[SAtalk] spamd piling up - just killing me

hello everyone, I have a problem that's making me miserable. I'm running spamassassin-2.44-11.8.x on a shriek (RH9) box and am having a problem: spamd processes get spawned whenever a mail arrives but for a particular user, they never seem to finish. therefore I end up with a bunch of spamd inst

Re[2]: [SAtalk] Messages full of white text

Hello Fred, Thursday, December 4, 2003, 1:10:56 PM, you wrote: FIIC> I thought up an idea for this, insted of trying to detect the white FIIC> text in general, why not try to detect the patterns the spammers FIIC> are using with them.. Take the following rules as an example: Run against my corp

Re: [SAtalk] [RD] Proposed Rules

Thursday, December 4, 2003, 10:23:38 PM, I responded to Jon Gerdes' earlier email: JG>> I'm still ploughing through some of your rules. I've ammended your JG>> CONSFROM9 rule somewhat: JG>> # A From without vowels is probably invalid JG>> header WHL_CONSFROMFrom =~ /[EMAIL PROTECTED],20}\

Re: [SAtalk] Blacklists

Hi, On Sat, 6 Dec 2003 01:05:16 - "Alan Munday" <[EMAIL PROTECTED]> wrote: > With various threads talking, and questioning, about blacklists I have > started to try and understand these a bit more. [snip] > What this does not make clear is if my firewall is rejecting mail against > the first

Re[2]: [SAtalk] Problem with email=no content

Wednesday, December 3, 2003, 2:14:26 AM, David wrote: DBF> On Tue, 2 Dec 2003, Robert Menschel wrote: >> The second rule then reverses that test, checking for the lack of a FROM >> header. (There may be a better way to do this -- anyone?) Results: >> >> RM_hx_from -- 45925s/16069h of 63136 corpus

Re: [SAtalk] sa-learn: what happened to --dir ?

Awesome, yes it works that way for me, too. I read the man page and thought it had been deprecated --On Saturday, December 06, 2003 10:38 AM +1000 Peter Kiem <[EMAIL PROTECTED]> wrote: So it defaults to folders already. So you would just need to do sa-learn --spam /var/tmp/spam and it s

[SAtalk] Blacklists

With various threads talking, and questioning, about blacklists I have started to try and understand these a bit more. My own setup uses those lists given below, though these run from my firewall mail proxy rather than from any of the mail handling applications. >From this weeks mail log I have

Re: [SAtalk] sa-learn: what happened to --dir ?

OK, just tried it without the --dir and it still works. further down in the man sa-learn you see this: "Simply run this command once for each of your mail folders, and it will 'learn' from the mail therein." So it defaults to folders already. So you would just need to do sa-learn --spam /var/

Re: [SAtalk] sa-learn: what happened to --dir ?

> I have too many files to learn, so sa-learn craps out with "bad > interpreter: Too many arguments". I am invoking 2.60 like this: sa-learn > --spam -d /var/tmp/spam/* Too many files in /var/tmp/spam which overflows the shell expansion > I used to invoke 2.54 like this: sa-learn --spam --dir

Re: [SAtalk] spamds that don't finish

Hi All, On Thu, Dec 04, 2003 at 04:06:44PM -0800, Bob Amen wrote: > > Another idea, are you using Bayes, and if so do you not have > > bayes_learn_to_journal enabled? I tried turning "bayes_learn_to_yournal" on for that particular user and some of his spamd processes are still getting stuck. I r

[SAtalk] sa-learn: what happened to --dir ?

I have too many files to learn, so sa-learn craps out with "bad interpreter: Too many arguments". I am invoking 2.60 like this: sa-learn --spam -d /var/tmp/spam/* I used to invoke 2.54 like this: sa-learn --spam --dir /var/tmp/spam What happened to the flag --dir ? That worked great in 2.54.

RE: [SAtalk] bigevil.cf + rsync?

Sorry but brain dead me forgot to mention that the /etc/init.d/spamd file is a home cooked one (doing much more than just restart). I noticed that some people were naming it spamassassind, etc... I just took for granted people would just replace it with their own items and leave them with ju

RE: [SAtalk] BigEvilRules homage...

Thanks! There are even more surprises waiting in the wings. There are some REALLY cool things the "inner circle" have been working on. Hopefully they will be tested out for a SARE update around the 16th. 2 in particular make me feel all warm and fuzzy :) There are truely some great people on this

RE: [SAtalk] bigevil.cf + rsync?

Nice! It should be said that this script contains a restart function that ONLY works with SA 2.60 and up! :) --Chris > -Original Message- > From: Smart,Dan [mailto:[EMAIL PROTECTED] > Sent: Friday, December 05, 2003 4:21 PM > To: [EMAIL PROTECTED] > Subject: RE: [SAtalk] bigevil.cf + rsy

RE: [SAtalk] BigEvilRules homage...

Ah, someone who's done what I wanted, nad haven't had time to figure out due to too many other things to do right now. How do you tweak the invisible font score? |-Original Message- |From: Rubin Bennett [mailto:[EMAIL PROTECTED] |Sent: Friday, December 05, 2003 13:14 |To: [EMAIL PROTECTED

RE: [SAtalk] bigevil.cf + rsync?

How would you run a spamassassin --lint to check if the file is ok before sending the mail and restarting? Ideas? <> | -Original Message- | From: Smart,Dan | Sent: Friday, December 05, 2003 3:21 PM | To: [EMAIL PROTECTED] | Subject: RE: [SAtalk] bigevil.cf + rsync? | | Thanks for t

RE: [SAtalk] bigevil.cf + rsync?

Thanks for the script Gary/Peter. I've cleaned things up and here is what I put together: #!/bin/sh ## This file updates the big evil policy file for spam assassin DATE=`date +"%Y%m%d-%H%M"` [ -f /tmp/bigevil.cf ] && rm -f /tmp/bigevil.cf wget -N http://www.merchantsoverseas.com/wwwroot/gorilla

[SAtalk] BigEvilRules homage...

I thought I'd let y'all know that I haven't received a single Spam in my inbox for over 24 hours. I have, however, received over 250 Spams in my spam folder... SpamAssassin 2.6, with BigEvilRules, Popcorn rules, and a small upward tweak in the scoring of the invisible html rule (up to 3.5 points)

Re: [SAtalk] Basic flow of SpamAssassin

At 03:10 PM 12/5/2003, kelli coggins wrote: Does the message ever leave the user's in folder on the mail server while SpamAssassin is running? If not, what happens to the original message (before it is re-wrapped as spam)? If so, how is it sent back to the correct mail box? I've never run SA on a w

[SAtalk] OUTCH! *OBFU*-Checks hit 'attached RFC-conform Mail'

Hi! I just found a perfectly legitimate E-Mail which neighter contained Spam-Text nor any html in my Spambox, hit by two 'ofsucation checks'. One I had generated with https://sandgnat.com/cmos/cmos.jsp in response to the ever increasing use of the Word 'curn', the other checks for 'too long or sh

Re: [SAtalk] Disable a User who does not want SA

Kenneth Porter wrote: --On Monday, December 01, 2003 3:55 PM -0600 Rich Puhek <[EMAIL PROTECTED]> wrote: Here's the nospam.pl script: Why not use grep? * ! ? /usr/local/bin/nospam.pl $LOGNAME I forget why at the moment. I think I opted for a full-blown script so that: 1) I was certain of

RE: [SAtalk] Being BigEvil inspired...

> -Original Message- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] *snip* > > Yes. URI will be more efficient, too. > > - --j. LOL, it figures it would come from you ;) You said the magic words, "more efficient". And just like that *BOOM* 1.60 is up! At least it wasn't an FP

[SAtalk] Basic flow of SpamAssassin

I am trying to get a clear understanding of the basics of Spam Assassin and what it does so that I can then figure out which options we need to use. Will someone please correct me where I am wrong? In our scenario, we have a win2000 box running Post.Office as our mail delivery program. Basically,

RE: [SAtalk] Being BigEvil inspired...

You have to restart spamd. Not mimedefang. Unless it uses spamassassin, in which case, run: spamassassin --lint and find out where it is pulling the CF files from. Make sure bigevil is in the correct location. --Chris > -Original Message- > From: Hamilton, Kent [mailto:[EMAIL PROTECTED]

RE: [SAtalk] Being BigEvil inspired...

> > At 02:15 PM 12/5/2003, Larry Rosenman wrote: > > > >> > But incoming messages encoded in Base64 containg links with > > >> the above > > >> > domains are not recognized ?? Why ?? > > >> one word: rawbody > > >> > > >> LER > > >> > > > > > > OUCH! That makes a lot of sense. Hmmm.Shoul

RE: [SAtalk] bigevil.cf + rsync?

OK, I can confirm that switching from the plain-text digest to the MIME digest appears to have solved the problem. Gary, your last post was legible in the latest digest. Kelson Vibber SpeedGate Communications --- This SF.net email is spon

RE: [SAtalk] Changing user spamd runs as

I have the same issue also. No matter how I configure bayes in my config files spamd continues to look in the user directories for the bayes database. I have sa-learn updating to /var/spool/spamassassin/ but spamd keeps trying to create user files in my home directory. I have tried the -x flag

Re: [SAtalk] Being BigEvil inspired...

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Larry Rosenman writes: >>> one word: rawbody >>> >>> LER >> >> OUCH! That makes a lot of sense. Hmmm.Should I change bigevil to >> URI??? >Dunno, I'd ask for some SA-Developers opinions. Yes. URI will be more efficient, too. - --j. -BE

RE: [SAtalk] Being BigEvil inspired...

> > > > > > But incoming messages encoded in Base64 containg links with > > the above > > > domains are not recognized ?? Why ?? > > one word: rawbody > > > > LER > > > > OUCH! That makes a lot of sense. Hmmm.Should I change bigevil to > URI??? > A related question: when you scan the mess

Re: [SAtalk] LOL - ascii art spam

> > Damn are we back in the good old BBS days? :) Dunno about the rest of you but life was alot more fun back then ;-) Gary --- This SF.net email is sponsored by: IBM Linux Tutorials. Become an expert in LINUX or just sharpen your skills.

RE: [SAtalk] Being BigEvil inspired...

At 02:15 PM 12/5/2003, Larry Rosenman wrote: >> > But incoming messages encoded in Base64 containg links with >> the above >> > domains are not recognized ?? Why ?? >> one word: rawbody >> >> LER >> > > OUCH! That makes a lot of sense. Hmmm.Should I change bigevil to > URI??? Dunno, I'd as

RE: [SAtalk] Being BigEvil inspired...

Chris, I updated my bigevil.cf file this morning and I haven't seen a hit on it since. Yes, I stopped mimedefang and restarted it after the update. Any ideas? Sendmail, mimedefang, spamassassin-2.60 with Bayes on. > -Original Message- > From: Chris Santerre [mailto:[EMAIL PROTECTED]

Re: [SAtalk] Being BigEvil inspired...

At 01:58 PM 12/5/2003, Brian Ipsen wrote: But incoming messages encoded in Base64 containg links with the above domains are not recognized ?? Why ?? Any chance the particular B-64 messages are multipart with one part being QP and the other part being base64? get_decoded_body_text_array has this c

[SAtalk] Re: Possible FP on big evil list

Chris Santerre wrote: CC'd to list for opinions. OK, this one actually bothers me. The URIs hitting are Pull\.xmr3\.com and xmr3\.com . Googleing on these shows many people blocking this domain. Has this person signed up for this "Sams Club" newsletter? Is it UCE not spam? (That is a loaded/large

Re: [SAtalk] LOL - ascii art spam

"Yackley, Matt" wrote: > Damn are we back in the good old BBS days? :) > > I received this one today and damn near fell of my chair > laughing. *snicker* It's not even very *good* ASCII art... -kgd -- "Sendmail administration is not black magic. There are legitimate technical reasons why

Re: [SAtalk] Re: paris hilton

Adam D. Lopresto said: > On Fri, 5 Dec 2003, Chris Thielen wrote: > >> What you're seeing here is the bugfix regarding word boundaries >> mentioned >> on the home page and the version history. I'll explain why it works >> like >> it does. >> >> Take this simple regex, for example: >> /asdf/i >> Le

RE: [SAtalk] Being BigEvil inspired...

--On Friday, December 05, 2003 14:16:56 -0500 Chris Santerre <[EMAIL PROTECTED]> wrote: -Original Message- From: Larry Rosenman [mailto:[EMAIL PROTECTED] Sent: Friday, December 05, 2003 2:04 PM To: Brian Ipsen; [EMAIL PROTECTED] Subject: Re: [SAtalk] Being BigEvil inspired... --On F

RE: [SAtalk] Being BigEvil inspired...

> -Original Message- > From: Larry Rosenman [mailto:[EMAIL PROTECTED] > Sent: Friday, December 05, 2003 2:04 PM > To: Brian Ipsen; [EMAIL PROTECTED] > Subject: Re: [SAtalk] Being BigEvil inspired... > > > > > --On Friday, December 05, 2003 19:58:37 +0100 Brian Ipsen > <[EMAIL PROTECT

RE: [SAtalk] bigevil.cf + rsync?

At 10:27 AM 12/5/2003, Gary Smith wrote: I use outlook web access at work and that has been set to default to plain unless it comes in encoded. When I get home at home I use outlook and if it comes in using anything other than plain text it has a tendency to mangle. The copy of this I got direct

RE: [SAtalk] Being BigEvil inspired...

Hi, > I'm predicting you are not running 2.60 of SA? Older versions don't catch > the BASE64. Fom a tagged message: X-Spam-Status: Yes, hits=8.4 required=5.0 tests=BIZ_TLD,DATE_IN_PAST_03_06, DCC_CHECK,HTML_IMAGE_ONLY_02,HTML_MESSAGE,MIME_BASE64_TEXT, MIME_HTML_NO_CHARSET,MIME_H

RE: [SAtalk] Being BigEvil inspired...

I'm predicting you are not running 2.60 of SA? Older versions don't catch the BASE64. > -Original Message- > From: Brian Ipsen [mailto:[EMAIL PROTECTED] > Sent: Friday, December 05, 2003 1:59 PM > To: [EMAIL PROTECTED] > Subject: [SAtalk] Being BigEvil inspired... > > > Hi, > > Inspire

Re: [SAtalk] Being BigEvil inspired...

--On Friday, December 05, 2003 19:58:37 +0100 Brian Ipsen <[EMAIL PROTECTED]> wrote: Hi, Inspired by the BigEvil list I've created my own little file in in /etc/mail/spamassassin like this; rawbody SpamLinks_1 /\b(?:rxwarehouseusa\.com|rxmoreusa\.com|self-entertainment\.biz|herbal9\ .bi z|only

RE: [SAtalk] SA-Talk poisoning Bayes

Dang! That's still not right. This should be the right logic: 1. OR-ing the list domains that discuss spam 2. AND-ing the fact the Bayes learned the message 3. Execute a forget! ## Unlearn messages from postfix and spamassassin lists to stop Bayes poisoning. :0## Test the NOTs * ! [EMAIL P

[SAtalk] Being BigEvil inspired...

Hi, Inspired by the BigEvil list I've created my own little file in in /etc/mail/spamassassin like this; rawbody SpamLinks_1 /\b(?:rxwarehouseusa\.com|rxmoreusa\.com|self-entertainment\.biz|herbal9\.bi z|onlyzbestout.\biz|yunoz\.biz|naturalherbal\.biz)\b/i describe SpamLinks_1Generated Sp

RE: [SAtalk] SA-Talk poisoning Bayes

Since this is not a delivering recipe (not to a file or pipe) I don't need to clone (I think!) Also, I'm not using extracted matches for anything so take out '\/' extraction operator Here's updated code... procmailrc - ## Unlearn messages from postfix and spamassassin lists to st

Re: [SAtalk] Re: paris hilton

On Fri, 5 Dec 2003, Chris Thielen wrote: > What you're seeing here is the bugfix regarding word boundaries mentioned > on the home page and the version history. I'll explain why it works like > it does. > > Take this simple regex, for example: > /asdf/i > Let's pretend my rules-gen script is much

[SAtalk] Re: Simplifying BigEvilList rules

On Fri, 5 Dec 2003 10:21:31 -0500, Chris Santerre <[EMAIL PROTECTED]> writes: > Basically you see the rules now in Alpha order. This is because I cat >> all > my lists together for the last few months, sorted, and ran uniq. My scrpits > for writing the rules work with 2 formats: > > 1 domain per

RE: [SAtalk] bigevil.cf + rsync?

I use outlook web access at work and that has been set to default to plain unless it comes in encoded. When I get home at home I use outlook and if it comes in using anything other than plain text it has a tendency to mangle. I also noticed that some of the threads started to encoded some weir

RE: [SAtalk] bigevil.cf + rsync?

All of Gary's posts read: Content-Type: text/plain; charset="utf-8" ?? --Chris Santerre > -Original Message- > From: Kelson Vibber [mailto:[EMAIL PROTECTED] > Sent: Friday, December 05, 2003 12:40 PM > To: [EMAIL PROTECTED] > Subject: RE: [SAtalk] bigevil.cf + rsync? > > >

Re: [SAtalk] Why didn't this autolearn?

At 12:39 PM 12/5/2003, Chris Barnes wrote: My autolearn threshhold is the default (what is that 15?). Other accounts do autolearn, but I'm not sure why this one didn't. Ideas? Here is the report: X-Spam-Status: Yes, hits=54.7 1) the autolearning score of this email isn't 54.7, and it's not 54.7 -

RE: [SAtalk] Tune a bit harder

dul.dnsbl.sorbs.net is what I use. --chris > -Original Message- > From: Dan [mailto:[EMAIL PROTECTED] > Sent: Friday, December 05, 2003 1:39 PM > To: SA Mailing list > Subject: [SAtalk] Tune a bit harder > > > Hey guys! > > I have spam assassin running with amavisd-new and postfix. >

Re: [SAtalk] Re: paris hilton

[EMAIL PROTECTED] said: > If I enter a single-character string in the "easy mode" text box, the > rules will somehow manage to drop the character from the obfuscated > rules. I.e. for the input "d" I get the regex /(?!\bd\b)\b/i (and not > the nonsensical /(?!\bd\b)\bd\b/i or an error message in t

Re: [SAtalk] Changing user spamd runs as

At 12:04 PM 12/5/2003, Nichols, William wrote: but on startup of RH9 I have it starting spamd, how do I change the user there? Edit the init script that starts spamd.. it's probably in /etc/rc.d/init.d or /etc/init.d, but I've never checked on a RH9 box. ---

Re: [SAtalk] Changing user spamd runs as

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Friday 05 December 2003 09:42, Nichols, William wrote: > I figured that part out, > > Now one quicj question again in my maillog file I see the identifier > that it was marked as SPAM. > > I also see that it is not able to update the bayes databas

Re: [SAtalk] Tune a bit harder

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Friday 05 December 2003 10:39 am, Dan wrote: > Hey guys! > > I have spam assassin running with amavisd-new and postfix. Its blocking a > good chunk of spam, but not enough yet. (tuning is needed I assume) Oh and > its a SMTP gateway for a exchange s

RE: [SAtalk] Re: What is this? Bayes poison?

I've been noticing spam with semicolons as well. Might be worth adding to your rules... |-Original Message- |From: Scott A Crosby [mailto:[EMAIL PROTECTED] |Sent: Friday, December 05, 2003 03:55 |To: Bryan Hoover |Cc: [EMAIL PROTECTED] |Subject: [SAtalk] Re: What is this? Bayes poison? | |

RE: [SAtalk] Changing user spamd runs as

I figured that part out, Now one quicj question again in my maillog file I see the identifier that it was marked as SPAM. I also see that it is not able to update the bayes database - permission denied. I have spamd running as the same user that the spamassassin process was, but it canno

RE: [SAtalk] bigevil.cf + rsync?

"Gary Smith" <[EMAIL PROTECTED]> wrote: WW91IGRvbid0IG5lZWQgdG8uICBTcGFtYXNzYXNzaW4gcmVhZHMgYWxsIGZpbGVzIGluIHRoZSAv ZXRjL21haWwvc3BhbWFzc2Fzc2luIGRpcmVjdG9yeSBlbmRpbmcgd2l0aCAuY2YuICBTbyB3aGVu IHlvdSByZXN0YXJ0IHRoZSBkYWVtb24gaXQgcmVhZHMgdGhlIG5ld2x5IGFkZGVkIG9yIGNoYW5n I would have liked to have f

[SAtalk] Tune a bit harder

Hey guys! I have spam assassin running with amavisd-new and postfix. Its blocking a good chunk of spam, but not enough yet. (tuning is needed I assume) Oh and its a SMTP gateway for a exchange server. In postfix I have my bad domains lists and known spammer list. (that I am always updating) Howev

[SAtalk] Why didn't this autolearn?

My autolearn threshhold is the default (what is that 15?). Other accounts do autolearn, but I'm not sure why this one didn't. Ideas? Here is the report: X-Spam-Status: Yes, hits=54.7 required=5.0 tests=BAD_CREDIT,BAYES_99, BigEvilList_48,CLICK_BELOW_CAPS,DATE_IN_FUTURE_03_06, DATE_SPAMWARE_Y2

[SAtalk] Re: More .procmailrc

[EMAIL PROTECTED] wrote: > Apart from the line termination issue which several people already > explained, this will never match anything. You need to protect the > asterisks because they have a special meaning in regular expressions. > Adding insult to injury, Procmail won't cope if the first char

RE: [SAtalk] Changing user spamd runs as

Mike, So in there should I just change: SPAMDOPTIONS="-d -c -a" To SPAMDOPTIONS="-d -c -a -u filter" Thanks, Bill Nichols - -Original Message- From: Mike Kuentz (2) [mailto:[EM

RE: [SAtalk] Changing user spamd runs as

modify /etc/sysconfig/spamassassin to have the -u username option it. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Nichols, William Sent: Friday, December 05, 2003 12:04 PM To: SA Mailing list Subject: [SAtalk] Changing user spamd runs as I am having

[SAtalk] Re: bigevil.cf + rsync?

Peter Kiem <[EMAIL PROTECTED]> wrote: > Any chance we can get rsync access to bigevil.cf so we can autoupdate > whenever you change your rules? I simply took the script Chris wrote and put it in my cron.daily. Not quite as clean as updating only when he has a new one, but still pretty nice. --

[SAtalk] Changing user spamd runs as

I am having a brainfart - I am trying to change the user that spamd runs as.   Currently it runs as root (this is a testing server) I want it to run as another user, I know I can start it with spamd -u "username"   but on startup of RH9 I have it starting spamd, how do I change the user th

Re: [SAtalk] Customise the default alert message

At 07:21 AM 12/5/2003, george o'dowd wrote: Anyone know how to customise the default alrert message ? "Spamassassin has detected possible spam running on server xxx.xxx etc etc " Anyone know how I can change the content of that message ? I've never seen that message, but there is a similar one.. se

Re: [SAtalk] More maildrop an easier way.

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Friday 05 December 2003 08:35 am, Bart Schaefer wrote: > On Fri, 5 Dec 2003, Satya wrote: > > On Dec 5, 2003 at 08:46, [EMAIL PROTECTED] wrote: > > >Adding insult to injury, Procmail won't cope if the first character of > > >a regular expression is

[SAtalk] RE: Re: BIG HUGE EVIL RULE NEWS!!!!

On Thu, 4 Dec 2003, Chris Santerre wrote: > Up until now, no one has really done anything with hosts. This is kind of > the first instance where it will make a large impact. I'm sure no one has > ever complained to these hosts. We have all been complaining about ISPs > where the email comes from,

RE: [SAtalk] Spam Statistics

I'd like a copy of the 'tweaked' version :) > -Original Message- > From: mikea [mailto:[EMAIL PROTECTED] > Sent: Thursday, December 04, 2003 12:17 PM > To: Spamassassin List > Subject: Re: [SAtalk] Spam Statistics > > > On Thu, Dec 04, 2003 at 08:09:31AM -0800, Gary Funck wrote: > > > >

Re: [SAtalk] More .procmailrc

On Fri, 5 Dec 2003, Satya wrote: > On Dec 5, 2003 at 08:46, [EMAIL PROTECTED] wrote: > > >Adding insult to injury, Procmail won't cope if the first character of > >a regular expression is a backslash, so we have to add a set of parens > >to protect +that+ as well. > > > > * ^Subject: (\*\*\*\*\*

RE: [SAtalk] Re: Simplifying BigEvilList rules

Hey there, sorry I didn't respond yet. I was actually figuring out how I would use these cool scripts. There are some GREAT ideas here, but I might be working counter to them. Let me explain how I do this, and how I think updates would be done. This way we can talk about changing it to get better r

[SAtalk] Re: More .procmailrc

On Friday, December 5, 2003 at 08:39 (which was Friday, December 5, 2003 at 14:39 where I am) Satya wrote: > :0: > * ^X-Spam-Level: \*\*\*\*\*\*\*\*\* > spam > works for me. I'm not normally much good at procmail scripts, but wouldn't: * ^X-Spam-Level: \*{9,} Be a bit shorter? -- Greetings,

[SAtalk] Re: More .procmailrc

On Friday, December 5, 2003 at 08:39 (which was Friday, December 5, 2003 at 14:39 where I am) Satya wrote: > :0: > * ^X-Spam-Level: \*\*\*\*\*\*\*\*\* > spam > works for me. I'm not normally much good at procmail scripts, but wouldn't: * ^X-Spam-Level: \*{9,} Be a bit shorter? -- Greetings,

RE: [SAtalk] SA-Talk poisoning Bayes

How does this look for a way to "un-poison" SA-Talk: It uses the Procmail "OR" scheme of checking for the failure of ANDed negation. --- procmailrc --- :0 c * ! ^X-Spam-Status:.*autolearn=ham * ! ^TO_\/[EMAIL PROTECTED] * ! ^TO_\/postfix-users@(postfix.org|cloud9.net) { } # This evaluates to an Or

[SAtalk] Re: BUGGY_CGI

On Fri, 5 Dec 2003 10:12:18 -, Adam Griffiths <[EMAIL PROTECTED]> posted to spamassassin-talk: > This is the first time I have suggested a rule change to this list, I'd be > grateful if someone could let me know if my message is useful. It's a good start, but it would be really optimal if yo

[SAtalk] Re: Customise the default alert message

On Fri, 05 Dec 2003 12:21:17 +, george o'dowd <[EMAIL PROTECTED]> posted to spamassassin-talk: > Anyone know how to customise the default alrert message ? > "Spamassassin has detected possible spam running on server xxx.xxx etc etc " > Anyone know how I can change the content of that message

[SAtalk] Re: howto consider as spam any russian mail ?

On Fri, 5 Dec 2003 09:54:11 +0100, stephane ancelot <[EMAIL PROTECTED]> posted to spamassassin-talk: > Is there a way to remove any russian email ? Look at the ok_languages setting. E.g. ok_languages en fr (any other languages you understand) See the Mail::SpamAssassin::Conf documentation for d

Re: [SAtalk] Re: More .procmailrc

On Dec 5, 2003 at 08:46, [EMAIL PROTECTED] wrote: >Adding insult to injury, Procmail won't cope if the first character of >a regular expression is a backslash, so we have to add a set of parens >to protect +that+ as well. > > :0: > * ^Subject: (\*\*\*\*\*SPAM\*\*\*\*\*) > Spamfolder Oddly enou

Re: [SAtalk] BIG HUGE EVIL RULE NEWS!!!!

On Dec 4, 2003 at 17:14, Damian Gerow wrote: >Yes, a spammer would need high availability. But so does Microsoft, Apple, >CBC (Canadian Broadcasting Corporation), etc. Again, just because an image >is hosted by Akamai doesn't even mean that Akamai is aware of this -- it >just means that someone

[SAtalk] Customise the default alert message

Anyone know how to customise the default alrert message ? "Spamassassin has detected possible spam running on server xxx.xxx etc etc " Anyone know how I can change the content of that message ? Thanks George _ MSN 8 with e-mail virus

[SAtalk] Re: What is this? Bayes poison?

On Fri, 05 Dec 2003 02:07:01 -0500, Bryan Hoover <[EMAIL PROTECTED]> writes: > Buy hard to get V-a-l-i-u-m, [EMAIL PROTECTED], P.r.o.z.a.c and much more > on.line!! Look for: V[. /_,-]*a[. /_,-]*l[. /_,-]*i[. /_,-]*u[. /_,-]*m P[. /_,-]*r[. /_,-]*o[. /_,-]*z[. /_,-]*a[. /_,-]*c F[. /_,

Re: [SAtalk] Disable a User who does not want SA

- Original Message - From: "Kenneth Porter" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Friday, December 05, 2003 5:52 AM Subject: Re: [SAtalk] Disable a User who does not want SA > --On Monday, December 01, 2003 3:55 PM -0600 Rich Puhek > <[EMAIL PROTECTED]> wrote: > > > Here's the

[SAtalk] BUGGY_CGI

Hi This is the first time I have suggested a rule change to this list, I'd be grateful if someone could let me know if my message is useful. The BUGGY_CGI test is coded to indicate a message is not spam when the X-Mailer is "NMS FormMail". However the current header test does not match the latest

how much of a load hit should bayes be? WAS: RE: [SAtalk] spamds that don't finish

Hi List, > I'm sorry if I gave you the wrong impression, if you are using Bayes with > auto_learn (auto_learn 1), then you most likely -do- want > bayes_learn_to_journal set to 1. (enabled). Sorry David, got tired last night (been banging my head against this for a few days), I meant i set it to

Re: [SAtalk] Re: Simplifying BigEvilList rules

* Greg Webster <[EMAIL PROTECTED]> [2003-12-05 01:23]: > Excellent. I am in agreement. > I've sent a raw list of all the urls in the rules to Chris Santerre wish > a promise that one I find some time I'll write up some perl code to > clean up and form rules out of them. I resend two perl scripts

[SAtalk] howto consider as spam any russian mail ?

Hi, Is there a way to remove any russian email ? Bye steph --- This SF.net email is sponsored by: IBM Linux Tutorials. Become an expert in LINUX or just sharpen your skills. Sign up for IBM's Free Linux Tutorials. Learn everything from the ba

[SAtalk] Re: What is this? Bayes poison?

Kenneth Porter wrote: > > I'm getting a bunch of these. Are these just intended to poison Bayes DB's? > What's the sender's objective? Maybe someone's just looking out for your spirtual well being. The other day, I was excited about not having received a single spam in days (no spam today, BTW),

[SAtalk] Re: Rule Length

On Mon, 24 Nov 2003 11:31:38 +1000, Andrew <[EMAIL PROTECTED]> posted to spamassassin-talk: > Does anybody know if there is any limit for the character length of a > rule? Based on a very quick look, the answer is no. The size of the disk on which you have the rules is the deciding factor :-)