At 07:30 PM 7/31/03 -0700, ian douglas wrote:
X-MailScanner-SpamCheck: spam, SpamAssassin (score=7.4, required 6, AWL
0.00,
BAYES_30 -0.93, HTML_40_50 0.74, HTML_FONT_COLOR_BLUE 0.10,
MIME_HTML_ONLY 0.10)
I'd try running it through command-line SA with the AWL on. I suspect that
M
At 11:16 PM 7/31/03 -0400, Larry Gilson wrote:
Have these statistics been fairly true over time or do they fluctuate? It
seems that the statistics are point-in-time numbers that tell more about the
reported spam rather than the effectiveness of the specific check. While
the corpus of messages fe
Hey Kelli,
Your documentation should tell you if you can deliver to a program. I took
a quick look at the doc and found the link:
http://support.openwave.com/post_office/docs/PO/FAQ/faq6.htm#E227E30
Hope this helps.
--Larry
> -Original Message-
> From: kelli coggins
> I have no
At 19:10 31/07/2003 -0700, ian douglas wrote:
> H, maybe we should make some new rules that test the ratio of
> invisible text to visible text?
But if the background is BLACK, white text is perfectly acceptable ...
right?
So defining "visible" vs "invisible" is your toughest chore.
You can work
> -Original Message-
> From: Matt Kettler
> from SA 2.55's rules/STATISTICS-set1.txt
>
> OVERALL% SPAM% HAM% S/ORANK SCORE NAME
> 27.427 51.2148 0.16580.997 1.002.06 RAZOR2_CHECK
> 13.201 24.7144 0.00741.000 0.974.40 PYZOR_CHECK
>6.254
On Thursday 31 July 2003 07:10 pm, ian douglas wrote:
> > H, maybe we should make some new rules that test the ratio of
> > invisible text to visible text?
>
> But if the background is BLACK, white text is perfectly acceptable ...
> right?
>
> So defining "visible" vs "invisible" is your toughe
X-MailScanner-SpamCheck: spam, SpamAssassin (score=7.4, required 6, AWL
0.00,
BAYES_30 -0.93, HTML_40_50 0.74, HTML_FONT_COLOR_BLUE 0.10,
MIME_HTML_ONLY 0.10)
0.00
+ -0.93
+ 0.74
+ 0.10
+ 0.10
---
does NOT equal 7.4 ... I'm no math genius but my $2000 calculator here
run
>
> Also of note it looks like the thing has some bugs in it.. it would appear
> that $RANDOMIZE is intended to be replaced with random words, but in a few
> spots, a $RANDOMIZE got split with a newline in between. It might be
> interesting to do a rule to look for it which has some \s?'s added in
> H, maybe we should make some new rules that test the ratio of
> invisible text to visible text?
But if the background is BLACK, white text is perfectly acceptable ...
right?
So defining "visible" vs "invisible" is your toughest chore.
-id
---
On Thursday 31 July 2003 03:25 pm, Gary Funck wrote:
> As you can see there's extensive use of a white font color which obscures
> the many random words that have been inserted in order to subvert signature
> checking.
> X-Spam-Status: No, hits=2.2 required=5.0
> tests=AWL,HTML_60_70,HTML_FONT_IN
Hello Ian,
Thursday, July 31, 2003, 2:55:29 PM, you wrote:
ID> Curious why SA would have default rules defined (CLICK_BELOW, AWL) that have a
ID> score of 0.00? Why bother with the overhead of these if the scores are 0?
ID> I've seen a few others come in with AWL at 0.00 and just ignored them b
Tony Earnshaw <[EMAIL PROTECTED]> wrote:
>
> For example, this Postfix server is configured to do reverse lookups
> on envelope senders (MAIL FROM: senders) /and/ separately to deny any
> envelope senders who say that they are from this domain
> (billy.demon.nl) but are sending from another IP ran
I too would like to know - the only copy I could find on my machine was in
the source directory dated at the time of my last update...
Ed
At 07:33 PM Thursday, 7/31/2003, Sanjay K. Patel wrote -=>
How can someone generate this report on the their local copy of
spamassassin?
-SKP
-Original M
As you can see there's extensive use of a white font color which obscures
the many random words that have been inserted in order to subvert signature
checking.
Actually, that kind of behavior is intended more to be bayes poison than a
razor avoider (although it's good at both). They've picked a r
At 06:22 PM 7/31/2003 -0400, Theo Van Dinter wrote:
On Thu, Jul 31, 2003 at 02:55:29PM -0700, Ian Douglas wrote:
> Curious why SA would have default rules defined (CLICK_BELOW, AWL) that
have a
> score of 0.00? Why bother with the overhead of these if the scores are 0?
If they're 0, they shouldn'
At 07:23 PM 7/31/2003 -0400, Walter Ray wrote:
HI
I would like to get Bayes and SA Learn going but I have no clue on how to do
this. Could someone please point me in the direction of some detailed
documentation that tells me what to do???
man sa-learn is a good start. It's actually pretty det
At 07:33 PM 7/31/2003 -0400, Sanjay K. Patel wrote:
How can someone generate this report on the their local copy of
spamassassin?
It's not generated by your local copy.. Those statistics are included as a
part of the SA distribution.
They are the rule hit-rate statistics from the corpus that was
How can someone generate this report on the their local copy of
spamassassin?
-SKP
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Matt
Kettler
Sent: Thursday, July 31, 2003 3:42 PM
To: Clay Atkins; [EMAIL PROTECTED]
Subject: Re: [SAtalk] DCC vs Razor2 vs
On Thu, 31 Jul 2003, Ian Douglas wrote:
> > > (this one WAS spam, I've since trained and added rules for the content)
> > > X-MailScanner-SpamCheck: not spam, SpamAssassin (score=5.1, required 6,
> > > AWL 0.00, FROM_OFFERS 4.30, OFFERS_ETC 0.37)
> >
> > Here I suspect the average of emails fro
HI
I would like to get Bayes and SA Learn going but I have no clue on how to do
this. Could someone please point me in the direction of some detailed
documentation that tells me what to do???
Thanks!!!
Walter
-
> > (this one WAS spam, I've since trained and added rules for the content)
> > X-MailScanner-SpamCheck: not spam, SpamAssassin (score=5.1, required 6,
> > AWL 0.00, FROM_OFFERS 4.30, OFFERS_ETC 0.37)
>
> Here I suspect the average of emails from this address is nearly zero
> (or perhaps your
On Thu, 31 Jul 2003, Ian Douglas wrote:
> I just got two pieces of Email, and they had these SA headers:
>
> (this one wasn't spam, it was a mailing list with advertisements throughout)
> X-MailScanner-SpamCheck: not spam, SpamAssassin (score=5.1, required 6,
> CLICK_BELOW 0.00, CONSOLIDATE
I'm having trouble thinking of a good way to handle these short ads that fly
under SA's radar. I'm running 2.60(cvs), fyi.
Here's the HTML:
satchel brains alexander evacuation metier extant crept bonaparte ar testifiers eventide acyclically barrymore merlin austin powersets ploughman break albu
On Thu, Jul 31, 2003 at 02:55:29PM -0700, Ian Douglas wrote:
> Curious why SA would have default rules defined (CLICK_BELOW, AWL) that have a
> score of 0.00? Why bother with the overhead of these if the scores are 0?
If they're 0, they shouldn't be running. It's more likely the scores
are near z
I just got two pieces of Email, and they had these SA headers:
(this one wasn't spam, it was a mailing list with advertisements throughout)
X-MailScanner-SpamCheck: not spam, SpamAssassin (score=5.1, required 6,
CLICK_BELOW 0.00, CONSOLIDATE_DEBT 1.10, LOW_INTEREST 2.29,
NO_FEE 0.5
On Thu, 31 Jul 2003, C. Regis Wilson wrote:
> obfuscatedmatch("prescription")
>
> which processes the string with all the infamous tricks
> that spammers use (i and 1, o and 0, a and @, gaps, etc.)
> Ideally, obfuscatedmatch would add more weight than a
> regular match. Someone talking innocently
Hi-
Someone in our office presented this to me. Is there a way to create a rule
for messages delivered during off hours? I work for an office that is
primarily occupied between 8:00am to 6:00pm, and most of our mail received
between 8:00pm to 6:00am is mostly junk. I definitely wouldn't su
> (Side question, what's a good gap class, \A or [-_*/\. ], or... ?)
I see spaces, periods, tildes (~), and short comment markers a lot ()
-id
---
This SF.Net email sponsored by: Free pre-built ASP.NET sites including
Data Reports, E-commerce
I am brand new to SA and have little perl (or programming) experience, but
am trying to install SA 2.55 on our Win 2K server. Thanks to great
documentation from Michael Bell, I have SA installed and the tests he
suggests seem to work.
I have no idea how to integrate it with our mail program though
I have been writing these rules to combine various version of words into one
rule. For example:
I start with
/prescription/
and do some minor subs to make
/pr[e3][s5]cr[i1]pt[i1][o0]n/i
Then, add gappies
/p.?r.?[e3].?[s5].?c.?r.?[i1].?p.?t.?[i1].?[o0].?n/i
(Side question, what's a good gap
> On Thu, 2003-07-31 at 14:45, Clay Atkins wrote:
> > Any thoughts on which of these is better, none, or a combination of
> > them?
> >
>
> Ya know, that would be a good topic for a poll at the SA news site.
>
It would be a good topic for the FAQ, too, since this questions seems to
arise almost eve
You can also look at the module at www.horde.org
I use the horde project progs to supply webmail to my customers..
They have a nice sa module
> >
> > Does anyone know of a good web based front-end for spamassassin?
> ... and does anybody know if there's some sort of "WebMin module"
> to config
At 01:45 PM 7/31/2003 -0500, Clay Atkins wrote:
Any thoughts on which of these is better, none, or a combination of them?
The STATISTICS*.txt files that come with spamassassin will speak much more
definitively about the accuracy of these tools than any human on this list can.
from SA 2.55's rules
HI Kris...
MANY thanks for the helpful info. We are adjusting our settings and I'm
definitely
going to do the upgrade ASAP.
Thanks again!!!
Walter
- Original Message -
From: "Kris Deugau" <[EMAIL PROTECTED]>
To: "SA-Talk" <[EMAIL PROTECTED]>
Sent: Tuesday, Jul
On Thu, 2003-07-31 at 14:45, Clay Atkins wrote:
> Any thoughts on which of these is better, none, or a combination of
> them?
>
Ya know, that would be a good topic for a poll at the SA news site.
--
AltGrendel <[EMAIL PROTECTED]>
---
This
> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] On
> Behalf Of Clay Atkins
> Sent: Thursday, July 31, 2003 11:45 AM
> To: [EMAIL PROTECTED]
> Subject: [SAtalk] DCC vs Razor2 vs Pyzor
>
>
> Any thoughts on which of these is better, none, or a combination of
>
Hi Luis --
It's easy enough to get open relays into the DSBL, and that's *very*
effective ;)
http://dsbl.org/faq-help has the details.
--j.
---
This SF.Net email sponsored by: Free pre-built ASP.NET sites including
Data Reports, E-commerce,
Any thoughts on which of these is better, none, or a combination of
them?
---
This SF.Net email sponsored by: Free pre-built ASP.NET sites including
Data Reports, E-commerce, Portals, and Forums are available now.
Download today and enter to w
I prefer fairly easy method of turning on timelog and then I grep for
DCC from those files.
-Original Message-
From: Matt Kettler [mailto:[EMAIL PROTECTED]
Sent: Thursday, July 31, 2003 9:54 AM
To: Sanjay K. Patel; [EMAIL PROTECTED]
Subject: Re: [SAtalk] dcc
At 07:28 AM 7/31/03 -0400, Sa
On Thu, Jul 31, 2003 at 12:37:17PM -0400, Daniel Carrera wrote:
> > X-Spam-Status: No, hits=-17.6 required=5.0
> ^
>
> One of your tests must have given it a significant negative score that
> offset all the positive scores. You might want to look at the headers and
> s
that's a negative number. Negative 17.6 is definitely less than 5.0
This due to a VERY well known scoring issue in versions 2.50-2.53.. In
these versions several rules, including MSGID_GOOD_EXCHANGE and REFERENCES,
had very large negative scores, resulting in the effective whitelisting of
messa
On Thu, 31 Jul 2003, John Schneider wrote:
> I received a spam email this morning that looks like it
> scored high enough to be tagged spam but was not.
>
> Here is the header info/score analysis:
>
> X-Spam-Status: No, hits=-17.6 required=5.0
(snip)
>
> If anyone has any comments or ideas abou
"Erick Calder" <[EMAIL PROTECTED]> wrote:
hei all, just wanted to announce I'm now publishing two dns-based lists of
ip addresses that can be used for scoring. these lists comprise addresses
of spammers doing dictionary attacks on my server.
read about it at: http://nospam.arix.com/dns.php
I thoug
John Schneider wrote:
> I received a spam email this morning that looks like it scored high
> enough to be tagged spam but was not.
>
> X-Spam-Status: No, hits=-17.6 required=5.0
>
> If anyone has any comments or ideas about this, I would appreciate
> hearing them. Thank you.
Hi,
it's commented
Hi,
X-Spam-Status: No, hits=-17.6 required=5.0
That's -17.6, not 17.6 :)
Regards,
Rick
John Schneider wrote:
I received a spam email this morning that looks like it scored high enough
to be tagged spam but was not.
Here is the header info/score analysis:
X-Spam-Status: No, hits=-17.6 requi
If you look carfully, you will see a minus sign on the spam score:
> X-Spam-Status: No, hits=-17.6 required=5.0
^
One of your tests must have given it a significant negative score that
offset all the positive scores. You might want to look at the headers and
see which
Hi,
It's possible to let SA learn to distinguish your spam, but its not as
simple as ust adding a spam to the list.
Suppose you could give SA an email and tell it to block it. Suppose that
you then get another spam with looks _almost_ like the one you got before,
but there's a tiny difference
I received a spam email this morning that looks like it scored high enough
to be tagged spam but was not.
Here is the header info/score analysis:
X-Spam-Status: No, hits=-17.6 required=5.0
tests=BASE64_ENC_TEXT,DCC_CHECK,EMAIL_ATTRIBUTION,HTML_40_50,
HTML_FONT_BIG,HTML_FONT_COLOR_RED,HTM
Hi, people, remember my last post about a DOS attack? well, I had to block
the entire mail traffic from alternativagratis.com at iptables level, since
it left me without any child processes of Sendmail to run. Since then the
mail subsystem it's working pretty well again. The problem is that I've
[EMAIL PROTECTED] wrote:
(1) From: Tail Wagging Offers News Letter <[EMAIL PROTECTED]>
X-Spam-Score: 5
X-Spam-Level: * (5)
X-Spam-Flag: NO
X-Scanned-By: MIMEDefang 2.28 (www.roaringpenguin.com/mimedefang)
My spam threshold is set to 1.5. This email should have been flagged
At 09:32 AM 7/31/2003 -0500, Cherie Gatlin wrote:
Hi, I would just like to know how to ADD emails to spamassassin. It
catches quite a few, but I still get 6 or 7 a day and I would like to know
how to configure the program to catch those the next time they come in.
Well spamassassin doesn't kee
At 07:28 AM 7/31/03 -0400, Sanjay K. Patel wrote:
How can I verify that spamassassin is using dcc? When I do cdcc info I do
get a response but this is no guarantee that spamassassin is using dcc. I
call spamassassin through MailScanner
I usually test my Mailscanner's setup using the spamassassin co
You need to configure either your MTA (e.g. sendmail) or your mail client
(e.g. pine, mutt, Mozilla mail) to do something special with emails marked
as spam (e.g. send them to a different folder).
Here is an example of the relevant portion of the header:
X-Spam-Status: Yes, hits=6.0 required=
Hi, I would just like to know how to ADD
emails to spamassassin. It catches quite a few, but I still get 6 or
7 a day and I would like to know how to configure the program to catch those the
next time they come in.
Thanks!
Cherie
**
I have a quick question or update. I read in a perl guide that \> actually
matches the end of a "word". I guess similar to \b, or something?
I want to match the literal character ">", as in a rule that matches
"<[EMAIL PROTECTED]>". So if the rule ends something like:
>From =~ /.\>/i
It s
On Thursday, Jul 31st 2003 at 14:24 +0100, quoth Nick Leverton:
=>I'v been reading with interest the recent thread on regular expression
=>performance. Has anyone ever done any performance figures on, for
=>instance, large whitelists though ? A client of ours wants to whitelist
=>all their re
At 12:05 PM 7/31/03 +0530, jagan wrote:
sir,
i ahve downloaded ur spamassasin . i need to insatll to my server which runs
on linux. I like to have the method of
1.INSTALLATION AND
2.INTEGRATING THIS WITH MY MTA QMAIL USING spamd . That is via C AND NOT
PERL.
so how could i go about installing.
Em Qua, 2003-07-30 às 22:49, Justin Mason escreveu:
> Raul Dias writes:
> >BTW, you don't need to localize $_ .
> >$_ is already localized per block {}.
>
> !? are you sure?
I should have gone sleep before written that. :)
The bahaviour is not the same to subroutines. So Mark were right in
locali
Title: Bayes Database Size
I am wondering if there is a setting to increase the size of the bayes database.
I am using a shared database for bayes learning and would like the database to learn
more so that it is more reliable for all users without setting up individual scanning.
Dan Jones
How can I verify that spamassassin is using dcc? When I do cdcc info I do
get a response but this is no guarantee that spamassassin is using dcc. I
call spamassassin through MailScanner
SKP
---
This SF.Net email sponsored by: Free pre-built AS
I'v been reading with interest the recent thread on regular expression
performance. Has anyone ever done any performance figures on, for
instance, large whitelists though ? A client of ours wants to whitelist
all their regular correspondents. Sounds reasonable except that there
may be over 1
Title: Untitled
Looks like it was a two fold problem, I still had a 'defang_mime 0' entry inmy sa-mimedefang.cf file, and I also setup a working dir for the bayes db'swithpermissions and set the location in the cf file, now my box is ideling away.RegardsRabie-Original Message-From: Simo
Hello Rich,
Wednesday, July 30, 2003, 4:20:52 PM, you wrote:
RP> I've been pondering an idea for an improvement to SA. Would anyone else
RP> find the following to be useful:
RP> report_safe_attach_threshold -- set threshold above which a mail has to
RP> score to have report_safe level 1 appl
ID> When I run sa-learn on known spam/ham, I get output like this:
ID>
ID> ..
ID> Learned from 4 messages.
ID> And then it just hangs there, it never completes. No other output, nada.
ID> Any ideas
sir,
i ahve downloaded ur spamassasin . i need to insatll to my server which runs
on linux. I like to have the method of
1.INSTALLATION AND
2.INTEGRATING THIS WITH MY MTA QMAIL USING spamd . That is via C AND NOT PERL.
so how could i go about installing.
ur INSTALL does not provide detais on
Evan Platt wrote:
>
> SpamAssassin - SA-Talk is for SpamAssassin for Unix. Are you running
Hi,
is there a special SA list for SpamAssassin in Windows or can I send
inquieres on this list too? Should I tag may subject if question is
windows related, e.g. [W32] .
And I did not get a hint on sendin
66 matches
Mail list logo
