Re: [Fwd: Better check your sig now you are a spammer :-)]

[Ron McKeating]

On Wed, 2004-10-06 at 16:54, Matt Kettler wrote:
> At 09:01 AM 10/6/2004, Ron McKeating wrote:
> 
> >Nigel M kindly sent me this. we will have to think of new job titles
> >unless SA can detect the difference between specialist and cialis. Ooops
> >now nobody will see this email.
> 
> SA can, does and will detect the difference. However, poorly written add-on 
> rules can do whatever they like.
> 
> CIALIS2 is no part of any release of SA from 2.0 through 3.0.0. (Yes I did 
> check them all with grep -r).
> 
> All of the drug rules in 20_drugs.cf from SA 3.0 have proper \b's at the 
> head and foot of the regex, which force a word-boundary.
> 
>  From the looks of it, the administrator of rioja.localnet decided to add 
> his/her own rules, and failed to properly insert \b's where he/she should 
> have.
> 
> Any cialis rule should look something like:
>   body CIALIS/\bCialis\b/i
> 
> not:
>   body CIALIS2   /Cialis/i
> 
> Sorry, but SA can't do anything to fix bad regex writing on the part of the 
> end user. 

Then I stand corrected and apologise for casting any aspersions on the
reputation of SA. Still made I larf tho.

-- 
Ron McKeating
Senior IT Services Specialist
Internet Services and Software Solutions
Loughborough University
01509 222329

Re: [Fwd: Better check your sig now you are a spammer :-)]

[Loren Wilton]

> > *  4.0 CIALIS2 BODY: Contains the word "cialis".
> >
> So where did this rule come from ?

My guess woudl be someone's local.cf.  It looks like a rather poorly written
rule.

Loren

Re: [Fwd: Better check your sig now you are a spammer :-)]

[Matt Kettler]

At 09:01 AM 10/6/2004, Ron McKeating wrote:
Nigel M kindly sent me this. we will have to think of new job titles
unless SA can detect the difference between specialist and cialis. Ooops
now nobody will see this email.
SA can, does and will detect the difference. However, poorly written add-on 
rules can do whatever they like.

CIALIS2 is no part of any release of SA from 2.0 through 3.0.0. (Yes I did 
check them all with grep -r).

All of the drug rules in 20_drugs.cf from SA 3.0 have proper \b's at the 
head and foot of the regex, which force a word-boundary.

From the looks of it, the administrator of rioja.localnet decided to add 
his/her own rules, and failed to properly insert \b's where he/she should have.

Any cialis rule should look something like:
 body CIALIS/\bCialis\b/i
not:
 body CIALIS2   /Cialis/i
Sorry, but SA can't do anything to fix bad regex writing on the part of the 
end user. 

RE: [Fwd: Better check your sig now you are a spammer :-)]

[Rikhardur.EGILSSON]

Whoever configured SA for [EMAIL PROTECTED] must have either modified
the points or lowered the "required" limit.

I ran my_rules_du_jour this morning and the SA report in your mail, as it got
to my Inbox was :

X-Spam-Status: No, hits=-9.9 required=5.0 tests=BAYES_00,DRUGS_ERECTILE,
USER_IN_WHITELIST_TO autolearn=no version=2.63

I have no idea where the "CIALIS2" rule comes from ?


- Ríkharður


-Original Message-
From: Ron McKeating [mailto:[EMAIL PROTECTED] 
Sent: 06 October, 2004 3:40 PM
To: EGILSSON Rikhardur, EXD/ITN/CSO
Cc: spam
Subject: RE: [Fwd: Better check your sig now you are a spammer :-)]


On Wed, 2004-10-06 at 14:12, [EMAIL PROTECTED] wrote:
> X-Spam-Status: Yes, hits=4.0 required=4.0 tests=CIALIS2 autolearn=no 
>   version=2.64
> X-Spam-Report: 
>   *  4.0 CIALIS2 BODY: Contains the word "cialis".
> 
> 
> This is not a SA problem, this is a "User Problem".
> 
> Whoever creates a word-matching rule that, alone, gives the required
> number of points to flag a mail as Spam, deserves what he gets (or 
> gets not, as in this example).
> 
So where did this rule come from ?


> Antidrug only applies 1.5 points for finding /\bCialis\b/I
> 
>   - Ríkharður
> 
> 
> -Original Message-
> From: Ron McKeating [mailto:[EMAIL PROTECTED]
> Sent: 06 October, 2004 3:01 PM
> To: spam
> Subject: [Fwd: Better check your sig now you are a spammer :-)]
> 
> 
> Nigel M kindly sent me this. we will have to think of new job titles
> unless SA can detect the difference between specialist and cialis. 
> Ooops now nobody will see this email.
> 
> Ron
-- 
Ron McKeating
Senior IT Services Specialist
Internet Services and Software Solutions
Loughborough University
01509 222329

RE: [Fwd: Better check your sig now you are a spammer :-)]

[Ron McKeating]

On Wed, 2004-10-06 at 14:12, [EMAIL PROTECTED] wrote:
> X-Spam-Status: Yes, hits=4.0 required=4.0 tests=CIALIS2 autolearn=no 
>   version=2.64
> X-Spam-Report: 
>   *  4.0 CIALIS2 BODY: Contains the word "cialis".
> 
> 
> This is not a SA problem, this is a "User Problem".
> 
> Whoever creates a word-matching rule that, alone, gives the required number
> of points to flag a mail as Spam, deserves what he gets (or gets not, as in
> this example).
> 
So where did this rule come from ?


> Antidrug only applies 1.5 points for finding /\bCialis\b/I
> 
>   - Ríkharður
> 
> 
> -Original Message-
> From: Ron McKeating [mailto:[EMAIL PROTECTED] 
> Sent: 06 October, 2004 3:01 PM
> To: spam
> Subject: [Fwd: Better check your sig now you are a spammer :-)]
> 
> 
> Nigel M kindly sent me this. we will have to think of new job titles unless
> SA can detect the difference between specialist and cialis. Ooops now nobody
> will see this email.
> 
> Ron
-- 
Ron McKeating
Senior IT Services Specialist
Internet Services and Software Solutions
Loughborough University
01509 222329

RE: [Fwd: Better check your sig now you are a spammer :-)]

[Rikhardur.EGILSSON]

X-Spam-Status: Yes, hits=4.0 required=4.0 tests=CIALIS2 autolearn=no 
version=2.64
X-Spam-Report: 
*  4.0 CIALIS2 BODY: Contains the word "cialis".


This is not a SA problem, this is a "User Problem".

Whoever creates a word-matching rule that, alone, gives the required number
of points to flag a mail as Spam, deserves what he gets (or gets not, as in
this example).

Antidrug only applies 1.5 points for finding /\bCialis\b/I

- Ríkharður


-Original Message-
From: Ron McKeating [mailto:[EMAIL PROTECTED] 
Sent: 06 October, 2004 3:01 PM
To: spam
Subject: [Fwd: Better check your sig now you are a spammer :-)]


Nigel M kindly sent me this. we will have to think of new job titles unless
SA can detect the difference between specialist and cialis. Ooops now nobody
will see this email.

Ron
-- 
Ron McKeating
Senior IT Services Specialist
Internet Services and Software Solutions
Loughborough University
01509 222329

[Fwd: Better check your sig now you are a spammer :-)]

[Ron McKeating]

Nigel M kindly sent me this. we will have to think of new job titles
unless SA can detect the difference between specialist and cialis. Ooops
now nobody will see this email.

Ron
-- 
Ron McKeating
Senior IT Services Specialist
Internet Services and Software Solutions
Loughborough University
01509 222329
--- Begin Message ---
Ron,

I thought this might amuse you - took me a moment to work out the
problem...

-- 
[ Nigel Metheringham   [EMAIL PROTECTED] ]
[ - Comments in this message are my own and not ITO opinion/policy - ]

--- Begin Message ---
This is a Mailman mailing list bounce action notice:

List:   Exim-users
Member: [EMAIL PROTECTED]
Action: Subscription disabled.
Reason: Excessive or fatal bounces.



The triggering bounce notice is attached below.

Questions? Contact the Mailman site administrator at [EMAIL PROTECTED]
--- Begin Message ---
This message was created automatically by mail delivery software.

A message that you sent could not be delivered to one or more of its
recipients. This is a permanent error. The following address(es) failed:

  [EMAIL PROTECTED]
This mail box is not accepting spam. If you feel your e-mail is not spam, 
please e-mail me again asking for a whitelist entry.

-- This is a copy of the message, including all the headers. --

Return-path: <[EMAIL PROTECTED]>
Received: from mail by suzaku.infostations.net with spam-scanned (Exim 4.41 #1 
(Gentoo))
id 1CF9Pl-0002AU-AC
for <[EMAIL PROTECTED]>; Wed, 06 Oct 2004 03:52:58 -0700
Received: from sesame.csx.cam.ac.uk ([131.111.8.41])
by suzaku.infostations.net with esmtp (Exim 4.41 #1 (Gentoo))
id 1CF9Pk-0002AN-Lb
for <[EMAIL PROTECTED]>; Wed, 06 Oct 2004 03:52:57 -0700
Received: from [::1] (port=3769 helo=sesame.csx.cam.ac.uk)
by sesame.csx.cam.ac.uk with esmtp (Exim 4.42)
id 1CF9Mh-0003rQ-Pb; Wed, 06 Oct 2004 11:49:47 +0100
Received: from scamper.lut.ac.uk ([158.125.1.219]:40354)
by sesame.csx.cam.ac.uk with esmtp (Exim 4.42) id 1CF9Mf-0003r9-3Z
for [EMAIL PROTECTED]; Wed, 06 Oct 2004 11:49:47 +0100
Received: from [131.231.80.5] (helo=[131.231.80.5])
by scamper.lut.ac.uk with asmtp (TLSv1:AES256-SHA:256) (Exim 4.34)
id 1CF9Pk-0003fc-Uf
for [EMAIL PROTECTED]; Wed, 06 Oct 2004 11:52:57 +0100
From: Ron McKeating <[EMAIL PROTECTED]>
To: "Exim-Users (E-mail)" <[EMAIL PROTECTED]>
Content-Type: text/plain
Message-Id: <[EMAIL PROTECTED]>
Mime-Version: 1.0
X-Mailer: Ximian Evolution 1.4.6 (1.4.6-2) 
Date: Wed, 06 Oct 2004 11:52:56 +0100
Content-Transfer-Encoding: 7bit
X-Scan-Signature: 002eea541692a829a8250b7ac6c1eabb
X-Spam-Score: -3.9 (---)
Subject: [exim] system filter
X-BeenThere: [EMAIL PROTECTED]
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: A user list for the exim MTA 
List-Unsubscribe: ,

List-Archive: 
List-Post: 
List-Help: 
List-Subscribe: ,

Sender: [EMAIL PROTECTED]
Errors-To: [EMAIL PROTECTED]
X-Spam-Flag: YES
X-Spam-Checker-Version: SpamAssassin 2.64 (2004-01-11) on 
kurama.infostations.net
X-Spam-Level: 
X-Spam-Status: Yes, hits=4.0 required=4.0 tests=CIALIS2 autolearn=no 
version=2.64
X-Spam-Report: 
*  4.0 CIALIS2 BODY: Contains the word "cialis".

Does the system filter apply to a message that is rejected at the data
stage. IE if the data acl gives a 550 reject does that mean that message
is never passed through the system filter?

Ron
-- 
Ron McKeating
Senior IT Services Specialist
Internet Services and Software Solutions
Loughborough University
01509 222329


-- 
## List details at http://www.exim.org/mailman/listinfo/exim-users Exim details 
at http://www.exim.org/ ##

--- End Message ---
--- End Message ---
--- End Message ---