Re: The www[variations]continue....

2009-07-17 Thread Michelle Konzack
Am 2009-07-17 09:46:28, schrieb Ben:
 Dan,
 
 Thanks for the rules.
 
 I am using AE_MED42 from a previous thread, is this AE_MED44 meant 
 to replace this or work in addition to it?
 
 Also just curious, why the low score?  With the default required hits of 
 5.0 and this in my setup being the only rule to hit it would not be 
 tagged as spam.  Am i missing something or have you lowered your 
 required hits?

I have scored it with 10.00 because the stupid AWL which scores  in  30%
of all cases with -5.00.

Thanks, Greetings and nice Day/Evening
Michelle Konzack
Systemadministrator
Tamay Dogan Network
Debian GNU/Linux Consultant


-- 
Linux-User #280138 with the Linux Counter, http://counter.li.org/
# Debian GNU/Linux Consultant #
Michelle Konzack   c/o Shared Office KabelBW  ICQ #328449886
+49/177/9351947Blumenstasse 2 MSN LinuxMichi
+33/6/61925193 77694 Kehl/Germany IRC #Debian (irc.icq.com)


signature.pgp
Description: Digital signature


Re: The www[variations]continue....

2009-07-17 Thread Justin Mason
On Fri, Jul 17, 2009 at 09:45, Michelle
Konzacklinux4miche...@tamay-dogan.net wrote:
 Am 2009-07-17 09:46:28, schrieb Ben:
 Dan,

 Thanks for the rules.

 I am using AE_MED42 from a previous thread, is this AE_MED44 meant
 to replace this or work in addition to it?

 Also just curious, why the low score?  With the default required hits of
 5.0 and this in my setup being the only rule to hit it would not be
 tagged as spam.  Am i missing something or have you lowered your
 required hits?

 I have scored it with 10.00 because the stupid AWL which scores  in  30%
 of all cases with -5.00.

sounds like you should turn off the AWL?

--j.


20_sought.cf from http://yerp.org/rules/stage/ empty

2009-07-17 Thread Robert Brooks

did this ruleset get discontinued? I have...

# Note: rule names are based on a hash of the content pattern.

meta JM_SOUGHT_1   (0)
score JM_SOUGHT_1  0
describe JM_SOUGHT_1  Body contains frequently-spammed text patterns


Opt In Spam

2009-07-17 Thread twofers
Neil Rocks !
 
Thanks Neil.
 
Wes

--- On Thu, 7/16/09, Neil Schwartzman neil.schwartz...@returnpath.net wrote:


From: Neil Schwartzman neil.schwartz...@returnpath.net
Subject: Re: Opt In Spam
To: twofers twof...@yahoo.com, Spamassassin 
users@spamassassin.apache.org
Date: Thursday, July 16, 2009, 1:29 PM


FOLLOW-UP:

A process was hung on one of the 20 hives serving the whitelists and
reported this IP as being listed. We've restarted the process and it is
no longer reporting incorrectly.


On 16/07/09 8:05 AM, Neil Schwartzman neil.schwartz...@returnpath.net wrote:


Now, I am aware that we recently changed the DNS hives serving up Safe (aka
safelist aka Habeas) and I'm wondering if there is a glitch between SA and
our lists. I don't know.

I expect I need to take this up with the developer team, and bump it to
someone else over here. I've also BCCed our contacts at SA for clarification

-- 
Neil Schwartzman
Director, Certification Security  Standards
Return Path Inc.
0142002038




  

Re: The www[variations]continue....

2009-07-17 Thread Benny Pedersen

On Fri, July 17, 2009 11:14, Justin Mason wrote:
 I have scored it with 10.00 because the stupid AWL which scores  in  30%
 of all cases with -5.00.

score AWL 10

?

perldoc Mail::SpamAssassin::Plugin::AWL

see factor

 sounds like you should turn off the AWL?

it works for me :)

-- 
xpoint



Re: 20_sought.cf from http://yerp.org/rules/stage/ empty

2009-07-17 Thread Benny Pedersen

On Thu, July 16, 2009 16:06, Robert Brooks wrote:
 did this ruleset get discontinued? I have...

nope still active, you just got a dynamic file without any seeks

-- 
xpoint



Re: 20_sought.cf from http://yerp.org/rules/stage/ empty

2009-07-17 Thread Karsten Bräckelmann
Cc'ing reporter, not a list subscriber.

On Thu, 2009-07-16 at 15:06 +0100, Robert Brooks wrote:
 did this ruleset get discontinued? I have...

 meta JM_SOUGHT_1   (0)

This was an intermediate glitch, has been fixed yesterday already.
Thanks for the heads-up.

-- 
char *t=\10pse\0r\0dtu...@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4;
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;il;i++){ i%8? c=1:
(c=*++x); c128  (s+=h); if (!(h=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}



spamd.exe won't stay running...

2009-07-17 Thread mtm81

If I try to run the spamd.exe service it will run as a process up to around
24k of memory usage then quit out. 

nothing showing in error log or anything else??? 

I've tried to run it by itself...  also tried running it within a daemon
service provider such as NTrunner for example but no joy.. any ideas anyone? 

I just to find out why the service keeps quitting?? 

if I run the spamassassin services without using the spamd side of things it
runs fine on the server but obviously uses a high amount of CPU instead of
the spamd service which I'm lead to believe is more efficient? 

thanks for any replies..
-- 
View this message in context: 
http://www.nabble.com/spamd.exe-won%27t-stay-running...-tp24533158p24533158.html
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.



Re: 20_sought.cf from http://yerp.org/rules/stage/ empty

2009-07-17 Thread Robert Brooks

Benny Pedersen wrote:

On Thu, July 16, 2009 16:06, Robert Brooks wrote:

did this ruleset get discontinued? I have...


nope still active, you just got a dynamic file without any seeks


ok, I have rules in the current 20_sought.cf, thanks for clarifying this.

(will sort out my subscribed address to the list too)


Return Path Safe whitelist UPDATE [was: Opt In Spam]

2009-07-17 Thread Neil Schwartzman
On 16/07/09 11:39 AM, LuKreme krem...@kreme.com wrote:

 * -4.3 HABEAS_ACCREDITED_SOI RBL: Habeas Accredited Opt-In
 or Better
 *  [66.59.8.161 listed in sa-accredit.habeas.com]
 
 
 If you search for HABEAS_ACCREDITED you will find that a LOT of admins
 either drop these scores to very low numbers, or actually set them
 slightly positive.

I'm not certain as to how a search such as you suggest would reveal any
indication of this. Please explain.

 In my mailspool they are a spam indicator and I
 have them scored as such:
 
 score HABEAS_ACCREDITED_COI 1.0
 score HABEAS_ACCREDITED_SOI 1.5

I fully understand if you do/did not want to use our whitelist (keep
reading, we've made a few changes), however, we have historically blocked
lookups from people with this type of scoring when we became aware of such
things. I think it is silly to be punitive, and more than a little naïve.

I have regularly posted here as to the work that we do, how we do it, and
the challenges of migrating the poorly-kept legacy Habeas Safe whitelist to
our systems.

The migration work is ongoing, about 95% of the way there. However, the last
5% is non-trivial.

That said, from a more administrative side here are some facts and figures
that may interest you:

- In the past six months we have ended our relationship with 113 companies
on Safe
- We have deleted at least 2.5K IPs associated with those companies

- We have added hundreds, if not 1,000 IPs from our Certified programme
members, companies held to extremely exacting performance metrics, including
complaint feeds from Hotmail, Yahoo!, two anonymous webmail providers.

VALUE ADDS
We have actively begun compliance on Safe whitelist members for things like:
- spamtraps (from several sources to which Spamassassin does NOT
have access)
- bounce-processing efficacy (again, something SA cannot do for you)
- Recursive DNS
- nameserver snowshoeing. We do not allow one NS/domain to avoid domain
reputation
- WHOIS transparency - no proxy services
- disclosure of sign-ups, privacy policy present and reasonable

Future plans:

- Automation (including intra-day checks of DNSBLs, trap hits, and so on)

- re-jigging our programme metrics, standards and license agreement to be
coherent (we are still labouring under legacy agreements in some cases)

- Overall programme/client/IP SA scoring for both our whitelist products,
Safe and Certified, using our massive corpus (not to belittle Justin's rule
scoring efforts, but he uses what he readily admits is a very small corpus).
We have live data feeds from the world's largest receiving sites, we run
FBLs for at least a dozen of receivers, and we intend to make good use of
this data. I don't know how long it will take until an SA score will become
a compliance metric, or if it ever will, time will tell, but I am very
excited to see what comes of this project.

- Continual client audits especially of legacy Safe customers.

IOW, we take all this stuff very seriously, have committed resources both
financial, development, and human to this end, and we greatly value our
longstanding relationship with the Spamassassin user community.

So, bottom line: 

Zero-out our scoring? That is and will always be your right.

Making it a positive spam sign?? Well, if you run a home system with no
users, I suppose no damage done. If you are running SA in front of actual
users at a business installation, I'd think it very brave to incur known
false positives, and reject mail they potentially want, especially in this
job market.

-- 
Neil Schwartzman
Director, Accreditation Security  Standards
Certified | Safelist
Return Path Inc.
0142002038

The opinions contained herein are my personal stance and may not reflect the
viewpoint of Return Path Inc.



spamd.exe error update - found log..here's the error - but what does it mean?

2009-07-17 Thread mtm81

This is the error I'm getting when running spamd.exe:

Fri Jul 17 13:24:01 2009 [4120] error: getprotobyname(tcp): Unknown error at
spamd.raw line 605.

Any ideas?
-- 
View this message in context: 
http://www.nabble.com/spamd.exe-error-update---found-log..here%27s-the-error---but-what-does-it-mean--tp24533526p24533526.html
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.



Re: Plugin extracting text from docs

2009-07-17 Thread Jonas Eckerman

Matus UHLAR - fantomas wrote:


I've been thinking about it. The pdftohtml could provide interesting
infromations like colour informations that could lead to better spam
detection. Any experiences with this?


I've been thinking a bit more about this.

My current plan is to download the trunk version of SA from SVN to a 
development system and put a decent way for plugins to ask SA to render 
the extracted HTML into visible, invisible, meta, etc.


Once done and somewhat tested I'll see what the devs thinks about my patch.

It shouldn't be hard at all, it's a small change to 
Mail::SpamAssassin::Message::Node, but I never seem to have as much time 
as I need for even half of my work and projects... :-/


If the patch is accepted, my ExtractText plugin will use the opened up 
functionality if it's there. If it's not any extracted HTML will be 
added using set_rendered as it does now.


/Jonas
--
Jonas Eckerman
Fruktträdet  Förbundet Sveriges Dövblinda
http://www.fsdb.org/
http://www.frukt.org/
http://whatever.frukt.org/


Re: spamd.exe error update - found log..here's the error - but what does it mean?

2009-07-17 Thread Jari Fredriksson
 This is the error I'm getting when running spamd.exe:
 
 Fri Jul 17 13:24:01 2009 [4120] error:
 getprotobyname(tcp): Unknown error at spamd.raw line 605.
 
 Any ideas?

Do you have 

c:\WINDOWS\system32\drivers\etc\protocol

and the line with tcp in it?




Re: spamd.exe error update - found log..here's the error - but what does it mean?

2009-07-17 Thread mtm81



Do you have 

c:\WINDOWS\system32\drivers\etc\protocol

and the line with tcp in it?



yes I have that...
-- 
View this message in context: 
http://www.nabble.com/spamd.exe-error-update---found-log..here%27s-the-error---but-what-does-it-mean--tp24533526p24534595.html
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.



Re: spamd.exe error update - found log..here's the error - but what does it mean?

2009-07-17 Thread Jari Fredriksson
 Do you have
 
c:\WINDOWS\system32\drivers\etc\protocol
 
 and the line with tcp in it?
 
 
 
 yes I have that...

..or if the spamd.exe is run under cygwin, the file should be

c:\cygwin\etc\protocol

or whatever, under the cygwin structure of course.

I have not managed to get spamd.exe into my machine. Tried compiling with cpan 
under cygwin..

I compiled but tests failed badly.






Re: Return Path Safe whitelist UPDATE [was: Opt In Spam]

2009-07-17 Thread LuKreme

On 17-Jul-2009, at 06:24, Neil Schwartzman wrote:

On 16/07/09 11:39 AM, LuKreme krem...@kreme.com wrote:


   * -4.3 HABEAS_ACCREDITED_SOI RBL: Habeas Accredited Opt-In
or Better
   *  [66.59.8.161 listed in sa-accredit.habeas.com]



If you search for HABEAS_ACCREDITED you will find that a LOT of  
admins

either drop these scores to very low numbers, or actually set them
slightly positive.


I'm not certain as to how a search such as you suggest would reveal  
any

indication of this. Please explain.


Did you try the search and read the emails for, oh, I don't know,  
let’s just say this year?




In my mailspool they are a spam indicator and I
have them scored as such:

score HABEAS_ACCREDITED_COI 1.0
score HABEAS_ACCREDITED_SOI 1.5


I fully understand if you do/did not want to use our whitelist (keep
reading, we've made a few changes), however, we have historically  
blocked
lookups from people with this type of scoring when we became aware  
of such
things. I think it is silly to be punitive, and more than a little  
naïve.


It's very simple, Habeas headers are a fairly strong indicator of spam  
in my mail spool. I search all the mail for habeas headers and it  
shows up about 90% in spam and 10% in ham. I score it thus. To be  
perfectly fair, I SHOULD score SOI at about 3.0 based on my mailspool.


I have regularly posted here as to the work that we do, how we do  
it, and
the challenges of migrating the poorly-kept legacy Habeas Safe  
whitelist to

our systems.


That doesn't change the fact that your headers show up overwhelmingly  
in unwanted mail. That is my only metric. I wouldn't care if you were  
the anti-spam avatar himself come down from on high; my scoring is  
based on my mailspool.


[Promo adspeak removed]


So, bottom line:


Bottom line is as I said, habeas headers are a strong spam indicator  
and will be scored as such until (and if) that ever changes. The  
scores applied are not high enough to push the rare legitimate email  
over a threshold, but are high enough to prevent my having to deal  
with any of the borderline cases that might not get tagged otherwise.



Zero-out our scoring? That is and will always be your right.


I wold only zero out your scoring is the ham/spam balance was fairly  
close to 1:1 and not 1:10 as it is.


Making it a positive spam sign?? Well, if you run a home system with  
no
users, I suppose no damage done. If you are running SA in front of  
actual
users at a business installation, I'd think it very brave to incur  
known

false positives,


What false positives? I've not had anyone ever complain about a miss- 
tagged habeas-containing message.



--
These are the thoughts that kept me out of the really good schools. --  
George Carlin




RE: Return Path Safe whitelist UPDATE [was: Opt In Spam]

2009-07-17 Thread Robert
 
Neil

it appears that you and your organization are taking an excellent proactive
stance and work ethic against spam and UCE etc...

and you should be commended for that.

the thing is, the SA community and the world at large should not be your
free customer compliance labor force.

we should be the excepetion to the rule in helping and i highly recommend
internal metrics that meter  catch junk as it happens or thereabouts.

you should know before we do.  :-)

that said, possibly you should educate the SA community to the specifics of
your rulesets and proper scoring and why...

at least provide a specific URL set to the list that educates the likes of
us without watered down sales hype.

otherwise it is possible many admins might or will continue to score as a
spammy factor instead of a hammy or less hammy factor and possible
defeat some of the dilligent and hard work your org is putting forth

takr,

 - rh




spamd socket partial read

2009-07-17 Thread Filippo Carletti
Please, refer to this mail
(http://grokbase.com/post/2009/07/15/spamassassin-plugin-doesn-t-send-full-mail-to-spamd/JCzoiz1UQ8ZKEInNXZQu0ndhk54)
for some (confused) background informations.

qpsmtpd spamassassin plugin is here:
http://github.com/abh/qpsmtpd/blob/7efee7b1af632fc1caf1a03a00b4d36790f25c1d/plugins/spamassassin

This plugin sends the full mail to spamd, but spamd reads only the
headers and wait for 300 seconds for the body (already sent by
qpsmtpd).

spamd strace:

read(6, SYMBOLS SPAMC/1.3\r\nUser: qpsmtpd\r\n\r\nX-Envelope-From:
perceptua...@studguard.de\r\nReceived: from c2.nethesis.it (HELO
pc-federico) (77.238.14.78)\r\nby nethesis.it (qpsmtpd/0.40) with
SMTP; Wed, 15 Jul 2009 18:17:09 +0200\r\nDate: Tue, 14 Jul 2009
19:00:57 +0700\r\nFrom: \Pat Bright\
forbidding...@sparkus.com\r\nSubject: Get a degree with no
problems.\r\nTo: cristian.man...@nethesis.it\r\nMessage-ID:
000d01ca047a$bf729840$6400a...@forbiddingsz3\r\nMIME-Version:
1.0\r\nX-MIMEOLE: Produced By Microsoft MimeOLE
V6.0.6001.18049\r\nX-Mailer: Microsoft Windows Mail
6.0.6001.18000\r\nContent-type: text/plain; format=flowed;
charset=iso-8859-1; reply-type=original\r\nContent-transfer-encoding:
7bit\r\nX-Priority: 3\r\nX-MSMail-priority: Normal\r\n\r\n, 4096) =
733

SA 3.2.5 on Centos 4.6, perl 5.8.5.

If I shorten the first line of the body, spamd reads the whole mail
(see mail referenced at the beginning for a strace).
Here is also a gdb backtrace of spamd waiting in read():

#0  0x009d17a2 in _dl_sysinfo_int80 () from /lib/ld-linux.so.2
#1  0x00cff673 in __read_nocancel () from /lib/tls/libpthread.so.0
#2  0x00cbb09f in PerlIOUnix_read () from
/usr/lib/perl5/5.8.5/i386-linux-thread-multi/CORE/libperl.so
#3  0x00cba8b1 in Perl_PerlIO_read () from
/usr/lib/perl5/5.8.5/i386-linux-thread-multi/CORE/libperl.so
#4  0x00cbc439 in PerlIOBuf_fill () from
/usr/lib/perl5/5.8.5/i386-linux-thread-multi/CORE/libperl.so
#5  0x00cb9a43 in Perl_PerlIO_fill () from
/usr/lib/perl5/5.8.5/i386-linux-thread-multi/CORE/libperl.so
#6  0x00cba803 in PerlIOBase_read () from
/usr/lib/perl5/5.8.5/i386-linux-thread-multi/CORE/libperl.so
#7  0x00cbc513 in PerlIOBuf_read () from
/usr/lib/perl5/5.8.5/i386-linux-thread-multi/CORE/libperl.so
#8  0x00cba8b1 in Perl_PerlIO_read () from
/usr/lib/perl5/5.8.5/i386-linux-thread-multi/CORE/libperl.so
#9  0x00cbdb14 in PerlIO_getc () from
/usr/lib/perl5/5.8.5/i386-linux-thread-multi/CORE/libperl.so
#10 0x00c64e6b in Perl_sv_gets () from
/usr/lib/perl5/5.8.5/i386-linux-thread-multi/CORE/libperl.so
#11 0x00c48aa4 in Perl_do_readline () from
/usr/lib/perl5/5.8.5/i386-linux-thread-multi/CORE/libperl.so
#12 0x00c49877 in Perl_pp_readline () from
/usr/lib/perl5/5.8.5/i386-linux-thread-multi/CORE/libperl.so
#13 0x00c3016d in Perl_runops_debug () from
/usr/lib/perl5/5.8.5/i386-linux-thread-multi/CORE/libperl.so
#14 0x00be1c91 in perl_run () from
/usr/lib/perl5/5.8.5/i386-linux-thread-multi/CORE/libperl.so
#15 0x080493b2 in main ()

I'm looking for a way to isolate the source of the problem: perl, a
perl module, spamd, spamassassin, what else?
Thanks.

-- 
Ciao,
Filippo


Re: Opt In Spam

2009-07-17 Thread rich...@buzzhost.co.uk
On Fri, 2009-07-17 at 03:25 -0700, twofers wrote:
 Neil Rocks !
  
 Thanks Neil.
  
 Wes
 
 --- On Thu, 7/16/09, Neil Schwartzman
 neil.schwartz...@returnpath.net wrote:
 
 
 From: Neil Schwartzman neil.schwartz...@returnpath.net
 Subject: Re: Opt In Spam
 To: twofers twof...@yahoo.com, Spamassassin
 users@spamassassin.apache.org
 Date: Thursday, July 16, 2009, 1:29 PM
 
 FOLLOW-UP:
 
 A process was hung on one of the 20 hives serving the
 whitelists and
 reported this IP as being listed. We've restarted the process
 and it is
 no longer reporting incorrectly.
 
 
 On 16/07/09 8:05 AM, Neil Schwartzman
 neil.schwartz...@returnpath.net wrote:
 
 Now, I am aware that we recently changed the DNS hives
 serving up Safe (aka
 safelist aka Habeas) and I'm wondering if there is a
 glitch between SA and
 our lists. I don't know.
 
 I expect I need to take this up with the developer
 team, and bump it to
 someone else over here. I've also BCCed our contacts
 at SA for clarification
 
 -- 
 Neil Schwartzman
 Director, Certification Security  Standards
 Return Path Inc.
 0142002038
 
 
I have (as usual) a different view. Being told how wonderful they were I
thought it would be a blast to opt-in, then opt out again. On opting out
I found I was mailed again by RP. So I blocked the range. They found
another range and spammed me, I blocked it again. Tonight, they have
done it again - I guess this is another 'fault with a hive serving the
whitelists' or similar b/s. Opt out is opt out. It means I don't want
you to keep finding new ranges to spam me about your services;

  From: 
Ryan Osborne
ryan.osbo...@returnpath.net
To: 
@buzzhost.co.uk
   Subject: 
Are you getting your email to the
Inbox?
  Date: 
Fri, 17 Jul 2009 15:06:02 -0400
(20:06 BST)
Mailer: 
Produced By Microsoft Exchange V6.5


I am reaching out from Return Path regarding your inquiry during our
Lunch and Learn.  We focus on helping marketers like you increase email
response and revenue by maximizing your email delivery rates and
optimizing your email performance. 

 

On average, 20% of permission email is blocked or filtered by ISPs. ISPs
like Hotmail and Yahoo! look at several factors in your sending history
(or reputation) to determine legitimate mail from spam, but
unfortunately one out of five times they get it wrong. We at Return Path
can help you build a stellar sending reputation so that ISPs don’t
mistake your messages for spam and instead, fast track your email to the
inbox. Once you’re IN, we’ll help ensure your strategy is aligned with
subscriber interest so that you can maintain high deliverability rates
and drive more response and revenue to your program. 

 

Our industry leading monitoring tools and services are used by companies
of all shapes and sizes including Polo Ralph Lauren,  Software AG,
Fidelity Investments, eBay, Coldwater Creek, Overstock.com, REI,
Match.com, E-Harmony, Twitter, Facebook, and MySpace, plus 2000 more!
You can read our case studies on our website. 

I welcome the opportunity to talk with you to jointly determine which
Return Path solutions will drive the strongest ROI across your email
programs.  When would be the best time to set up the meeting to review
your delivery needs?

 

Let me know what time works best for you. I look forward to speaking
with you soon. 

 

Best Regards, 

 

p.s. If you are new to deliverability and want to learn more before we
chat, you can register for our Lunch  Learn Webinar: Are My Emails
Getting Blocked? Click here to choose the date and time that works for
you. 

Thank you,

Ryan Osborne

New Business Development

Return Path - Increasing Email Reach and Response

8001 Arista Place Suite 300

Broomfield, CO 80021

303-999-3121 (office)

303-496-1283 (fax)





Re: Opt In Spam

2009-07-17 Thread Neil Schwartzman
On 17/07/09 3:32 PM, rich...@buzzhost.co.uk rich...@buzzhost.co.uk
wrote:

 I have (as usual) a different view. Being told how wonderful they were I
 thought it would be a blast to opt-in, then opt out again. On opting out
 I found I was mailed again by RP. So I blocked the range. They found
 another range and spammed me, I blocked it again. Tonight, they have
 done it again - I guess this is another 'fault with a hive serving the
 whitelists' or similar b/s. Opt out is opt out. It means I don't want
 you to keep finding new ranges to spam me about your services;
 
   From:
 Ryan Osborne
 ryan.osbo...@returnpath.net
 To:
 @buzzhost.co.uk
Subject:
 Are you getting your email to the
 Inbox?
   Date:
 Fri, 17 Jul 2009 15:06:02 -0400
 (20:06 BST)
 Mailer:
 Produced By Microsoft Exchange V6.5

I¹m not certain who told you were here at Return Path are wonderful, but I
do appreciate their input.

Now, please don¹t be silly Richard.

Your assertion that we encountered a block and then switched to a new IP
netblock is preposterous. We have several ranges and mail streams. You opted
in and then opted out. OK, in what timeframe? Minutes? Hours? The proscribed
10-day CANSPAM limit? A couple of months?

I will ensure you are added to our suppression list and unsubbed from all
lists, immediately. If our processes are broken, we want to know; I¹ve BCCed
our CPO in on this.

Thanks for the heads up.

-- 
Neil Schwartzman
Director, Certification Security  Standards
Return Path Inc.
0142002038




Re: Return Path Safe whitelist UPDATE [was: Opt In Spam]

2009-07-17 Thread Derek Harding

LuKreme wrote:

In my mailspool they are a spam indicator and I
have them scored as such:

score HABEAS_ACCREDITED_COI 1.0
score HABEAS_ACCREDITED_SOI 1.5


It's very simple, Habeas headers are a fairly strong indicator of spam 
in my mail spool. I search all the mail for habeas headers and it 
shows up about 90% in spam and 10% in ham. I score it thus. To be 
perfectly fair, I SHOULD score SOI at about 3.0 based on my mailspool.


I don't get why you'd search for spammers including headers that have 
not been in actual use for many years and conflate those results with a 
DNS whitelist that is currently being maintained.


HABEAS_ACCREDITED_COI  SOI have nothing to do with Habeas headers in an 
email. The two are entirely distinct and (almost certainly) bear no 
correlation with each other since I'd be shocked if anyone on either of 
those lists included the headers.


Derek



Re: Opt In Spam

2009-07-17 Thread Neil Schwartzman



On 17/07/09 4:03 PM, Neil Schwartzman neil.schwartz...@returnpath.net
wrote:

 Your assertion that we encountered a block and then switched to a new IP
 netblock is preposterous. We have several ranges and mail streams. You opted
 in and then opted out. OK, in what timeframe? Minutes? Hours? The proscribed
 10-day CANSPAM limit? A couple of months?
 
 I will ensure you are added to our suppression list and unsubbed from all
 lists, immediately. If our processes are broken, we want to know; I¹ve BCCed
 our CPO in on this.

Richard,

I inquired internally, and here is what we understand to have happened.

You signed up for a Lunch and Learn. You were mailed the information in that
regard. Apparently you were flagged in our systems as having attended the
event. You also indicated you wanted a demo of our tools during your
sign-up. A sales person, Ryan, followed up on the lead with a 1-to-1 email.
He also tried to call the apparently erroneous telephone number you entered
in the form.

We have verified the unsubscribe and suppressed your address.

Let us know if there is anything else we can do to help.

Thanks again for bringing this to all our attention.
-- 
Neil Schwartzman
Director, Certification Security  Standards
Return Path Inc.
0142002038




Re: Opt In Spam

2009-07-17 Thread rich...@buzzhost.co.uk
On Fri, 2009-07-17 at 14:41 -0600, Neil Schwartzman wrote:
 
 
 On 17/07/09 4:03 PM, Neil Schwartzman neil.schwartz...@returnpath.net
 wrote:
 
  Your assertion that we encountered a block and then switched to a new IP
  netblock is preposterous. We have several ranges and mail streams. You opted
  in and then opted out. OK, in what timeframe? Minutes? Hours? The proscribed
  10-day CANSPAM limit? A couple of months?
  
  I will ensure you are added to our suppression list and unsubbed from all
  lists, immediately. If our processes are broken, we want to know; I¹ve BCCed
  our CPO in on this.
 
 Richard,
 
 I inquired internally, and here is what we understand to have happened.
 
 You signed up for a Lunch and Learn. You were mailed the information in that
 regard. Apparently you were flagged in our systems as having attended the
 event. 
I hate to say this, but if that's what you understand to have happened
you have some serious issues with data management. Here is what
happened. Injected an address into your web form, injected a dead phone
number. Never confirmed opt in, when mail came clicked 'unsubscribe' 

 You also indicated you wanted a demo of our tools during your
 sign-up. A sales person, Ryan, followed up on the lead with a 1-to-1 email.
 He also tried to call the apparently erroneous telephone number you entered
 in the form.
So, not only have you abused the unsubscribe, you tried to call the
number too. Gee, you are very determined spammers dude.
 
 We have verified the unsubscribe and suppressed your address.
 
 Let us know if there is anything else we can do to help.
Can you supply me with all the address ranges you have so I can add
manual blocks for them. Thanks.
 Thanks again for bringing this to all our attention.