Re: [SAtalk] This should go to the sightings list, but it brings up an important flaw

On Wed, Oct 30, 2002 at 01:49:26PM -0500, Matt Kettler wrote: > Another simple rule would be to detect emails which have both an X-Mailer > and a User-Agents header. The OE rule actually detects an X-Mailer header, > so the mail you got would have had to have both headers. FYI: we've been workin

Re: [SAtalk] *whine* Local RBL checks not supported

> Just create a subdomain, say blacklist.your-domain, and delegate it to > your rbldns server. That's what you'll have to do to use rbldns > anyway. "Local". That means not on the network. 127.0.0.1:53. As noted in my previous email that is the IP in /etc/hosts for rbl.mail.premiernet.net. Tha

Re: [SAtalk] Need help interfacing with local RBL

> The tests you performed were manually directed at the rbldns server. > However, RBL queries are done using standard DNS lookups, and are > therefore subject to the normal DNS recursive lookup algorithm. > > So if you didn't delegate the RBL base domain (rbl.mail...) to the > rbldns server, your

[SAtalk] bayes, spamd, and future of per-user/per-system bayes

Bug? The bayes code in 2.50 doesn't get invoked from spamd because there is no hook from handle_user to [re]open the bayes databases. I have to think this is an oversight, but I thought I'd better ask. * Should spamd do this? The learn code is a bit slow and if the authors are open to code submis

[SAtalk] "NewsGroups, please help" spam

I just got a piece of spam from someone who claims to need help on how to post to Usenet. It could, theoretically, be a genuine message (though it would be odd to tell someone your age in such a request), but the headers have all sorts of spammy fingerprints all over them, in addition to this

Re: [SAtalk] "NewsGroups, please help" spam

On Wed, 30 Oct 2002 02:38:21 -0800 Matthew Cline <[EMAIL PROTECTED]> wrote: > I'm puzzled as to what this spam is hoping to do. Gain the user's trust > by posing as a clueless newbie, then use that trust to scam them? Possibly, or it could be to verify the address. --- Lars Hansson -

[SAtalk] sendmail and spamassassin

Hi everybody I'm a student and I'd like to know more about sendmail and spamassassin I've already installed sendmail 8.12.3 and spamassassin 2.43 acording to the readme and installation files in our test server. So my problem now is: incoming and outgoing mail are not tagged by SpamAssassin . An

Re: [SAtalk] "NewsGroups, please help" spam

On Wed, 30 Oct 2002 the voices made Lars Hansson write: > On Wed, 30 Oct 2002 02:38:21 -0800 > Matthew Cline <[EMAIL PROTECTED]> wrote: > > > I'm puzzled as to what this spam is hoping to do. Gain the user's trust > > by posing as a clueless newbie, then use that trust to scam them? > > Possibly,

Re: [SAtalk] Extremely long time to scan on some emails

Javier Gostling said: > Has anyone experienced this behaveiour? I'm completely puzzled byt this, > and have received several of these messages in the last few days. If you > want a copy of these messages, write me and I'll send you a copy > privately, so as not to overload the list. Javier, plea

Re: [SAtalk] Teaching the Bayesian Filter

Mike Loiterman said: > Once I get it going, would it be wise to download the public corpus > and run the mailboxes through the appropriate sa-learn-spam or > sa-learn-nonspam filters? Mike, if you don't have your own saved spam collection, it'll do. But *spam to your account* works a lot bette

RE: [SAtalk] .forward / .procmailrc ignored -- postfix?

Thanks. I figured it out. I already had procmail set as the mailbox_command but I wasn't positive how it would interact with .procmailrc because of all the extra parameters that were being passed. So, I looked into it a little more and it turns out that by default procmail will put everything in

[SAtalk] unsubscribe

 

Re: [SAtalk] unsubscribe

Like the headers say: List-Unsubscribe: , Evan At 08:28 AM 10/30/2002, you wrote: --- This sf.net email is sponsored b

Re: [SAtalk] sendmail and spamassassin

What method of calling SpamAssassin from sendmail did you set up? procmail? mime-defang? milter? mailscanner? (and lots of others) If you've not configured one of these mechanisms, that's why. Simply installing SpamAssassin only makes it available for things to use. It doesn't automatically for

[SAtalk] Messages dropping in Outlook

Over the last couple of days I have installed SA 2.43 and MIME-Defang 2.24 on RedHat 8. I installed the patched MIME tools module. Also followed the advice in Mickey Hill's MIMEDefang HOWTO. Not running the spamd yet. The linux box is acting as a front end and then forwards the message into ou

[SAtalk] This should go to the sightings list, but it brings up an important flaw

I got a spam today, that hit many rules, and still only got a 0.6 -Spam-Status: No, hits=0.6 required=5.0 tests=BASE64_ENC_TEXT,CUSTOM_FREE_HD,CUSTOM_GET_FREE DATE_MISSING,FORGED_AOL_RCVD,IN_REP_TO,MISSING_MIMEOLE REMOVE_PAGE,SPAM_PHRASE_01_02,SUBJEC

Re: [SAtalk] razor2 and spamassassin

John covici <[EMAIL PROTECTED]> [2002-10-29 06:38:32 -0500]: > Do you know what the no such file or directory refers to which I got > when I tried spamassassin -r -D ? It would help if you shared the error message you are seeing with the list. Otherwise the best anyone could say is that you are s

Re: [SAtalk] Perspectives on (not) using SA

> > Did you read the original article? He claims to be _more_ accurate than > > SA while still doing header-content-only tests (not DNSbl). Of course, I > > don't know whether that includes blocking IP ranges with a private list. I have seen a lot of claims that filter brand X is accurate at a s

Re: [SAtalk] How is Bayes working out for people?

Bart Schaefer <[EMAIL PROTECTED]> [2002-10-29 12:27:58 -0800]: > Who else is using the Bayesian classifier from the current 2.50-cvs? What > kind of results is it giving you? > [...] > Not bad, but not as good as I'd hoped. I don't have any good data such as you have collected. But so far I am

Re: [SAtalk] New method of verifying Mail addresses?

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Wed, 30 Oct 2002, Andre Bonhote wrote: > Hi SA-Talkers > > I just received the attached mail this morning, and I was quite upset. > For me, this is a completely new way of validating an email address. It > might be hard to catch this with SA ... F

RE: [SAtalk] .forward / .procmailrc ignored -- postfix?

Aaahhh...yes. You can't have procmail work by calling itself a second time. On Wed, 30 Oct 2002, Kaleb Pederson wrote: > Thanks. I figured it out. I already had procmail set as the > mailbox_command but I wasn't positive how it would interact with > .procmailrc because of all the extra param

Re: [SAtalk] This should go to the sightings list, but it brings upan important flaw

On Wed, 30 Oct 2002, Tim Helton wrote: > score USER_AGENT_OE -0.3 > score USER_AGENT_MUTT-4.109 > score USER_AGENT -1.143 > > > Maybe it would be beneficial to see if more than 1 user agent is > detected, and give it a +2, instead of a -5 defini

Re: [SAtalk] How is Bayes working out for people?

On Wed, 30 Oct 2002, Bob Proulx wrote: > I don't have any good data such as you have collected. But so far I > am rather disappointed with the results from different bayesian > classifiers that I have toyed with. Late yesterday I finally got three never-before-seen spams that the BAYES_* rule sc

Re: [SAtalk] This should go to the sightings list, but it brings up an important flaw

Another simple rule would be to detect emails which have both an X-Mailer and a User-Agents header. The OE rule actually detects an X-Mailer header, so the mail you got would have had to have both headers. I did a casual search of my emails and didn't find any (spam or nonspam) with both, so th

Re: [SAtalk] This should go to the sightings list, but it brings up an important flaw

I wrote: Another aspect of this flaw is the heavy positive weights posessed by some mailers. This is easily added to a spam mail for bonus points, so I tend to view any USER_AGENT rule with a score less than -2 as being highly questionable, making an easy target for spam white listing. To fur

[SAtalk] spamd authenticating spamc's uid

I sent this to spamassassin-devel a moment ago, then realized it's probably fair-game to spamassassin-talk, too. Here you go: --- We're considering implementing spamd/spamc in a fairly normal way: spamd runs as root to maintain full

[SAtalk] Sql question

Title: Sql question When using an SQL database to store user preferences, once SA queries a particular user, does it cache their preferences or is a query done for every message?  I'm looking at doing this sitewide and I'm wondering how well this performs. Thanks, Eric

Re: [SAtalk] This should go to the sightings list, but it brings up

At Wed Oct 30 18:37:32 2002, Jan Korger wrote: > > On Wed, 30 Oct 2002, Tim Helton wrote: > > > score USER_AGENT_OE -0.3 > > score USER_AGENT_MUTT-4.109 > > score USER_AGENT -1.143 > > > > > > Maybe it would be beneficial to see if more than 1

[SAtalk] spamc/spamd vs. SA speed comparison

When I run: $ time spamassassin -t < sample-spam.txt I get: real0m32.395s user0m1.340s sys 0m0.070s When I use spamd/spamc I get the following in my log when I do: $ spamc < sample-spam.txt spamd[28922]: [info] setuid to kibab succeeded spamd[28922]: [Created user preferences fil

Re: [SAtalk] bayes, spamd, and future of per-user/per-system bayes

Liudvikas Bukys said: > Bug? The bayes code in 2.50 doesn't get invoked from spamd because there > is no hook from handle_user to [re]open the bayes databases. > I have to think this is an oversight, but I thought I'd better ask. > * Should spamd do this? This should now be fixed in CVS... > T

[SAtalk] Header vs Email Body Markup

This is probably me having a brain-F@rt, but... How do I get SA to alter the headers, but not the body of the email? If I set report_header 1 it removes the score from both the headers and the body. I would like the score to be left in the headers, but removed from the body of the email. ???

[SAtalk] Primary MX ping

In the "bayes, spamd, and future of per-user/per-system bayes" thread [EMAIL PROTECTED] remarked >not so good when your primary MX *is* actually unreachable ;). Couldn't we integrate an optional capability that would periodically make a port 25 connection to a specified and QUIT saving the unava

[SAtalk] Rewrite to text/plain

Hello, I want to disable the Body-Rewrite to text/plain, but I don't found any hints. Thanks for help Joerg -- Jörg Frings-Fürst 54526 Landscheid http://www.fixundfoxi.dydndns.info -- Registered Linux User # 280687 GPG Key ID : 9E5F BE06 E208 BAA3 GPG Fingerprint : 4F77 0BBE 4148 5D92

Re: [SAtalk] Rewrite to text/plain

On Wed, Oct 30, 2002 at 11:18:24PM +0100, Joerg Frings-Fuerst wrote: > I want to disable the Body-Rewrite to text/plain, but I don't found any > hints. $ man Mail::SpamAssassin::Conf look for "defang_mime" -- Randomly Generated Tagline: "You can't run sausage backwards through a meat grinder

Re: [SAtalk] Rewrite to text/plain

[dave@pacific:/etc/mail/spamassassin]% grep -i mime local.cf defang_mime 0 On Wednesday 30 October 2002 2:18 pm, Joerg Frings-Fuerst wrote: > Hello, > > I want to disable the Body-Rewrite to text/plain, but I don't found an

Re: [SAtalk] Rewrite to text/plain

Put "defang_mime0" into your /etc/mail/spamassassin/local.cf file. On Wed, 30 Oct 2002, Joerg Frings-Fuerst wrote: > Hello, > > I want to disable the Body-Rewrite to text/plain, but I don't found any > hints. > > Thanks for help > > Joerg > > -- Mike Burger http://www.bubbanfrien

Re: [SAtalk] spamc/spamd vs. SA speed comparison

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Wed, 30 Oct 2002, Kaleb Pederson wrote: > However, if I use -a -c -L as a parameter I get: > > spamd[29034]: [info] setuid to kibab succeeded > spamd[29034]: [processing message for kibab] 1000, > expecting 4656 bytes. > spamd[29034]: [identified

RE: [SAtalk] Teaching the Bayesian Filter

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Well, I don't keep ANY of the spam I get on my server and I only keep the spam I download off the server for about a day or so. Its going to be tough to train it. Would it be practical to have the filter learn the spams as they are tagged? I run m

[SAtalk] You have a secret admirer

Guess what... You've got a secret admirer! Want to find out who? Just click to http://www.SomeoneLikesYou.com to find out who! Email address: [EMAIL PROTECTED] Invitation code: gh8nwd Make sure you enter this information exactly as shown above. Sincerely, The SomeoneLikesYou Matchmaker

Re: [SAtalk] You have a secret admirer

now thats funny! :) You mean someone likes SpamAssassin? - Original Message - From: Someone Likes You To: [EMAIL PROTECTED] Sent: Wednesday, October 30, 2002 3:35 PM Subject: [SAtalk] You have a secret admirer Guess what... You've got a secret admirer! Want to find out who? Just click

[SAtalk] A few SA/mutt questions

Hey y'all, A few quick questions. I've been using SA since April, using my Linux box as my depot for the house and it is working great. My questions: 1) I'm not using 2.50 yet, but I wanted to start collecting spam to use as a training set when I do. Do I have to run it through "spamassassin -

Re: [SAtalk] You have a secret admirer

On Wednesday 30 October 2002 04:25 pm, Brian May wrote: > now thats funny! :) You mean someone likes Spamassassin? Probably from SendMail, Exim, or some other mail server. Or maybe it's actually from a spam-ware: "I hated you. Oh, how I hated you, thwarting me at every step, taunting me wit

Re: [SAtalk] You have a secret admirer

On Wed, Oct 30, 2002 at 06:38:20PM -0600, Jess Anderson wrote: > Does this mean that the salist is wide open? Why shouldn't > there be a restriction that only subscribers can post? I > thought most mailing lists were set up with that restriction. I'd say most lists about free software are open lik

Re: [SAtalk] Need help interfacing with local RBL

On Wed, Oct 30, 2002 at 02:30:51PM -0600, Ken Causey wrote: > Yes, and the problem is that I am not running a seperate RBL server. Um, rbldns /is/ a separate RBL server. > I simply want a process on the mail server listening only on localhost. > There is only one mail server and I have no interes

Re: [SAtalk] A few SA/mutt questions

On Wed, Oct 30, 2002 at 07:37:25PM -0500, Dave Slusher wrote: > 2) For those who use mutt, how can I bind multiple actions to a > single keypress? With macros -- simply list the desired keypresses in sequence. > What I have now is a key bound for the reporting. > What I want to do is to have on

Re: [SAtalk] You have a secret admirer

On Wed, 30 Oct 2002 16:25:22 -0800, you wrote: >now thats funny! :) You mean someone likes SpamAssassin? I thought it was funny that you have to give them 5+ more email addresses to get clues about who sent you the note. "Help us spread more spam and we'll tell you about someone else who spre

Re: [SAtalk] You have a secret admirer

1) yes the sa-talk mailing list is more-or-less wide open. The fact that the satalk list gets a Nigerian scam email about once every two months is a prime example. 2) no it probably should should not be closed, this is the official forum for posting technical problems and many posters aren't su

Re: [SAtalk] You have a secret admirer

--On Wednesday, October 30, 2002 7:55 PM -0500 Duncan Findlay <[EMAIL PROTECTED]> wrote: > I'd say most lists about free software are open like that. It's really > a whole community thing. Many people like to browse the web archives > and post only occasionally. Why shouldn't that be allowed? I'm

Re: [SAtalk] You have a secret admirer

Heh, quite an interesting scam. Supposedly set up to prevent the sting of rejection: if you and your "crush" list each other's email addresses as "Interests", then they notify you, and you can get that person's email address for a "small fee". So this encourages you to enter lots of valid ema

Re: [SAtalk] You have a secret admirer

On Wed, Oct 30, 2002 at 05:43:55PM -0800, Kenneth Porter wrote: > --On Wednesday, October 30, 2002 7:55 PM -0500 Duncan Findlay > <[EMAIL PROTECTED]> wrote: > > > I'd say most lists about free software are open like that. It's really > > a whole community thing. Many people like to browse the web

[SAtalk] Genealogy

Hi folks, I admin 28 or so Genealogy lists and message boards at Rootsweb.com, recently, I've noticed a big increase in posts to the lists being "bounced" to me as Admin, cause they are being rejected as S P A M..I don't want to even talk about the bounces from my Essex County NY list... The lar

Re: [SAtalk] You have a secret admirer

On Wed, Oct 30, 2002 at 06:19:30PM -0800, Matthew Cline wrote: > The *don't* say anything about selling "other personally identifiable > information" of *registered* users. Phone number, phyiscal mailing > address, gender, hobbies... Plus, why mention "other personally > identifiable informati

Re: [SAtalk] Genealogy

On Thu, Oct 31, 2002 at 02:47:04AM +, [EMAIL PROTECTED] wrote: > Last I heard, Genealogy was the 2nd or 3rd biggest internet activity, Behind what? Porn and spam? -- Duncan Findlay --- This sf.net email is sponsored by: Influence the fut

[SAtalk] spamd not working on SA 2.42+

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hi, I've been doing some tests using SA 2.41 without much troubles. Today I decided to upgrade to the latest stable version (2.43). After installing the new version, spamd didn't work anymore. spamassassin works ok. After trying different versions (

Re: [SAtalk] You have a secret admirer

On Wed, 2002-10-30 at 18:38, Jess Anderson wrote: > Does this mean that the salist is wide open? Why shouldn't > there be a restriction that only subscribers can post? I > thought most mailing lists were set up with that restriction. Some, but some people read the mailing list through an archive.

Re: [SAtalk] You have a secret admirer

On Wed, 2002-10-30 at 19:16, Frank Pineau wrote: > On Wed, 30 Oct 2002 16:25:22 -0800, you wrote: > > >now thats funny! :) You mean someone likes SpamAssassin? > > > I thought it was funny that you have to give them 5+ more email addresses to get > clues about who sent you the note. > > "Help

RE: [SAtalk] You have a secret admirer

> 2) no it probably should should not be closed, this is the official forum > for posting technical problems and many posters aren't subscribed to the > list. If spammers spam the list, it's just more test data for the > development of SA as far as I'm concerned. Others might chime in > differing o

Re: [SAtalk] You have a secret admirer

On Wed, 30 Oct 2002, Duncan Findlay wrote: > On Wed, Oct 30, 2002 at 06:38:20PM -0600, Jess Anderson wrote: > > Does this mean that the salist is wide open? Why shouldn't > > there be a restriction that only subscribers can post? I > > thought most mailing lists were set up with that restriction.

Re: [SAtalk] Rewrite to text/plain

Hallo, thanks for your answers Jörg -- Jörg Frings-Fürst 54526 Landscheid http://www.fixundfoxi.dydndns.info -- Registered Linux User # 280687 GPG Key ID : 9E5F BE06 E208 BAA3 GPG Fingerprint : 4F77 0BBE 4148 5D92 600F 7BF3 9E5F BE06 E208 BAA3 --

Re: [SAtalk] You have a secret admirer

> Heh, quite an interesting scam. Supposedly set up to prevent the sting > of rejection: if you and your "crush" list each other's email addresses > as "Interests", then they notify you, and you can get that person's > email address for a "small fee". So this encourages you to enter lots > of