[SAtalk] Re: Auto-learn SA after having trained it

2004-01-29 Thread Bryan Hoover
Matt Kettler wrote: > At 10:19 AM 1/23/2004, Mark Squire wrote: > >Hi all, > >I have been training SA manually for a couple of weeks now. I estimate > >a good 2000 emails for both Spam and Ham have been learned by it. > >Coupla questions though . . . I want to put it into auto-learn mode > >becaus

[SAtalk] Re: Is my spamtrap working?

2004-01-18 Thread Bryan Hoover
Paul Fielding wrote: > However, when I look at the datestamp on the files in the .spamassassin > directory before and after processing the spam or ham, the datestamps haven't > changed. I can see that the database is getting use - whenever I check the > datestamp it has been quite recently updated

[SAtalk] Re: Is my spamtrap working?

2004-01-18 Thread Bryan Hoover
Paul Fielding wrote: > > Quoting Bryan Hoover <[EMAIL PROTECTED]>: > > > You could set these scripts' spamassassin, sa-learn commands with -D, > > and use standard error redirection to a text file. The output will tell > > you which Bayes database it

[SAtalk] Re: Is my spamtrap working?

2004-01-17 Thread Bryan Hoover
Paul Fielding wrote: > > I recently set up a shared database with spamtrap and hamtrap accounts, as per: > > http://www.stearns.org/doc/spamassassin-setup.current.html#autoreporting > > You can see the details of the procmail and local.cf files at the link above, > but the sort story is that the

[SAtalk] Re: Where are values kept for the built-in rules?

2004-01-17 Thread Bryan Hoover
"Yackley, Matt" wrote: > > I would like to increase one of the built-in rule hit values. > > Tnx - John > > > > Hi John, > The standard location is in /usr/share/spamassassin/50_scores.cf file, > however any changes made to the file would be wiped out by an upgrade or > re-install. The best way

[SAtalk] Re: Where are values kept for the built-in rules?

2004-01-17 Thread Bryan Hoover
John Fleming wrote: > > I would like to increase one of the built-in rule hit values. Tnx - John Do it in your .spamassassin/user_prefs file, or for site wide, local.cf in your rules directory. Look in rules/50_scores.cf for the rules, and scores to copy/paste, and change. Bryan > ---

[SAtalk] Re: Duplicate Emails

2004-01-11 Thread Bryan Hoover
Robert Menschel wrote: > I'm trying to make sure my corpus is as clean as possible, eliminating > all duplicates. > > I tried to use the masses/corpora/uniq-mailbox program for this, and had > problems which I've documented in bugzilla report 2920. > > Fortunately, my email client identifies and

[SAtalk] Re: Mass-Check

2004-01-11 Thread Bryan Hoover
Robert Menschel wrote: > Of course, the amount of ham and spam in your corpus does have an impact. > I have over 17,000 ham and 70,000 spam in my corpus right now, and my run > time for a single rule has gone from 20 minutes when I first started > using cygwin to something just less than 2 hours. (

[SAtalk] Re: Mass-Check

2004-01-11 Thread Bryan Hoover
Robert Menschel wrote: > Some people have been asking about my mass-check capabilities and > reports. > > I've just completed documenting my current system at > http://www.exit0.us/index.php/BobCorpusTest I tried to run mass-check a bit ago -- for the first time -- and I'm afraid it was killed on

[SAtalk] Re: Bayes database expiry running forever?

2004-01-11 Thread Bryan Hoover
Michael Jacob wrote: > > Hi, > > something seems to be wrong with my bayes db, or is this considered > 'normal'? Log: I backed up my Bayes db, and ran with -D force-expire to see what it'd do. I got pretty much what you show, except after the "something fishy" line, it paused for a moment or tw

[SAtalk] Re: Is BigEvil for me?

2004-01-09 Thread Bryan Hoover
Gary Funck wrote: > > > From: Robert Menschel > Here's an idea that I've been considering for a while: have SA change its > scoring strategy to use a Neural Net, instead of using the strictly additive > scoring. SA would still use its custom rules to detect spam markers, but it Just a couple comm

[SAtalk] Re: Pyzor reporting

2004-01-09 Thread Bryan Hoover
Bryan Hoover wrote: > > Alan Munday wrote: > > > > Is anyone finding pyzor reporting a bit hit and miss? > > Just got my first spam in days today. Taught Bayes, reported to Razor2, > and you reminded me about Pyzor. I got: > > [EMAIL PROTECTED] pyzor report --

[SAtalk] Re: optimal bayes "size"/"number of tockens" ?

2004-01-09 Thread Bryan Hoover
Oliver Thalmann wrote: > > Hi > > are there some recommendations for tuning the size > (number of tokens) of a bayes db ? > > i.e. are there some recommendations of optimal number of > tokens, maximum recommended number of tokens, etc ? > > i currently have something like this > > sa-learn -

[SAtalk] Re: Bayes sa-learning routine

2004-01-09 Thread Bryan Hoover
Kevin Roberts wrote: > > Once I have run the sa-learn routine on a group of thousands of messages, is > it necessary to keep all of those messages to run the next time I run > sa-learn? It takes a while for sa-learn to process thousands of message so > I was wondering if I only ran sa-learn on th

[SAtalk] Re: Pyzor reporting

2004-01-09 Thread Bryan Hoover
Alan Munday wrote: > > Is anyone finding pyzor reporting a bit hit and miss? Just got my first spam in days today. Taught Bayes, reported to Razor2, and you reminded me about Pyzor. I got: [EMAIL PROTECTED] pyzor report --mbox Reporting using: > > $ formail -s spamassassin -r < /var/spool/mai

[SAtalk] spam archiving

2004-01-07 Thread Bryan Hoover
In case anyone's interested in routines to auto-archive spam, I improved the Procmail recipes I recently pointed to, so that archiving is done in the more appropriate FIFO fashion. I made a few other changes too. ftp://ftp.wecs.com/procmail/archcron-fifo.zip Bryan -- Were I to wish for anything

[SAtalk] Re: Bizarre spam

2004-01-06 Thread Bryan Hoover
Christopher Kunz wrote: > > Hi, > > I received this here just some minutes ago. It went to a role account > and through a ticketing system so there's no usable headers (it wasn't > scanned by SA either), but the content speaks for itself... Looks like > pure bayes poison. Maybe. Or maybe it's a

[SAtalk] Re: Where's all my spam at?

2004-01-06 Thread Bryan Hoover
Spam?! I love it! Current spam, and bad address folders (I edited out access writes, and owner for "security") (note dates): -- users 2533780 Jan 6 20:12 caughtspam -- users 807847 Jan 6 20:12 badaddress -- users 124533 Jan 6 19:37 bayes_strays And the scourge t

[SAtalk] Re: Adjusting scores and weights

2004-01-04 Thread Bryan Hoover
Default SA install is not always as leak proof as one might hope. I was getting several spam a day after upgrading to 2.60. I then: Installed Razor2 and applied the patch for it -- comes with SA. Sorted out my spam corpus -- ham only in the ham file; spam only in the spam file; no list mail, th

[SAtalk] Re: Resource conservation

2004-01-04 Thread Bryan Hoover
Gary Funck wrote: > > The line to search for reads: > > > > HEADER = `$FORMAIL -X ""` # The space after the X is vital. > > > > http://pm-doc.sourceforge.net/pm-tips-body.html > > > > Thanks for the pointer. I think the situation discused in that example > is different than your usage. The space i

[SAtalk] Re: Resource conservation

2004-01-03 Thread Bryan Hoover
Gary Funck wrote: > > > From: Bryan Hoover [mailto:[EMAIL PROTECTED] > > Sent: Saturday, January 03, 2004 7:05 PM > [...] > > > > #extract only the address part -- so that's the format addresses should > > appear in #mailing list address file to

[SAtalk] Re: Resource conservation

2004-01-03 Thread Bryan Hoover
needed. Bryan Bryan Hoover wrote: > > Bob, > > Sorry I was a little distracted the first time I read this message. I > have addressed some of what you bring up. > > Bob Proulx wrote: > > > > Bryan Hoover wrote: > > > HEADERTAG=From > > >

[SAtalk] Re: Resource conservation

2004-01-03 Thread Bryan Hoover
Bob, Sorry I was a little distracted the first time I read this message. I have addressed some of what you bring up. Bob Proulx wrote: > > Bryan Hoover wrote: > > HEADERTAG=From > > ADDRESSFILE=/usr/home/bhoover/listreply > > Use $MAILDIR here? > > ADDRESSFIL

[SAtalk] Re: Resource conservation

2004-01-03 Thread Bryan Hoover
Bob, Sorry I was a little distracted the first time I read this message. I have addressed some of what you bring up. Bob Proulx wrote: > > Bryan Hoover wrote: > > HEADERTAG=From > > ADDRESSFILE=/usr/home/bhoover/listreply > > Use $MAILDIR here? > > ADDRESSFIL

[SAtalk] Re: Forwarding mail as spam and ham?

2004-01-03 Thread Bryan Hoover
On the subject of forwarding, headers, and Bayes learning, Bill Reynolds sent me the following message, and the attached scripts addressing the question. Bryan Original Message Subject: Bayes Training Script For Forwarded Spam Date: Sat, 03 Jan 2004 00:52:27 -0700 From: Bill Rey

[SAtalk] Re: A cron job to delete old spam?

2004-01-02 Thread Bryan Hoover
Liu Shuai wrote: > > Hi all, > > I want to set up a system wide cron job that deletes old (2 weeks maybe) > tagged spam from each user's > spam folder, but I am not sure how. > > Does anybody here has a script that does similar job that I can use as a > reference? If not, can some one > give me

[SAtalk] Re: Problem with Zero points spam messages.

2004-01-02 Thread Bryan Hoover
Dragoncrest wrote: > > That's cool. So, which file do I need to nuke or edit or whatever > to reset everything back to day one values? I don't want to delete or edit > the wrong thing and end up with a total mess. :) Bayes database location defaults to ~/.spamassassin The Bayes files

[SAtalk] Re: Resource conservation

2004-01-01 Thread Bryan Hoover
Bryan Hoover wrote: > I'm still looking at the differences between the code from which I > pulled the above -- it's not matching in the exact same way. My > original code -- that which I'm using on my account -- matches more > flexibly, but there have been no false m

[SAtalk] Re: Resource conservation

2004-01-01 Thread Bryan Hoover
Bob Proulx wrote: > > I like it! Much more efficient than listing all of the addresses > out. It is pretty nifty -- I love stuff like that :). I only partially tested what I pasted -- which I "extrapolated" from my implimented code -- I had forgotten to test whether it matched only for addresse

[SAtalk] Re: Resource conservation

2004-01-01 Thread Bryan Hoover
Bob Proulx wrote: > > Martin Radford wrote: > > In your scenario, it sounds very much like you're already running > > procmail. In this case, the best method is to tell procmail not to > > call spamc/spamassassin if mail is from one of those lists. > > > > For example, my own .procmailrc looks li

[SAtalk] Re: mass-check and hit-frequencies help needed

2004-01-01 Thread Bryan Hoover
Robert Menschel wrote: > I'll keep playing with those files. We'll figure it out sooner or later. > Thanks for the help. Another quick speculation. Be sure, if you havn't already, you've got all your Perl modules up to date -- since you are running from an alternate environment and all. I thinki

[SAtalk] Re: mass-check and hit-frequencies help needed

2004-01-01 Thread Bryan Hoover
Bryan Hoover wrote: > > perl ./mass-check -c ./spamassassin -j 1 --loghits --mid --mbox ./corpus.ham/* > > >ham.log > > perl ./mass-check -c ./spamassassin -j 1 --loghits --mid --mbox ./corpus.spam/* > > >spam.log > > perl ./hit-frequencies -x -c /home/O

[SAtalk] Re: Problem with Zero points spam messages.

2004-01-01 Thread Bryan Hoover
Dragoncrest wrote: > > >Though his friends and family getting scored sounds very possibly like > >some Bayes corruption going on because of the false negative > >autolearn(ing) -- not a good thing. > >Granted though, as the scoring from friends and family was not posted, > >Bayes may not have had

[SAtalk] Re: mass-check and hit-frequencies help needed

2003-12-31 Thread Bryan Hoover
Robert Menschel wrote: > > I'm hoping someone can help me with mass-check, or more specifically with > hit-frequencies. > > I've installed Cygwin on my W/XP-H box. Within Cygwin I've installed SA, > not to use for mail filtering (that happens on my servers), but > specifically for mass-check. >

[SAtalk] Re: Forwarding mail as spam and ham?

2003-12-31 Thread Bryan Hoover
Kevin Roberts wrote: > > Hello all, > > I am new to the forum so forgive me if I ask a question that has been > answered before. > > I am currently using the sa-learn system by forwarding a spam message that > makes it through spamassassin to a spam only mailbox. I do the same with > ham as wel

[SAtalk] Re: Problem with Zero points spam messages.

2003-12-31 Thread Bryan Hoover
Bob Proulx wrote: > > My normal daily email coming in scores higher than that. Heck, normal > > emails from friends and family score at least 2.6 or higher. SO > > something's a little whacky with SA, but I'm unsure of what it is. Anyone > > got any ideas? > > What? Your friends and fami

[SAtalk] Re: Problem with Zero points spam messages.

2003-12-31 Thread Bryan Hoover
Err, one more time: ./sa-learn --spam --mbox fales-neg.txt That is, don't forget the *spam*!! part! Bryan Bryan Hoover wrote: > > Dragoncrest wrote: > > > > Not sure what to make of this, but for some reason lately I've been > > getting some email

[SAtalk] Re: Problem with Zero points spam messages.

2003-12-31 Thread Bryan Hoover
Oh, that'd be: ./sa-learn --ham --mbox fales-neg.txt That is, don't forget the 'ham' part. Bryan Dragoncrest wrote: > > Not sure what to make of this, but for some reason lately I've been > getting some emails getting through with either zero points or very low > points scores that are

[SAtalk] Re: Problem with Zero points spam messages.

2003-12-31 Thread Bryan Hoover
Dragoncrest wrote: > > Not sure what to make of this, but for some reason lately I've been > getting some emails getting through with either zero points or very low > points scores that are obvious spam. Here's an example of the header on > one of these emails. > > X-Spam-Status: No, hit

[SAtalk] Re: new razor issue

2003-12-31 Thread Bryan Hoover
"S. M. C. Butler" wrote: > > > Hi all, > > I just found a new problem with razor. I'm seeing the following > > debug: Razor2 is available > debug: entering helper-app run mode > razor2 check skipped: No such file or directory Insecure dependency in > open while running with -T switch at Heh.

[SAtalk] Re: Ebay spoof?

2003-12-26 Thread Bryan Hoover
Martin Radford wrote: > > At Fri Dec 26 22:31:27 2003, Gary Funck wrote: > > > > As far as 66.135.209.220 goes: > > > > # dig -x 220.209.135.66 +recursive > > You're looking up the wrong IP address. If you reverse the octets, > you must append ".in-addr.arpa" Ah, I suppose that explains that.

[SAtalk] Re: Ebay spoof?

2003-12-26 Thread Bryan Hoover
Gary Funck wrote: > Interesting. The message body appeared as plain text. > However, the similar spam that we received here (see attached) > was thick with HTML that obscured its purpose. > > Do you have something in your mail delivery pipeline that converts HTML to > text? Nope. Nothing like th

[SAtalk] Re: Ebay spoof?

2003-12-26 Thread Bryan Hoover
Gary Funck wrote: > > It is best to post the entire message as an attachment. In this case, > I'd bet that the apparent Ebay link goes somewheree elese (do "view source" > on the message). Original message attached -- pretty much the same I think, as that pasted was from a straight 'cat /var/mail

[SAtalk] Ebay spoof?

2003-12-26 Thread Bryan Hoover
Does anyone know if the following mail is an ebay spoof? I think I've got an account with them, but it's been so long since I used it... And the site requires you to sign in in order to make a report, or request info -- apparently ebay does not provide a direct contact email address. Bayes won't

[SAtalk] Re: YO DEVELOPER! SA Rule COUNTER?

2003-12-13 Thread Bryan Hoover
Charles Gregory wrote: > > Hi! > > I suggested this once before, and did not see any response. > Many rules that I see suggested on this list all have the characteristic > of being a good test against e-mail that contain a large number of > occurences (a high 'count') of a particular 'trick' or '

[SAtalk] Re: Bayes database stats

2003-12-13 Thread Bryan Hoover
Matt Kettler wrote: > Well, 5mb * (743/100) = 37.15mb... that's pretty close to 44mb at an > estimate. Doesn't seem large at all given the specs.. Heh.. True that. My brain is *not* a arithmatic calculator :). Plus, Alexander may have been just counting up the total Bayes directory size, which

[SAtalk] Re: Bayes database stats

2003-12-13 Thread Bryan Hoover
Alexander Litvinov wrote: > > Today I have dumped my bayes db and calculate some statistics. > > 742753 - total number of words in it > 515654 - total number of words which have been seen only once > 80485 - ... twice > 35325 - ... 3 times > > This statistics shows that most of the db us n

Re: [SAtalk] Re: DCC incidence

2003-12-13 Thread Bryan Hoover
- > Name: ex.txt >ex.txtType: Plain Text (text/plain) > Encoding: 7bit > > > > On Dec 13, 2003, at 10:21 AM, Bryan Hoover wrote: > > > Simon Byrnand wrote: > >> Just a bit of a "me to

Re: [SAtalk] Re: SA 2.61 and this annoying spammer?

2003-12-13 Thread Bryan Hoover
Robert Nicholson wrote: > > I noticed the scores you reported were with 2.60. > > I don't understand why your scores as so much higher than mine. > > Do you have any custom rule modifications? > > I will take the message below and run it thru 2.61 now. > > Why do you get more hits? Your debug

Re: [SAtalk] Re: DCC incidence

2003-12-13 Thread Bryan Hoover
Simon Byrnand wrote: > Just a bit of a "me too" post, I checked my last two days email including > Ham and Spam and checked the hitrate of DCC and RAZOR2 and here were the > results: > > Ham: 0 DCC hits, 1 RAZOR2 hit out of 203 Ham messages. > Spam: 174 DCC hits, 57 RAZOR2 hits out of 242 Spam mes

[SAtalk] Re: SA 2.61 and this annoying spammer?

2003-12-13 Thread Bryan Hoover
> > Name: ex.txt >ex.txtType: Plain Text (text/plain) > Encoding: 7bit > > > > On Dec 13, 2003

[SAtalk] Re: SA 2.61 and this annoying spammer?

2003-12-12 Thread Bryan Hoover
Robert Nicholson wrote: > > Anybody who's installed A 2.61 > > Can you tell me what the score for the following email was > > From: Advance in Pay <[EMAIL PROTECTED]> > Subject:Need cash in the bank ASAP? > Date: December 12, 2003 4:28:24 PM CST > To:

[SAtalk] Re: Virginia Busts Spammers

2003-12-12 Thread Bryan Hoover
"Scott Williams , Area4" wrote: > > If you see two spammers hang hopefully a 100 will stop or atleast move > off shore. I was just thinking, I know spam is a big problem, and all that, but reading the article, I don't know. I hate to sound schizophrenic, but I mean, surely these guys are not "

[SAtalk] Re: One persistent spammer defeating SA.

2003-12-11 Thread Bryan Hoover
[EMAIL PROTECTED] wrote: > For many of these, one can observe that the "user name" in the From: > header often also occurs in the Subject line. This could be a useful > rule pattern, although there are bound to be false positives, so the > score should be rather low. > > I don't know off-hand if t

[SAtalk] Re: Help with DCC setup for use with Spamassaian

2003-12-11 Thread Bryan Hoover
stan wrote: > > On Wed, Dec 10, 2003 at 01:22:23AM -0500, Bryan Hoover wrote: > > stan wrote: > > > Yes, I just erviewd the firewall config. It will pass all trafic > > > originating on the innsied. I see that may not be a good general case, but > > > i

[SAtalk] Re: One persistent spammer defeating SA.

2003-12-10 Thread Bryan Hoover
[EMAIL PROTECTED] wrote: > /^Reply-to:\s*(<[-a-z0-9_.]+\@([-a-z0-9_]+\.)+[a-z]+>)\s+\1/i > > Underscore is not technically valid in a domain name but you do see > them in practice anyway. > > I'm not sure this is any better than what I originally posted, as I > haven't tested this properly. My

[SAtalk] Re: One persistent spammer defeating SA.

2003-12-09 Thread Bryan Hoover
[EMAIL PROTECTED] wrote: > > /^reply-to:[EMAIL PROTECTED](\.org|\.net)[EMAIL PROTECTED](\.org|\.net)\$/igm > > This is probably a sufficient pattern, but one distinguishing feature > in the examples was that the same address would be repeated twice. Think there were instances with two different

[SAtalk] Re: DCC incidence

2003-12-09 Thread Bryan Hoover
"Covington, Chris" wrote: > > On my site DCC hits approximately 20% of False Positives also (that is, > of the 1-2% of false positives, 20% have Razor hits), so don't give it > too much weight. Razor2 is the worse for that (50% of false > positives)... but I've weighted my scoring accordingly. S

[SAtalk] Re: Help with DCC setup for use with Spamassaian

2003-12-09 Thread Bryan Hoover
stan wrote: > Yes, I just erviewd the firewall config. It will pass all trafic > originating on the innsied. I see that may not be a good general case, but > it should be OK here (Small home network). > > BTW, I decided to try (breifly) disabling all packet firewalling. Guess > what? cdcc still sa

[SAtalk] Re: One persistent spammer defeating SA.

2003-12-07 Thread Bryan Hoover
Robert Nicholson wrote: > > I've got a mailbox full of messages that got past SA > > They are all from the same spammer. What sort of stuff is in the messages? And if it's a bulk send -- that is, a real spammer, as opposed to someone targeting only you (which would be, most likely, for the most

[SAtalk] Re: Rule out-of-date?? (was... loud)

2003-12-06 Thread Bryan Hoover
Charles Gregory wrote: > > but I can't be expected to 'spot' all bugs like this. Having a simple list You vill spot ze bugs. You vill spot *all* of ze bugs. > of rules that are buggy on the SA website, with or without adjusted scores > would be relatively easy to assemble for anyone who is

[SAtalk] Re: Tune a bit harder

2003-12-06 Thread Bryan Hoover
Dan wrote: > > ideas? Any other products I should put on? razor? Yeah, Razor, and DCC (similar to Razor, but more aggressive - both in tagging as spam, and scoring, though Razor score can be tweaked) will help quite a bit. Also, train Bayes which will help catch those that might otherwise slip b

[SAtalk] Re: What is this? Bayes poison?

2003-12-05 Thread Bryan Hoover
Kenneth Porter wrote: > > I'm getting a bunch of these. Are these just intended to poison Bayes DB's? > What's the sender's objective? Maybe someone's just looking out for your spirtual well being. The other day, I was excited about not having received a single spam in days (no spam today, BTW),

[SAtalk] Re: Simple SA-Learn question

2003-12-04 Thread Bryan Hoover
Tobin wrote: > > I have my bayes built and running. I have 100 new spams to add to it. > Can I just SA-Learn JUST those 100 and it will add to the tokens? Do I Yes. > need to have a equal amount of ham to feed in this next 100 spam? No. Though equal amounts spam, ham are recommended for best r

[SAtalk] Re: failed lock file?

2003-12-04 Thread Bryan Hoover
[EMAIL PROTECTED], To clarify, the guy in the link didn't seem to have any memory problems - see bottom of mail - but others with Bayes problems have, and the lock file(s) are/is where he pointed. In my single user installation, the lock file's in the .spamassassin directory. Br

[SAtalk] Re: failed lock file?

2003-12-04 Thread Bryan Hoover
[EMAIL PROTECTED] wrote: Hey all,     One of the mailgate boxes fell offline for about 8 hours, and when it came back up, /var/log/mail has a lot of entries like the stuff below: Stray lock files from crashing, probably due to low memory - guessing from what others have reported: http://lists

[SAtalk] Re: How to do better than 85% detect?

2003-12-04 Thread Bryan Hoover
Kurt Buff wrote: Is there anything I can do to help improve the detection rate? I'm willing Definately a good point on the poisoned Bayes.  You want to be obsessive about keeping spam, and ham separate - in doubt, leave it out.  And obviously the best way to be sure, is train manually. Installing

[SAtalk] Re: SA questions

2003-12-02 Thread Bryan Hoover
Robert Menschel wrote: > You beat me to it ... I was going to suggest the same thing. I've been > feeding all of my list traffic through sa-learn for the past month, and > if anything it has improved my Bayes performance. I think the idea of bypassing list mail is efficiency - you know it's not

[SAtalk] Re: How to make SA "learn" from spam?

2003-12-02 Thread Bryan Hoover
John Oliver wrote: > I'm led to believe I can feed untagged spam (and tagged non-spam) to SA > for it to "learn" how to be better. How do I do this? You were led right. Assuming mbox format mail file -- for instance, Netscape, Eurdora (and my FreeBSD account with qmail is mbox format) - you can

[SAtalk] Re: Installing DCC after the fact RH 9

2003-12-01 Thread Bryan Hoover
I'll give you a dollar if you turn off html in your email composer :). There's right much documentation on the DCC web site: http://www.rhyolite.com/anti-spam/dcc/ - installation link just a bit down the page. Basically, you need to install the client program - dccproc.  Instructions on the site

[SAtalk] Re: DCC incidence

2003-12-01 Thread Bryan Hoover
Kai, Nice, informative whitepaper (http://www.arrak.fi/files/arska_white_paper.pdf) on SA oriented spam handling. Bryan Kai Risku wrote: > > > Can anyone please tell me generally how frenquently they're > > DCC is hitting with SA? > > A quick grep from last month's logfile reveals DCC hits > o

[SAtalk] Re: DCC incidence

2003-12-01 Thread Bryan Hoover
Aaron Young wrote: > > On Sat, 29 Nov 2003, Bryan Hoover wrote: > > > Can anyone please tell me generally how frenquently they're DCC is > > hitting with SA? > > DCC is working fine for me. I have three spams out of eight that arrived > in the last 30

[SAtalk] Re: Bayes trashed

2003-11-30 Thread Bryan Hoover
Jack Gostl wrote: > > > On Sunday 30 November 2003 02:42 pm, you wrote: > > I do agree with you. Why would you be getting mails in like that though? > > This is an old email address. I've been watching the spams slowly > increase. Too many newsgroup posts, too much online ordering, too much > buy

[SAtalk] Re: DCC incidence

2003-11-30 Thread Bryan Hoover
"Christopher X. Candreva" wrote: > > On Sat, 29 Nov 2003, Bryan Hoover wrote: > > > Can anyone please tell me generally how frenquently they're DCC is > > hitting with SA? > > Well I just cleaned out my probably-spam folder a few minutes ago, but out

Re: [SAtalk] DCC incidence

2003-11-29 Thread Bryan Hoover
Clive Dove wrote: > > > I have observed that both Pyzor and Razor are working as they show up in > > the caught spam, but there is no sign that any of the other database checks > > are being run. > > > > How do I enable these features? Are their applications that have to be > > installed? There'

Re: [SAtalk] DCC incidence

2003-11-29 Thread Bryan Hoover
Clive Dove wrote: > > On Saturday 29 November 2003 18:53, Bryan Hoover wrote: > I noticed the same thing. I have come to the conclusion that DCC and RBL > checking are not working in Spamassassin 2.60 and I wondered if there was > something additional tha had to be done. Mm

[SAtalk] DCC incidence

2003-11-29 Thread Bryan Hoover
Can anyone please tell me generally how frenquently they're DCC is hitting with SA? I installed for single user client yesterday, and aside from a run with the sample-spam.txt file, I've seen no dcc check hits in caught spam SA markup (out of my usual 300 or so spam/24 hours). The dcc install s

[SAtalk] Re: Razor and SA. Is it working?

2003-11-27 Thread Bryan Hoover
Frank DeChellis wrote: > > Hi! > > We are using SA 2.6nb1 and Razor 2.22. > > I registered my username as stated and I entered the line "use_razor2" in my > local.cf . > > Do the 2 points below mean it's working? Yup, looks like it's working. The output does report you don't have a .razor/raz

[SAtalk] Re: An Open Letter to the SA-talk forum

2003-11-26 Thread Bryan Hoover
Oh! It's been a brutal, seat of the pants, knock down, drag out, riot! Things were said. Observations made. And lessons learned all around. It's been exciting to the point of being unnerving. And Logan, hanging tough. I for one, can't wait to read the edtorial letters, and the follow up revi

[SAtalk] Re: An Open Letter to the SA-talk forum

2003-11-25 Thread Bryan Hoover
Dan Wilder wrote: > > On Tue, Nov 25, 2003 at 06:04:13PM -0600, Scott A Crosby wrote: > > To everyone here, give the guy a break. > > Hear, hear! > > It's all too easy to make a mistake in print. Give Logan Is it now? I think you need to go back and read the article again. The word, blanant

[SAtalk] Re: http://www.infoworld.com/article/03/11/14/45FEspam_1.html?s=tc

2003-11-23 Thread Bryan Hoover
Man, that article is indeed rather damning - in affect, though unlikely effect. The article, flagrantly irresponsible, says more about the magazine, and the author, than any commentary about the reality of SA's effectiveness as an anti-spam tool. The fact that older SA versions don't hold up well

[SAtalk] Re: What is marked as spam

2003-11-23 Thread Bryan Hoover
Taking a break from reading Orwell's 1984... Also be aware that SA uses 1 of 4 different score sets depending on which of auto_learn, and network checks are on. From some documentation somewhere: #If four valid scores are listed, then the score that is used depends on how #SpamAssassin is being

[SAtalk] Re: What is marked as spam

2003-11-22 Thread Bryan Hoover
Have you seen the configuration generator at: http://www.yrex.com/spam/spamconfig.php Bryan John Oliver wrote: > > On Sat, Nov 22, 2003 at 06:24:38PM -0800, Robert Menschel wrote: > > -BEGIN PGP SIGNED MESSAGE- > > Hash: SHA1 > > > > Hello John, > > > > Saturday, November 22, 2003, 4:24

[SAtalk] Re: SA in the news: Reason, November issue

2003-11-21 Thread Bryan Hoover
Not too sure about the article's comment about no solution being complete. That is, more praise for Bayes, as it stopped 6 out of around 300 today, that would have gotten through without it. Zero spam today. I'm heavy on spam learning relative to ham, but I haven't had any false positives yet.

[SAtalk] bayes works!

2003-11-19 Thread Bryan Hoover
Which I'm sure is no surprise to most. Just wanted to mention that I'd been trying to clean up a polluted ham corpus by using 'forget', but I continued to get poor results. Long story short, I cleaned up my ham, and removed both ham, and spam that had spambouncer headers - which I assume sa-learn

Re: [SAtalk] db working but not?

2002-06-30 Thread Bryan Hoover
Andrew Kohlsmith wrote: > > >now user steve has an entry in the userpref database that asks his > default > > >score to be 5.0. However SA doesn't seem to be listening: > > > > Are you running spamd with the -q option? > > Yes. As I'd said entries for GLOBAL (including whitelist entries) are >

Re: [SAtalk] Interview with "Spam King" Scelson

2002-06-30 Thread Bryan Hoover
Matthew Cline wrote: > > Scelson, who designed the software, says it will penetrate virtually > > > any system designed to stop ads from reaching the intended mailbox. > > > "If it accepts e-mail, there's a way in," he says. "And this is > > designed to get around anything." Yeah, right. Looks

Re: [SAtalk] procmailrc entry is wrong

2002-06-27 Thread Bryan Hoover
Steve Wingate wrote: > # Added for SpamAssassin > :0fw > | spamassassin -P > > :0: > * ^X-Spam-Status: Yes > caughtspam > > The above entry was taken directly from the documentation. This is kind of a procmail question, but... I think the documentation - the README at least - specifies a path.

Re: [SAtalk] Local rules page

2002-06-27 Thread Bryan Hoover
Weyland wrote: > but it's nice to have things like this to get my set-up > at least slightly customized while I spend the time to learn. I'm just a user, but I'd say, you'd have a hard time finding or writing any spam filter better than SA. Bryan -- [Insert Maxwell Smart accent] ==>> Reply-To m

Re: [SAtalk] Intermittent Error

2002-06-27 Thread Bryan Hoover
Mike Scott wrote: > I've set up SpamAssassin 1.20 on my account on a shared FreeBSD server > > (i.e. I don't have root access), and it generally works perfectly, but > > about one email in ten generates the following error (taken from my > procmail log, with the address the email forwards to dele

Re: [SAtalk] SA doesn't do anything...

2002-06-24 Thread Bryan Hoover
Dr. Martinus wrote: > I tried running > > "spamassassin -t -L sample-spam.txt" > > from within the directory where sample-spam.txt resides. Nothing > happens, i.e. it appears as if something is going on, but it takes > too long (several minutes), so I hit Ctrl-C to stop it. What could be > wrong?

Re: [SAtalk] Fwd: Re: SPEWS? (SA trusts them)

2002-06-24 Thread Bryan Hoover
Andrew Kohlsmith wrote: > Noone in their right mind would trust SPEWS directly, the problem is > people trust Spam Assassin, and Spam Assassin uses > relays.osirusoft.com > with enough weight to kill an email-- Someone quoted this very same mail in my ISP's mail newsgroup. Note the blantant ina

Re: [SAtalk] newbie installs SA

2002-06-24 Thread Bryan Hoover
Weyland wrote: > I've installed SA with MIMEDefang, and have > a problem that I'm not sure how to figure out. > > Too, I can use the test of " spamassassin -t < sample-nonspam.txt > > nonspam.out" and see that it works by viewing the resulting file. > > How can I diagnose what the problem is? Ha

Re: [SAtalk] Error after upgrading

2002-06-23 Thread Bryan Hoover
Nils Vogels wrote: > results of a cat sample-spam.txt | spamassassin -DP : > > debug: Failed to parse line in SpamAssassin configuration, skipping: > auto_report_threshold 30 The auto_report_threshold line should be removed from user_prefs - SA's not reading it. > Can't locate object metho

Re: [SAtalk] anyone seen cloudmark.com?

2002-06-20 Thread Bryan Hoover
Duncan Findlay wrote: > Yep, it's razor. Vipul is the other (or another) co-founder. I read the article at coudmark. I never really considered the lawsuit aspect. The Razor voting concept would indeed seem to sidestep that issue. And I'd think individual SA users like myself would be immune to

Re: [SAtalk] Re: Freeze for 2.30, call for nonspam.log submissions

2002-06-10 Thread Bryan Hoover
Jeremy Zawodny wrote: > > Hormel's Spam page). Maybe each release could be a different Spam > > dish (Spam a L'orange, Spam Fettucine Primavera, Spam Cheese Torte, But doesn't that sound like SA is *serving* spam? Bryan -- I struggle in vain. My foot slips. My life is still a poet's existenc

Re: [SAtalk] Finally got it working...

2002-06-09 Thread Bryan Hoover
David T-G wrote: > Well, I actually took the "lost cause" tack from your mail, though I > agree that there are bulk-friendly ISPs and others which just don't > care. Nah, didn't really mean to imply a lost cause. I was rather, optimistically projecting, or wishfully thinking regarding ISP's con

Re: [SAtalk] Finally got it working...

2002-06-09 Thread Bryan Hoover
David T-G wrote: > This is an interesting one, though... I'm sure there are some that > won't > listen to complaints, though perhaps if enough people complain they > might. > How, however, are those caring ISPs to chase the spammers around, as > you > put it, if nobody tells 'em about the proble

Re: [SAtalk] Ammusingly misconfigured spam software

2002-06-09 Thread Bryan Hoover
Brian May wrote: > Not to nitpick, but that is most languages.. if you don't know how to > use > the languange.. its kinda hard to make it do what you want it to > do... :) Sure. I made my comments with tounge firmly planted in cheek. Indeed, the measure of intelligence is not a function of

Re: [SAtalk] Finally got it working...

2002-06-09 Thread Bryan Hoover
David T-G wrote: > actually report the spammer a la spamcop? I'm pretty sure neither report spammers. My guess is, ISPs that care do a good enough job chasing spamers around. The rest won't listen to complaints. I imagine, reporting them is, seen in the light of day, is probably pointless. Br

  1   2   >