Re: [SAtalk] Recent trend in spaming tactics

On Fri, Sep 26, 2003 at 11:38:15PM -0400, Matt Kettler wrote: Many spammers are using paypal.com to get their emails whitelisted. Also I noted this too. It doesn't seem like a good idea therefore that spamassassin comes with a pre-built whitelist; it makes it too easy for abusers to know which

Re: [SAtalk] no spam today uses SA?

, we should tell the FSF about it. -- Carlo Wood [EMAIL PROTECTED] --- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf ___ Spamassassin-talk mailing list

Re: [SAtalk] No BAYES_* ?

the cron job, prior to executing the sa-learn command. -- Carlo Wood [EMAIL PROTECTED] --- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf ___ Spamassassin

Re: [SAtalk] No BAYES_* ?

, but it is not! It is a header that qmail adds to ALL my mail?! -- Carlo Wood [EMAIL PROTECTED] --- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf ___ Spamassassin-talk mailing list

[SAtalk] No BAYES_* ?

The attached mail got through spam-assassin without a problem... Why? Where is the BAYES_* test? Does this mean that the bayes engine thinks this is less than 10% chance to be spam? That would be ridiculous! How can I test on which keywords it is basing that this ham? -- Carlo Wood [EMAIL

Re: [SAtalk] No BAYES_* ?

On Wed, Sep 10, 2003 at 03:55:41PM +0200, Carlo Wood wrote: The attached mail got through spam-assassin without a problem... Why? Where is the BAYES_* test? It turns out that NO mail is having the BAYES_* test anymore all of a sudden... Why? How can I debug what is going on please

Re: [SAtalk] No BAYES_* ?

On Wed, Sep 10, 2003 at 10:36:33AM -0400, Matt Kettler wrote: At 03:55 PM 9/10/03 +0200, Carlo Wood wrote: The attached mail got through spam-assassin without a problem... Why? Where is the BAYES_* test? Does this mean that the bayes engine thinks this is less than 10% chance to be spam

Re: [SAtalk] I want SA to handle mailinglists. Need some creativity here.

, this is not an SA problem: SA just marks whether or not a mail is spam. -- Carlo Wood [EMAIL PROTECTED] --- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf

Re: [SAtalk] SpamAssassin with Pyzor DCC using Qmail-Scanner

-L -u spamc The spamc user does exist and its home directory is /opt/spamassassin. When I issue the spamc command manually, it does not user pyzor or dcc. Any thoughts? Remove the -L, that makes spamd skip any network tests, including the pyzor/dcc ones. (L = local). -- Carlo Wood [EMAIL

Re: [SAtalk] Another Keyword for Spam

detected. Markus Moreover, spamassassin should imho treat the characters Ee3 as the same, likewise Ss5$, Ii1|!, Oo0 Aa@ etc etc, when looking for really spammy keywords. It starts to be common practise that spammers try to avoid automatic recognition like that. -- Carlo Wood [EMAIL PROTECTED

Re: [SAtalk] why so low

0 score X_OSIRU_SPAMWARE_SITE 0 score X_OSIRU_SPAM_SRC 0 -- Carlo Wood [EMAIL PROTECTED] --- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf

Re: [SAtalk] bayes filter: learn and forget

it when it already knew it. If it learned it as spam and you learn it again as ham or visa versa then it also works. -- Carlo Wood [EMAIL PROTECTED] --- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf

Re: [SAtalk] Very Slow when using SpamAssassin

for some network query. Try adding this to /etc/mail/spamassassin/local.cf : skip_rbl_checks 1 use_razor2 0 use_dcc 0 use_pyzor 0 Or run spamd or spamassassin (which ever you use) with the -L flag. And see if that helps. -- Carlo Wood [EMAIL

Re: [SAtalk] Bug: Failed to create default user preference file //.spamassassin/user_prefs

:38 /usr/spamassassin/bayes_toks The 'nobody' owned files were changed by cron. It works just fine thus. -- Carlo Wood [EMAIL PROTECTED] --- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf

Re: [SAtalk] Bayes and whitelisting

a whitelisted mail? :) Mails on a list like this can easily score as spam, but - in the same message - might contain a lot of valuable words/tokens and that does screw up the Bayesian database when learning it as spam. Perhaps a 'never_autolearn_whitelist_to' should be added? -- Carlo Wood [EMAIL PROTECTED

Re: [SAtalk] Bayes and whitelisting

, but it would be better if a new flag was added for this particular purpose. -- Carlo Wood [EMAIL PROTECTED] --- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf

Re: [SAtalk] bayes feedback

I read here that bayes is only turned on after it learned from at least 200 spams AND 200 hams. That number could be more. It only starts to be efficient after you got say 1000 of both. Once it kicks in, you should see tests with names like BAYES_*. -- Carlo Wood [EMAIL PROTECTED

Re: [SAtalk] System goes down

On Tue, Sep 02, 2003 at 04:04:45PM +0200, Kandji Développeur wrote: Hello, I've been using spamassassin for 2 weeks and it (*seems*) that it caused my system to go down... The story : linux RedHat 7.3 - kernel 2.4.18#3 on smp system (2xPII) perl 5.6.1 spamassassin version 2.55

Re: [SAtalk] System goes down

/var/spool/qmailscan/working/new/alinoe.co qmailq4541 0.0 0.8 2216 1028 ?D16:52 0:00 sh -c /usr/bin/spamc -f /var/spool/qmailscan/working/new/alinoe.co -- Carlo Wood [EMAIL PROTECTED] --- This sf.net email is sponsored

Re: [SAtalk] Bayes and whitelisting

to use SA and run that on the machine that is also running the firewall. That way my working machine is not loaded anymore. -- Carlo Wood [EMAIL PROTECTED] --- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http

Re: [SAtalk] System goes down

switch. Also thanks! Another very valuable hint. Damn, and I really have read the man page of spamd in the past but had forgotten about this possibility completely. -- Carlo Wood [EMAIL PROTECTED] --- This sf.net email is sponsored by:ThinkGeek

Re: [SAtalk] System goes down

of tcpserver) as well as the maximum number of remote deliveries (5) and -why not- the local deliveries (5). Those where respectively 20, 20 and 10. -- Carlo Wood [EMAIL PROTECTED] --- This sf.net email is sponsored by:ThinkGeek Welcome to geek

Re: [SAtalk] Bug: Failed to create default user preference file //.spamassassin/user_prefs

On Sun, Aug 31, 2003 at 12:35:23PM -0400, Matt Kettler wrote: At 01:50 PM 8/31/2003 +0200, Carlo Wood wrote: What does it use to determine the users home directory? SpamAssassin uses ~/ to determine the home directory of the current user. And yes, that is standardized and should

[SAtalk] Bayes and whitelisting

, resulting in it automatically being added as 'ham'. What is it that SA (2.55) does? I've white listed *this* mailinglist for example, but I really don't want it to be classified as ham! Regards, -- Carlo Wood [EMAIL PROTECTED] --- This sf.net

Re: [SAtalk] Bayes and whitelisting

that will cause SA to NOT auto-learn anything that is whitelisted. -- Carlo Wood [EMAIL PROTECTED] --- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf

Re: [SAtalk] SQL

when you use a REAL mail, not just plain text thus. -- Carlo Wood [EMAIL PROTECTED] --- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf ___ Spamassassin-talk

Re: [SAtalk] Bayes and whitelisting

this. Hopefully my feedback can help to improve the documentation at this point though: it is easy to assume that white listed mail is still classified / auto-learned. I'd suggest an explicit mention under 'whitelist_from' et al that matched mails will not be auto-learned. -- Carlo Wood [EMAIL

Re: [SAtalk] Spamassassin in vhost env

On Sun, Aug 31, 2003 at 12:52:14AM +0200, Alexander Newald wrote: /home/vhost/.spamassassin/bayes_toks) I also didn't manage to get userprefs from db. What about the -u option of spamc? -- Carlo Wood [EMAIL PROTECTED] --- This sf.net email

[SAtalk] Bug: Failed to create default user preference file //.spamassassin/user_prefs

directory? -- Carlo Wood [EMAIL PROTECTED] --- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https

[SAtalk] Wrong score for Message-ID

points) Message-Id is fake (in Outlook Express format) Isn't 13 points for *just* the message ID not a bit much? -- Carlo Wood [EMAIL PROTECTED] --- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf

[SAtalk] sa-learn: Does --forget ignore the headers? (Attempt 2)

Can someone please answer this mail that I posted a few days ago? On Fri, Aug 29, 2003 at 01:00:45AM +0200, Carlo Wood wrote: I have the following setup: 1) Firewall receives mail, pipes it through spamd and adds a header marking it as spam. 2) Firewall sends the mail through

Re: [SAtalk] sa-learn: Does --forget ignore the headers? (Attempt 2)

On Sat, Aug 30, 2003 at 01:45:05PM +0200, Carlo Wood wrote: Question: Will the Basesian filters be correctly adjusted, despite the change of headers? I figured it out. The answer is yes. It only looks at the Message-Id. -- Carlo Wood [EMAIL PROTECTED

[SAtalk] sa-learn: Does --forget ignore the headers?

) encapsulation and extra new-lines etc won't matter either. But does it work like that? -- Carlo Wood [EMAIL PROTECTED] --- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf

Re: [SAtalk] FW: Best Child Pornography Site

child pornography is more probably a serious mail about the topic than that will be any kind of advertisement. -- Carlo Wood [EMAIL PROTECTED] --- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf

Re: [SAtalk] Spammer fights back!

of the screen, or use an extremely small font. Or the words could be part of a construct that is never displayed at all, not limited to HTML comments. In order to detect that you'd need a fullfledged HTML decoder... this is going to eat a lot of cpu :( -- Carlo Wood [EMAIL PROTECTED

Re: [SAtalk] RBL

on either spamassassin or spamd. -- Carlo Wood [EMAIL PROTECTED] --- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf ___ Spamassassin-talk mailing list [EMAIL

Re: [SAtalk] Scores for OSIRU Tests

anymore. Thanks -- Carlo Wood [EMAIL PROTECTED] --- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf ___ Spamassassin-talk mailing list [EMAIL PROTECTED

Re: [SAtalk] RBL

that perl stuff, will it just work now? (After restarting spamd). There clearly is no way to verify it :/ -- Carlo Wood [EMAIL PROTECTED] --- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf

Re: [SAtalk] RBL

uncertain about whether it works, -- Carlo Wood [EMAIL PROTECTED] PS I removed [EMAIL PROTECTED] from the CC because his mail server says that that user doesn't exist. --- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven

Re: [SAtalk] Message ID

On Tue, Aug 26, 2003 at 02:03:59PM +0200, 'Carlo Wood' wrote: I'll carefully make a new list that I will post later. Ok, I now did it correctly - using an awk program. Number of hams: 4548 Number of hams without '^(X-[Mm]ailer|User-Agent):': 1833 Number of Messsage ids with a domain: 4262 List

[SAtalk] No X-Spam-Report header line?!

for the rest the mail is unaltered. I really need the X-Spam-Report: lines! Please help. -- Carlo Wood [EMAIL PROTECTED] --- This SF.net email is sponsored by: VM Ware With VMware you can run multiple operating systems on a single machine

Re: [SAtalk] Message ID

... hostname ansset -- Carlo Wood [EMAIL PROTECTED] --- This SF.net email is sponsored by: VM Ware With VMware you can run multiple operating systems on a single machine. WITHOUT REBOOTING! Mix Linux / Windows / Novell virtual machines at the same

Re: [SAtalk] Message ID

then message-ids and X-mailer lines were mixed from different messages. I'll carefully make a new list that I will post later. -- Carlo Wood [EMAIL PROTECTED] --- This SF.net email is sponsored by: VM Ware With VMware you can run multiple operating

Re: [SAtalk] Message ID

of spam shouldn't be too hard, you probably have them already - don't you? Typical mailinglist mails are not hard to get either, if you are only concerned with the body content. -- Carlo Wood [EMAIL PROTECTED] --- This SF.net email is sponsored

Re: [SAtalk] 2.41/2.50 spamd/spamc problem

SINGLE MESSAGE. Therefore I'd like to be sure that whatever -F 0 did is still done. But how? -- Carlo Wood [EMAIL PROTECTED] --- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf