Re: Parallelizing Spam Assassin

2009-07-31 Thread rich...@buzzhost.co.uk
On Thu, 2009-07-30 at 23:55 -0700, poifgh wrote: > Hi > > I was measuring how quickly could SA [spam assassin] process spams when > several SA processes are run in parallel over separate mbox files. I used a > 8 core machine. Below are the numbers when I forked different number of > processes. >

Re: Parallelizing Spam Assassin

2009-07-31 Thread rich...@buzzhost.co.uk
On Fri, 2009-07-31 at 09:53 +0100, Justin Mason wrote: > On Fri, Jul 31, 2009 at 09:32, > rich...@buzzhost.co.uk wrote: > > Imagine what Barracuda Networks could do with that if they did not fill > > their gay little boxes with hardware rubbish from the floors of MSI and > >

Re: Parallelizing Spam Assassin

2009-07-31 Thread rich...@buzzhost.co.uk
On Fri, 2009-07-31 at 07:26 -0400, Matt Kettler wrote: > rich...@buzzhost.co.uk wrote: > > On Fri, 2009-07-31 at 09:53 +0100, Justin Mason wrote: > > > >> On Fri, Jul 31, 2009 at 09:32, > >> rich...@buzzhost.co.uk wrote: > >> > >>> Imag

Re: Parallelizing Spam Assassin

2009-07-31 Thread rich...@buzzhost.co.uk
On Fri, 2009-07-31 at 08:25 -0700, John Hardin wrote: > On Fri, 31 Jul 2009, rich...@buzzhost.co.uk wrote: > > > ... dropping in here and making jokes at such low hanging fruit. > > Make all the jokes at Barracuda's expense that you like, complain about > them all you

Re: Parallelizing Spam Assassin

2009-07-31 Thread rich...@buzzhost.co.uk
On Fri, 2009-07-31 at 17:37 -0400, Glenn Sieb wrote: > LuKreme said the following on 7/31/09 3:27 PM: > >> Richard -- please watch your language. This is a public mailing > >> list, and offensive language here is inappropriate. > > > > I dunno, 'gay' isn't that offensive. > > > > > > Gay is *not

Re: Parallelizing Spam Assassin

2009-08-01 Thread rich...@buzzhost.co.uk
On Fri, 2009-07-31 at 23:40 -0700, Linda Walsh wrote: > It's an American thing. Things that are normal speech for UK blokes, get > Americans all disturbed. I'm sure that is mostly it, Linda. They don't seem to 'get' it. Two things I observe in this whole 'barracuda-gate' posting; 1. Being 'offen

Re: Ahh! What's all this SPAM?!?!?

2009-08-12 Thread rich...@buzzhost.co.uk
On Wed, 2009-08-12 at 20:36 -0600, LuKreme wrote: > I find my users almost never look at the SPAM > mailbox There is an easy fix for that - take that facility away :-)

Re: Slightly OT - Spam opprortunities in SMTP-AUTH

2009-08-12 Thread rich...@buzzhost.co.uk
On Wed, 2009-08-12 at 20:30 -0600, LuKreme wrote: > On 11-Aug-2009, at 08:58, Charles Gregory wrote: > > Again, I could be wrong, and would welcome input on this, but my > > feeling is that a webmail interface is a lot more trouble for a > > spammer to write scripts for? > It's not really any

MIME::lite

2009-08-12 Thread rich...@buzzhost.co.uk
The other day I recall someone mentioning they routinely block anything where the mailer is MIME::Lite. I don't do this myself as any self respecting spammer with more than a quarter of a brain cell is not going to make a slip like that {a script kiddie may - but that is another story}. I noticed

Re: Barracuda RBL in first place

2009-08-14 Thread rich...@buzzhost.co.uk
On Fri, 2009-08-14 at 06:30 -0700, Marc Perkel wrote: > http://www.sdsc.edu/~jeff/spam/cbc.html > > It appears from Jeff's Blacklists Compared list the Barracuda has > overtaken spamhaus for the #1 position. Not sure about the accuracy of > the list as compared to spamhaus but seams reasonably g

Re: Barracuda RBL in first place

2009-08-14 Thread rich...@buzzhost.co.uk
On Fri, 2009-08-14 at 16:13 +0100, Mike Cardwell wrote: > Marc Perkel wrote: > > > http://www.sdsc.edu/~jeff/spam/cbc.html > > > > It appears from Jeff's Blacklists Compared list the Barracuda has > > overtaken spamhaus for the #1 position. Not sure about the accuracy of > > the list as compare

Re: Barracuda RBL in first place

2009-08-14 Thread rich...@buzzhost.co.uk
On Fri, 2009-08-14 at 09:28 -0600, LuKreme wrote: > On 14-Aug-2009, at 09:03, Michael Scheidell wrote: > > my rbl beats everyone. > > It IS very effective at stopping spam. In fact, it stops 100% of spam. > > But it's sorta like the world's greatest ftp site (ftp://127.0.0.1/) > which has aweso

Re: Barracuda RBL in first place

2009-08-14 Thread rich...@buzzhost.co.uk
On Fri, 2009-08-14 at 18:33 +0100, Mike Cardwell wrote: > rich...@buzzhost.co.uk wrote: > > > I've not laughed so much since I added a low priority mx pointing to > > 127.0.0.1 . > > Heh. Looks like someone got there before me: > > http://rfc-i

Re: Barracuda RBL in first place

2009-08-14 Thread rich...@buzzhost.co.uk
On Fri, 2009-08-14 at 16:56 -0700, Marc Perkel wrote: > My experience is that the barracuda lists are reasonably good. A few > FP but not a lot. I get more FP's with Barracuda than I do UCE Protect - which is rather funny given the slating UCE Protect get. > And if they are exceeding spamhaus the

Re: Barracuda RBL in first place

2009-08-17 Thread rich...@buzzhost.co.uk
On Mon, 2009-08-17 at 00:51 -0600, LuKreme wrote: > On 16-Aug-2009, at 16:55, MySQL Student wrote: > >> So perhaps instead of adding another RBL, maybe some admins need to > >> consider adding in some HELO checking / rejection. > > Can you explain a bit more here? What are you checking for, that th

Re: Barracuda RBL not in first place

2009-08-17 Thread rich...@buzzhost.co.uk
On Mon, 2009-08-17 at 06:39 -0700, Marc Perkel wrote: > > > rich...@buzzhost.co.uk wrote: > > > > I have to agree with LuKreme, my overnight had 446 blocked prior to RBL, > > and only 387 by RBL. Again, noted that 'Barracuda' missed 43, 35 of > > th

RE: Barracuda RBL not in first place

2009-08-17 Thread rich...@buzzhost.co.uk
On Mon, 2009-08-17 at 08:36 -0700, R-Elists wrote: > > > > But this is all *OT* and has no relevance to SA. Why this > > list was spammed with an unscientific spin of a claim in the > > first instance just shows the dark hand of Barracuda at work. > > > > > > > > Richard, > > i imagine you

RE: Barracuda RBL not in first place

2009-08-17 Thread rich...@buzzhost.co.uk
On Mon, 2009-08-17 at 09:21 -0700, R-Elists wrote: > > Richard Wrote: > > No. Here is why. When someone posts a Barracuda send-up that > > is questionable, it will still end up in the archives. It is, > > therefore, relevant that any counter argument and supporting > > material be archived with

RE: Barracuda RBL not in first place

2009-08-17 Thread rich...@buzzhost.co.uk
On Mon, 2009-08-17 at 09:49 -0700, R-Elists wrote: > i want to publicly apologize to richard and the list. > > although i firmly stand behind what i posted, i should have done it off > list. > > i ask richard and the list to please forgive me > > thanks you > > - rh > Don't worry about it - I

Re: Barracuda RBL in first place

2009-08-18 Thread rich...@buzzhost.co.uk
On Tue, 2009-08-18 at 20:02 +0100, Ned Slider wrote: > LuKreme wrote: > > On 17-Aug-2009, at 04:24, Ned Slider wrote: > >> Question - in Postfix do "user unknown" rejections still incur a dns > >> RBL lookup, or does the rejection occur before reject_rbl_client? > > > > > > HELO/EHLO rejections

Re: Barracuda RBL in first place

2009-08-18 Thread rich...@buzzhost.co.uk
On Wed, 2009-08-19 at 01:06 +0200, mouss wrote: ... > in short, whatever jeff says, spamhaus is the one. the fundamental > concept is not "how many spam it blocks", but "how much do I trust it". > Exactly!

Re: spams to abuse@ id

2009-08-24 Thread rich...@buzzhost.co.uk
On Tue, 2009-08-25 at 08:06 +0200, Benny Pedersen wrote: > else fight sender forgies in mta, and only accept spf pass, if sender > domain is not with spf record count how many ham mails is comming from > this domain, if none, then domain blacklist this sender, open again if > there is spf la

Re: antispam comparison by virus bulletin

2009-09-07 Thread rich...@buzzhost.co.uk
On Mon, 2009-09-07 at 10:00 +0100, Justin Mason wrote: > On Sun, Sep 6, 2009 at 22:59, mouss wrote: > > Justin Mason a écrit : > >> In fairness, they got in touch to ask for help in setting up a more > >> recent SA, but none of us (ie the PMC) had the spare cycles to help > >> out. Comparative thi

Re: Using a blacklist - configuration-file not working

2009-09-11 Thread rich...@buzzhost.co.uk
On Fri, 2009-09-11 at 00:51 -0700, franc wrote: > Hello, > > i just installed spamassassin 3.2.4 (running on Perl 5.8.8) with postfix > 2.5.1 on a Ubuntu 8.04. > Now i want to use a personal blacklist an i put into > > /etc/spamassassin/myblacklist.cf > > an put into it: > > blacklist_from mai

Re: Using a blacklist - configuration-file not working

2009-09-11 Thread rich...@buzzhost.co.uk
On Fri, 2009-09-11 at 01:07 -0700, franc wrote: > > rich...@buzzhost.co.uk wrote: > > > > To do this, somewhere near the end of your main.cf: > > header_checks = regexp:/etc/postfix/header_checks > > > > File /etc/postfix/header_checks looks like this:

Re: Using a blacklist - configuration-file not working

2009-09-11 Thread rich...@buzzhost.co.uk
On Fri, 2009-09-11 at 01:07 -0700, franc wrote: > > rich...@buzzhost.co.uk wrote: > > > > To do this, somewhere near the end of your main.cf: > > header_checks = regexp:/etc/postfix/header_checks > > > > File /etc/postfix/header_checks looks like this:

Re: Using a blacklist - configuration-file not working

2009-09-11 Thread rich...@buzzhost.co.uk
On Fri, 2009-09-11 at 03:53 -0700, franc wrote: > > > rich...@buzzhost.co.uk wrote: > > > > Create the blacklist file: > > # vim /etc/spamassassin/blacklist.cf > > > > blacklist_from *...@aol.com > > blacklist_from drop.t...@aol.com > >

Re: MagicSpam

2009-09-23 Thread rich...@buzzhost.co.uk
On Wed, 2009-09-23 at 23:36 +0100, RW wrote: > On Wed, 23 Sep 2009 10:40:11 -0700 (PDT) > linuxmagic wrote: > > Incidently the point about backscatter is wrong. The traditional > approach of classifying, and then discarding or filing to a spam folder, > produces zero backscatter from spam. Backs

Re: MagicSpam

2009-09-23 Thread rich...@buzzhost.co.uk
On Wed, 2009-09-23 at 19:45 -0400, Aaron Wolfe wrote: > On Wed, Sep 23, 2009 at 1:40 PM, linuxmagic wrote: > > I really like this quote from their sales web site: > > "Now you can have MagicSpam spam protection for your Postfix (Linux) > Mail Servers. Complete with one click install"... You

Re: MagicSpam

2009-09-24 Thread rich...@buzzhost.co.uk
On Thu, 2009-09-24 at 12:51 +0100, RW wrote: > On Thu, 24 Sep 2009 06:46:42 +0100 > "rich...@buzzhost.co.uk" wrote: > > > On Wed, 2009-09-23 at 23:36 +0100, RW wrote: > > > On Wed, 23 Sep 2009 10:40:11 -0700 (PDT) > > > linuxmagic wrote: > > >

Re: Constant Contact

2009-10-17 Thread rich...@buzzhost.co.uk
On Fri, 2009-10-16 at 13:29 -0700, John Hardin wrote: > On Fri, 16 Oct 2009, John Rudd wrote: > > > Me. I work for one of their clients (a University). One or two of > > our divisions use them for large mailings to our internal users. > > How is Constant Contact better than (say) GNU mailman fo

Re: Constant Contact

2009-10-17 Thread rich...@buzzhost.co.uk
On Sat, 2009-10-17 at 07:26 -0400, Aaron Wolfe wrote: > On Sat, Oct 17, 2009 at 5:47 AM, rich...@buzzhost.co.uk > wrote: > > On Fri, 2009-10-16 at 13:29 -0700, John Hardin wrote: > >> On Fri, 16 Oct 2009, John Rudd wrote: > >> > >> > Me. I work for on

Re: Constant Contact

2009-10-17 Thread rich...@buzzhost.co.uk
On Sat, 2009-10-17 at 09:30 -0400, Gene Heskett wrote: > On Saturday 17 October 2009, rich...@buzzhost.co.uk wrote: > >On Sat, 2009-10-17 at 07:26 -0400, Aaron Wolfe wrote: > >> On Sat, Oct 17, 2009 at 5:47 AM, rich...@buzzhost.co.uk > >> > >> wrote: > >&

Re: Constant Contact

2009-10-17 Thread rich...@buzzhost.co.uk
On Sat, 2009-10-17 at 18:53 +0200, Karsten Bräckelmann wrote: > On Sat, 2009-10-17 at 14:24 +0100, rich...@buzzhost.co.uk wrote: > > On Sat, 2009-10-17 at 07:26 -0400, Aaron Wolfe wrote: > > > > [...] Why are we covering for their mistakes and > > > supporting a com

Re: Constant Contact

2009-10-17 Thread rich...@buzzhost.co.uk
On Sat, 2009-10-17 at 19:58 +0200, Karsten Bräckelmann wrote: > In other words, how comes you're only venting about the companies you > despise, and don't even mention the whitelist with a single word? > > guenther > You need to deal with your personality issues - this is *not* about *you* ei

Re: Is spamming legal in the UK ?

2009-10-23 Thread rich...@buzzhost.co.uk
On Fri, 2009-10-23 at 10:38 +0200, Per Jessen wrote: > I was just spammed by T-mobile (UK). Seems incredible that an otherwise > reputable company would sink so low - does anyone know if spamming > (given the right conditions) is legal in the UK ? > > > /Per Jessen, Zürich > Recently I've caugh

Re: Is spamming legal in the UK ?

2009-10-23 Thread rich...@buzzhost.co.uk
I need to add this is in ADDITION to guidelines mostly aimed at junk faxes published here and already quoted: http://www.ico.gov.uk/what_we_cover/privacy_and_electronic_communications.aspx

Re: Geocities closed

2009-10-27 Thread rich...@buzzhost.co.uk
On Tue, 2009-10-27 at 05:08 -0600, LuKreme wrote: > On 27-Oct-2009, at 04:53, Mike Cardwell wrote: > > Why have any geocities specific rules any more if geocities doesn't > > exist? It's not as if spammers can host their websites on geocities > > anymore so there's no reason why a spammer would

Re: Geocities closed

2009-10-27 Thread rich...@buzzhost.co.uk
On Tue, 2009-10-27 at 05:50 -0700, John Rudd wrote: > On Tue, Oct 27, 2009 at 05:42, rich...@buzzhost.co.uk > wrote: > > On Tue, 2009-10-27 at 05:08 -0600, LuKreme wrote: > >> On 27-Oct-2009, at 04:53, Mike Cardwell wrote: > >> > Why have any geocities specific ru

Re: Geocities closed

2009-10-27 Thread rich...@buzzhost.co.uk
I just found this one working: http://uk.geocities.com/midsomerland/midsomerland_indexone.htm so providence would suggest leaving things alone.

Low Score - {Brazillian Host} Lottery Spam

2009-10-27 Thread rich...@buzzhost.co.uk
Anyone else seeing these today? Or seen them recently? http://pastebin.com/m4e25954f score=0.1 Subject was real neat: Subject: =?ISO-8859-1?B?WW91IFdvbiCjMQ==?=,750,000.00 GBP You Won £750,000.00 GBP {surprised this did not bite} End of the message is missing on the five of them that I've ha

Barracuda List Broken

2009-10-30 Thread rich...@buzzhost.co.uk
Anyone else noticing lots of DNS timeouts on the Barracuda List today? Looks like it's really struggling. Perhaps they are hosting it on their own hardware now LOL.

Re: there goes the uri scripts..

2009-10-30 Thread rich...@buzzhost.co.uk
On Fri, 2009-10-30 at 15:10 -0400, Charles Gregory wrote: > On Fri, 30 Oct 2009, Terry Carmen wrote: > >> approval to a plan to permit Web addresses in characters other than the > >> Latin alphabet, including Arabic, Chinese, Hindi and Korean. > > I'd be *really* surprised if these became popular

HOTMAIL SPAM =Rule to bite on X-Originating-IP or length of FROM list?

2009-10-31 Thread rich...@buzzhost.co.uk
I don't see a great deal of spam from Hotmail, but often get it with headers looking like this: X-Originating-IP: [123.160.198.207] From: joannie nolin To: , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , A couple of observations; 123.160.198.207 - is on

Re: VL scoring 0.1 Phish Spam

2009-10-31 Thread rich...@buzzhost.co.uk
On Sat, 2009-10-31 at 07:29 -0500, Chris wrote: > On Sat, 2009-10-31 at 07:46 +0000, rich...@buzzhost.co.uk wrote: > > http://pastebin.com/m53a550ce > > > > Somewhat unfortunately seen coming out of The Dana-Farber Cancer > > Institute. > > > > Looking

Re: HOTMAIL SPAM =Rule to bite on X-Originating-IP or length of FROM list?

2009-10-31 Thread rich...@buzzhost.co.uk
On Sat, 2009-10-31 at 07:35 -0500, Chris wrote: > On Sat, 2009-10-31 at 07:59 +0000, rich...@buzzhost.co.uk wrote: > > I don't see a great deal of spam from Hotmail, but often get it with > > headers looking like this: > > > > X-Originating-IP: [123.160.198.207]

Re: VL scoring 0.1 Phish Spam

2009-10-31 Thread rich...@buzzhost.co.uk
On Sat, 2009-10-31 at 08:05 -0500, Chris wrote: > On Sat, 2009-10-31 at 12:53 +0000, rich...@buzzhost.co.uk wrote: > > On Sat, 2009-10-31 at 07:29 -0500, Chris wrote: > > > On Sat, 2009-10-31 at 07:46 +, rich...@buzzhost.co.uk wrote: > > > >

Re: HOTMAIL SPAM =Rule to bite on X-Originating-IP or length of FROM list?

2009-10-31 Thread rich...@buzzhost.co.uk
On Sat, 2009-10-31 at 13:58 +, RW wrote: > On Sat, 31 Oct 2009 07:59:24 + > "rich...@buzzhost.co.uk" wrote: > > A couple of observations; > > 123.160.198.207 - is on the PBL {deep in the heart of China} so is > > possible to extend the network tests to l

Re: HOTMAIL SPAM =Rule to bite on X-Originating-IP or length of FROM list?

2009-10-31 Thread rich...@buzzhost.co.uk
On Sat, 2009-10-31 at 16:30 +0200, Henrik K wrote: > On Sat, Oct 31, 2009 at 02:13:45PM +0000, rich...@buzzhost.co.uk wrote: > > On Sat, 2009-10-31 at 13:58 +, RW wrote: > > > On Sat, 31 Oct 2009 07:59:24 +0000 > > > "rich...@buzzhost.co.uk" wr

Re: HOTMAIL SPAM =Rule to bite on X-Originating-IP or length of FROM list?

2009-10-31 Thread rich...@buzzhost.co.uk
On Sat, 2009-10-31 at 18:49 +0200, Henrik K wrote: > On Sat, Oct 31, 2009 at 03:33:59PM +0000, rich...@buzzhost.co.uk wrote: > > > > > > Uh, SpamAssassin parses X-Originating-IP and friends just fine. Of course > > > PBL isn't going to hit it, since it's

Re: Crashes running SA as milter in Postfix

2009-11-01 Thread rich...@buzzhost.co.uk
On Sun, 2009-11-01 at 22:31 +0100, Patrick Ben Koetter wrote: > We regularly experience SA crashes on a Ubuntu Hardy machine. The setup is as > follows: > > Postfix (2.5.1) -> SpamAssassin Milter (0.3.1-6) -> SpamAssassin > (3.2.4-1ubuntu1.1) > > The milter is run like this: > > /usr/sbin/spa

Re: [SPAM:6.0] Re: FN: RUSSIAN_LINKS BODY:

2009-11-03 Thread rich...@buzzhost.co.uk
On Tue, 2009-11-03 at 10:55 +, Ned Slider wrote: > rich...@buzzhost.co.uk wrote: > > RUSSIAN_LINKS BODY: link to .ru > > > > Appears to miss the example: > > http://pastebin.com/m7ae0f8ec > > > > Unless I'm missing something ? > > > >

Re: Messagelabs sends phish, SA+ClamAV+sanesecurity sigs catches it

2009-11-06 Thread rich...@buzzhost.co.uk
On Thu, 2009-11-05 at 23:54 -0600, David B Funk wrote: > I just now found a phish in one of my spamtraps, no surprise there. > The surprising thing is that it was sent out via a messagelabs.com > mailserver, complete with headers indicating that it passed their virus > checks. > At my end spamassas

Re: facebook Spam Question

2009-11-08 Thread rich...@buzzhost.co.uk
On Sun, 2009-11-08 at 10:39 +, Chip M. wrote: > > Ugh. I just checked Twitter, and no SPF record. :( No? What's this? ;; ANSWER SECTION: twitter.com.600 IN TXT "v=spf1 ip4:128.121.145.168 ip4:128.121.146.128/27 mx ptr a:postmaster.twitter.com mx:one.textdrive.com i

Re: [SPAM:6.0] Spam coming from hotmail.

2009-11-09 Thread rich...@buzzhost.co.uk
On Mon, 2009-11-09 at 07:56 -0500, Casartello, Thomas wrote: > I’ve been getting a lot of non-scoring spam coming from hotmail over > the last couple weeks. It’s one user that’s been complaining about it. > > Here’s a few samples: {serious ascii murder commited} I could not stop laughing at this

RE: [SPAM:6.0] Spam coming from hotmail.

2009-11-09 Thread rich...@buzzhost.co.uk
Running those through my SA gets the biggest hit for the second example with the Indian link in the body. But that's a custom rule kindly given to me by of one of the good people on this list. I'm more concerned with this: X-Originating-IP: [189.69.146.53] In Brazil yet my relay module does not

Re: Spam coming from hotmail.

2009-11-09 Thread rich...@buzzhost.co.uk
On Mon, 2009-11-09 at 17:12 +, RW wrote: > On Mon, 09 Nov 2009 15:09:18 + > "rich...@buzzhost.co.uk" wrote: > > > > > Running those through my SA gets the biggest hit for the second > > example with the Indian link in the body. But that's a cu

Re: Regex Question

2009-11-10 Thread rich...@buzzhost.co.uk
On Tue, 2009-11-10 at 14:32 +0100, Ralf Hildebrandt wrote: > * rahlqu...@gmail.com : > > Ok regex is not my strong suit by any means. Trying to get a match for email > > addresses that start with a pipe character ( about 15% of my spam is this ). > > That's not needed. Why are you accepting mail t

Re: Regex Question

2009-11-10 Thread rich...@buzzhost.co.uk
On Tue, 2009-11-10 at 16:50 +0100, Benny Pedersen wrote: > On tir 10 nov 2009 15:26:43 CET, "rich...@buzzhost.co.uk" wrote > > Please keep this in your mind in future before trotting out that tired > > old gas. > > imho Ralf have never being banned in maillist

Re: Regex Question

2009-11-10 Thread rich...@buzzhost.co.uk
On Tue, 2009-11-10 at 11:45 -0500, Alex wrote: > >> imho Ralf have never being banned in maillist here, if you dont like > >> his answers just unsubscribe > >> > > Trotting out useless, pointless, tardy, curt, terse replies benefit > > nobody at all and makes the poster look arrogant especially whe

Re: [Fwd: Re: Getting off the "Cloudmark" formerly "spamnet" blacklist]

2009-11-13 Thread rich...@buzzhost.co.uk
On Fri, 2009-11-13 at 09:12 +0100, Matus UHLAR - fantomas wrote: > On 12.11.09 13:55, Chris Hoogendyk wrote: > > I don't know about Linux viruses; BUT, I do remember less than ten years > > ago when it was virtually impossible to build a Linux box with a hot > > online connection, because you w

Re: Getting off the "Cloudmark" formerly "spamnet" blacklist

2009-11-13 Thread rich...@buzzhost.co.uk
> > > > put it online. He still got hacked again at least once after that. > > > > > > > > I also heard stories of my son doing battle with hackers who had gotten > > > > > > > > into his Linux system. > > On 13.11.09 08:38,

Re: Getting off the "Cloudmark" formerly "spamnet" blacklist

2009-11-13 Thread rich...@buzzhost.co.uk
On Fri, 2009-11-13 at 11:40 +0100, Matus UHLAR - fantomas wrote: > Am I the only one who thints that issues clearly off-topic should be sent > off-list? > Your response was to correct an onlist reply to an onlist remark. Is there some reason why you would feel it appropriate to off-list that? AF

Re: DNSBL Comparison 20091114

2009-11-15 Thread rich...@buzzhost.co.uk
On Sun, 2009-11-15 at 03:14 -0500, Warren Togami wrote: > http://mail-archives.apache.org/mod_mbox/spamassassin-users/200910.mbox/%3c4ad11c44.9030...@redhat.com%3e > Compare this report to a similar report last month. > > http://wiki.apache.org/spamassassin/NightlyMassCheck > The results below are

balancechecker.zip balancechecker.exe

2009-11-15 Thread rich...@buzzhost.co.uk
Is anyone else seeing an influx of spam with a zip attachment balancechecker.zip? This contains a windows executable, balancechecker.exe, which appears to be testing clean with clam and others. I'm inclined to think it's *not* clean and is viral. EXAMPLE http://pastebin.com/m730f90e9

Re: DNSBL Comparison 20091114

2009-11-15 Thread rich...@buzzhost.co.uk
On Sun, 2009-11-15 at 20:34 +, Justin Mason wrote: > On Sun, Nov 15, 2009 at 08:53, rich...@buzzhost.co.uk > wrote: > > On Sun, 2009-11-15 at 03:14 -0500, Warren Togami wrote: > >> http://mail-archives.apache.org/mod_mbox/spamassassin-users/200910.mbox/%3c4ad11c44.

Re: balancechecker.zip balancechecker.exe

2009-11-15 Thread rich...@buzzhost.co.uk
On Mon, 2009-11-16 at 00:07 +0100, Ralph Bornefeld-Ettmann wrote: > rich...@buzzhost.co.uk schrieb: > > Is anyone else seeing an influx of spam with a zip attachment > > balancechecker.zip? > > > > This contains a windows executable, balancechecker.exe, which appears t

Re: DNSBL Comparison 20091114

2009-11-16 Thread rich...@buzzhost.co.uk
On Mon, 2009-11-16 at 17:21 +1000, Res wrote: > On Mon, 16 Nov 2009, rich...@buzzhost.co.uk wrote: > > >>>> safe. BRBL has a high hit rate as well, with a moderate safety rating. > > Wondered why i wasn't getting anything from mysql.com for over a week,

Re: DNSBL Comparison 20091114

2009-11-16 Thread rich...@buzzhost.co.uk
On Mon, 2009-11-16 at 14:00 +, Justin Mason wrote: > First -- my name is not Jim. Secondly -- I don't care what Spamhaus > does, I'm asking what you suggest SpamAssassin do to measure FPs. Is that a core feature of spamassassin Just in? Is it necessary to have that data? Will 'Hey, I noticed

Re: balancechecker.zip balancechecker.exe

2009-11-16 Thread rich...@buzzhost.co.uk
On Mon, 2009-11-16 at 14:08 +0100, Ralph Bornefeld-Ettmann wrote: > rich...@buzzhost.co.uk schrieb: > > On Mon, 2009-11-16 at 00:07 +0100, Ralph Bornefeld-Ettmann wrote: > >> rich...@buzzhost.co.uk schrieb: > >>> Is anyone else seeing an influx

Re: rbl checks not running

2009-11-20 Thread rich...@buzzhost.co.uk
On Fri, 2009-11-20 at 12:29 -0800, Mark Hedges wrote: > On Fri, 20 Nov 2009, Mark Hedges wrote: > > > > Hi. I've set up my own rbldnsd server. It's responding > > to queries correctly, for example, I am trying to block > > the server that this message comes from, 64.22.103.163. > > > > I forgot

Custom Rule Location

2009-11-22 Thread rich...@buzzhost.co.uk
I think this may have been answered before, but I can't find it in the archives. Custom rules can be kept in /etc/spamassassin/whateva.cf files no problem. I would like to keep some rules separate for maintenance, by keeping rules I write in /etc/spamassassin/custom/, and some that friends write i

Re: Custom Rule Location

2009-11-22 Thread rich...@buzzhost.co.uk
On Sun, 2009-11-22 at 17:10 +0100, Benny Pedersen wrote: > man sa-update Thanks, but all that says is making use of: --updatedir Will allow rules to be downloaded to a different directory. What I'm looking to do is have SA look in these directories in addition to the default locations. I don't

Re: Custom Rule Location

2009-11-22 Thread rich...@buzzhost.co.uk
On Sun, 2009-11-22 at 14:17 -0500, Alex wrote: > Hi, > > > What I'm looking to do is have SA look in these directories in addition > > to the default locations. I don't have a problem putting rules there > > Benny. I have a problem getting SA to look there for them :-) > > Are you talking about d

Re: HABEAS_ACCREDITED SPAMMER

2009-11-23 Thread rich...@buzzhost.co.uk
Thanks to Matus for the explanation, LuKreme for the suggestion on scoring and Hajdu for the contact details. I am obliged to you and thank you for your time.

Re: HABEAS_ACCREDITED SPAMMER

2009-11-23 Thread rich...@buzzhost.co.uk
On Mon, 2009-11-23 at 17:08 -0700, LuKreme wrote: > On Nov 23, 2009, at 7:39, Matus UHLAR - fantomas > wrote: > > > Yes, why to differ between non-abusing and abusing marketers... > > We've been through this before. On my mail, habeas is a very strong > indicator of spam. It does not appear

Re: HABEAS_ACCREDITED SPAMMER

2009-11-24 Thread rich...@buzzhost.co.uk
On Tue, 2009-11-24 at 09:17 +0100, Hajdú Zoltán wrote: > Habeas (nowdays ReturnPath) certifies their clients, forces them to provide > unsubscription options in their advertising messages, etc. If > there wasnt any unsubscribe option then contact their support/abuse team. > They list many import

Re: HABEAS_ACCREDITED SPAMMER

2009-11-24 Thread rich...@buzzhost.co.uk
On Wed, 2009-11-25 at 00:23 -0700, LuKreme wrote: > On 24-Nov-2009, at 15:23, Jeff Mincy wrote: > > From: LuKreme > >> On Nov 23, 2009, at 7:39, Matus UHLAR - fantomas > > > >>> Yes, why to differ between non-abusing and abusing marketers... > > > >> We've been through this before. On m

Re: well, isnt that special...

2009-11-25 Thread rich...@buzzhost.co.uk
On Wed, 2009-11-25 at 17:34 +, Ned Slider wrote: > Aaron Wolfe wrote: > > On Wed, Nov 25, 2009 at 12:04 PM, Ned Slider wrote: > >> R-Elists wrote: > >>> > >>> on a much more important note, can those on the list that have a good > >>> handle > >>> on better filtering spam and/or UCE from Const

Re: UCEPROTECT questions

2009-11-25 Thread rich...@buzzhost.co.uk
On Wed, 2009-11-25 at 13:45 -0500, Alex wrote: > Hi, > > I'm interested in people's opinion of UCEPROTECT. I'm aware of how it > works, but even UCEPROTECT1 seems to catch an awful lot of ham, and I > wondered if I was doing something wrong. > > I've set the score to 0.01 for now, while I watch a

Re: well, isnt that special...

2009-11-25 Thread rich...@buzzhost.co.uk
On Wed, 2009-11-25 at 19:20 +0100, Benny Pedersen wrote: > On ons 25 nov 2009 18:55:11 CET, "rich...@buzzhost.co.uk" wrote > > Any more ranges most welcome :-) > > iptables -A FIREWALL -s 127.0.0.0/8 -j DROP > Very good. That was nearly funny :-) Why don't

Re: well, isnt that special...

2009-11-25 Thread rich...@buzzhost.co.uk
On Wed, 2009-11-25 at 14:04 -0500, Alex wrote: > > iptables -A FIREWALL -s 127.0.0.0/8 -j DROP > > Nah, use REJECT so you get that immediate satisfaction :-) > > Alex NO NO NO NO NO! Drop has the effect of tarpitting them :-) As the Supremes sang; "Set me free why don't you baby? You just k

Re: well, isnt that special...

2009-11-26 Thread rich...@buzzhost.co.uk
On Thu, 2009-11-26 at 08:57 +0100, Per Jessen wrote: > rich...@buzzhost.co.uk wrote: > > > On Wed, 2009-11-25 at 14:04 -0500, Alex wrote: > >> > iptables -A FIREWALL -s 127.0.0.0/8 -j DROP > >> > >> Nah, use REJECT so you get that immediate satisfactio

Re: which free RBL do you use?

2009-11-27 Thread rich...@buzzhost.co.uk
On Fri, 2009-11-27 at 12:27 +0100, Matus UHLAR - fantomas wrote: > On 26.11.09 17:12, Allen Chen wrote: > > I didn't touch my spamassassin server for almost one year. > > It's still running and filtering spam without any problems. > > But I think things are changed a lot. I'm using 3.2.4. > > So I

Re: which free RBL do you use?

2009-11-27 Thread rich...@buzzhost.co.uk
On Fri, 2009-11-27 at 14:03 +0100, Matus UHLAR - fantomas wrote: > Why do you tell me? Tell the OP, I just have used the same > terminology. Matus, why are you once more sending me off list replies? Again, will you *please* keep your replies *ON LIST*. I pointed out that RBL is trademark just to

Re: which free RBL do you use?

2009-11-27 Thread rich...@buzzhost.co.uk
On Fri, 2009-11-27 at 17:17 +0100, Benny Pedersen wrote: > On fre 27 nov 2009 16:47:54 CET, "rich...@buzzhost.co.uk" wrote > > Matus, why are you once more sending me off list replies? > > Again, will you *please* keep your replies *ON LIST*. > > priceless reply-to

Re: Unhindered Pharma Spam

2009-11-28 Thread rich...@buzzhost.co.uk
On Sat, 2009-11-28 at 09:48 +, Arthur Dent wrote: > Hello all, > > I have had a couple of these sail into my my inbox untouched by SA with > the exception of RDNS_NONE and Bayes. Score of -0.1! > > http://pastebin.com/m478c33ce > > Even after learning they still only score 3.6 > > Anything

Re: which free RBL do you use?

2009-11-30 Thread rich...@buzzhost.co.uk
Matus forgot to include this one he sent to me personally: > On Fri, 2009-11-27 at 14:03 +0100, Matus UHLAR - fantomas wrote: > > Why do you tell me? Tell the OP, I just have used the same > > terminology. On 27.11.09 15:47, rich...@buzzhost.co.uk wrote: > Matus, why are you

Re: Unhindered Pharma Spam

2009-11-30 Thread rich...@buzzhost.co.uk
; > > > > http://pastebin.com/m478c33ce > > > > > > Even after learning they still only score 3.6 > > > > > > Anything I can do? > > On 28.11.09 10:12, rich...@buzzhost.co.uk wrote: > > I got '5' for it, at a push... > >

Re: Unhindered Pharma Spam

2009-11-30 Thread rich...@buzzhost.co.uk
On Mon, 2009-11-30 at 13:57 +0100, Matus UHLAR - fantomas wrote: > it's funny that you send me private copies for mail that DOES belong to > the list, but you refuse private mail even if it's does NOT belong here. > Well, I figured if you wanted to go on being an ignorant asshole and keep doing i

Re: Unhindered Pharma Spam

2009-11-30 Thread rich...@buzzhost.co.uk
On Mon, 2009-11-30 at 13:57 +0100, Matus UHLAR - fantomas wrote: > > > On 28.11.09 10:12, rich...@buzzhost.co.uk wrote: > > > > I got '5' for it, at a push... > > > > > > > > X-Spam-Report: > > > > * 5.0 RELAYCOUNTRY_FR Rel

Re: Unhindered Pharma Spam

2009-11-30 Thread rich...@buzzhost.co.uk
On Mon, 2009-11-30 at 14:14 +0100, Matus UHLAR - fantomas wrote: > > > > > On 28.11.09 10:12, rich...@buzzhost.co.uk wrote: > > The last time I checked no two email systems, be they home, soho or > > enterprise, had to be the same. Unless, of course, you are now declari

Re: NOT really about Unhindered Pharma Spam

2009-11-30 Thread rich...@buzzhost.co.uk
On Mon, 2009-11-30 at 10:08 -0500, Charles Gregory wrote: > PS. If I were a spammer I would be laughing my ass off at this waste of > time. Every effort spent on fighting each other is less spent on them. Actually, it's reasonable to argue that you are worse - you've just contributed to an argum

Re: OT: Re: NOT really about Unhindered Pharma Spam

2009-11-30 Thread rich...@buzzhost.co.uk
On Mon, 2009-11-30 at 12:06 -0500, Matt Garretson wrote: > Chris Owen wrote: > > Why anyone replies to this guy about anything is beyond me. > > Adding him to a kill file doesn't do much good when you still > > see the other half of the "argument". > > > +1 > > If you must feed the trolls, ple

Re: HABEAS_ACCREDITED SPAMMER

2009-11-30 Thread rich...@buzzhost.co.uk
On Mon, 2009-11-30 at 12:19 -0700, J.D. Falk wrote: > On Nov 25, 2009, at 3:57 AM, Hajdú Zoltán wrote: > > > Then whos job? :) Habeas doesnt monitor Your Inbox. > > > > If You have the time to write here just for 'flaming' against a ~good > > concept... > > ...Maybe it would be a better idea to

Re: HABEAS_ACCREDITED SPAMMER

2009-12-02 Thread rich...@buzzhost.co.uk
On Tue, 2009-12-01 at 15:06 -0700, J.D. Falk wrote: > On Nov 30, 2009, at 12:38 PM, rich...@buzzhost.co.uk wrote: > > > So please, spare me the sob story about what a wonderful idea HABEAS is. > > Talk is cheap, action speaks louder than words. > > Who's sobbing?

OT: Christmas Gift ideas

2009-12-02 Thread rich...@buzzhost.co.uk
This is top of my list.. http://www.amazon.co.uk/Constant-Contact-Guide-email-Marketing/dp/0470503416/ref=sr_1_1?ie=UTF8&s=books&qid=1259777127&sr=8-1

Re: J.D. Falk spineless insults (Re: HABEAS_ACCREDITED SPAMMER)

2009-12-03 Thread rich...@buzzhost.co.uk
On Thu, 2009-12-03 at 11:23 -0700, J.D. Falk wrote: > On Dec 2, 2009, at 12:59 AM, rich...@buzzhost.co.uk wrote: > > > As for > > insulting you - grow up. You work in the business of sending unwanted > > junk email. > > You haven't done any research at all,

Re: HABEAS_ACCREDITED WHY BY DEFAULT?

2009-12-04 Thread rich...@buzzhost.co.uk
On Fri, 2009-12-04 at 00:18 -0800, jdow wrote: > From: "LuKreme" > Sent: Thursday, 2009/December/03 20:55 > > > > On Dec 3, 2009, at 13:43, "rich...@buzzhost.co.uk" > > wrote: > >> On Thu, 2009-12-03 at 11:23 -0700, J.D. Falk wrote: >

Re: HABEAS_ACCREDITED WHY BY DEFAULT?

2009-12-04 Thread rich...@buzzhost.co.uk
On Fri, 2009-12-04 at 04:16 -0800, jdow wrote: > From: "Yet Another Ninja" > Sent: Friday, 2009/December/04 02:28 > > > > On 12/4/2009 10:57 AM, rich...@buzzhost.co.uk wrote: > > > FINAL > >> This is not a social club, it's a question and

<    1   2   3   >