Re: Clearly bogus false positives -- on "abuse" contact point, no less

2008-02-17 Thread Philip Prindeville
Matt Kettler wrote: Philip Prindeville wrote: Matt Kettler wrote: Philip Prindeville wrote: Depends on whether you equate bare domains with URL's, I suppose. If MUA's equate them with URLs, spammers will use this, and SpamAssassin will use it. There is only so much braindea

Re: SVN notifications killing spamassassin

2008-02-17 Thread Philip Prindeville
L by the most ignorant of UA's")... something requiring a protocol name (ftp:, http:, tftp:, etc.), a domain name, and a path name (even if it's just slash). Or at the very least, to score complete URL's higher than just domain names alone. -Philip

Re: Clearly bogus false positives -- on "abuse" contact point, no less

2008-02-17 Thread Philip Prindeville
Matt Kettler wrote: Philip Prindeville wrote: Karsten Bräckelmann wrote: Please, do not paste a gigantic blob of multipart MIME messages. Put it up somewhere, raw, and simply provide a link. On Sat, 2008-02-16 at 18:44 -0800, Philip Prindeville wrote: Anyway, I have no idea why I'm s

Re: Clearly bogus false positives -- on "abuse" contact point, no less

2008-02-16 Thread Philip Prindeville
Karsten Bräckelmann wrote: Please, do not paste a gigantic blob of multipart MIME messages. Put it up somewhere, raw, and simply provide a link. On Sat, 2008-02-16 at 18:44 -0800, Philip Prindeville wrote: Anyway, I have no idea why I'm seeing some of these scores. URL matches when

Clearly bogus false positives -- on "abuse" contact point, no less

2008-02-16 Thread Philip Prindeville
iki for some of these, but couldn't find descriptions. What should I do? Just block their domain? I don't want to deal with their misconfiguration issues. -Philip Received: from localhost (localhost) by mail.redfish-solutions.com (8.14.1/8.14.1) id m1H2M5XP027602;

Re: help

2007-11-13 Thread Philip Prindeville
ment the ineffectual ones you're now using. ;-) -Philip Kim Hurlbutt wrote: Wondering if you can point me in the right direction on how to make our spam scores lower. How can I get information on how to make edits to our pages to lower our scores? We currently use Kintera to send our e

US Senate as "bad internet citizens"???

2007-11-13 Thread Philip Prindeville
it was asking too much to have meaningful legislation on "net neutrality" (or digital rights, or copyright reform, etc) come from Washington D.C. Perhaps in 50 years they'll finally have a handle on it. But I dared to hope... -Philip

Re: How to filter messages from this list?

2007-11-06 Thread Philip Prindeville
as-Attach: X-MS-TNEF-Correlator: Thread-Topic: Chuckle Thread-Index: AcfzukOHakkCi8HDRJ2nEhvQOY8RZgACopXw References: <[EMAIL PROTECTED]> From: "John Doe" <[EMAIL PROTECTED]> To: "Philip Prindeville" <[EMAIL PROTECTED]> X-OriginalArrivalTime: 10 Sep 2007 16:10:40.0

Re: It's a fine line...

2007-11-06 Thread Philip Prindeville
o mail to the abuse mailbox to see if it gets delivered, and then if it bounced, mail to the OrgTech mailbox instead... because that's too much wasted time... So you To: the abuse mailbox on the odd chance that it exists, and you Bcc: the "noc" mailbox (or the "hostmaster" or whatever) as a fallback address. -Philip

Re: It's a fine line...

2007-11-06 Thread Philip Prindeville
cultural imperialism. Bests, Olivier That's a fairly specious argument. -Philip

Re: It's a fine line...

2007-11-05 Thread Philip Prindeville
me countries enforce anti-spam, anti-trespass laws. Others lack them or don't enforce them. When these countries put some teeth into the enforcement of their laws, then they will stop being blacklisted. -Philip

Re: It's a fine line...

2007-11-05 Thread Philip Prindeville
John D. Hardin wrote: On Mon, 5 Nov 2007, Steven Kurylo wrote: Philip Prindeville wrote: Between the truly clueless administrator, and those that feign ignorance to cover up their implicit approval of spammers... What do you do in the case where someone is filtering deliveries to

Re: It's a fine line...

2007-11-05 Thread Philip Prindeville
Steven Kurylo wrote: Philip Prindeville wrote: Between the truly clueless administrator, and those that feign ignorance to cover up their implicit approval of spammers... What do you do in the case where someone is filtering deliveries to their "abuse" mailbox? (Like 99% of mail

It's a fine line...

2007-11-05 Thread Philip Prindeville
Between the truly clueless administrator, and those that feign ignorance to cover up their implicit approval of spammers... What do you do in the case where someone is filtering deliveries to their "abuse" mailbox? (Like 99% of mail sent there isn't going to score positively...) Sigh.

Re: OT: Motivating good behavior from negligent ISP's

2007-07-11 Thread Philip Prindeville
Phil Barnett wrote: On Wednesday 11 July 2007, Philip Prindeville wrote: Michele Neylon :: Blacknight wrote: Philip Prindeville wrote: No joy. How long ago did you report it? Which time? It happens regularly, and it's been going on over a

Re: OT: Motivating good behavior from negligent ISP's

2007-07-11 Thread Philip Prindeville
Michele Neylon :: Blacknight wrote: Philip Prindeville wrote: No joy. How long ago did you report it? Which time? It happens regularly, and it's been going on over a month. Ok. That changes things, but you didn't say anything in your post about it going on for a month

Re: OT: Motivating good behavior from negligent ISP's

2007-07-11 Thread Philip Prindeville
Michele Neylon :: Blacknight wrote: Philip Prindeville wrote: We're seeing a lot of unwanted attempts to relay traffic through our site by Orange.fr, and we've reported this to their Abuse contact as well as their upstream provider (rain.fr): Jul 11 11:30:37 mail mimedefang.pl[316

OT: Motivating good behavior from negligent ISP's

2007-07-11 Thread Philip Prindeville
BL site (or as appropriate) to get them listed on until they start "playing well with others"? Would the FAQ's "Reporting Spam" section be a good place to mention the various sites that you can rat out offenders? Thanks, -Philip

Re: ldap: failed to load user scores from LDAP server

2007-07-06 Thread Philip S. Hempel
d. I looked and found that yes schema is used in perl net ldap but I would assume if your going to use uri::ldap to parse the uri it needs to follow uri::ldaps requirements. I could be wrong, but it seems that the change made from 3.1 to 3.2 has been implemented wrong. Is Net::LDAP::Schema what should be used for getting the schema instead? Thanks Philip S. Hempel

ldap: failed to load user scores from LDAP server

2007-06-20 Thread Philip S. Hempel
ry little. Really nothing related to spamassasin and ldap. Thanks. Philip S. Hempel

Re: KANA damage and locales

2007-05-07 Thread Philip Prindeville
Philip Prindeville wrote: > I'm looking at the headers I just got from a Canadian > ISP's autoresponder I guess the software is called > "KANA". Anyone know who owns this? (Yes, "someone > not very clueful", I know... let's be more specific th

KANA damage and locales

2007-05-05 Thread Philip Prindeville
Ironically, KANA is supposed to track Spam (and other service) tickets... but it just ends up muddying the waters by potentially creating more incidents of Spam. Quelle folie. -Philip

OT: Dealing w/ poor network citizens like Yahoo!

2007-04-19 Thread Philip Prindeville
From: "Monster.com" <[EMAIL PROTECTED]> X-Mailer: Microsoft Outlook, Build 10.0.2627 Reply-To: "Monster.com" <[EMAIL PROTECTED]> X-Priority: 3 (Normal) Message-ID: <[EMAIL PROTECTED] To: Philip Prindeville <[EMAIL PROTECTED]> Subject: Money-Investment Mime

Re: whitelist_from ip_range

2007-04-19 Thread Philip Prindeville
d ips as trusted_networks > Given the number of ISP's that don't have rDNS configured, whitelist_from_rcvd should probably be extended to support IP/CIDR addresses as well... Let's not overload the meanings of trusted_networks and internal_networks. These latter two are already confusing enough for most newbies without having them take on additional unintended meanings. -Philip

[Mimedefang] Adding new From: variable

2007-04-11 Thread Philip Prindeville
e a bug for the enhancement? -Philip

Tutorial for setting up a spamassassin mailfilter? (No local mailboxes except spamtrap)

2007-04-09 Thread Philip Seccombe
rd so mail.abcltd.com goes to our spamassassin filters ip address. Email to @abcltd.com goes to our spam filter, it checks it, if its spam it saves it in a local mailbox, if its ham it forwards it to ABC Ltd's server. Kind Regards, Philip Seccombe Turnstone Technologies NZ Limited Phone:

RE: spam mails bypassing spamassassin?

2007-02-23 Thread Philip Seccombe
I take it your saving your email on the same server that does the spam filtering? Only other thing I could think of if this is not the case is email being sent directly to your mail server via secondry mx records or something. I run a server which filters mail for clients which is what made me th

RE: FuzzyOcr - no image files found in samples?

2007-02-13 Thread Philip Seccombe
ind Regards, Philip Seccombe Turnstone Technologies NZ Limited Phone: +64 9 970 5550 Fax: +64 9 970 5559 DDI: +64 9 970 5552 Email: [EMAIL PROTECTED] Web: www.turnstone.co.nz -Original Message- From: Steve Pfister [mailto:[EMAIL PROTECTED] Sent: Wednesday, 14 February 2007 10:51 a.m.

RE: SpamAssassin using spamc but not using rules correctly? Is my time being wasted changing local.cf etc?

2007-02-12 Thread Philip Seccombe
users@spamassassin.apache.org Subject: Re: SpamAssassin using spamc but not using rules correctly? Is my time being wasted changing local.cf etc? On Tue, Feb 13, 2007 at 11:42:22AM +1300, Philip Seccombe wrote: > Hi everyone, > > > > I've taken over a mail server from a previous techn

RE: Blocking MMS messages?

2007-02-12 Thread Philip Seccombe
TECTED] or something? Kind Regards, Philip Seccombe Turnstone Technologies NZ Limited Phone: +64 9 970 5550 Fax: +64 9 970 5559 DDI: +64 9 970 5552 Email: [EMAIL PROTECTED] Web: www.turnstone.co.nz -Original Message- From: Steve Monkhouse [mailto:[EMAIL PROTECTED] Sent: Tuesday, 13 February

SpamAssassin using spamc but not using rules correctly? Is my time being wasted changing local.cf etc?

2007-02-12 Thread Philip Seccombe
sa_fast) { while ($si < $sa_score) { $si++; $sa_level .= $sa_symbol; } } } $stop_spamassassin_time=[gettimeofday]; $spamassassin_time = tv_interval ($start_spamassassin_time, $stop_spamassassin_time); &debug("spamassassin: finished scan

RE: How to block yahoogroups?

2007-02-11 Thread Philip Seccombe
Can you blacklist @ returns.groups.yahoo.com and then whitelist [EMAIL PROTECTED] or something? I'm not sure how the yahoo groups work, but is the reply address specific to each group or does it get sent from the person to the group address like this list? Kind Regards, Philip Sec

RE: A New Approach: Find the Ham

2007-02-11 Thread Philip Seccombe
Apologies if this has been answered before or anything, but where/how are you generating those stats? I'm not using SA with SQL so I'm not sure if it will work for me, but those I like! Stats in question: http://www.blue-canoe.com/stats/index.php?D1=11 Kind Regards, Philip Seccombe

RE: sa-update gives error message Insecure dependency in open while running with -T switch

2007-02-08 Thread Philip Seccombe
newest version. 0 upgraded, 0 newly installed, 0 to remove and 38 not upgraded. nibbler:/etc/init.d# If apt-get will not install it, how do I upgrade it properly? Kind Regards, Philip Seccombe Turnstone Technologies NZ Limited Phone: +64 9 970 5550 Fax: +64 9 970 5559 DDI: +64 9 970 5552 Email

RE: sa-update gives error message Insecure dependency in open while running with -T switch

2007-02-08 Thread Philip Seccombe
.77). Term::ReadKey is up to date (2.30). Term::ReadLine::Perl is up to date (1.0302). YAML is up to date (0.62). Text::Glob is up to date (0.07). CPAN is up to date (1.8802). File::Which is up to date (0.05). nibbler:~# And there's just nothing happening Kind Regards, Philip Seccombe Turnstone

RE: sa-update gives error message Insecure dependency in open while running with -T switch

2007-02-08 Thread Philip Seccombe
have any parameters you want to pass to the calls, please specify them here. Parameters for the 'perl Build.PL' command? Typical frequently used settings: --install_base /home/xxx # different installation directory Your choice: [] Oops :s Kind Regards, Philip Secc

RE: sa-update gives error message Insecure dependency in open while running with -T switch

2007-02-08 Thread Philip Seccombe
bjects with matching identifiers. nibbler:~# Kind Regards, Philip Seccombe Turnstone Technologies NZ Limited Phone: +64 9 970 5550 Fax: +64 9 970 5559 DDI: +64 9 970 5552 Email: [EMAIL PROTECTED] Web: www.turnstone.co.nz -Original Message- From: Doc Schneider [mailto:[EMAIL PROTECT

sa-update gives error message Insecure dependency in open while running with -T switch

2007-02-08 Thread Philip Seccombe
tion passed, installing update [9013] dbg: channel: updating MIRRORED.BY contents [9013] dbg: channel: cleaning out update directory [9013] dbg: channel: extracting archive Insecure dependency in open while running with -T switch at /usr/lib/perl/5.8/IO/File.pm line 70. Kind Regards, Phi

Training Bayes ham messages when they are sent out of the server

2007-02-06 Thread Philip Seccombe
e of squirrelmail to look like a spam filter release but its far from ideal, does anyone know of any templates for squirrelmail or have they developed any? Kind Regards, Philip Seccombe Turnstone Technologies NZ Limited Phone: +64 9 970 5550 Fax: +64 9 970 5559 DDI: +64 9 970 5552 Ema

Using whitelist_from_rcvd when there's no rDNS

2006-12-11 Thread Philip Prindeville
their email. Thanks, -Philip

This seen on Dice

2006-12-08 Thread Philip Prindeville
Any takers? ;-) http://seeker.dice.com/seeker.epl?rel_code=1102&op=5&type=14&dockey=xml/7/a/[EMAIL PROTECTED]&bb=0&source=15

This seen on Dice

2006-12-08 Thread Philip Prindeville
Any takers? ;-) http://seeker.dice.com/seeker.epl?rel_code=1102&op=5&type=14&dockey=xml/7/a/[EMAIL PROTECTED]&bb=0&source=15

Re: Interesting text content in the new spams

2006-11-23 Thread Philip Prindeville
Poor choice of words. Not a virus. A vaccine. ;-) -Philip Justin Mason wrote: >er, it's illegal, and we're not criminals like they are? ;) > >--j. > >Philip Prindeville writes: > > >>Given that spammers read this list to figure out how to defeat us...

Re: Interesting text content in the new spams

2006-11-23 Thread Philip Prindeville
Given that spammers read this list to figure out how to defeat us... Why don't we just secure a copy of ratware and engineer a retro-virus for it? -Philip Justin Mason wrote: >there was a very interesting project described in CEAS which did >just this -- engaged 419ers and other

Re: Interesting text content in the new spams

2006-11-23 Thread Philip Prindeville
tware Ostg Source Group in >all Rights. >Latest a News new or Graphics and Sprites Release archive. Va >Software Ostg Source Group in all Rights. >Intended Audience Education.""" > >-- > > I hear the New York Times isn't too picky about who they hire. Someone could create an army of ghost writers and sit back and collect the paychecks. -Philip

List weirdness

2006-11-23 Thread Philip Prindeville
this a lurking ratware writer? Who on this list runs Exchange? Why is this bouncing back to me, and not the envelope sender, which was: Return-Path: <[EMAIL PROTECTED]> -Philip --- Begin Message --- Subject of the message: Redundant QP encoding of Subject/From fields... Rec

Re: Braindeath in the Navy

2006-11-23 Thread Philip Prindeville
Jonas Eckerman wrote: >Philip Prindeville wrote: > > > >>Received: (private information removed) >> >> > > > >>It just boggles my mind why anyone would go through that much trouble >>to deliberately damage a header line, rather than just

Re: Greylisting

2006-11-22 Thread Philip Prindeville
Don't they? I thought the recommended retry time was 2 minutes, doubling on each failure, and maxing out at 2 hours. That's what sendmail does (unless it's retry time has been explicitly set to more than 2 hours, of course). -Philip Richard Frovarp wrote: >I don't thi

Braindeath in the Navy

2006-11-21 Thread Philip Prindeville
including the definition of CFWS in 3.2.3.] It just boggles my mind why anyone would go through that much trouble to deliberately damage a header line, rather than just delete it. Well, maybe they'll get a whiff of the errs of their ways in the Hall of Spam Shame... -Philip

Re: Greylisting

2006-11-21 Thread Philip Prindeville
y limit how many sites they hit before they get shut down. Of course, graylisting a larger value (2 hours) for totally unknown correspondents would be more effective. -Philip

Redundant QP encoding of Subject/From fields...

2006-11-21 Thread Philip Prindeville
ere are no non-USASCII characters in either field. Hence, specifying =?iso-8859-1?Q? is not necessary. The test SUBJECT_EXCESS_QP seems to handle this (at least the Subject: part). I'd like to crank it up to 3.5 or higher. Any intuitive reasons why this wouldn't work? Are there any valid mailers that are braindead? Thanks, -Philip

Re: ??

2006-11-21 Thread Philip Prindeville
, Pound Sterling, Trademark, etc. Plus, there are words in English that when properly written do contain accents, such as resume, dais, cliche, cooperation, etc. Excluding words with pounds and yen in the Subject line might be a good thing, however... -Philip

Accurately deprecating charsets

2006-11-17 Thread Philip Prindeville
I'll ask again... Can someone who handles a fair mix of email content (i.e. not just western European languages) do a triage (individually) of the rules below for ham versus spam? I'd suspect that very little genuine ham contains "IBM852" or "Unicode" or "CP12[

Re: ????? ??? ??????

2006-11-16 Thread Philip Prindeville
g Hamann > > You're right! The rendering system does need to be pretty smart. Unfortunately, few of them are. But that's still no excuse to lobotomize character encodings. The least offensive of all solutions would have been to create a throw-away non-rendering character, like the non-break space, that says, "glue these two together as a ligature". It would waste a lot less of an already limited encoding space, too. -Philip

Re: ????? ??? ??????

2006-11-16 Thread Philip Prindeville
You'd think, wouldn't you???? -Philip Robert Nicholson wrote: > This is Japanese > > # Japanese: Peter Evans writes: iso-2022-jp = rfc approved, rfc 1468, > created > # by Jun Murai in 1993 back when he didnt have white hair! rfc > approved. > # (rfc 2237

Re: ????? ??? ??????

2006-11-16 Thread Philip Prindeville
ss. Just out of curiosity, what are the charsets_for_locale{'en'} anyway? If it were up to me, I'd limit it to USASCII, ISO-8859-1, and UTF-8. Period. Likewise, for Japanese, how many UA's use anything other than ISO2022JP? This is the blessed standard. Anything

Re: Microsoft blacklisted?

2006-11-14 Thread Philip Prindeville
John D. Hardin wrote: >On Tue, 14 Nov 2006, Daryl C. W. O'Shea wrote: > > > >>Philip Prindeville wrote: >> >> >> >>>whitelist_from_rcvd [EMAIL PROTECTED] mail1.microsoft.com >>>whitelist_from_rcvd [EMAIL PROTECTED] smt

Re: Microsoft blacklisted?

2006-11-14 Thread Philip Prindeville
SM wrote: >At 11:49 14-11-2006, Philip Prindeville wrote: > > >>The problem with this is that the DNS returns the response (of the multiple >>PTR records) in no particular order, so looking up the rDNS can return >>one of three different names... >> >&

Re: Microsoft blacklisted?

2006-11-14 Thread Philip Prindeville
SM wrote: >At 18:56 13-11-2006, Philip Prindeville wrote: > > >>I recently saw an email get bounced that was legitimately coming >> >> >>from Microsoft: > >[snip] > > > > >>I've put into my spamassassin/sa-mimedefang.

Re: Microsoft blacklisted?

2006-11-13 Thread Philip Prindeville
Matt Kettler wrote: >Philip Prindeville wrote: > > >>I recently saw an email get bounced that was legitimately coming >>from Microsoft: >> >>Nov 13 14:59:26 mail mimedefang.pl[19053]: helo: maila.microsoft.com >>(131.107.115.212) said "helo smtp.mi

Microsoft blacklisted?

2006-11-13 Thread Philip Prindeville
be maila.microsoft.com instead? And what do DNS_FROM_RFC_ABUSE and DNS_FROM_RFC_POST correspond to? Where do I get the descriptions of these tests, why some sites get tagged with them, etc? -Philip

Re: פריצת דרך מאתגרת

2006-11-13 Thread Philip Prindeville
H_WIN1252) describe WIN_CHARSETContent-Type is Windows-specific text score WIN_CHARSET 0.01 -Philip Robert Nicholson wrote: >You may have misunderstand but that's the point. > >The message was _not_ being filtered out like it should be and that >

Re: Can't upgrade w/ RPM

2006-11-02 Thread Philip Prindeville
Jim Maul wrote: >Philip Prindeville wrote: > > >>Hi. >> >>I'm running FC3 on an AMD64 platform for my mail server, >>and I had last installed SpamAssassin 3.1.5. Well, I grabbed the >>tarball for 3.1.7, and did a "rpmbuild -tb ..." of the t

Can't upgrade w/ RPM

2006-11-02 Thread Philip Prindeville
86_64/perl-Mail-SpamAssassin-3.1.7-1.x86_64.rpm error: Failed dependencies: perl-Mail-SpamAssassin = 3.1.5-1 is needed by (installed) spamassassin-3.1.5-1.x86_64 any ideas why this is happening and what the fix is? -Philip

Re: Image spams getting thru

2006-10-30 Thread Philip Prindeville
I tried to use Compress::LZW to decompress the stream, but that only seems to work on 12 or 16 bit minimum codesize, whereas GIF images are routinely 4, 6, or 8 bits long. Does anyone have a handle on what Perl modules to use for dissecting GIF objects? Thanks, -Philip

Re: How to whitelist_from <> ?

2006-10-19 Thread Philip Prindeville
Matt Kettler wrote: >Philip Prindeville wrote: > > >>Matt Kettler wrote: >> >> >> >> >>>Philip Prindeville wrote: >>> >>> >>> >>> >>> >>>&

Re: How to whitelist_from <> ?

2006-10-19 Thread Philip Prindeville
Matt Kettler wrote: >Philip Prindeville wrote: > > >>There's no way to whitelist just the empty address then? Rather than >>everything? >> >>-Philip >> >> >> >> >Not given the simple file-glob format of the whitelist comm

Re: How to whitelist_from <> ?

2006-08-25 Thread Philip Prindeville
Matt Kettler wrote: >Philip Prindeville wrote: > > >>There's no way to whitelist just the empty address then? Rather than >>everything? >> >>-Philip >> >> >> >> >Not given the simple file-glob format of the whitelist comm

Re: How to whitelist_from <> ?

2006-08-24 Thread Philip Prindeville
Matt Kettler wrote: >Philip Prindeville wrote: > > >>> >>> >>> >>Well, yes, especially since the IP address of the sender is reserved for >>a machine that does ticketing and auto-replies exclusively (I was going >>

Re: How to whitelist_from <> ?

2006-08-23 Thread Philip Prindeville
John D. Hardin wrote: >On Wed, 23 Aug 2006, Philip Prindeville wrote: > > > >>Hmm Maybe if I post with a more obvious subject line >> >>What is the notation for writing a "whitelist_from" or >>"whitelist_from_rcvd" when the sender

How to whitelist_from <> ?

2006-08-23 Thread Philip Prindeville
Hmm Maybe if I post with a more obvious subject line What is the notation for writing a "whitelist_from" or "whitelist_from_rcvd" when the sender is <> ? (As in "MAIL FROM: <>") Thanks, -Philip Philip Prindeville wrote: >Well, I have

Broken abuse auto-responders

2006-08-22 Thread Philip Prindeville
Well, I have the following issue. When I report abuse to [EMAIL PROTECTED], they send me back an auto-generated email ticket with a broken Date: on it (honestly, people, how hard is it to correctly format the date???). They do this as <> for the sending address. How does one go about writing a "

Re: Rejection text

2006-07-19 Thread Philip Prindeville
SPAM is invalid? > >(I had a user who had a 3rd party program that he'd do that with - I >asked him to stop because when he'd do it, it'd bog down my email >with "invalid recipient" type emails since the person he >was "notifying" was an invalid address). > > Thankfully there are fewer open relays each day, and hence if you reject the message as it's being sent, then the sender is the spammer, and he will know he is failing. With any luck, he might even remove you from the list of addresses that he will try to spam in the future. -Philip

Whitelisting abuse and <>

2006-07-19 Thread Philip Prindeville
What are the steps to whitelist email sent from <> (i.e. Postmaster when bouncing mail) or [EMAIL PROTECTED] Thanks, -Philip

Does SpamAssassin support SPF?

2006-07-01 Thread Philip Mak
Does SpamAssassin support SPF record checking? Or is this something I have to patch into my incoming SMTP server?

Re: On bichromatic GIF stock spam

2006-07-01 Thread Philip Prindeville
I did a trivial test for alternative and gif, and it didn't pan out very >well. Will need some additional conditions to make it more usable. > >Loren > > > What Perl modules are there that can process (decode, perform certain inspections and histogram analysis, etc) of GIF files? I'd like to throw something together... -Philip

Re: On bichromatic GIF stock spam

2006-06-25 Thread Philip Prindeville
John D. Hardin wrote: >On Sun, 25 Jun 2006, Philip Prindeville wrote: > > > >>John D. Hardin wrote: >> >> >> >>>On Sat, 24 Jun 2006, Philip Prindeville wrote: >>> >>> >>> >>>>The spammers send mul

Re: On bichromatic GIF stock spam

2006-06-25 Thread Philip Prindeville
John D. Hardin wrote: >On Sat, 24 Jun 2006, Philip Prindeville wrote: > > > >>the text and the images. The spammers send multipart/alternative >>because they want the text/plain section to confuse the Bayes >>filters, since they know it won't be rendered.

Re: On bichromatic GIF stock spam

2006-06-24 Thread Philip Prindeville
much of the above would be absolutely necessary, but I >suspect at least some of it is. Still, this is a fairly trivial sort of >thing to have to accumulate. Expecially since all spam (at least currently) >uses gifs, which a blind man can decode with a hair comb - no fancy software >required. > >Loren > > Yup. Exactly. -Philip

Re: On bichromatic GIF stock spam

2006-06-24 Thread Philip Prindeville
Michael Scheidell wrote: >>-Original Message- >>From: Philip Prindeville [mailto:[EMAIL PROTECTED] >>Sent: Saturday, June 24, 2006 2:10 PM >>To: users@spamassassin.apache.org >>Subject: On bichromatic GIF stock spam >> >> >>I get a lot o

On bichromatic GIF stock spam

2006-06-24 Thread Philip Prindeville
ely, which hosts a lot of the lists that I read... -Philip

Re: Adding Phishing Link rule

2006-06-24 Thread Philip Prindeville
. ;-) I.e. that at a minimum the host portions of the URL and the label for the link would have to match... If the sender REALLY needs to have the link reside somewhere else, they could always have the published address send a Location: response that redirects you to the eventual resting place

Re: how do reject email with ....

2006-06-08 Thread Philip Prindeville
document them. -Philip Screaming Eagle wrote: >I getting this type of spam: > > Return-Path: <[EMAIL PROTECTED]> > X-Spam-Checker-Version: SpamAssassin 3.1.0 (2005-09-13) on > X-Spam-Virus: No > X-Spam-Status: No, score=1.4 required=8.0 tests=BAYES_50,HTML_30_40, >

Bad quoting

2006-06-08 Thread Philip Prindeville
I noticed the following message (well, I'll just put a fragment): Note that the '=' got escaped as '=3D' they probably entered the text and their HTML editor escaped it, not figuring it was raw HTML being entered directly... -Philip

Blacklist of phone numbers?

2006-06-03 Thread Philip Mak
Is there a blacklist of phone numbers? A lot of diploma spam I get has totally different message bodies, except they list the same phone number to call.

Clarifying internal_networks

2006-05-31 Thread Philip Prindeville
or port 465 (and not the typical usage of submitting messages via a pipe into an exec'd sendmail process on the same machine, etc). If I have a network 192.168.1.0/24, and I have workstations at 10-25 that submit email, should I just have: internal_networks 192.168.1.0/24 Thanks, -Philip

Lots of this kind of spam getting through

2006-05-27 Thread Philip Mak
I'm getting about 50+ per day of these spams not being caught by SpamAssassin (SpamAssassin version 3.1.1 running on Perl version 5.8.4). There's two types: 1. Lose weight type spam, uses bad English e.g. "yrs" instead of "years", "u" instead of "you", "ur" instead of "your", talks about not havin

Re: Crosspost: [Mimedefang] Using per-list SA policies

2006-05-26 Thread Philip Prindeville
Kai Schaetzl wrote: Philip Prindeville wrote on Fri, 26 May 2006 13:32:10 -0600: Except that developers aren't vetted in any particular way. vetted? You can sign yourself up for most lists, if you have a valid address and a web browser. You have to try to get you

Re: Crosspost: [Mimedefang] Using per-list SA policies

2006-05-26 Thread Philip Prindeville
jdow wrote: From: "Philip Prindeville" <[EMAIL PROTECTED]> are fired... And you might have a specific set of rules for a list like alsa-devel (the 'L' in ALSA is for Linux, so it might be reasonable to assume that no one will be posting with charset='window

Re: Crosspost: [Mimedefang] Using per-list SA policies

2006-05-26 Thread Philip Prindeville
Kai Schaetzl wrote: Philip Prindeville wrote on Fri, 26 May 2006 11:26:33 -0600: No, it's to a list. At the list exploder, we want to be able to apply certain per-list policies. For instance, for most lists (but not all), the following would be applicable: I don't use

Re: Crosspost: [Mimedefang] Using per-list SA policies

2006-05-26 Thread Philip Prindeville
rhaps especially if it's MS, since they're big enough to have adequate personnel and resources to know better) should be spanked. Otherwise, it won't get fixed. As I remember, setting the default codepage in Windows to be ISO-8859-1 system-wide isn't that hard. -Philip

Crosspost: [Mimedefang] Using per-list SA policies

2006-05-25 Thread Philip Prindeville
Well, I didn't get any responses on the MDF mailing list, so I was wondering if SA was the better angle to be coming at this with. Thanks, -Philip --- Begin Message --- I was wondering... Since MdF can be used to invoke SA, and it can extract information from the headers such as

Re: Filtering windows-1252 charset

2006-05-22 Thread Philip Prindeville
Kai Schaetzl wrote: Philip Prindeville wrote on Thu, 18 May 2006 08:47:48 -0600: How legitimate is email sent as windows-1252? Very, because broken Windows clients use it. Kai Ah, the "Strong Arm school of standards enforcement." ;-) -Philip

Re: Filtering windows-1252 charset

2006-05-18 Thread Philip Prindeville
e in the Unix world (or more broadly, not in the Windows world), why would you want to use vendor-specific encodings for no reason other than they're the broken defaults Microsoft chose to use? -Philip

Re: ALL_TRUSTED causing false negatives?

2006-05-10 Thread Philip Mak
On Wed, May 10, 2006 at 04:47:40PM -0400, Matt Kettler wrote: > Philip Mak wrote: > > Why does ALL_TRUSTED have a score of -3.3? Doesn't this mean that any > > spammer who connects directly to my mail server has a good chance of > > getting past SpamAssassin? >

ALL_TRUSTED causing false negatives?

2006-05-10 Thread Philip Mak
I've been getting a lot of spam lately ever since I moved my mail server to a new system. Here's one of the false negatives that slipped through, for example: X-Spam-Status: No, score=-2.1 required=5.0 tests=ALL_TRUSTED,BAYES_50, NO_REAL_NAME,RCVD_BY_IP,YOUR_INCOME autolearn=ham

Re: Russian Spam

2006-04-14 Thread Philip Prindeville
Are you running Mimedefang? It might be a start. We block email from subscriber addresses at networks that are known to be large sources of spam. See: http://www.mimedefang.org/kwiki/index.cgi?PhilipsWorkingFilter in particular, how %bad_tld's is used. -Philip Kristopher Austin wrote

Re: xxxl spam

2006-04-14 Thread Philip Prindeville
m since Outlook prefers MIME content. If anyone wants to talk to us, they can stick with ISO Latin-1. We don't need no stinkin' Windows-125x... (or -839 for that matter). -Philip

Re: Non-English languages

2006-04-13 Thread Philip Prindeville
>adult, what do you recommend for accomplishing that? > > > Same here. I took a couple years of high school Spanish in California and Comic books. Or "bande dessinee" as it's called in French. The story lines are often simple, and the pictures give a lot of context to what is being talked about. -Philip

Haven't seen this one before... "Premature padding of base64 data"

2006-04-13 Thread Philip Prindeville
Hmmm. Already a rule for that. Good... -Philip

<    1   2   3   4   >