[SAtalk] [Q] more_spam_to (was: "Sorry - I'm blind.")

> You can also use more_spam_to or all_spam_to instead of whitelist_to.. They > have stronger scores by default. What are those? What do more_spam_to and all_spam_to do? -- Daniel Carrera, Math PhD student at UMD. PGP KeyID: 9AF77A88 .-"~~~"-. Weekly Smile: / O

[SAtalk] Sorry - I'm blind.

Okay, I'm blind. I didn't realize that the email DID have USER_IN_WHITELIST_TO in the header. I'll just change some values in user_prefs: score USER_IN_WHITELIST_TO -7.0 -- Daniel Carrera, Math PhD student at UMD. PGP KeyID: 9AF77A88 .-"~~~"-. Weekly Smil

[SAtalk] Problems with whitelist_to

didn't? The headers don't show WHITELIST_TO anywhere. What happened? Any help would be most appreciated. -- Daniel Carrera, Math PhD student at UMD. PGP KeyID: 9AF77A88 .-"~~~"-. Weekly Smile: / O O \ :s: There are 10 types of people in the world... \ \___

Re: [SAtalk] Newbie

> Family Care International > 588 Broadway Suite 503 > New York, NY 10012 > Phone:212-941-5300 xt 36 > Fax:212-941-5563 > Mailto: [EMAIL PROTECTED] > > References > >1. mailto:[EMAIL PROTECTED] >2. mailto:[EMAIL PROTECTED] >

Re: [SAtalk] Where is BAYES?

On Thu, Aug 07, 2003 at 05:30:53PM -0400, Theo Van Dinter wrote: > On Thu, Aug 07, 2003 at 05:17:39PM -0400, Daniel Carrera wrote: > > I checked. They are not 0. My user_prefs file contains the following: > > > > score BAYES_40 0.0 -0.056 -0.034 > > score BAYES_44

[SAtalk] Where is BAYES?

, USERPASS There is no BAYES line anywhere. I'm completely at a loss. The other spams that I get do have BAYES lines, but this one does not. Any ideas as to why this is happening? -- Daniel Carrera | PGP: 6643 8C8B 3522 66CB D16C D779 2FDD 7DAC 9AF7 7A88 Math PhD. UMD |

Re: [SAtalk] Where is BAYES?

e gotten have BAYES scores below 40 or above 60, so I have not tested the 40-60 range. Any other ideas? Like I said. I'm stumped. -- Daniel Carrera | PGP: 6643 8C8B 3522 66CB D16C D779 2FDD 7DAC 9AF7 7A88 Math PhD. UMD | http://www.math.umd.edu/~dcarrera/pgp.html Weekly Smile: There

Re: [SAtalk] Where is BAYES?

On Thu, Aug 07, 2003 at 05:30:53PM -0400, Theo Van Dinter wrote: > On Thu, Aug 07, 2003 at 05:17:39PM -0400, Daniel Carrera wrote: > > I checked. They are not 0. My user_prefs file contains the following: > > > > score BAYES_40 0.0 -0.056 -0.034 > > score BAYES_44

Re: [SAtalk] Bayes scores too low

gave them 90% or 99% probability. I noticed that too. After I found that my SA was well-trained enough to have a very high accuracy I raised the values for BAYES. Cheers, -- Daniel Carrera | PGP: 6643 8C8B 3522 66CB D16C D779 2FDD 7DAC 9AF7 7A88 Math PhD. UMD | http://www.math.umd

Re: [SAtalk] New Install of SA

thing like this: # First pass the email through SA: :0fw | /usr/bin/spamassassin # If it's spam, send it to the spam folder. :0: * ^X-Spam-Status: Yes spam Hope that helps. -- Daniel Carrera | PGP: 6643 8C8B 3522 66CB D16C D779 2FDD 7DAC 9AF7 7A88 Math PhD. UMD | http://www.math

[SAtalk] "O" vs 0 and "1" vs "l"

ules like: body MY_CONFIDENTIAL_1 /C[O0]NFIDENT(?:AI|IA)L/i But I'd rather not have to. -- Daniel Carrera | PGP: 6643 8C8B 3522 66CB D16C D779 2FDD 7DAC 9AF7 7A88 Math PhD. UMD | http://www.math.umd.edu/~dcarrera/pgp.html Weekly Smile: There

Re: [SAtalk] My rules don't work.

> Send yourself a simple message to test the rules. > > The Base64 trick that spammers use will NOT look at body rules! You may have > recieved one with this trick. Thanks for the suggestion. Yes I've done that already. -- Daniel Carrera | PGP: 6643 8C8B 3522 66CB D16C D7

Re: [SAtalk] My rules don't work.

oes that mean I'm stuck and there's nothing I can do to configure SA? If it's a security hole, I have no expectation that I will be allowed to do make my own rules. So what am I supposed to do? -- Daniel Carrera | PGP: 6643 8C8B 3522 66CB D16C D779 2FDD 7DAC 9AF7

[SAtalk] My rules don't work.

are now up and running! I can't wait to see you on deck with me and my girlfriends! In case you don't remember how to reach me, you can go to the website below to make discreet reservations... We'll have a great time! xoxo- Katrina http://EcstaseaYachtCharter.com - End forwarde

Re: [SAtalk] My rules don't work.

On Tue, Aug 05, 2003 at 09:14:25AM -0400, Theo Van Dinter wrote: > On Tue, Aug 05, 2003 at 02:35:55AM -0400, Daniel Carrera wrote: > > So does that mean I'm stuck and there's nothing I can do to configure SA? > > If it's a security hole, I have no expectation that I w

Re: [SAtalk] Re: whitelist_to (regex?)

on't know how to use it. But thanks for pointing me in the right direction. Cheers, -- Daniel Carrera | PGP: 6643 8C8B 3522 66CB D16C D779 2FDD 7DAC 9AF7 7A88 Math PhD. UMD | http://www.math.umd.edu/~dcarrera/pgp.html * * * * * Weekly Smile * * * * * * * * * * * * * * * * * * * * * * * *

[SAtalk] [Q] whitelist_to (regex?)

as on how I would say this? Is it possible? Thanks a lot, -- Daniel Carrera | PGP: 6643 8C8B 3522 66CB D16C D779 2FDD 7DAC 9AF7 7A88 Math PhD. UMD | http://www.math.umd.edu/~dcarrera/pgp.html * * * * * Weekly Smile * * * * * * * * * * * * * * * * * * * * * * * * Sign in a hotel in Athens:

Re: [SAtalk] Why are there 4 scores?

> Nope. 'net' means with DNSBL checks. 'local' means no DNSBL lookups. Huh? What is a DNSBL? How do I find out which one my system has? This is a UNIX network. -- Daniel Carrera | PGP: 6643 8C8B 3522 66CB D16C D779 2FDD 7DAC 9AF7 7A88 Math PhD. UMD | http://www

[SAtalk] Why are there 4 scores?

emails (that match the rule) get that score? Could someone confirm or deny my interpretation of rules? Thanks a lot. -- Daniel Carrera | PGP: 6643 8C8B 3522 66CB D16C D779 2FDD 7DAC 9AF7 7A88 Math PhD. UMD | http://www.math.umd.edu/~dcarrera/pgp.html * * * * * Weekly Smile * * * * * * * *

Re: [SAtalk] Re: Problem with "penis enlargement" :)

ative of spam! Tell me if I'm wrong. My Bayes database won't be polluted as long as I don't feed messages from this list to SA, right? > I use procmail, and tell it not to bother sending mail to this list to > spamc. Can you tell me how to do that? Thanks. -- Daniel

[SAtalk] Re: Problem with "penis enlargement" :)

LING_LIST (-0.3 points) RCVD_IN_NJABL (0.8 points) UPPERCASE_25_50(2.1 points) Cheers, -- Daniel Carrera | PGP: 6643 8C8B 3522 66CB D16C D779 2FDD 7DAC 9AF7 7A88 Math PhD. UMD | http://www.math.umd.edu/~dcarrera/pgp.html * * * *

[SAtalk] 1)Change Bayes scores; 2)Whitelists

. 2) I put SA's list in my whitelist, but the emails I get from SA aren't hitting the WHITELIST rule. SA interprets the email as comming from whoever posted the message to SA. Does anyone know how I can make SA emails part of my whitelist? Thanks a lot, -- Daniel Carrera | PGP: 6643

Re: [SAtalk] Question about using sa-learn

lable now. > Download today and enter to win an XBOX or Visual Studio .NET. > http://aspnet.click-url.com/go/psa0013ave/direct;at.aspnet_072303_01/01 > _______ > Spamassassin-talk mailing list > [EMAIL PROTECTED] > https://lists.sourc

Re: [SAtalk] SA-Learn usually learns 0 messages, why?

g about the ignored messages. > > > >How does the --forget option work? If I use it with all spam, do they >get learned as separate messages or does it always remove the old data >from database first? > > > >-- > >

Re: [SAtalk] Spam scored above threshhold but is not tagged.

e, Portals, and Forums are available now. > Download today and enter to win an XBOX or Visual Studio .NET. > http://aspnet.click-url.com/go/psa0013ave/direct;at.aspnet_072303_01/01 > ___ > Spamassassin-talk mailing list > [EMAIL PROTECTED

Re: [SAtalk] spam

ailcode: 4426 >SIUC - Carbondale, IL 62901-4426 >phone: (618) 453-6548; fax: (618) 453-6552 >******** > > References > >1. mailto:[EMAIL PROTECTED] -- Daniel Carrera | PGP: 6643 8C8B

Re: [SAtalk] Help

_ > Spamassassin-talk mailing list > [EMAIL PROTECTED] > https://lists.sourceforge.net/lists/listinfo/spamassassin-talk -- Daniel Carrera | PGP: 6643 8C8B 3522 66CB D16C D779 2FDD 7DAC 9AF7 7A88 Math PhD. UMD | ht

Re: [SAtalk] Bayes ratios?

01 > ___ > Spamassassin-talk mailing list > [EMAIL PROTECTED] > https://lists.sourceforge.net/lists/listinfo/spamassassin-talk -- Daniel Carrera | PGP: 6643 8C8B 3522 66CB D16C D779 2FDD 7DAC 9AF7 7A88 Math PhD. UMD | http://www.math.umd.edu/~

Re: [SAtalk] Spam Corpus

for "Email". What's the B for? >From your explanation of UBE, I think I agree with you. Cheers, -- Daniel Carrera | PGP: 6643 8C8B 3522 66CB D16C D779 2FDD 7DAC 9AF7 7A88 Math PhD. UMD | http://www.math.umd.edu/~dcarrera/pgp.html A child's letter to GOD: Dear GOD, Di

Re: [SAtalk] Want to turn off AWL (at least for my address)

a computer that serves mail? I guess that there must be some software aking to Apache that could be called mailsever, but I thought that was the MTA. - -- Daniel Carrera | PGP: 6643 8C8B 3522 66CB D16C D779 2FDD 7DAC 9AF7 7A88 Math PhD. UMD | http://www.math.umd.edu/~dcarrera/pgp.html A child&#

Re: [SAtalk] Want to turn off AWL (at least for my address)

how she's calling SA. So it's stupid to accuse her of "refusing point black" to collaborate. BTW, I honestly don't understand why these matter. I guess that the SA version might be relevant in case it's a known bug. But even then, your rudeness is totally un

Re: [SAtalk] SA not filtering spam.

sson wrote: > Daniel Carrera wrote: > >> debug: is spam? score=6.9 required=3.2 \ > >> tests=BAYES_70,FROM_ENDS_IN_NUMS,UNDESIRED_LANGUAGE_BODY > > > > Well, the score is higher than the required. Shouldn't this have been > > flagged as spam? How come it

Re: [SAtalk] What it some spam passes through?

without getting false positives? > > Thank you... > > -- > Bonny - Registered Linux User #251752 >--- VB LUG Moderator --- > If a program is useless, it must be documented. - -- Daniel Carrera| OpenPGP fingerprint: Mathematics Dept. | 6643 8C8B 3522 66CB D16C

Re: [SAtalk] spam funny

s to compensate (and also because a known sig is a high indicator of hamminess). - -- Daniel Carrera| OpenPGP fingerprint: Mathematics Dept. | 6643 8C8B 3522 66CB D16C D779 2FDD 7DAC 9AF7 7A88 UMD, College Park | http://www.math.umd.edu/~dcarrera/pgp.html -BEGIN PGP SIGNATURE- Versi

Re: [SAtalk] spam funny

If there is a recognizable PGP sig, it counts very well (e.g. -4.5) if it's not recognized it counts a little bad (e.g. +1.0) - -- Daniel Carrera| OpenPGP fingerprint: Mathematics Dept. | 6643 8C8B 3522 66CB D16C D779 2FDD 7DAC 9AF7 7A88 UMD, College Park | http://www.math.umd.edu/~dc

Re: [SAtalk] spam funny

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 > The same PGP signature problem applies to the multiple-consonant rules > Daniel Carrera offered. I picked a signed email at random, and > found: ... 4cons ... 7cons ... 8cons ... 6cons ... > > I receive a lot of PGP-signed email .

Re: [SAtalk] spam funny

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 > Probably more effective would be to write this as an eval: rule and > write a function for it. (eval:consonant_count('0', '4'), How do you write a function for SA? - -- Daniel Carrera| OpenPGP fingerprint: Mat

Re: [SAtalk] spam funny

; I'm playing with Chris's OBFU rules, but I'll keep watching the list for > more ideas, too - I'd love to be able to catch these! - -- Daniel Carrera| OpenPGP fingerprint: Mathematics Dept. | 6643 8C8B 3522 66CB D16C D779 2FDD 7DAC 9AF7 7A88 UMD, College Park | h

Re: [SAtalk] spam funny

;m not happy with it though. I'll give it some thought - -- Daniel Carrera| OpenPGP fingerprint: Mathematics Dept. | 6643 8C8B 3522 66CB D16C D779 2FDD 7DAC 9AF7 7A88 UMD, College Park | http://www.math.umd.edu/~dcarrera/pgp.html -BEGIN PGP SIGNATURE- Version: GnuPG v

Re: [SAtalk] spam funny

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Fri, Jul 25, 2003 at 06:27:59PM -0300, Raul Dias wrote: > [...] > > body MY_CONSONANT_4 /[^aeiou]{4}/ > > I think you meant something like: > /[^aeiou\s\d]{4}/ That works better. Yes, that's why I asked for conf

Re: [SAtalk] spam funny

some day) I'll update the rule. > So the pattern may work in somebody's *private* > setup but might be a bad idea in a global setting. Yes, definitely. That's what it was meant for. - -- Daniel Carrera| OpenPGP fingerprint: Mathematics Dept. | 6643 8C8B 3522 66CB D16C D779

Re: [SAtalk] spam funny

ical rules, as I have done above. What I was saying in my post was essentially that if you get (say) 7 consecutive consonants, then that email will test positive for rules MY_CONSONANT_4 up to MY_CONSONANT_7 so they'll add up. Cheers, - -- Daniel Carrera| OpenPGP fingerprint: M

Re: [SAtalk] spam funny

o .NET. > http://aspnet.click-url.com/go/psa0013ave/direct;at.aspnet_072303_01/01 > ___ > Spamassassin-talk mailing list > [EMAIL PROTECTED] > https://lists.sourceforge.net/lists/listinfo/spamassassin-talk - -- Daniel Carrera| OpenPGP fingerprint: Mathematics Dept. | 664

Re: [SAtalk] reporting idea

ay and enter to win an XBOX or Visual Studio .NET. > http://aspnet.click-url.com/go/psa0013ave/direct;at.aspnet_072303_01/01 > ___ > Spamassassin-talk mailing list > [EMAIL PROTECTED] > https://lists.sourceforge.net/lists/listinfo/spamass

Re: [SAtalk] [RD] rule discussion

[1]http://www.merchantsoverseas.com/wwwroot/gorilla/sa_rules.htm >"A little nonsense now and then, is relished by the wisest men." - > Willy Wonka > > References > >1. http://www.merchantsoverseas.com/wwwroot/gorilla/sa_rules.htm - -- Daniel

Re: [SAtalk] SA not filtering spam.

x27;t know how I did this. I don't think I would type "rm .forward .procmailrc" without noticing. But well, problem solved. Thanks for the help. -- Daniel Carrera| OpenPGP fingerprint: Mathematics Dept. | 6643 8C8B 3522 66CB D16C D779 2FDD 7DAC 9AF7 7A8

Re: [SAtalk] SA not filtering spam.

Yes, I KNOW! My MTA is configured to redirect emails that fail SA's test. This is demonstrated by the fact that it has already redirected over 100 emails which failed SA's test. On Fri, Jul 25, 2003 at 07:44:59AM +0300, Jari Fredriksson wrote: > Daniel Carrera wrote: > &

Re: [SAtalk] SA not filtering spam.

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Actually, cancel that. If SA couldn't read my user_prefs, then it wouldn't have worked on the command-line. Ideas anyone? On Fri, Jul 25, 2003 at 12:16:00AM -0400, Daniel Carrera wrote: > On Fri, Jul 25, 2003 at 12:07:21AM -0400, Th

Re: [SAtalk] SA not filtering spam.

t it is reasonable to conclude that SA is not reading my ~/.spamassassin/user_prefs ? If that is the case, I guess that I'll talk to my sysadmin. But I really want to know if that's where the problem is. If not, waiting until tomorrow for no reason will only mean that my problem wi

Re: [SAtalk] SA not filtering spam.

if I didn't do anything wrong, that still leaves the question as to why the spam got through. - -- Daniel Carrera| OpenPGP fingerprint: Mathematics Dept. | 6643 8C8B 3522 66CB D16C D779 2FDD 7DAC 9AF7 7A88 UMD, College Park | http://www.math.umd.edu/~dcarrera/pgp.html -BEGIN PGP SIGNATUR

Re: [SAtalk] SA not filtering spam.

Ooops, I forgot to attach .../user_prefs. -- Daniel Carrera| OpenPGP fingerprint: Mathematics Dept. | 6643 8C8B 3522 66CB D16C D779 2FDD 7DAC 9AF7 7A88 UMD, College Park | http://www.math.umd.edu/~dcarrera/pgp.html # SpamAssassin user preferences file. See 'perldoc Mail::SpamAssassin:

[SAtalk] SA not filtering spam.

Shouldn't this have been flagged as spam? How come it made it to my inbox? Any help would be much appreciated. - -- Daniel Carrera| OpenPGP fingerprint: Mathematics Dept. | 6643 8C8B 3522 66CB D16C D779 2FDD 7DAC 9AF7 7A88 UMD, College Park | http://www.math.umd.edu/~dcarrera/p

Re: [SAtalk] Spam Corpus

ikely to interested in viaragas, porn or bankers from Nigera. Would it be best if I did not borrow spam from other people? -- Daniel Carrera| OpenPGP fingerprint: Mathematics Dept. | 6643 8C8B 3522 66CB D16C D779 2FDD 7DAC 9AF7 7A88 UMD, College Park | http://www.math.umd.edu/~dcarrera/

Re: [SAtalk] Help. SA is not learning

d it seems that this batch actually had 691 messages. I'm still surprised that there was enough repetition that there were only 11 new messages. Well, I tried with aother batch and the results were better. ~450 new messages in a file that contained about 500. So that certainly look

[SAtalk] Help. SA is not learning

-mbox spam_borrowed_10 ... Learned from 11 messages. dcarrera ~$ grep 'Subject: ' spam_borrowed_10 | wc -l 6972 dcarrera ~$ Does anyone know what's going on? - -- Daniel Carrera| OpenPGP fingerprint: Mathematics Dept. | 6643 8C8B 3522 66CB D16C D779 2FDD 7DAC 9AF7 7A88 UMD,

Re: [SAtalk] sa-learn

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hi, > I had a look through the Archives and found Daniel Carrera recently > asked the same question, but without a reply. Shouldn't this be in the > FAQ? I did get a reply. Yes, spamassassin understands its own modifications to th

[SAtalk] Spam Corpus

ive it. I don't think that my spam is particularly different from most people's. A generic collection of spam would be good to get me started. Thanks for the help. This list has been incredibly helpful to his "newbie" :) Cheers. - -- Daniel Carrera| OpenPGP fingerprint:

Re: [SAtalk] I quote: "Learned from 0 messages."

:55:13AM -0400, Matt Kettler wrote: > At 12:32 AM 7/22/2003 -0400, Daniel Carrera wrote: > > (sorry, I can't help you with your main question about learning from an > mbox file.. I've not done that myself, but I can help you with your second > part) > > >On a re

[SAtalk] I quote: "Learned from 0 messages."

obably have all the ham I need from today's email batch, but it'll take me a while to gather 200 spams, so I'd like to know how close I am. Thanks for the help. - -- Daniel Carrera| OpenPGP fingerprint: Mathematics Dept. | 6643 8C8B 3522 66CB D16C D779 2FDD 7DAC 9AF7

[SAtalk] [Q] RFC 822 vs mbox formats.

the other, or are both used in conjunction? Thanks for the help. -- Daniel Carrera| OpenPGP fingerprint: Mathematics Dept. | 6643 8C8B 3522 66CB D16C D779 2FDD 7DAC 9AF7 7A88 UMD, College Park | http://www.math.umd.edu/~dcarrera/pgp.html

[SAtalk] [Q] Training SA's Bayesian filter.

parate file. I would like to use this file to training SA. The problem is that SA alters the header siginficantly. SA's output includes an analysis explaining why it thinks that the give email is spam. This will do bad things to the statistical approach. Is there a way to use this outp

Re: [SAtalk] SpamAssassin Test scores

have two more questions: - How do I find out my threshold? How do I change it? - What is the threshold for "whitelist_from"? How do I change it? Thanks for the help. - -- Daniel Carrera| OpenPGP fingerprint: Mathematics Dept. | 6643 8C8B 3522 66CB D16C D779 2FDD 7DAC 9AF7 7A88 UMD

[SAtalk] SpamAssassin Test scores

te list". Now I want to make stringent tests so I stop getting spam. Thank you for your help. -- Daniel Carrera| OpenPGP fingerprint: Mathematics Dept. | 6643 8C8B 3522 66CB D16C D779 2FDD 7DAC 9AF7 7A88 UMD, College Park | http://