Re: [SAtalk] Rule for no reverse DNS

2003-09-16 Thread Bob Proulx
Michael W. Cocke wrote: Just FYI, AOL is doing reverse DNS and won't accept incoming email if they don't approve of the sending IP address.. as in, they won't accept messages from my domain because I use dyndns and not a static IP. It is probably not that you don't have reverse DNS. It is

[SAtalk] The Verisign folly

2003-09-16 Thread Kristian Koehntopp
http://slashdot.org/article.pl?sid=03/09/16/0034210mode=nestedtid=126tid=95tid=98tid=99 Verisign today just added wildcard A records pointing to 64.94.110.11 to the .com and .net zones. How does this affect SpamAssassin and if it does, what are we doing about this? Kristian

Re: [SAtalk] Infinite-Monkeys

2003-09-16 Thread Bob Apthorpe
Hi, On Mon, 15 Sep 2003 09:16:02 -0700 ian douglas [EMAIL PROTECTED] wrote: Hey folks. Left the list for a while but re-subscribed 'cause I have a question to ask: I have MailScanner running SA for me on 2 different servers and got everything working VERY well about two months ago.

Re: [SAtalk] Rule for no reverse DNS

2003-09-16 Thread Bob Apthorpe
On Mon, 15 Sep 2003 18:23:46 -0400 Michael W. Cocke [EMAIL PROTECTED] wrote: On Mon, 15 Sep 2003 13:39:18 -0500, you wrote: On Mon, 2003-09-15 at 08:13, Michael W. Cocke wrote: [snip] Pardon me while I expose my ignorance. What's a smarthost, and given me by which provider? All I

Re: [SAtalk] The Verisign folly

2003-09-16 Thread Martin Huber
How does this affect SpamAssassin and if it does, what are we doing about this? Well, for one thing ORBS is magically alive again: :( --SNIP-- RCVD_IN_ORBS (0.1 points) RBL: Received via a relay in orbs.dorkslayers.com [RBL check: found

[SAtalk] Website spammer with number

2003-09-16 Thread Andrea Riela
Hi folks, A lot of spammer's websites in body are like these: Donat43 Discountrate2 Account45 ... .com/.net/.biz ... (this is indifferent). Wich type of URI rule could I use to filter these pornsite/commsite ? Have you got any suggestion? Examples? Thanks for all Best Regards Andrea

[SAtalk] NO_DNS_FOR_FROM now useless? Rule needs crit fix?

2003-09-16 Thread Michael Bell
At least I think so. Tell me I'm wrong and I'll slink into the corner. According to SlashDot, Verisign is now as of 9/15 evening wildcarding all .com and .net domains that aren't registered to go to a advertising page! Now, admittedly that doesn't affect other TLDs. And if the advertising page

Re: [SAtalk] qmail + vpopmail + spamassassin

2003-09-16 Thread maca02
We have the same cofiguration on our mail server now and today we decided to reconfigure all to qmail-vpopmail-sa-amavis-[something], because amavis and sa are scripts, that can work together. Nowadays it is not available amavis+sa+qmail, so we had to rewrite the amavis script for using with

Re: [SAtalk] NO_DNS_FOR_FROM now useless? Rule needs crit fix?

2003-09-16 Thread Christof Damian
how about a DNS_FOR_FROM_IS_SITEFINDER as they all point to the same ip address you have just to check for that one. christof On Tue, 16 Sep 2003, Michael Bell wrote: At least I think so. Tell me I'm wrong and I'll slink into the corner. According to SlashDot, Verisign is now as of 9/15

Re: [SAtalk] The Verisign folly

2003-09-16 Thread Daniel Quinlan
Kristian Koehntopp [EMAIL PROTECTED] writes: How does this affect SpamAssassin and if it does, what are we doing about this? It has a very negative effect on some tests, particularly NO_DNS_FOR_FROM which caught roughly 2% of spam with a 99.9% accuracy rate (those are my real-time numbers

Re: [SAtalk] Website spammer with number

2003-09-16 Thread Fred
# Domain name starts with number(s) uri MY_DOMAIN_STARTS_NUMS /[.\/@]+\d+[a-zA-Z\-]+[a-zA-Z0-9\-]*\.(com|net|biz|info)/i describe MY_DOMAIN_STARTS_NUMS Domain name starts with numbers score MY_DOMAIN_STARTS_NUMS0.5 # Domain name ends with number(s) uri MY_DOMAIN_ENDS_NUMS

Re: [SAtalk] Rule for no reverse DNS

2003-09-16 Thread Michael W. Cocke
On Tue, 16 Sep 2003 02:07:21 -0500, you wrote: [much snippage] Your options are a) smarthost, or b) get a static allocation with proper DNS (forward and reverse) and current domain and SWIP contact info. Make sure your mail server sends a FQDN as its HELO greeting and that your abuse,

R: [SAtalk] Website spammer with number

2003-09-16 Thread Andrea Riela
Hi # Domain name starts with number(s) ... # Domain name ends with number(s) ... And domain name with number(s) like: Getit4less Hotxxxmail4u ...?? Thank you very much Andrea --- This sf.net email is sponsored by:ThinkGeek Welcome to

[SAtalk] Rule about click and evoclick

2003-09-16 Thread Andrea Riela
Hi folks, I'm thinking on uri MY_SPAM_HOST /http:\/\/(click|clix|track|adv)\d*\.\w+/i describe MY_SPAM_HOST URL points to a server named click score MY_SPAM_HOST 4.0 And if I've spam from evoclick.dom, or evoclix? Mmm ... It's usefull if I add the word fuck in the rule,

[SAtalk] cygwin + 2.60rc5

2003-09-16 Thread Fred
Hello, I just installed 2.60rc5 on cygwin (perl 5.6.1). When I start spamd I receive an error: $ spamd -d Use of uninitialized value in scalar assignment at /usr/lib/perl5/site_perl/5.6.1/Mail/SpamAssassin/Util.pm line 202. It appears that spamd is still running, as I am able to use the

Re: [SAtalk] Rule for no reverse DNS

2003-09-16 Thread Michael W. Cocke
On Tue, 16 Sep 2003 02:07:21 -0500, you wrote: [much snippage] Your options are a) smarthost, or b) get a static allocation with proper DNS (forward and reverse) and current domain and SWIP contact info. Make sure your mail server sends a FQDN as its HELO greeting and that your abuse,

Re: R: [SAtalk] Website spammer with number

2003-09-16 Thread mikea
On Tue, Sep 16, 2003 at 01:14:07PM +0200, Andrea Riela wrote: Hi # Domain name starts with number(s) ... # Domain name ends with number(s) ... And domain name with number(s) like: Getit4less Hotxxxmail4u ...?? Be aware that scoring mail-IDs this way may cause false positives, and

Re: [SAtalk] The Verisign folly

2003-09-16 Thread wrolf . courtney
This is an appalling unilateral abuse of VeriSign's power. Forget about the negative consequences. They are simply abusing their control over these TLDs to direct users who make typos to their site. Anyone know appropriate VeriSign, ICANN, or other e-mail addresses that we can express our

[SAtalk] Report send to user as to what spam they received?

2003-09-16 Thread Jennifer Fountain
Is there a way with SA to generate a report every day (and email to admin - me) with what spam it stopped? I wasn't sure if SA had an option or if I had to use third party software. Cheers, Jenn --- This sf.net email is sponsored

[SAtalk] annoying messages from DCC

2003-09-16 Thread Luis HernĂ¡n Otegui
Hi, just a little thing: Since I've upgraded to SA-2.60-RC4, I have this messages coming to my maillog: Sep 16 10:27:21 nahuel spamd[19247]: DCC - check failed: Insecure directory in $ENV{PATH} while running with -T switch at /usr/local/lib/perl5/site_perl/5.8.0/Mail/SpamAssassin/Dns.pm line

Re: [SAtalk] The Verisign folly

2003-09-16 Thread Kai Schaetzl
Kristian Koehntopp wrote on Tue, 16 Sep 2003 08:09:31 +0200: Verisign today just added wildcard A records pointing to 64.94.110.11 to the .com and .net zones. it's already been that way for .tv and .cc domains, but most people didn't notice. How does this affect SpamAssassin and if it

Re: [SAtalk] Rule for no reverse DNS

2003-09-16 Thread Kai Schaetzl
Michael W. Cocke wrote on Mon, 15 Sep 2003 18:23:46 -0400: My ISP might run an sm You sure have access to it, not specifically to it, but there is one you can use, rest assured, you just need to ask them or read the documents they sent you. If anyone using AOL needs to hear from me It's

RE: [SAtalk] NO_DNS_FOR_FROM now useless? Rule needs crit fix?

2003-09-16 Thread Chris Santerre
That sounds like the best idea so far. Verisign = teh suxor I suppose it is way too late to get it into 2.60. I missed this article yesterday. Thanks for the info as well. -Original Message- From: Christof Damian [mailto:[EMAIL PROTECTED] Sent: Tuesday, September 16, 2003 5:28 AM

Re: [SAtalk] Rule for no reverse DNS

2003-09-16 Thread Kai Schaetzl
Michael W. Cocke wrote on Mon, 15 Sep 2003 09:13:25 -0400: Pardon me while I expose my ignorance. What's a smarthost, and given me by which provider? All I get from my so-called ISP is a wire with an IP address, or do you mean dyndns? They also provide you with an SMTP server you can use

Re: [SAtalk] Rule for no reverse DNS

2003-09-16 Thread Kevin Sullivan
--On 09/15/03 18:23:46 -0400 Michael W. Cocke wrote: If anyone using AOL needs to hear from me, I'll tell them to complain to whatever AOL genius decided that this would be a good anti-spam measure. Please note - Due to the intense volume of spam, we have installed site-wide spam filters at

RE: [SAtalk] The Verisign folly

2003-09-16 Thread Giles Coochey
Interesting Link: http://www.iab.org/Documents/icann-vgrs-response.html smime.p7s Description: S/MIME cryptographic signature

[SAtalk] Increasing memory with SA 2.55 problem

2003-09-16 Thread Klaus Mueller
Hi, I have a problem with increasing memory usage of SpamAssassin on windows (spamc/spamd). I created a stand alone test program to check if the increasing memory is a problem of communication code or SA. The program tests the sample-spam.txt file using a loop of 1000 times. Result (Win2k SP4;

Re: [SAtalk] The Verisign folly

2003-09-16 Thread Rick Macdougall
Hi, [EMAIL PROTECTED] wrote: This is an appalling unilateral abuse of VeriSign's power. Forget about the negative consequences. They are simply abusing their control over these TLDs to direct users who make typos to their site. Anyone know appropriate VeriSign, ICANN, or other e-mail

[SAtalk] [RD] Domaine contains a color?

2003-09-16 Thread Chris Santerre
Well I've been swamped with other projects, and SA has been rocking. I'm starting to look at my spams again and I have a goofy question for everyone with a corpus. Can anyone give me stats on how many spam/ham have colors in the domain name? example: bluemountain.com, bluebottle.com,

Re: [SAtalk] Report send to user as to what spam they received?

2003-09-16 Thread Theo Van Dinter
On Tue, Sep 16, 2003 at 09:47:13AM -0400, Jennifer Fountain wrote: Is there a way with SA to generate a report every day (and email to admin - me) with what spam it stopped? I wasn't sure if SA had an option or if I had to use third party software. Since SA doesn't stop any mails from being

Re: [SAtalk] Rule about click and evoclick

2003-09-16 Thread Clay Irving
On Tue, Sep 16, 2003 at 01:22:35PM +0200, Andrea Riela wrote: I'm thinking on uri MY_SPAM_HOST /http:\/\/(click|clix|track|adv)\d*\.\w+/i describe MY_SPAM_HOST URL points to a server named click score MY_SPAM_HOST 4.0 And if I've spam from evoclick.dom, or evoclix?

[SAtalk] has orbs.dorkslayers been removed from spamass 2.6?

2003-09-16 Thread spamass
With all the talk about Osirusoft, I didn't even know that orbs was dead! thanks. --- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf ___

Re: [SAtalk] The Verisign folly

2003-09-16 Thread Robert Kehl
- Original Message - From: Bill Landry [EMAIL PROTECTED] Sent: Tuesday, September 16, 2003 4:56 PM - Original Message - From: Kai Schaetzl [EMAIL PROTECTED] Anyone knows a workaround for sendmail, so that it knows that any domain pointing to 64.94.110.11 isn't valid? I

[SAtalk] Re: The Verisign folly

2003-09-16 Thread Lance A. Brown
On Tue, 2003-09-16 at 13:03, Rich Puhek wrote: On a side note, the tactic appears to have backfired... 64.94.110.11 appears to be unpingable, and If I try typing a made-up domain into a browser, the page times out. Perhaps Verisign is suffering the /. effect? Several ISPs have null-routed

Re: [SAtalk] The Verisign folly

2003-09-16 Thread Rich Puhek
[EMAIL PROTECTED] wrote: This is an appalling unilateral abuse of VeriSign's power. Forget about the negative consequences. They are simply abusing their control over these TLDs to direct users who make typos to their site. Anyone know appropriate VeriSign, ICANN, or other e-mail addresses

[SAtalk] Re: The Verisign folly

2003-09-16 Thread Rich Puhek
Lance A. Brown wrote: On Tue, 2003-09-16 at 13:03, Rich Puhek wrote: On a side note, the tactic appears to have backfired... 64.94.110.11 appears to be unpingable, and If I try typing a made-up domain into a browser, the page times out. Perhaps Verisign is suffering the /. effect? Several

[SAtalk] RCVD_IN_ORBS

2003-09-16 Thread Gary Carr
SA is flagging 100% of the incoming email with the RCVD_IN_ORBS score. Even mail from our internal network. None of the ip addresses are listed in X-Spam-Status: No, hits=0.5 required=3.0 tests=RCVD_IN_ORBS version=2.55 Has the orbs.dorkslayers.com gone the way of Osirusoft? Thanks, Gary

Re: [SAtalk] The Verisign folly

2003-09-16 Thread Evan Platt
--On Tuesday, September 16, 2003 12:03 PM -0500 Rich Puhek [EMAIL PROTECTED] wrote: On a side note, the tactic appears to have backfired... 64.94.110.11 appears to be unpingable, and If I try typing a made-up domain into a browser, the page times out. Perhaps Verisign is suffering the /.

Re: [SAtalk] no spam today uses SA?

2003-09-16 Thread Vivek Khera
CW == Carlo Wood [EMAIL PROTECTED] writes: CW On Mon, Sep 15, 2003 at 04:46:18PM -0400, Theo Van Dinter wrote: They need to follow the PAL/GPL. A commercial version is perfectly fine, assuming they've made changes such that we're a component. CW They still have to provide the source code

Re: [SAtalk] SpamAssassin 2.60 rc4 released

2003-09-16 Thread Matt Thoene
On Friday, September 12, 2003 @ 11:33:14 AM [-0700], Vivek Khera wrote: MT == Matt Thoene [EMAIL PROTECTED] writes: MT Hi...just upgraded from rc3 to rc4 and am now seeing this in the logs... MT razor2 check skipped: Bad file descriptor Insecure dependency in MT connect while running setuid

RE: [SAtalk] The Verisign folly

2003-09-16 Thread Covington, Chris
All interested parties should read: http://www.iab.org/Documents/icann-vgrs-response.html I just hope Verisign doesn't read this as OK, we'll change an aspect or two of how the new system works. Chris --- This sf.net email is sponsored

Re: [SAtalk] no spam today uses SA?

2003-09-16 Thread Vivek Khera
RD == Rich Duzenbury [EMAIL PROTECTED] writes: RD It looks as though the same trademark atty Joseph G Adams has RD attempted to register it for deersoft and for network associates. Maybe because NA bought Deersoft? -- =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Vivek

Re: [SAtalk] Razor 2.22- 2.36 Taint issue patch

2003-09-16 Thread Vivek Khera
ML == Mike Loiterman [EMAIL PROTECTED] writes: ML I followed the instuructions below to patch Razor2's taint problem. ML The Config.pm patch worked perfectly, but the Core.pm patch failed at ML hunk 1. Is this an SA issue, or a Razor issue..(i.e. patch created ML by Razor folks or SA folks)?

[SAtalk] sa-learn cron jobs = BAYES_90

2003-09-16 Thread Darxus
Today, for the first time, spamassassin's bayesian filter decided its own cron job output wasn't spam. I've been running 0 3 * * * /home/darxus/sausr/local/bin/sa-learn --rebuild since 8/26, and every day it was ranked spam probability is 90 to 99%. I was about to give up on spamassassin and

[SAtalk] Razor2.patchfile missing?

2003-09-16 Thread Mike Loiterman
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Just installed rc5, but I seem to be missing the Razor2.patchfile. Where is it located? Is this different then the patchfile posted to the list? I tried applying the ptachfile posted to the list but it fails at chunk 1 on the Core.pm patch.

Re: [SAtalk] RCVD_IN_ORBS

2003-09-16 Thread Jim
On Tue, Sep 16, 2003 at 01:43:14PM -0400, Gary Carr wrote: SA is flagging 100% of the incoming email with the RCVD_IN_ORBS score. Even mail from our internal network. None of the ip addresses are listed in X-Spam-Status: No, hits=0.5 required=3.0 tests=RCVD_IN_ORBS version=2.55 Has

Re: [SAtalk] The Verisign folly

2003-09-16 Thread Matt Thoene
On Tuesday, September 16, 2003 @ 11:09:25 AM [-0700], Covington, Chris wrote: All interested parties should read: http://www.iab.org/Documents/icann-vgrs-response.html I just hope Verisign doesn't read this as OK, we'll change an aspect or two of how the new system works. Chris Well, it

RE: [SAtalk] The Verisign folly

2003-09-16 Thread Tom Meunier
Date: Sat, 25 Jan 2003 10:19:37 +1100 -tom -Original Message- http://www.iab.org/Documents/icann-vgrs-response.html --- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf

Re: [SAtalk] The Verisign folly

2003-09-16 Thread mikea
On Tue, Sep 16, 2003 at 07:42:22PM +0100, [EMAIL PROTECTED] wrote: I'm sure ICANN has already gotten an earful. I, for one, and going to leave ICANN alone so that they can concentrate on a course of action against Verisign. They have already responded in a letter to VeriSign: To

RE: [SAtalk] RCVD_IN_ORBS

2003-09-16 Thread Todd Schuldt
Posted in another newgroup area: Message-ID: [EMAIL PROTECTED] As has been pointed out on the NANOG mailing list, many recent versions of SpamAssassin still check for DNSBLs on dorkslayers.com. While dorkslayers.com is still a registered domain name, it doesn't have a name server and therefore

Re: [SAtalk] The Verisign folly

2003-09-16 Thread [EMAIL PROTECTED]
I'm sure ICANN has already gotten an earful. I, for one, and going to leave ICANN alone so that they can concentrate on a course of action against Verisign. They have already responded in a letter to VeriSign: To restore the data integrity and predictability of the DNS infrastructure, the

Re: [SAtalk] Razor2.patchfile missing?

2003-09-16 Thread Theo Van Dinter
On Tue, Sep 16, 2003 at 01:25:07PM -0500, Mike Loiterman wrote: Just installed rc5, but I seem to be missing the Razor2.patchfile. Where is it located? grrr It's in CVS, but it wasn't added to the MANIFEST file so it wasn't put in the tarball. :( I just fixed it. The patch is the same as

RE: [SAtalk] no spam today uses SA?

2003-09-16 Thread Bill
It is pretty obvious a lot of people assume things about the SA licence but haven't actually read it or tried to understand it... Same goes for a lot of Open Source projects, it seems. Many companies just assume that the authors of an open source project cannot afford to sue and just do

RE: [SAtalk] The Verisign folly

2003-09-16 Thread Covington, Chris
-Original Message- From: J. S. Townsley [mailto:[EMAIL PROTECTED] Note the date on that first letter. --JST * Covington, Chris [Tue, 16 Sep 2003] From: Covington, Chris [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: RE: [SAtalk] The Verisign folly All interested parties should

Re: [SAtalk] RCVD_IN_ORBS

2003-09-16 Thread Adam D. Barratt
On Tue, 2003-09-16 at 18:43, Gary Carr wrote: SA is flagging 100% of the incoming email with the RCVD_IN_ORBS score. Even mail from our internal network. None of the ip addresses are listed in [...] Has the orbs.dorkslayers.com gone the way of Osirusoft? dorkslayers has been dead as a doornail

Re: [SAtalk] no spam today uses SA?

2003-09-16 Thread Theo Van Dinter
On Tue, Sep 16, 2003 at 02:21:47PM -0400, Vivek Khera wrote: Why? Do they own the copyrights to SA? If not, then there's not much they can do about it. I don't think we need to go down this path... At the moment, copyright of the individual code bits hasn't been assigned anywhere officially.

[SAtalk] How to process a local DNS query?

2003-09-16 Thread Bill Landry
I wanted to setup an RHSBL test that would simply query my local DNS server for a host A record. Here is what I attempted to do, however, this does not work: header RCVD_IN_VERISCAM eval:check_rbl_from_host('veriscam', '.', '64.94.110.11') describe RCVD_IN_VERISCAMVERISCAM: bogus

RE: [SAtalk] The Verisign folly

2003-09-16 Thread Tom Meunier
I think the linked IAB missive is related to this: http://www.merit.edu/mail.archives/nanog/2003-01/msg00023.html WTF is Verisign doing anyway? Deciding the Internet is their own private toy? And everyone in the world is using it at their (verisign's) whim? -tom -Original Message-

RE: [SAtalk] The Verisign folly

2003-09-16 Thread Bart Schaefer
On Tue, 16 Sep 2003, Tom Meunier wrote: WTF is Verisign doing anyway? Deciding the Internet is their own private toy? Making a grab for cash: Back-of-the-envelope calculations suggest that VeriSign could create revenue of $1m per day for itself and partners if it could convert

Re: [SAtalk] user_prefs file creation error

2003-09-16 Thread Brian Morrison
On Mon, 15 Sep 2003 15:57:34 -0400 in [EMAIL PROTECTED] Russell Premont [EMAIL PROTECTED] wrote: When I run the following sa-learn --spam --dir /spamassassin/Maildir/cur I get the following error Failed to create default user preference file /spamassassin/.spamassassin/user_prefs I

Re: [SAtalk] has orbs.dorkslayers been removed from spamass 2.6?

2003-09-16 Thread Adam D. Barratt
On Tue, 2003-09-16 at 17:49, [EMAIL PROTECTED] wrote: With all the talk about Osirusoft, I didn't even know that orbs was dead! Dorkslayers died a death some months ago, after the nameservers were hit by over 6500 machines in 17 seconds in May, each making multiple queries (and that was the

Re: [SAtalk] blacklist_to ?

2003-09-16 Thread Fred I-IS.COM
I am using 2.60rc2 rc3 rc5 and it works in all these versions. In 2.55 it does not work or was not implemented. Frederic Tarasevicius Internet Information Services, Inc. Razvan Cosma wrote: Hello, I have seen this option mentioned several places on the web (but not in the perldoc

[SAtalk] Deleting spam

2003-09-16 Thread Bill Banks
Hi, I need to know how-to setup SA to delete spam on the server side not the client side - Bill Banks Wachusett Programming http://www.ourweb.net508-829-2005 --

Re: [SAtalk] The Verisign folly

2003-09-16 Thread daniel lance herrick
On Tue, 16 Sep 2003, Matt Thoene wrote: On Tuesday, September 16, 2003 @ 11:09:25 AM [-0700], Covington, Chris wrote: All interested parties should read: http://www.iab.org/Documents/icann-vgrs-response.html I just hope Verisign doesn't read this as OK, we'll change an aspect or two

RE: [SAtalk] The Verisign folly

2003-09-16 Thread J. S. Townsley
Note the date on that first letter. --JST * Covington, Chris [Tue, 16 Sep 2003] From: Covington, Chris [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: RE: [SAtalk] The Verisign folly All interested parties should read: http://www.iab.org/Documents/icann-vgrs-response.html I just

[SAtalk] Help Unblacklisting RBL

2003-09-16 Thread Jennifer Wheeler
what am i doing wrong here? I am trying to unblacklist an address getting tagged by Infinite-Monkeys. using spamassassin 2.55 i put the following line in /etc/mail/spamassassin/local.cf with all my other rules and whitelisted addresses (all work fine) but this will not work...

[SAtalk] Update of manufacturer strings

2003-09-16 Thread Hubert Daubmeier
Hello my postmaster has pointed me to this discussion list -- Questions regarding SpamAssassin should be sent to the mailing list: spamassassin-talk /at/ lists /dot/ sourceforge /dot/ net. -- I would like to outline a problem and like to ask for

[SAtalk] This guys annoying.

2003-09-16 Thread Robert Nicholson
ok folks Spamassassin isn't doing a very good job with this guys spam From: Mark [EMAIL PROTECTED] Date: Tue Sep 16, 2003 11:16:00 AM Asia/Bangkok To: [EMAIL PROTECTED] Subject: I heard from them :) Return-Path: [EMAIL PROTECTED] Delivered-To: [EMAIL PROTECTED] Delivered-To: [EMAIL PROTECTED]

Re: [SAtalk] sa-learn cron jobs = BAYES_90

2003-09-16 Thread Darxus
Reading through this list a bit got me to run some of these through spamassassin -D. Looks like the reason the sa-learn cron jobs were being classified as spam is that most legitimate email is sent to me as [EMAIL PROTECTED] or [EMAIL PROTECTED], and most spammers email me as [EMAIL PROTECTED]

Re: [SAtalk] Razor 2.22- 2.36 Taint issue patch

2003-09-16 Thread Mike Loiterman
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 I posted my latest patches for razor 2.34 here a few days ago. I Is this the patch you posted: - - - --- Client/Core.pm~ 2002-11-25 19:07:38.0 +0100 +++ Client/Core.pm 2002-11-25 18:55:35.0 +0100 @@ -216,8 +216,10 @@

RE: [SAtalk] Razor 2.22- 2.36 Taint issue patch

2003-09-16 Thread Mike Loiterman
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Kris Deugau wrote: Mike Loiterman wrote: I followed the instuructions below to patch Razor2's taint problem. The Config.pm patch worked perfectly, but the Core.pm patch failed at hunk 1. Is this an SA issue, or a Razor issue..(i.e. patch

Re: [SAtalk] The Verisign folly

2003-09-16 Thread Greg Cirino
-tom -Original Message- http://www.iab.org/Documents/icann-vgrs-response.html the problem is all the other TLD's that are wildcard(ed) and hosted on other registrar roots. Not just .com and .net The .cn .tw (not yet .kr) are also using the same technique I believe there was a post

Re: [SAtalk] How to process a local DNS query?

2003-09-16 Thread Daniel Quinlan
Bill Landry [EMAIL PROTECTED] writes: I wanted to setup an RHSBL test that would simply query my local DNS server for a host A record. Here is what I attempted to do, however, this does not work: [...] The current 2.60 code isn't able to do such a test. Just apply this patch to the 2.60

Re: [SAtalk] Razor2.patchfile missing?

2003-09-16 Thread Daniel Quinlan
Mike Loiterman [EMAIL PROTECTED] writes: I tried applying the ptachfile posted to the list but it fails at chunk 1 on the Core.pm patch. I'm trying to patch razor-agents-2.34. This patch (which will be with the next release) applies fine for me. --- start of cut text -- This

Re: [SAtalk] [SAdev] SpamAssassin 2.60 rc5 released

2003-09-16 Thread Brian Morrison
On Mon, 15 Sep 2003 23:30:51 -0400 in [EMAIL PROTECTED] Theo Van Dinter [EMAIL PROTECTED] wrote: Pick it up from: http://SpamAssassin.org/released/Mail-SpamAssassin-2.60-rc5.tar.gz http://SpamAssassin.org/released/Mail-SpamAssassin-2.60-rc5.zip Built this from .spec file, updated the

Re: [SAtalk] [SAdev] SpamAssassin 2.60 rc5 released

2003-09-16 Thread Theo Van Dinter
On Tue, Sep 16, 2003 at 10:12:46PM +0100, Brian Morrison wrote: Built this from .spec file, updated the rpms, identifies as 2.60-rc4 AFAICS. Slip up,or maybe I'm still running rc4 and the rpm -U failed? To build the RPM from these rc tarballs, you have to rename them to

Re: [SAtalk] Help Unblacklisting RBL

2003-09-16 Thread Bob Apthorpe
Hi, On Tue, 16 Sep 2003, Jennifer Wheeler wrote: what am i doing wrong here? I am trying to unblacklist an address getting tagged by Infinite-Monkeys. using spamassassin 2.55 i put the following line in /etc/mail/spamassassin/local.cf with all my other rules and whitelisted addresses

[SAtalk] Weird

2003-09-16 Thread Philip Bubel
Since upgrading to SA 2.55 (SA is being called via procmail), I'm getting a large amount of error messages in my mail.log (see blow). SA is working fine aside from these error messages however. Anybody know what's I missed during the upgrade? Please let me know. Thanks spamd[22835]: Failed to

Re: [SAtalk] Help Unblacklisting RBL

2003-09-16 Thread Daniel Quinlan
Jennifer Wheeler [EMAIL PROTECTED] writes: what am i doing wrong here? I am trying to unblacklist an address getting tagged by Infinite-Monkeys. Monkeys is a DNS blacklist. It is also not used by SpamAssassin by default, so you seem to be confused in one way or another. 1. unblacklist_from

RE: [SAtalk] Help Unblacklisting RBL

2003-09-16 Thread Jennifer Wheeler
I completely agree with your opinion about the open proxy biz. I'll see if we can get them to take care of that on their end. In the meantime, I've been asked to get these particular emails through to us without a spam tag :) I'm just having trouble accomplishing that. (and have had to fight

Re: [SAtalk] Razor 2.22- 2.36 Taint issue patch

2003-09-16 Thread Daniel Quinlan
Mike Loiterman [EMAIL PROTECTED] writes: Is this the patch you posted: - - - --- Client/Core.pm~ 2002-11-25 19:07:38.0 +0100 +++ Client/Core.pm2002-11-25 18:55:35.0 +0100 @@ -216,8 +216,10 @@ foreach $rr ($query-answer) { my $pushed = 0;

[SAtalk] FORGED_MUA_OUTLOOK from a mac

2003-09-16 Thread Bill Leuze
Hi Is it possible that SpamAssassin doesn't recognize legitimate mac outlook 4.01 users? I had to whitelist a mac user so her messages could get through, What brings her over the bounce threshold is FORGED_MUA_OUTLOOK. following is message that would bounce if not whitelisted: Return-Path:

[SAtalk] help with master.cf and filter

2003-09-16 Thread Alan Fullmer
I have a question, and forgive me if this has been posted already. I scoured through the docs and coulnd't really find the info I needed. I am trying to pass a variable through to a shell. (i've been told to use a forward file, and use procmailrc file. but I am also using mysql for my

Re: [SAtalk] Razor 2.22- 2.36 Taint issue patch

2003-09-16 Thread Kris Deugau
No need to CC me; I'm subscribed to the list. Mike Loiterman wrote: Kris Deugau wrote: The patch was created by someone else. I didn't apply it directly, as I wanted a patch to apply during a .rpm build, so I rebuilt it as a whole-source-tree patch. I've just pushed it out to

[SAtalk] bayes_path error?

2003-09-16 Thread farber
I'm running spamd in daemon mode and I get the following error: File exists?Cannot open bayes_path /home/pop3/.spamassassin/bayes R/W: File exists?Cannot open bayes_path /home/pop3/.spamassassin/bayes R/W: File exists? Also spamd dies frequently supervice has to restart it about every 20

[SAtalk] RD - Here is a rule to check for Verisign redirect domain

2003-09-16 Thread Fred
Here's a quick rule I just made in response to Verisign's actions. header __DNS_SITEFINDER eval:check_rbl_from_host('sitefinder', '.') tflags __DNS_SITEFINDER net header SITEFINDER_IP eval:check_rbl_sub('sitefinder', '64.94.110.11') describe SITEFINDER_IP From: resolves to a verisign

Re: [SAtalk] help with master.cf and filter

2003-09-16 Thread Alan Fullmer
alright, one more question is there any way i can remove the @domain.tld? so i just have the email prefix before the @? - Original Message - From: Jim [EMAIL PROTECTED] To: Alan Fullmer [EMAIL PROTECTED] Sent: Tuesday, September 16, 2003 8:14 PM Subject: Re: [SAtalk] help with

Re: [SAtalk] help with master.cf and filter

2003-09-16 Thread Alan Fullmer
i added ${user} on the end of the master.cf command, then used $5 I now understand how it works. thanks! - Original Message - From: Jim [EMAIL PROTECTED] To: Alan Fullmer [EMAIL PROTECTED] Sent: Tuesday, September 16, 2003 8:14 PM Subject: Re: [SAtalk] help with master.cf and filter

RE: [SAtalk] Razor 2.22- 2.36 Taint issue patch

2003-09-16 Thread Mike Loiterman
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Daniel Quinlan wrote: The patch looks more like Morse code than a unified diff (it's quite corrupted). Use the one I posted earlier today. Heh...you're right. That patch was corrupt. Anyway, it patches fine now, but now I get an error on make:

Re: [SAtalk] Update of manufacturer strings

2003-09-16 Thread Bob Apthorpe
Hi, On Tue, 16 Sep 2003 18:13:12 +0200 Hubert Daubmeier [EMAIL PROTECTED] wrote: Hello my postmaster has pointed me to this discussion list -- [...] I would like to outline a problem and like to ask for updating the manufacturer strings for Microsoft Outlook 2003.

Re: [SAtalk] help with master.cf and filter

2003-09-16 Thread Jim
On Tue, Sep 16, 2003 at 08:35:23PM -0600, Alan Fullmer wrote: i added ${user} on the end of the master.cf command, then used $5 I now understand how it works. thanks! If I'm not mistaken, that is going to cause you to deliver two copies of the message: one to $recipient, the other to

Re: Fw: [SAtalk] The Verisign folly

2003-09-16 Thread Matt Beland
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Tuesday 16 September 2003 06:08 pm, Jeremy Kister wrote: while the patches above are not the perfect solution, they are as close as you can get while Verisign is in power. if anyone knows of a patch for BINDv9, please let me know. There's a

[SAtalk] (no subject)

2003-09-16 Thread Steve Thomas
Don't forget to vote with your wallet. * Move your domains from Network Solutions to any other registrar. * Don't renew your SSL certs and find another CA (if possible). Don't use Thawte - Verisign owns them. * Sell your VRSN stock and get out of any funds that invest

Re: Fw: [SAtalk] The Verisign folly

2003-09-16 Thread Steve Thomas
On Tue, Sep 16, 2003 at 08:31:55PM -0700, Matt Beland is rumored to have said: I stopped laughing, it occurred to me that hypocritical or no, that could mean trouble for ISC if VeriSign chose to push the issue. What kind of trouble? Certainly not legal trouble. There's nothing that says that