Re: Need God/Christian rule sets

[Marc Perkel]

On 10/3/2010 8:10 PM, John Hardin wrote:

On Sun, 3 Oct 2010, Marc Perkel wrote:

As I said in my original message. The rule itself would have no 
points. It would be combined with other rules like large sums of 
money and transfer and I'm someone you don't know.


You mean, like the ADVANCE_FEE and MONEY_FRAUD rules?



Yes - rules like that.

--
Marc Perkel - Sales/Support
supp...@junkemailfilter.com
http://www.junkemailfilter.com
Junk Email Filter dot com
415-992-3400

AW: Need God/Christian rule sets

[Hans-Werner Friedemann]

That´s not complicated!
Only use the RelayCountry-Plugin.


>> I'd like to just block all Arabic.


--
Marc Perkel - Sales/Support
supp...@junkemailfilter.com
http://www.junkemailfilter.com
Junk Email Filter dot com
415-992-3400

Re: AW: Need God/Christian rule sets

[Jason Haar]

 On 10/04/2010 06:51 PM, Hans-Werner Friedemann wrote:
> That´s not complicated!
> Only use the RelayCountry-Plugin.

Huh? You are suggesting Arabic spam exclusively comes from Arabic
countries? The same way English spam only comes from England? ;-)

What you want is a properly working textcat plugin (see my previous post
"are there any alternatives to textcat?"). However, language matching is
actually a very difficult thing in this Unicode era... Even that
apostrophe you put in your email isn't an ASCII apostrophe - a language
"guesser" has to take a lot of things into account...

-- 
Cheers

Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone: +64 3 9635 377 Fax: +64 3 9635 417
PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1

Re: Need God/Christian rule sets

[John Hardin]

On Sun, 3 Oct 2010, Marc Perkel wrote:

As I said in my original message. The rule itself would have no points. 
It would be combined with other rules like large sums of money and 
transfer and I'm someone you don't know.


You mean, like the ADVANCE_FEE and MONEY_FRAUD rules?

--
 John Hardin KA7OHZhttp://www.impsec.org/~jhardin/
 jhar...@impsec.orgFALaholic #11174 pgpk -a jhar...@impsec.org
 key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C  AF76 D822 E6E6 B873 2E79
---
  Liberals love sex ed because it teaches kids to be safe around their
  sex organs. Conservatives love gun education because it teaches kids
  to be safe around guns. However, both believe that the other's
  education goals lead to dangers too terrible to contemplate.
---
 75 days until TRON Legacy

Re: Need God/Christian rule sets

[Marc Perkel]

On 10/3/2010 12:09 PM, Michelle Konzack wrote:

Hello Marc,

Am 2010-10-03 09:21:02, hacktest Du folgendes herunter:

  I think we could catch a lot more spam if we had some God/Christian
rules.

Hey, thats cool!!  I need rules for Allah/Islamic stuff!

Problem 1:  They are written in arabic, urdu and two other
 languages I do not know.

Problem 2:  Arabic, Urdu and Farsi are three of my communication
 languages and can not globaly filtered.

Any suggestions?

Thanks, Greetings and nice Day/Evening
 Michelle Konzack




I'd like to just block all Arabic.


--
Marc Perkel - Sales/Support
supp...@junkemailfilter.com
http://www.junkemailfilter.com
Junk Email Filter dot com
415-992-3400

Re: Need God/Christian rule sets

[Marc Perkel]

 As I said in my original message. The rule itself would have no 
points. It would be combined with other rules like large sums of money 
and transfer and I'm someone you don't know.


On 10/3/2010 10:27 AM, m...@khonji.org wrote:

How do you propose to make such relations between the keywords, and how to 
mitigate false positives?

Naïve Bayes deals with words independently. If we want to link between words, I 
think we are into Natural Language Processing (NLP).

If you have any good thoughts please share.


---
Mahmoud Khonji


--
Marc Perkel - Sales/Support
supp...@junkemailfilter.com
http://www.junkemailfilter.com
Junk Email Filter dot com
415-992-3400

Re: Need God/Christian rule sets

[Michelle Konzack]

Hello Marc,

Am 2010-10-03 09:21:02, hacktest Du folgendes herunter:
>  I think we could catch a lot more spam if we had some God/Christian
> rules.

Hey, thats cool!!  I need rules for Allah/Islamic stuff!

Problem 1:  They are written in arabic, urdu and two other
languages I do not know.

Problem 2:  Arabic, Urdu and Farsi are three of my communication
languages and can not globaly filtered.

Any suggestions?

Thanks, Greetings and nice Day/Evening
Michelle Konzack

-- 
# Debian GNU/Linux Consultant ##
   Development of Intranet and Embedded Systems with Debian GNU/Linux

itsyst...@tdnet France EURL   itsyst...@tdnet UG (limited liability)
Owner Michelle KonzackOwner Michelle Konzack

Apt. 917 (homeoffice)
50, rue de Soultz Kinzigstraße 17
67100 Strasbourg/France   77694 Kehl/Germany
Tel: +33-6-61925193 mobil Tel: +49-177-9351947 mobil
Tel: +33-9-52705884 fix

  
 

Jabber linux4miche...@jabber.ccc.de
ICQ#328449886

Linux-User #280138 with the Linux Counter, http://counter.li.org/


signature.pgp
Description: Digital signature

Re: Need God/Christian rule sets

[m]

How do you propose to make such relations between the keywords, and how to 
mitigate false positives?

Naïve Bayes deals with words independently. If we want to link between words, I 
think we are into Natural Language Processing (NLP).

If you have any good thoughts please share.


---
Mahmoud Khonji

Need God/Christian rule sets

[Marc Perkel]

 I think we could catch a lot more spam if we had some God/Christian 
rules. Not that these rules should generate any point by themselves as 
there is a lot of religious non spam. But a lot of spam is enhanced with 
God/Christian language. When these rules are combined with other rules I 
think it would be very effective. Especially in a spam like:


I am a stranger - I and a devout Christian - I have a large sum of money 
that I will share with you - we need to keep this secret - contact me at 
my private email address - God bless you.


When Christian is combined with large sums of money and they don't know 
you, and want to tansfer the money to you it's pretty clear that spam. 
The idea is to create rules that do more than catch phrases but combine 
them to catch the whole story.

Re: spam assassin custom rule sets

[Matus UHLAR - fantomas]

> aquero wrote:
> > Thanks for your suggestions. But in my project i would like to use only
> > free rule sets. When i searched about the rules you specified ,razor2
> > and dcc seems to be paid rule sets.Can you please suggest any free
> > alternatives for these rules? and I would like to know the minimum cost
> > of these rules? Thanks again for your suggestions..:)

On 07.06.10 10:17, Bowie Bailey wrote:
> And DCC is free as long as you are not making it part of a commercial
> filtering product:
> 
> The non-commercial DCC software is distributed under a license
> <http://www.rhyolite.com/dcc/LICENSE> that is free only to
> organizations that do not sell filtering devices or services except
> to their own users and
> that participate in the global DCC network. ISPs that use DCC to
> filter mail for their
> own users are intended to be covered by the free license
> <http://www.rhyolite.com/dcc/LICENSE>.

Note that you must also be using public DCC network, otherwise you'll need
commercial version. The public DCC servers limit daily usage to 200k
DCC lookups, for more you need own server connected to public network.
While it sounds reasonable, DCC is understood as non-free by Debian Free 
Software Guidelines for this.

-- 
Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
The early bird may get the worm, but the second mouse gets the cheese. 

Re: spam assassin custom rule sets

[Bowie Bailey]

aquero wrote:
> Bowie Bailey wrote:
>   
>> aquero wrote:
>> 
>>> Hi,
>>>   When i checked the third party softwares for spam-assassin i found many
>>> custom rule sets. Do I have to install these rule sets manually? If I
>>> perform sa-update, will it will include all these rule sets into my
>>> spam-assassin rules list?
>>>   
>> Before you start adding a bunch of 3rd party rules, I would reactivate
>> the RBL checks.  Those will catch much more spam than any of the other
>> rulesets.  Also, you definitely want to bump your required_score back to
>> 5 before you start adding more rules.
>>
>> That being said, these are the rules that I use (in addition to the
>> stock rules and RBL lists):
>>
>> razor2
>> dcc
>> sought
>> khop-bl
>> khop-blessed
>> khop-general
>> khop-sc-neighbors
>> Botnet
>> FreeMail
>> iXhash
>>
>> Sought and the khop rules can be updated via sa-update.
>
> Thanks for your suggestions. But in my project i would like to use only free
> rule sets. When i searched about the rules you specified ,razor2 and dcc
> seems to be paid rule sets.Can you please suggest any free alternatives for
> these rules? and I would like to know the minimum cost of these rules?
> Thanks again for your suggestions..:)
Razor2 is free for everyone:

Razor2 Service Policy V2.0
March 13, 2006

Razor2 agents connect to the Cloudmark Collaborative Security
Network to report spam and check for fingerprints. Cloudmark
provides free and open access to the CCSN but reserves the right
to deny access to anyone.

And DCC is free as long as you are not making it part of a commercial
filtering product:

The non-commercial DCC software is distributed under a license
<http://www.rhyolite.com/dcc/LICENSE> that is free only to
organizations that do not sell filtering devices or services except
to their own users and
that participate in the global DCC network. ISPs that use DCC to
filter mail for their
own users are intended to be covered by the free license
<http://www.rhyolite.com/dcc/LICENSE>.

Pyzor is another service similar to Razor that is also free.

-- 
Bowie

Re: spam assassin custom rule sets

[aquero]

Bowie Bailey wrote:
> 
> aquero wrote:
>> Hi,
>>   When i checked the third party softwares for spam-assassin i found many
>> custom rule sets. Do I have to install these rule sets manually? If I
>> perform sa-update, will it will include all these rule sets into my
>> spam-assassin rules list?
> 
> Before you start adding a bunch of 3rd party rules, I would reactivate
> the RBL checks.  Those will catch much more spam than any of the other
> rulesets.  Also, you definitely want to bump your required_score back to
> 5 before you start adding more rules.
> 
> That being said, these are the rules that I use (in addition to the
> stock rules and RBL lists):
> 
> razor2
> dcc
> sought
> khop-bl
> khop-blessed
> khop-general
> khop-sc-neighbors
> Botnet
> FreeMail
> iXhash
> 
> Sought and the khop rules can be updated via sa-update.
> 
> -- 
> Bowie
> 
> 

Thanks for your suggestions. But in my project i would like to use only free
rule sets. When i searched about the rules you specified ,razor2 and dcc
seems to be paid rule sets.Can you please suggest any free alternatives for
these rules? and I would like to know the minimum cost of these rules?
Thanks again for your suggestions..:) 

-- 
View this message in context: 
http://old.nabble.com/spam-assassin-custom-rule-sets-tp28782309p28790982.html
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.

Re: spam assassin custom rule sets

[Bowie Bailey]

aquero wrote:
> Hi,
>   When i checked the third party softwares for spam-assassin i found many
> custom rule sets. Do I have to install these rule sets manually? If I
> perform sa-update, will it will include all these rule sets into my
> spam-assassin rules list?

Before you start adding a bunch of 3rd party rules, I would reactivate
the RBL checks.  Those will catch much more spam than any of the other
rulesets.  Also, you definitely want to bump your required_score back to
5 before you start adding more rules.

That being said, these are the rules that I use (in addition to the
stock rules and RBL lists):

razor2
dcc
sought
khop-bl
khop-blessed
khop-general
khop-sc-neighbors
Botnet
FreeMail
iXhash

Sought and the khop rules can be updated via sa-update.

-- 
Bowie

Re: spam assassin custom rule sets

[Jari Fredriksson]

On 4.6.2010 19:33, aquero wrote:
> 
> Hi,
>   When i checked the third party softwares for spam-assassin i found many
> custom rule sets. Do I have to install these rule sets manually? If I
> perform sa-update, will it will include all these rule sets into my
> spam-assassin rules list?

sa-update can be parameterised with a "channelfile".

Read this: http://khopesh.com/wiki/Anti-spam

-- 
http://www.iki.fi/jarif/
I use PGP. If there is an incompatibility problem with your mail
client, please contact me.

There is no distinctly native American criminal class except Congress.
-- Mark Twain



signature.asc
Description: OpenPGP digital signature

spam assassin custom rule sets

[aquero]

Hi,
  When i checked the third party softwares for spam-assassin i found many
custom rule sets. Do I have to install these rule sets manually? If I
perform sa-update, will it will include all these rule sets into my
spam-assassin rules list?
-- 
View this message in context: 
http://old.nabble.com/spam-assassin-custom-rule-sets-tp28782309p28782309.html
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.

Re: Custom Rule Sets

[Benny Pedersen]

On Mon, June 22, 2009 05:46, rich...@buzzhost.co.uk wrote:

> Is it possible to ask local.cf to include external files/dir for custom
> rules at all?

any file that ends in cf just like local.cf does, will be read if places
in the same dir as local.cf no magic includes is needed :)

-- 
xpoint

Re: Custom Rule Sets

[rich...@buzzhost.co.uk]

On Mon, 2009-06-22 at 07:53 -0400, Matt Kettler wrote:
> rich...@buzzhost.co.uk wrote:
> > On Mon, 2009-06-22 at 07:30 -0400, Matt Kettler wrote:
> >   
> >> rich...@buzzhost.co.uk wrote:
> >> 
> >>> On Mon, 2009-06-22 at 00:26 -0400, Matt Kettler wrote:
> >>>   
> >>>   
>  rich...@buzzhost.co.uk wrote:
>  
>  
> > Good morning,
> >
> > Looking at the docs I see a 'don't add your customer rules here' warning
> > in reference to the default /usr/share/spamassassin dir. Instead it
> > lists a couple of options including local.cf
> >
> > Is it possible to ask local.cf to include external files/dir for custom
> > rules at all? 
> >   
> >   
>  Yes, there is an include directive (see the Mail::SpamAssassin::Conf
>  docs) but by default SA will load *ALL* .cf files from your site rules
>  directory (usually /etc/mail/spamassassin), so includes at the local.cf
>  level are a bit silly.
>  
>  
> >>> I agree - but the docs seem to imply that you should not put them in
> >>> here - hence my confusion.
> >>>
> >>>   
> >>>   
> >> Where do they imply you should not create additional .cf files?
> >>
> >>
> >> 
> > I does not. I've already covered that and thanked a poster earlier for
> > guiding me in my error. Did you not read the follow up I posted?
> >
> >
> >   
> About 20 seconds after I replied..
> 
> Sorry, just waking up for the AM here... Didn't think to read the rest
> of the thread.
> 
Kind of ironic that when you were trying to correct me for not reading
the link properly ;-)

Re: Custom Rule Sets

[Matt Kettler]

rich...@buzzhost.co.uk wrote:
> On Mon, 2009-06-22 at 07:30 -0400, Matt Kettler wrote:
>   
>> rich...@buzzhost.co.uk wrote:
>> 
>>> On Mon, 2009-06-22 at 00:26 -0400, Matt Kettler wrote:
>>>   
>>>   
 rich...@buzzhost.co.uk wrote:
 
 
> Good morning,
>
> Looking at the docs I see a 'don't add your customer rules here' warning
> in reference to the default /usr/share/spamassassin dir. Instead it
> lists a couple of options including local.cf
>
> Is it possible to ask local.cf to include external files/dir for custom
> rules at all? 
>   
>   
 Yes, there is an include directive (see the Mail::SpamAssassin::Conf
 docs) but by default SA will load *ALL* .cf files from your site rules
 directory (usually /etc/mail/spamassassin), so includes at the local.cf
 level are a bit silly.
 
 
>>> I agree - but the docs seem to imply that you should not put them in
>>> here - hence my confusion.
>>>
>>>   
>>>   
>> Where do they imply you should not create additional .cf files?
>>
>>
>> 
> I does not. I've already covered that and thanked a poster earlier for
> guiding me in my error. Did you not read the follow up I posted?
>
>
>   
About 20 seconds after I replied..

Sorry, just waking up for the AM here... Didn't think to read the rest
of the thread.

Re: Custom Rule Sets

[rich...@buzzhost.co.uk]

On Mon, 2009-06-22 at 07:30 -0400, Matt Kettler wrote:
> rich...@buzzhost.co.uk wrote:
> > On Mon, 2009-06-22 at 00:26 -0400, Matt Kettler wrote:
> >   
> >> rich...@buzzhost.co.uk wrote:
> >> 
> >>> Good morning,
> >>>
> >>> Looking at the docs I see a 'don't add your customer rules here' warning
> >>> in reference to the default /usr/share/spamassassin dir. Instead it
> >>> lists a couple of options including local.cf
> >>>
> >>> Is it possible to ask local.cf to include external files/dir for custom
> >>> rules at all? 
> >>>   
> >> Yes, there is an include directive (see the Mail::SpamAssassin::Conf
> >> docs) but by default SA will load *ALL* .cf files from your site rules
> >> directory (usually /etc/mail/spamassassin), so includes at the local.cf
> >> level are a bit silly.
> >> 
> >
> > I agree - but the docs seem to imply that you should not put them in
> > here - hence my confusion.
> >
> >   
> 
> Where do they imply you should not create additional .cf files?
> 
> 
I does not. I've already covered that and thanked a poster earlier for
guiding me in my error. Did you not read the follow up I posted?

Re: Custom Rule Sets

[Matt Kettler]

rich...@buzzhost.co.uk wrote:
> On Mon, 2009-06-22 at 00:26 -0400, Matt Kettler wrote:
>   
>> rich...@buzzhost.co.uk wrote:
>> 
>>> Good morning,
>>>
>>> Looking at the docs I see a 'don't add your customer rules here' warning
>>> in reference to the default /usr/share/spamassassin dir. Instead it
>>> lists a couple of options including local.cf
>>>
>>> Is it possible to ask local.cf to include external files/dir for custom
>>> rules at all? 
>>>   
>> Yes, there is an include directive (see the Mail::SpamAssassin::Conf
>> docs) but by default SA will load *ALL* .cf files from your site rules
>> directory (usually /etc/mail/spamassassin), so includes at the local.cf
>> level are a bit silly.
>> 
>
> I agree - but the docs seem to imply that you should not put them in
> here - hence my confusion.
>
>   

Where do they imply you should not create additional .cf files?

Re: Custom Rule Sets

[rich...@buzzhost.co.uk]

On Mon, 2009-06-22 at 00:57 -0600, LuKreme wrote:
> On Jun 21, 2009, at 23:48, "rich...@buzzhost.co.uk"   > wrote:
> 
> > On Mon, 2009-06-22 at 00:26 -0400, Matt Kettler wrote:
> >> rich...@buzzhost.co.uk wrote:
> >>> Good morning,
> >>>
> >>> Looking at the docs I see a 'don't add your customer rules here'  
> >>> warning
> >>> in reference to the default /usr/share/spamassassin dir. Instead it
> >>> lists a couple of options including local.cf
> >>>
> >>> Is it possible to ask local.cf to include external files/dir for  
> >>> custom
> >>> rules at all?
> >> Yes, there is an include directive (see the Mail::SpamAssassin::Conf
> >> docs) but by default SA will load *ALL* .cf files from your site  
> >> rules
> >> directory (usually /etc/mail/spamassassin), so includes at the  
> >> local.cf
> >> level are a bit silly.
> >
> > I agree - but the docs seem to imply that you should not put them in
> > here - hence my confusion.
> 
> No, the docs say not to put them in /usr/share/spamassassin which is  
> not the same as  /etc/mail/spamassassin or /usr/local/etc/mail/ 
> spamassassin which is where local.cf and other custom cf files should  
> go.
> 
> 
You know something - you are right ;-)

Re: Custom Rule Sets

[LuKreme]

On Jun 21, 2009, at 23:48, "rich...@buzzhost.co.uk" > wrote:



On Mon, 2009-06-22 at 00:26 -0400, Matt Kettler wrote:

rich...@buzzhost.co.uk wrote:

Good morning,

Looking at the docs I see a 'don't add your customer rules here'  
warning

in reference to the default /usr/share/spamassassin dir. Instead it
lists a couple of options including local.cf

Is it possible to ask local.cf to include external files/dir for  
custom

rules at all?

Yes, there is an include directive (see the Mail::SpamAssassin::Conf
docs) but by default SA will load *ALL* .cf files from your site  
rules
directory (usually /etc/mail/spamassassin), so includes at the  
local.cf

level are a bit silly.


I agree - but the docs seem to imply that you should not put them in
here - hence my confusion.


No, the docs say not to put them in /usr/share/spamassassin which is  
not the same as  /etc/mail/spamassassin or /usr/local/etc/mail/ 
spamassassin which is where local.cf and other custom cf files should  
go.



--
Sent from my Bluetooth enabled iTouch.

Re: Custom Rule Sets

[rich...@buzzhost.co.uk]

On Mon, 2009-06-22 at 00:26 -0400, Matt Kettler wrote:
> rich...@buzzhost.co.uk wrote:
> > Good morning,
> >
> > Looking at the docs I see a 'don't add your customer rules here' warning
> > in reference to the default /usr/share/spamassassin dir. Instead it
> > lists a couple of options including local.cf
> >
> > Is it possible to ask local.cf to include external files/dir for custom
> > rules at all? 
> Yes, there is an include directive (see the Mail::SpamAssassin::Conf
> docs) but by default SA will load *ALL* .cf files from your site rules
> directory (usually /etc/mail/spamassassin), so includes at the local.cf
> level are a bit silly.

I agree - but the docs seem to imply that you should not put them in
here - hence my confusion.

Thank you Matt.

Re: Custom Rule Sets

[Matt Kettler]

rich...@buzzhost.co.uk wrote:
> Good morning,
>
> Looking at the docs I see a 'don't add your customer rules here' warning
> in reference to the default /usr/share/spamassassin dir. Instead it
> lists a couple of options including local.cf
>
> Is it possible to ask local.cf to include external files/dir for custom
> rules at all? 
Yes, there is an include directive (see the Mail::SpamAssassin::Conf
docs) but by default SA will load *ALL* .cf files from your site rules
directory (usually /etc/mail/spamassassin), so includes at the local.cf
level are a bit silly. Just put extra .cf files in the same directory
and SA will load them.

Generally speaking, the include directive is only used at the user_prefs
level, where a single file is parsed by default, not a whole directory.

See also:
http://wiki.apache.org/spamassassin/WritingRules

Custom Rule Sets

[rich...@buzzhost.co.uk]

Good morning,

Looking at the docs I see a 'don't add your customer rules here' warning
in reference to the default /usr/share/spamassassin dir. Instead it
lists a couple of options including local.cf

Is it possible to ask local.cf to include external files/dir for custom
rules at all? 

Thanks

RE: script to upgrade SpamAssassin (itself, not just rule sets)

[Robert - elists]

Typically we do something like this basic outline

login to non-root account and change to proper directory

wget
http://www.apache.org/dist/spamassassin/source/Mail-SpamAssassin-3.2.5.tar.g
z

rpmbuild -tb Mail-SpamAssassin-3.2.5.tar.gz

su to root and change to proper directory

yum localinstall perl-Mail-SpamAssassin-3.2.5-1.i386.rpm
spamassassin-3.2.5-1.i386.rpm

then when done we run sa-update script and check log files for problems

 - rh

script to upgrade SpamAssassin (itself, not just rule sets)

[jidanni]

Gentlemen, every few months we must upgrade Spamassassin (the software
itself, not just doing sa-update).

So what script do you use to take the bore out of the process?

Need something like:
set -xeu
set /tmp/$USER.SpamassassinUpgrade
mkdir $1
cd $1
latest=`(fancy code to determine latest version on nearest mirror or
just master)`
wget $latest
bunzip2 *.bz2
cd `ls|sed q`
echo|perl Makefile.PL PREFIX=$HOME #answer the question with RETurn
make
make install

RE: Rule-sets

[David Brodbeck]

On Thu, 7 Apr 2005 12:27:58 +0100, Gray, Richard wrote
> You probably also want to learn more about regular expressions too.
> There
> Was a lot of stuff that I didn't know before I started doing this.
> 
> In particular, useful things like back chaining and forward referencing
> are useful to understand.
> 
> I wish I could tell you I had found a good site or book about it,
>  but I haven't. If you do find one, would you let me know?

The best I've found so far is the section on regular expressions in
_Programming Perl_.  But that's an awfully thick book to buy just for that. ;)

RE: Rule-sets

[Chris Santerre]

>-Original Message-
>From: Bowie Bailey [mailto:[EMAIL PROTECTED]
>Sent: Thursday, April 07, 2005 10:44 AM
>Cc: users@spamassassin.apache.org
>Subject: RE: Rule-sets
>
>
>From: Ron McKeating [mailto:[EMAIL PROTECTED]
>> 
>> On Thu, 2005-04-07 at 12:27 +0100, Gray, Richard wrote:
>> > > > Thanks to all the replied, we have rules_du_jour and I am now
>> > > > getting an idea of how it works. I suppose the obvious 
>question is
>> > > > has anybody written a good howto on writing your own 
>rules. And if
>> > > > so where is it?
>> > > 
>> > 
>> > You probably also want to learn more about regular expressions too.
>> > There Was a lot of stuff that I didn't know before I 
>started doing this.
>
>> > 
>> > In particular, useful things like back chaining and 
>forward referencing
>> > are useful to understand.
>> > 
>> > I wish I could tell you I had found a good site or book 
>about it, but I
>> > haven't.  If you do find one, would you let me know?
>> > 
>> 
>> I use mastering regular expressions by O'Reilly
>
>Seconded.  Excellent book.
>
>Mastering Regular Expressions by Jeffrey E.F. Friedl
>Published by O'Reilly
>
>I found it when I was learning Perl.  It has lots of generic 
>RE stuff as
>well as a whole chapter (100 pages) on Perl specifics.

Most of my Perl knowledge comes from Theo's random signitures! ;) 

--Chris (Larry who?)

RE: Rule-sets

[Bowie Bailey]

From: Ron McKeating [mailto:[EMAIL PROTECTED]
> 
> On Thu, 2005-04-07 at 12:27 +0100, Gray, Richard wrote:
> > > > Thanks to all the replied, we have rules_du_jour and I am now
> > > > getting an idea of how it works. I suppose the obvious question is
> > > > has anybody written a good howto on writing your own rules. And if
> > > > so where is it?
> > > 
> > 
> > You probably also want to learn more about regular expressions too.
> > There Was a lot of stuff that I didn't know before I started doing this.

> > 
> > In particular, useful things like back chaining and forward referencing
> > are useful to understand.
> > 
> > I wish I could tell you I had found a good site or book about it, but I
> > haven't.  If you do find one, would you let me know?
> > 
> 
> I use mastering regular expressions by O'Reilly

Seconded.  Excellent book.

Mastering Regular Expressions by Jeffrey E.F. Friedl
Published by O'Reilly

I found it when I was learning Perl.  It has lots of generic RE stuff as
well as a whole chapter (100 pages) on Perl specifics.

Bowie

Re: Rule-sets

[Matt Kettler]

At 05:53 AM 4/7/2005, Matthew Newton wrote:
The "main" site for rules is generally http://www.rulesemporium.com/,
and spefically the http://www.rulesemporium.com/rules.htm page. They
have descriptions for what they do. You'll also find more on
http://www.exit0.us/, including the RulesDuJour script at
http://www.exit0.us/index.php?pagename=RulesDuJour that will
automatically check for new rules for you.
Don't forget the list of rulesets in the official Wiki:
http://wiki.apache.org/spamassassin/CustomRulesets
Really, I would regard the wiki page as the best starting page, as it 
references all the others, including exit0 and rulesemporium.

Rulesemporium is the outlet for all the rules built up by SARE, who do by 
far make the most and best add-on rules, but they aren't the only ones..

RE: Rule-sets

[Ron McKeating]

On Thu, 2005-04-07 at 12:27 +0100, Gray, Richard wrote:
> > > Thanks to all the replied, we have rules_du_jour and I am 
> > now getting 
> > > an idea of how it works. I suppose the obvious question is 
> > has anybody 
> > > written a good howto on writing your own rules. And if so 
> > where is it?
> > 
> 
> You probably also want to learn more about regular expressions too.
> There
> Was a lot of stuff that I didn't know before I started doing this. 
> 
> In particular, useful things like back chaining and forward referencing
> are useful to understand.
> 
> I wish I could tell you I had found a good site or book about it, but I
> haven't.
> If you do find one, would you let me know?
> 

I use mastering regular expressions by O'Reilly

Ron
> HTH
> 
> R
> 
> 
> ---
> This email from dns has been validated by dnsMSS Managed Email Security and 
> is free from all known viruses.
> 
> For further information contact [EMAIL PROTECTED]
> 
> 
> 
> 
-- 
Ron McKeating
Senior IT Services Specialist
Computing Services
Loughborough University
01509 222329

RE: Rule-sets

[Chris Santerre]

>
>Thanks to all the replied, we have rules_du_jour and I am now 
>getting an
>idea of how it works. I suppose the obvious question is has anybody
>written a good howto on writing your own rules. And if so where is it?
>
>Ron


see this page:
http://www.rulesemporium.com/links.htm

I need to add more. 

Chris Santerre 
System Admin and SARE Ninja
http://www.rulesemporium.com 

RE: Rule-sets

[Gray, Richard]

> > Thanks to all the replied, we have rules_du_jour and I am 
> now getting 
> > an idea of how it works. I suppose the obvious question is 
> has anybody 
> > written a good howto on writing your own rules. And if so 
> where is it?
> 

You probably also want to learn more about regular expressions too.
There
Was a lot of stuff that I didn't know before I started doing this. 

In particular, useful things like back chaining and forward referencing
are useful to understand.

I wish I could tell you I had found a good site or book about it, but I
haven't.
If you do find one, would you let me know?

HTH

R


---
This email from dns has been validated by dnsMSS Managed Email Security and is 
free from all known viruses.

For further information contact [EMAIL PROTECTED]

Re: Rule-sets

[Matthew Newton]

On Thu, Apr 07, 2005 at 11:00:52AM +0100, Ron McKeating wrote:
> On Thu, 2005-04-07 at 10:53 +0100, Matthew Newton wrote:
> > Ron,
> > 
> > On Thu, Apr 07, 2005 at 10:23:24AM +0100, Ron McKeating wrote:
> > > Thanks to all of you who replied about the job offer spams. Could
> > > anybody point at the best site for the latest rulesets and an
> > > explanation of what each one does.
> > 
> > The "main" site for rules is generally http://www.rulesemporium.com/,
> > and spefically the http://www.rulesemporium.com/rules.htm page. They
> > have descriptions for what they do. You'll also find more on
> > http://www.exit0.us/, including the RulesDuJour script at
> > http://www.exit0.us/index.php?pagename=RulesDuJour that will
> > automatically check for new rules for you.
> > 
> > I can send you the current RulesDuJour settings I am using, if you like,
> > assuming you are not already using it. You should check it yourself and
> > make sure you are happy with the rules yourself, though.
> > 
> > I still find that there are some spam messages that don't seem to be
> > covered by rules, so end up writing my own. I'm no expert, but basic
> > rule-writing isn't that hard if you can write regular expressions.
> > 
> > Matthew
> > 
> 
> Thanks to all the replied, we have rules_du_jour and I am now getting an
> idea of how it works. I suppose the obvious question is has anybody
> written a good howto on writing your own rules. And if so where is it?

http://wiki.apache.org/spamassassin/WritingRules is good. Remember to
run "spamassassin --lint" before restarting SA to make sure you haven't
made any errors. I usually score my rules with 0.1 first to see how
messages are hitting them, and then increase after a few days.

http://www.exit0.us/index.php?pagename=RulesBasics may also be useful.

The most confusing thing I originally found was the difference between
body, rawbody and raw. The exit0.us page above seems to explain that
fairly well.

Matthew


-- 
Matthew Newton <[EMAIL PROTECTED]>

UNIX and e-mail Systems Administrator, Network Support Section,
Computer Centre, University of Leicester,
Leicester LE1 7RH, United Kingdom

Re: Rule-sets

[Ron McKeating]

On Thu, 2005-04-07 at 10:53 +0100, Matthew Newton wrote:
> Ron,
> 
> On Thu, Apr 07, 2005 at 10:23:24AM +0100, Ron McKeating wrote:
> > Thanks to all of you who replied about the job offer spams. Could
> > anybody point at the best site for the latest rulesets and an
> > explanation of what each one does.
> 
> The "main" site for rules is generally http://www.rulesemporium.com/,
> and spefically the http://www.rulesemporium.com/rules.htm page. They
> have descriptions for what they do. You'll also find more on
> http://www.exit0.us/, including the RulesDuJour script at
> http://www.exit0.us/index.php?pagename=RulesDuJour that will
> automatically check for new rules for you.
> 
> I can send you the current RulesDuJour settings I am using, if you like,
> assuming you are not already using it. You should check it yourself and
> make sure you are happy with the rules yourself, though.
> 
> I still find that there are some spam messages that don't seem to be
> covered by rules, so end up writing my own. I'm no expert, but basic
> rule-writing isn't that hard if you can write regular expressions.
> 
> Matthew
> 

Thanks to all the replied, we have rules_du_jour and I am now getting an
idea of how it works. I suppose the obvious question is has anybody
written a good howto on writing your own rules. And if so where is it?

Ron
> 
-- 
Ron McKeating
Senior IT Services Specialist
Computing Services
Loughborough University
01509 222329

Re: Rule-sets

[Matthew Newton]

Ron,

On Thu, Apr 07, 2005 at 10:23:24AM +0100, Ron McKeating wrote:
> Thanks to all of you who replied about the job offer spams. Could
> anybody point at the best site for the latest rulesets and an
> explanation of what each one does.

The "main" site for rules is generally http://www.rulesemporium.com/,
and spefically the http://www.rulesemporium.com/rules.htm page. They
have descriptions for what they do. You'll also find more on
http://www.exit0.us/, including the RulesDuJour script at
http://www.exit0.us/index.php?pagename=RulesDuJour that will
automatically check for new rules for you.

I can send you the current RulesDuJour settings I am using, if you like,
assuming you are not already using it. You should check it yourself and
make sure you are happy with the rules yourself, though.

I still find that there are some spam messages that don't seem to be
covered by rules, so end up writing my own. I'm no expert, but basic
rule-writing isn't that hard if you can write regular expressions.

Matthew


-- 
Matthew Newton <[EMAIL PROTECTED]>

UNIX and e-mail Systems Administrator, Network Support Section,
Computer Centre, University of Leicester,
Leicester LE1 7RH, United Kingdom

Rule-sets

[Ron McKeating]

Thanks to all of you who replied about the job offer spams. Could
anybody point at the best site for the latest rulesets and an
explanation of what each one does.

Ron
-- 
Ron McKeating
Senior IT Services Specialist
Computing Services
Loughborough University
01509 222329

Re: Rule Sets

[Robert Menschel]

Hello J,

Wednesday, October 27, 2004, 6:29:21 AM, you wrote:

JTH> Knowing that the more rules sets you add, the longer it takes to scan a
JTH> message, what rule sets do you recommend?  I have found several sites with
JTH> sure sets such as The Rules Emporium and the SA wiki but I am certain I do
JTH> not need every rule set from those sites.

In addition to Matt's suggestions, look on the www.rulesemporium.com
site for the rule set files I've created with the names
70_sare_${whatever]0.cf -- those "file 0" files contain rules chosen
because they a) hit measurable spam, and b) hit no non-spam (at least
in our SARE mass-checks). They're the best bang for the buck in their
families.

I also have a fond place for 70_sare_specific.cf

I agree with Matt -- add these one at a time, and see how things work.
If you hit a performance wall, stop. Adding more rules makes things
worse.

If you add all of these, have plenty of resources left, and still
significant spam getting through, then add in the {whatever}1 file
rules.

Bob Menschel

Re: Rule Sets

[Matt Kettler]

At 08:29 AM 10/27/2004 -0500, you wrote:
Knowing that the more rules sets you add, the longer it takes to scan a
message, what rule sets do you recommend?  I have found several sites with
sure sets such as The Rules Emporium and the SA wiki but I am certain I do
not need every rule set from those sites.
For what little it's worth, this is my general advice on improving hit 
rations (covers add-on modules and rulesets). Bear in mind this is just my 
advice, and I'd really suggest trying things out one-at-a-time so you know 
how well each works for you:

1) Make sure you have Net::DNS installed, this is an optional perl module, 
but it allows the RBLs and SURBL checks to run.
(If you run spamassassin --lint -D you can watch SA test for DNS 
functionality.)

2) I've grown to like DCC quite a bit, but never trust it entirely. It does 
FP, but this is rarely a problem if you don't jack the score up.

3) Same goes for Razor. Just make sure it's 2.61 or better.
4) I really like the "Random" rules from rulesemporium.com. Not very high 
hit rate, but very good S/O on these.

5) feed your bayes DB as much fresh meat as you can (if you can).
For those with 2.6x versions I add antidrug, backhair and surbl to my 
recommendations, but 3.0 comes with these.  

Rule Sets

[J Thomas Hancock]

Knowing that the more rules sets you add, the longer it takes to scan a
message, what rule sets do you recommend?  I have found several sites with
sure sets such as The Rules Emporium and the SA wiki but I am certain I do
not need every rule set from those sites.

Thank you,
Tom