked in there was to make their accuracy visible in ruleqa. It's been months since I've looked at that, so it's needless. I'll remove them from svn asap. --j. 2011/6/11

Re: Sought rules

2011-06-12 Thread Justin Mason
On Sunday, June 12, 2011, Warren Togami Jr. wrote: > On 6/12/2011 12:32 AM, Warren Togami Jr. wrote: > > On 6/11/2011 10:03 AM, Justin Mason wrote: > > guys -- I'm going to make the whole question moot (in trunk at least) > -- the only reason SOUGHT and SOUGHT_FRAUD were

Re: 20_sought_fraud.cf

2013-04-12 Thread Justin Mason
it could be that whoever was uploading the fraud corpora which the ruleset builds from is no longer doing so. I'll take a look later on... --j. On Fri, Apr 12, 2013 at 12:25 PM, Benny Pedersen wrote: > Axb skrev den 2013-04-12 10:17: > > >> all I'm seeing in that file is >> >> meta JM_SOUGHT_1

Re: 20_sought_fraud.cf

2014-03-10 Thread Justin Mason
On Sat, Mar 8, 2014 at 9:31 PM, John Hardin wrote: > Justin, can you provide any enlightenment? If the base Sought dynamic > ruleset is indeed dead, can the wiki page be updated? > hi folks -- I've been in contact with some of the dev team regarding handing over the sought ru

Spamassassin and multimaster MySQL cluster

2014-06-02 Thread Justin Edmands
I have been reading about spamassassins ability to be used with a mysql cluster. I am familiar with XtraDB Cluster from Percona. It's currently what we use and it's pretty easy to setup. I have 3 locations with 2 relays at each location. I am thinking to just make each mail relay, into a Percona Xt

Large commented out body HTML causing SA to timeout/give up/allow spam

2014-09-05 Thread Justin Edmands
We are seeing a few emails that are about a 1MB and appear to have only a few lines of text. Upon further investigation, the email is in HTML with a HUGE commented out part. links, text, crap, and other stuff On the command line, I manually run the message through SA and it shows it has

Spamhaus timeouts -- are they being DDoSed again?

2014-09-19 Thread Justin Edmands
I caught wind from a post on ddos-protection.org that Spamhaus is getting DDoS attacked again. We are getting timeouts to spamhaus servers intermittently. One test scan will work properly with no timeouts, the next will say "deadline shrunk", then "the calling callback/abort on key" and spam will f

whitelist limitations

2014-11-13 Thread Justin Edmands
We have a few thousand vendors in our websites database that I would like to add to a whitelist. I am thinking of creating a /etc/mail/spamassassin/ corewhitelist.cf from this database. What are the limitations/ repercussions of using a sitewide whitelist? If I have 2000 addresses in the whitelist

Re: test email

2004-09-01 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Pierre Thomson writes: > Looks like one of Apache's sending relays got listed on SpamHaus SBL/XBL last > night: > > >Remote host said: 550 5.7.1 Mail from 209.237.227.199 refused - see > >http://www.spamhaus.org/ > > # host 209.237.227.199 > 199.2

Re: Comments on 3.0-rc2

2004-09-01 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Barry Jaspan writes: > I have recently upgraded my SpamAssassin-based product to use SA > 3.0-rc2. Generally, I think 3.0 is excellent; congratulations to the > developers. I have a few comments: > > - A bug was introduced between rc1 and rc2. I

Re: 3.0-rc2 Makefile.PL - Non Query option

2004-09-01 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 btw, perl Makefile.PL < /dev/null will use the defaults for all questions, that may help... but the patch would be welcome (as an attachment on a bugzilla entry) if you do implement that. - --j. Bob Pierce writes: > I'm setting up a kickstart

Re: Applying SURBL against blog comment spammers

2004-09-02 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Matthew Hunter writes: > On Thu, Sep 02, 2004 at 09:36:29AM -0400, Chris Santerre <[EMAIL PROTECTED]> > wrote: > > >-Original Message- > > >From: Jeff Chan [mailto:[EMAIL PROTECTED] > > >Sent: Thursday, September 02, 2004 3:24 AM > > >To: SAT

Re: Applying SURBL against blog comment spammers

2004-09-02 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Chris Santerre writes: > Which is NOT in SURBL!! (It will be today!) Because like Dr. Evil this is a > pre-emptive Shhh! It is just a matter of time before this site is used in an > email spam. I also see no difference between this blog spam and email

Re: Apache to Microsoft: who needs Sender-ID?

2004-09-03 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 John Andersen writes: > On Thursday 02 September 2004 03:43 pm, Steve Sobol wrote: > > Kevin Peuhkurinen wrote: > > > Yes. Although Microsoft has refused to disclose what they have > > > actually applied for patents on, their license only applies to

Re: Applying SURBL against blog comment spammers

2004-09-03 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Bob Apthorpe writes: > Bad form to reply to one's own posts, I know, but I've just updated > babycart so it takes metadata as well comments. Also, there's better > debugging info, better docs, comments are now swaddled in RFC8222 format > for easier d

Re: shifting the midpoint between the average spam and average ham

2004-09-03 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Joe Emenaker writes: > Joe Flowers wrote: > > >> If your "spread" is good and it's just the threshold that needs > >> adjusting, it would be trivial to make a rule that fires on every > >> message and give > it a score equal to the desired differen

Re: shifting the midpoint between the average spam and average ham

2004-09-05 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Joe Flowers writes: > > You make a valid point in that, if graphed separately, ham and spam > should show up as two separate curves on a graph. > > > However, there *is* overlap, > > Yes, I expect overlap or SA would be perfect with no FPs or FNs

Re: Ping for primary MX

2004-09-05 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Daniel Quinlan writes: > Kenneth Porter <[EMAIL PROTECTED]> writes: > > > Has anyone written a plugin for SA3 that pings the higher-priority MX > > peers for a domain and boosts the spam score if they're up? > > No, but by my quick test here it woul

Re: Bayes scoring weirdness?

2004-09-07 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Theo Van Dinter writes: > On Tue, Sep 07, 2004 at 02:32:42PM -0600, Chris Blaise wrote: > > The rules were ALL_TRUSTED,MISSING_DATE,USER_IN_BLACKLIST and I > > think since "ALL_TRUSTED" is a negative value. > > > > Am I missing something abou

Re: Usability. Spamassassin.

2004-09-08 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Martin Hepworth writes: > NM Public wrote: > > > > > And then say something like: If you do not immediately know the answer > > to all these questions, you should not be installing or administering > > SpamAssassin (unless it is for educational pu

Re: timing/performance issues

2004-09-08 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Ralf Hildebrandt writes: > I'm using spamassassin from within amavisd-new. Loggin shows that > amavis's SA-check is the most time-consuming step while processing an > email (>>80% of the total time needed). > > How can I run spamassassin against some

Re: Start an IP list to block?

2004-09-09 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Raymond Dijkxhoorn writes: > Hi! > > > Chris, Raymond , > > > > I went thru a random few of these and they're were listed at Spamhaus. > > Using spamhaus at SMTP level or SA doing RBL lookups would have caught and > > stopped them... Spamcop probabl

Re: Start an IP list to block?

2004-09-09 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Dan Mahoney, System Admin writes: > On Thu, 9 Sep 2004, Matt Kettler wrote: > > If it's blacklisting based on resolved ip, it should probably be noted > that there are a couple of caveats: > > 1) Spammers can set up multiple ip addresses to an A re

Re: Start an IP list to block?

2004-09-09 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Raymond Dijkxhoorn writes: > >> 1) Spammers can set up multiple ip addresses to an A record. Whatever > >> does the reporting should check all A records, from the top down. i.e. > >> query each NS multiple times to make sure it's not being round-rob

Re: Start an IP list to block?

2004-09-10 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Jeff Chan writes: > On Friday, September 10, 2004, 7:27:06 AM, Chris Santerre wrote: > > WOW! I think this would hit more FPs then listing the IP! Am I wrong there! > > I would never list the name server, as they may be hosting for much more > > then

Re: spamassassin-users on MARC

2004-09-14 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Matt Kettler writes: > At 03:49 PM 9/13/2004, Al Sparks wrote: > >I noticed that the Mailing list ARChives (MARC) doesn't have any posts > >for September, for spamassassin-users. > > > >The apache web page does advertise that MARC is one of the archiv

Re: Milter or Spamd error?

2004-09-14 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Andy Jezierski writes: > Andy Jezierski <[EMAIL PROTECTED]> wrote on 09/13/2004 10:13:01 AM: > > > I've got a question as to whether you think this is a milter error or a > > spamd error. I'm thinking milter. > > > > I'm running milter-spamc 0.24 al

Re: loads of expire files filling up /var/spool/spamassassin/nobody

2004-09-15 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Calum Mackay writes: > Calum Mackay wrote: > > Is it just me that gets loads of files bayes_toks.expire* filling up > > /var/spool/spamassassin/nobody ? > > > > I seem to get a 10MB file of this form in there for every single email - > > for every

Re: loads of expire files filling up /var/spool/spamassassin/nobody

2004-09-15 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Calum Mackay writes: > Justin Mason wrote: > > any idea why that had that effect? > > yup, SA, running as the user who was getting mail, was unable to move > the existing journal file out of the way, since it didn't own it.

Re: Start an IP list to block?

2004-09-15 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Chris Santerre writes: > >-Original Message- > >From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] > >Sent: Friday, September 10, 2004 1:05 PM > >To: Jeff Chan > >Cc: SURBL Discussion list (E-mail); Spamassassin-Talk (E-mail) > >Subject: Re: St

Re: Creating a custom tag via a plugin

2004-09-16 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 I'm pretty sure there's a bugzilla bug open about this... I can't find it though. Could you open a bug at http://bugzilla.spamassassin.org/ to request it? - --j. Brian Keifer writes: > I'm using SpamAssassin 3.0 RC5 to tag messages according to pe

Re: Creating a custom tag via a plugin

2004-09-16 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Michael Parker writes: > On Thu, Sep 16, 2004 at 09:35:34AM -0700, Justin Mason wrote: > > > > I'm pretty sure there's a bugzilla bug open about this... I can't find it > > though. Could you open a bug at http

Re: O'Reilly Spamassassin book

2004-09-22 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Chris Santerre writes: > You won't see anything on it yet. That was zero hour info I gave ;) Its in > the pre-alpha stages. > > I'll have to check that Perl code. I know who the reviewers were. LOL. ;) er, whoops ;) - --j. > --Chris > > >-Or

Re: CFLAGS

2004-09-22 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 David Brodbeck writes: > Is there a way to get the SpamAssassin build process to use -O instead of -O2 > while building spamc? I run FreeBSD on a DEC Alpha, and -O2 triggers > optimizer bugs in gcc on that architecture. I've just been editing the >

Re: ANNOUNCE: SpamAssassin 3.0.0 is released

2004-09-22 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Bill Landry writes: > - Original Message - > From: "Daniel Quinlan" <[EMAIL PROTECTED]> > > > Apache Software Foundation Announces SpamAssassin 3.0 Release > > Very sad that the Pyzor time-out issue never got resolved throughout the > pre-r

Re: Statistics

2004-09-23 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Dan Mahoney, System Admin writes: > On Wed, 22 Sep 2004, David Brodbeck wrote: > > > Dan Mahoney, System Admin wrote: > > > >> Hey all, > >> > >> In the process of trying to track statistics in SpamAssassin (and other > >> programs), and I'm thinki

Re: SlashDotting spammers

2004-09-23 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Kenneth Porter writes: > Every time I see a spam story on SlashDot I think how the SlashDot effect > could be used for good by getting everyone to visit the spammer's site and > take it to its knees, while driving up the spammer's bandwidth bill. Ch

Re: Output 'body' and 'rawbody' text in the Debug data for SA 3.0.0

2004-09-23 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Shane Metler writes: > Answering my own question ... > > Well I was able to find a BUG report that (at present) says 'body' and > 'rawbody' debug output has been removed from 3.0.0. I don't think it was in there in the first place ;) However if I

Re: [sa-list] Re: DSPAM-plugin for SpamAssassin 3.* ?

2004-09-23 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 snowjack writes: > David Brodbeck wrote: > > On Wed, 22 Sep 2004 17:26:12 -0700, snowjack wrote > >>Yeah, and it is true that SpamAssassin uses lots of RAM (20M per > >>process?) So what, RAM is cheap! > > > > If I'm not mistaken, some of that 20M i

Re: Mail::Audit and Mail::SpamAssassin no longer getting along?

2004-09-23 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Phil Thompson writes: > disclaimer: I posted this to comp.lang.perl.modules (no reply yet), but since > this list is the FIRST place I looked, I'll send here as well. > > Hello, > > Until yesterday, I was happily using a combination of Mail::Audit

Re: [sa-list] Re: DSPAM-plugin for SpamAssassin 3.* ?

2004-09-23 Thread Justin Mason
t all ;) - --j. Lucas Albers writes: > Could you use the embedded perl? > Mimedefang uses that for better memory sharing between processes, appears > to work on most platforms running 5.6 or later of perl. > > Justin Mason said: > > -BEGIN PGP SIGNED MESSAGE- >

Re: ALL_TRUSTED

2004-09-23 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Ray writes: > I see this is already in bugzilla. Should we just depreciate that rule for > now? It is really screwing up my scores. As the bz bug says -- it's a symptom as much as anything else. so adding support for the Received header format it

Re: Spammers using my server

2004-09-24 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Jay Ehrhart writes: > The non-deliverable reports are coming from my Linux apache user. > Non-deliverables usually come from root. I am running apache on the server > with forms. The forms software is the latest version and patches. > > Can anybody

Re: SA 3.0 TRAP

2004-09-24 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Bob Apthorpe writes: > On Fri, 24 Sep 2004 01:30:19 -0800 John Andersen <[EMAIL PROTECTED]> wrote: > > > If you are thinking about installing Spamassasin 3.0 PAY ATTENTION: > > > > If you haven't been reading this list carefully you will > > have m

Re: spamd dying?

2004-09-24 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Will Yardley writes: > Has anyone else seen a problem w/ spamd dying sometimes (after working > for a while)? I have been seeing this in the 3.0 rcs. I'm about to > upgrade to 3.0 release, but I'm wondering if anyone else has seen this. > > Much more

spam as a covert channel

2004-09-28 Thread Justin Mason
A little OT... This presentation from this year's Black Hat Briefings is really quite interesting -- http://www.blackhat.com/presentations/bh-usa-04/bh-us-04-kret.pdf It really does look like there may be some use of spam, specifically hashbusters and "chaff" headers, as a covert channel. Ho

Re: Version 3.0.0-r1 won't work with DCC & Pyzor & amavisd

2004-09-28 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 There's a new fix, which needs some testing in the bugzilla, at http://bugzilla.spamassassin.org/show_bug.cgi?id=3649 . If it fixes the issue, it'll go into 3.0.1. please test ;) - --j. Erik Slooff writes: > > Hello > > > > yesterday i've done s

Re: Congratulations and Thank You!!

2004-09-28 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Chris Santerre writes: > >-Original Message- > >From: Ed Kasky [mailto:[EMAIL PROTECTED] > >Sent: Monday, September 27, 2004 6:01 PM > >To: users@spamassassin.apache.org > >Subject: Congratulations and Thank You!! > > > > > >Just wanted to pas

Re: spamd dying?

2004-09-28 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Will Yardley writes: > On Fri, Sep 24, 2004 at 10:22:01AM -0700, Justin Mason wrote: > > Will Yardley writes: > > > > Has anyone else seen a problem w/ spamd dying sometimes (after working > > > for a while)? I have b

Re: Why such a low score?

2004-09-29 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 What Matt said ;) the perceptron really hates FPs. Also, another feature of the perceptron is that, if two rules hit the same spams and the same hams, it'll spread the scores equally between those two rules. e.g.: if RULE_1 hits a certain set of sp

Re: Solaris Gotcha - Re: Quick upgrade review from 2.4x -> 3.0

2004-09-29 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Christopher X. Candreva writes: > On Wed, 29 Sep 2004, Chris Santerre wrote: > > > OK, I'm officially running 3.0 in production now. The upgrade was > > miraculously easy. Despite my paranoia that something was going to bite me > > in the behind, it

Re: Solaris Gotcha - Re: Quick upgrade review from 2.4x -> 3.0

2004-09-29 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Christopher X. Candreva writes: > On Wed, 29 Sep 2004, Keith Hackworth wrote: > > > I ran into this too and I emailed the developer for this module about > > this. I haven't seen a response yet. I fixed it by modifying his perl > > Well, he respo

Re: Spamassassin 3.0 with mimedefang 2.37

2004-09-29 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Michael Parker writes: > On Wed, Sep 29, 2004 at 03:07:08PM -0700, Kelson wrote: > > (Developers: It might be worth mentioning the minimum 3.0-compatible > > versions for MD, Amavis, and other popular things-that-call-SA.) > > Why? > > How are deve

'Spam Forensics: Reverse-Engineering Spammer Tactics'

2004-09-29 Thread Justin Mason
My slides from the presentation I gave at Toorcon 2004, 'Spam Forensics: Reverse-Engineering Spammer Tactics', are now up, if anyone's interested in having a read ;) http://spamassassin.apache.org/presentations/2004-09-Toorcon/html --j.

Re: SURBL in 3.0

2004-09-30 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Theo Van Dinter writes: > On Thu, Sep 30, 2004 at 01:42:51PM +0200, Maurice Lucas wrote: > > >OK - I think I have narrowed down what is happening with this, though I > > >don't know why. I have placed my local.cf file in a non-standard > > >directo

Re: SURBL in 3.0

2004-09-30 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Theo Van Dinter writes: > On Thu, Sep 30, 2004 at 09:44:20AM -0700, Justin Mason wrote: > > if the init.pre is never read from what you specify as --siteconfigpath, > > that's a bug -- could you report it to the bugzilla?(ho

Re: 'Spam Forensics: Reverse-Engineering Spammer Tactics'

2004-09-30 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Chris Santerre writes: > Very nice. Page 13: Detecting Hashbusters, 2, who the hell figured that out? > Damn! ;) > SARE has run into the problem that there isn't much NEW in spam to tag on. > SA, SURBL, and SARE have 99% of everything covered. Like

Re: 2.6 -> 3.0 migration questions

2004-10-01 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Mike Burger writes: > On Thu, 30 Sep 2004, Ben Rosengart wrote: > > > On Wed, Sep 29, 2004 at 06:40:18PM -0600, Lucas Albers wrote: > > > Some options kick you in the face. > > > Such as -a for spamd which will prevent it from starting. > > > > Ouch

Re: What's the POINT?

2004-10-03 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Dan Mahoney, System Admin writes: > Wanted to share a recent email that I got, that SpamAssassin didn't pick > up on as being spam. I have one crucial question afterwards. I've been seeing more and more of these -- and the %MAKE_TEXT[5] ones too.

Re: Memory usage spikes ...

2004-10-04 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 David Brodbeck writes: > On Sun, 3 Oct 2004 12:00:51 -0700, Potato Chip wrote > > It's happened to me about 3 times, where an email will be sent to my > > server that specifically causes the problem. Killing the spamd process > > causes the sending M

Re: Memory footprint of spamd 3.0

2004-10-05 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Jerry Glomph Black writes: > spamd 3.0 does preforking of the child processes. > > Nothing wrong with that, but WHY do the children have such enormous RSS > numbers already when started (>20 Meg per process)? To me, this makes > no sense. > > 3.0 h

Re: Memory footprint of spamd 3.0

2004-10-08 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Jeff Tucker writes: > Michael Parker wrote: > > On Tue, Oct 05, 2004 at 10:22:42AM -0700, Morris Jones wrote: > > > >>I watched a spamd child grow to 250MB yesterday on a single message. I > >>have a suspicion that the memory usage growth is happeni

Re: Still "fishy" problems with bayes expiry in SA 3.0

2004-10-08 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Kai Schaetzl writes: > The problem seems to exists on all of our Bayes databases and I think the > cause is not "bad" data, but simply the way the SA expiry algorithm works. > There are no negative atimes or atimes in the future. If the database >

statistics help needed

2004-10-08 Thread Justin Mason
Hey all -- I've been considering possible improvements to how we figure out what rules are effective. Currently we use the S/O ratio and hit-rate of each individual rule, in other words, if a rule hits a lot of spam, and little nonspam, we detect that and consider it "good". However, that doesn'

Plesk / SA3 + General setup?

2004-10-10 Thread Justin Fielding
their outlook or any other client?  Acutally, how does a user tell the system about any kind of false +ve's?   Also, does anyone know of a good base config file for a plesk system?  For example does a plesk system use sql to store user details/prefs etc? Many Thanks,   Justin Fielding,Intel

Re: statistics help needed

2004-10-11 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Scott A Crosby writes: > On Fri, 08 Oct 2004 15:49:08 -0700, [EMAIL PROTECTED] (Justin Mason) writes: > > > However, that doesn't take in account the situation where multiple rules > > are hitting mostly the same mail;

Re: X-message-flag question

2004-10-11 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Jeremy Rumpf writes: > I've seen a few messages recently that contained the header > > X-message-flag: Authentic Sender, Hash: PoHgCaAr > > My questions are, are they trying to simulate something like hash cash? Does > anyone know of a MUA that ins

Re: feeding frenzy for ws.surbl.org!!!

2004-10-12 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 martin f krafft writes: > also sprach martin f krafft <[EMAIL PROTECTED]> [2004.10.12.1420 +0200]: > > > Only forward spam that SpamAssassin does not currently > > > automatically detect correctly. > > > > All of it? > > And with or without Bayesian

Re: relocating tmp files?

2004-10-15 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 email builder writes: > Greetings, > > I have been under the apparently false presumption that spamd prcessed > its messages in memory (perhaps this explains why each spamd process can > oft take up to 25% cpu?). I recently looked in /tmp and found

Re: relocating tmp files?

2004-10-15 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 64MB should be plenty -- those files shouldn't stick around once a scan has completed, and they should all be 250KB or less in size. In my experience tmpfs helps quite a lot, but in this case it's a trivial amount of the overall total runtime. - --j

Re: spamd, user_prefs and required scores

2004-10-15 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Loren Wilton writes: > > Has anyone else experienced this problem? I will try to set up a separate > > Yep, you aren't the first. 2-3 other people have commented on this. I > don't know if there is an official bug on this particular aspect or not;

Re: OT: Ninja Blanket

2004-10-15 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Chris Santerre writes: > >-Original Message- > >From: ChupaCabra [mailto:[EMAIL PROTECTED] > >Sent: Thursday, October 14, 2004 11:56 AM > >Cc: SpamAssassin Users > >Subject: Re: OT: Ninja Blanket > > > > > > > > > >Kenneth Porter wrote: > > >

Re: SPF, ALL_TRUSTED Confusion was RE: Default SURBL scores low?

2004-10-15 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Ray writes: > There are bugtrack entries for the ALL_TRUSTED problem that you are > describing. On my own network we were seeing all spam hit with -3.3 on > ALL_TRUSTED. We are using SA on Postfix as a "man in the middle" relay from > our AV to our

Re: SURBLs not working after upgrade to 3.0

2004-10-18 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Sahil Tandon writes: > Jeff Chan wrote: > > > That said, it sounds like your installation may be messed up > > since init.pre was missing. > > init.pre wasn't missing; the .sample was there since it should be > modified to suit the admin's needs

locating local.cf

2004-10-18 Thread Justin Fielding
.orig [111] (#4.3.0) - Illegal seek Oct 18 04:44:27 plesk X-Qmail-Scanner-1.23st: [plesk.okulyillari.com109806386566013302] Unable to open pipe to /var/qmail/bin/qmail-queue.orig [111] (#4.3.0) - In my mail log.   Many Thanks,   Justin Fielding,Intelliweb Ltd UK.   A mission statement is defin

Re: locating local.cf

2004-10-18 Thread Justin Fielding
SBL and XBL but have not worked out if I do that via SA or qmail. Many Thanks, Justin Fielding, Intelliweb Ltd UK. A mission statement is defined as "a long awkward sentence that demonstrates management's inability to think clearly." All good companies have one. -

Re: locating local.cf

2004-10-18 Thread Justin Fielding
]: server successfully spawned child process, pid 12744 Oct 18 17:31:20 plesk spamd[12732]: server successfully spawned child process, pid 12745 So I definatly don't think it is reading the local.cf Many Thanks, Justin Fielding, Intelliweb Ltd UK. A mission statement is defined as &q

Re: locating local.cf

2004-10-18 Thread Justin Fielding
I added: URIBL_SBL sbl-xbl.spamhaus.org to my local.cf, should this work? Many Thanks, Justin Fielding, Intelliweb Ltd UK. A mission statement is defined as "a long awkward sentence that demonstrates management's inability to think clearly." All good companies have one. - S

Re: locating local.cf

2004-10-18 Thread Justin Fielding
PROTECTED] root]# spamassassin --lint [EMAIL PROTECTED] root]# Looks ok now I have the use_dcc = 0 in local.cf. It seems to be picking the directory up ok. Where do I add the DNSBL of spamhaus? /etc/init.d/spamassassin ? Many Thanks, Justin Fielding, Intelliweb Ltd UK. A mission statement is

Re: Suggested "Hello" message.

2004-10-19 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Dan -- I don't know of one, but that'd be a great page for the Wiki as well, for future use ;) http://wiki.apache.org/spamassassin/ - --j. Dan Barker writes: > I'm a tiny ISP (/WISP - about 50 users) and I've decided to roll out > Spamassa

Re: Memory footprint of spamd 3.0

2004-10-20 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Jason Parsons writes: > Howdy. > > Following up on this thread... My spamd children don't seem to be > sharing much memory with their parents: > >PID USER PRI NI SIZE RSS SHARE STAT %CPU %MEM TIME CPU > COMMAND > 14692 alias 17

Re: Memory footprint of spamd 3.0

2004-10-20 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Jason Parsons writes: > > yep -- various versions of the Linux kernel do not measure "shared" > > memory in the same way. > > > > vanilla 2.4.18/19: reports "shared" correctly > > 2.4.x with Red Hat patches: incorrect > > 2.6.x: incorrect

Re: [OT] hascash

2004-10-21 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Alan Munday writes: > Does anyone have any knowledge on how the development of hascash is going? > I've been searching around this afternoon and can find only a little > information (2 pages of Google search results) out there. Particularly > looking

SpamAssassin 3.0.1 is released!

2004-10-23 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 SpamAssassin 3.0.1 is released! 3.0.1 contains some important bugfixes, and is recommended. Highlights: - excessive memory-usage fixes - bug fixed which stopped DCC, Pyzor working with amavisd - deprecate RCVD_IN_RFC_IPWHOIS - user_prefs we

Re: spamd still burning CPU in 3.0.1

2004-10-23 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 BTW, SpamAssassin *is* CPU-intensive. It's designed that way ;) - --j. Tim B writes: > email builder wrote: > > I hurried out and installed 3.0.1, thinking one of those memory/language > > improvements mentioned in the release notes were going to b

Re: SpamAssassin timed out [Scanned]

2004-10-23 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 David Thurman writes: > On 10/20/04 8:40 AM, "Matt Kettler" wrote: > > > Mailscanner is inappropriately impatient with SpamAssassin. It's timeouts > > were designed in the pre-bayes era, and are not designed to accommodate > > bayes housekeeping chor

Re: [SURBL-Discuss] Re: Non-SA URIBLs no longer hitting with SA 3.0.1

2004-10-25 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Sahil Tandon writes: > Jeff Chan wrote: > > > On Sunday, October 24, 2004, 3:09:53 PM, John Andersen wrote: > > > >>What file are you finding this above bug in? > >>I don't see that anywhere on my 3.0.1 install! > > > > > > There should be some

Re: SpamAssassin 3.0.1 is released!

2004-10-25 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Christopher X. Candreva writes: > On Fri, 22 Oct 2004, Justin Mason wrote: > > > - avoid bug in Sys::Hostname::Long that renames the hostname when "make > > test" is run > > According to changelog: > &

  1   2   3   4   5   6   7   8   9   10   >