[SAtalk] Spam in the (sort of) news

2002-10-27 Thread Daniel Rogers
Today's Doonesbury... http://images.ucomics.com/comics/db/2002/db021027.gif Dan. --- This SF.net email is sponsored by: ApacheCon, November 18-21 in Las Vegas (supported by COMDEX), the only Apache event to be fully supported by the ASF. http:

Re: [SAtalk] Sitewide use of spamassassin

2002-10-25 Thread Daniel Rogers
On Fri, Oct 25, 2002 at 01:44:13PM -0700, Mike Van Pelt wrote: > What is recommended these days? MIMEdefang is, IMHO beautiful. When used with mimedefang-multiplexor it can handle lots of mail in a very efficient fashion. And, as a bonus, you can virus scan through it. Dan. --

Re: [SAtalk] False positive for procmail-log analyzer

2002-10-24 Thread Daniel Rogers
On Thu, Oct 24, 2002 at 10:09:37AM +0200, Thomas -Balu- Walter wrote: > Today I got a false positive for a mail generated by the > postfix-log-analyzer "pflogsumm", because of the following hits: > > SPAM: Start SpamAssassin results -- > SPAM: This mail is

Re: [SAtalk] What happened? hits 5.6 but not spam?

2002-10-17 Thread Daniel Rogers
On Thu, Oct 17, 2002 at 11:19:51AM -0500, Chris A. Kalin wrote: > Look closely. It's "-5.6", that's negative 5.6. :) Because of *bump bump bump* bondedsender.com! *Cue conspiracy theories* Dan. --- This sf.net email is sponsored by: viaVeri

Re: [SAtalk] Pyzor, DCC or Razor2?

2002-10-17 Thread Daniel Rogers
On Thu, Oct 17, 2002 at 05:39:35PM +0200, Ives Aerts wrote: > After upgrading to 2.42, I get a lot less (actually none so far) false > positives but I do get more false negatives. To do something about > that, I thought of adding pyzor, dcc or razor2 to my installation. Any > suggestions as to whic

Re: [SAtalk] Korean/Japanese mail all spam??

2002-10-10 Thread Daniel Rogers
On Thu, Oct 10, 2002 at 04:13:30PM +0300, Odhiambo Washington wrote: > I am running SA 2.31 (hope to move to 2.42 soon..) ands I have the following > seetings in my local.cf: > > ..but still have e-mails from Korea/Japan and such like countries being > tagged as spam. > > > Why is this so? I'd

Re: [SAtalk] 2.42: est release?

2002-10-03 Thread Daniel Rogers
On Thu, Oct 03, 2002 at 09:23:04PM +0100, Justin Mason wrote: > > 1004 (TO_MALFORMED borken), > > WONTFIX ;) More like NOTABUG. :) (And I should know, I reported it!) > OK, if there's nothing moderately serious shown up tonight, I'll release > it tomorrow AM (GMT). Out of curiousity, with al

Re: [SAtalk] URL blacklist

2002-10-03 Thread Daniel Rogers
On Thu, Oct 03, 2002 at 02:25:59PM -0400, Kerry Nice wrote: > So, you haven't heard about drive-by spamming? You find an open wireless > lan connection and sit in somebody's front drive and spam away for a while. No, but I can't hardly say as I'm surprised. Why do I have a feeling that not even

Re: [SAtalk] 2.42: est release?

2002-10-02 Thread Daniel Rogers
On Wed, Oct 02, 2002 at 06:29:09PM +0100, Justin Mason wrote: > Re: those bugs -- Bug 1033 (-W/-R) is now fixed; 1046 (warnings from > Maekfile.PL on 5.005) is also fixed I think -- Malte? and 1039 is > probably not going to get fixed before 2.50 (it's a UI thing anyway.) 1046 is fixed, thanks.

Re: [SAtalk] URL blacklist

2002-09-30 Thread Daniel Rogers
On Mon, Sep 30, 2002 at 03:29:08PM -0700, Matthew Cline wrote: > Geez, that's worse than using open relays. To what depths *won't* spammers > sink to? None, clearly. It's only a matter of time before they start breaking in to people's houses to send mail on their computers. We even had one a

Re: [SAtalk] URL blacklist

2002-09-30 Thread Daniel Rogers
On Mon, Sep 30, 2002 at 04:09:48PM -0500, SpamTalk wrote: > Shouldn't a list such as this this be a part of the next release in the same > manner as frequent spam phases? I'm happy to provide my list, either for just a couple people, or for inclusion in the distro. The only problem is that there

Re: [SAtalk] URL blacklist

2002-09-30 Thread Daniel Rogers
On Mon, Sep 30, 2002 at 08:32:55AM -0500, Dan Abernathy wrote: > I'm seeing quite a few porn spams lately that SA is letting through. These > are text messages with wording "innocent" enough not to trigger SA, but > peppered with links to terra.es hosted porn sites. Yeah, I've been getting those

Re: [SAtalk] Smtp Spam Proxy

2002-09-26 Thread Daniel Rogers
On Thu, Sep 26, 2002 at 03:19:37PM -0700, Bob Amen wrote: > We quit using this and are currently running sendmail with spamass-milter > as a relay. Uh, Amen! We use sendmail with MIMEdefang (another milter), which also has the advantage that you can scan for viruses at the same time. Dan

Re: [SAtalk] "new" spam host

2002-09-21 Thread Daniel Rogers
On Fri, Sep 20, 2002 at 12:38:15PM -0700, Sidney Markowitz wrote: > How many could they send if traffic from their ip address to the SMTP port > on your mail server's ip address went to an SMTP tarpit instead of being > simply rejected? I seem to recall trying that and finding that they change th

Re: [SAtalk] s/SPAM/spam/ it seems

2002-07-08 Thread Daniel Rogers
On Mon, Jul 08, 2002 at 12:43:49PM -0400, Vivek Khera wrote: > Is Hormel in the computer business? Is their trademark registered in > the appropriate category that covers email/web? Only then is it > infringing. If you go to www.hormel.com and have a look at the bottom, you'll see: "SPAM is a

Re: [SAtalk] Time Travelers PLEASE HELP!!! 15548 (fwd)

2002-07-05 Thread Daniel Rogers
On Sat, Jul 06, 2002 at 12:19:36AM +0200, Tony L. Svanstrom wrote: > Anyone seen this one and knows its history...? (Weird spam deleted) That one has been around for a while now. Here's a link to someone who actually contacted the guy. http://pucklass.envy.nu/timetrip.html Dan. ---

Re: [SAtalk] anyone seen cloudmark.com?

2002-06-21 Thread Daniel Rogers
On Fri, Jun 21, 2002 at 05:36:15PM -0400, Duncan Findlay wrote: > In the U.S. you can get sued for stuff so simple as selling hot > coffee but failing to write "HOT" on the cup. That case isn't as simple as you might think... Have a look at http://lawandhelp.com/q298-2.htm (Third degree burns t

Re: [SAtalk] SpamAssassin with large email providers...?

2002-06-14 Thread Daniel Rogers
On Fri, Jun 14, 2002 at 12:26:23PM -0700, Jeff Campbell wrote: > Are there any similar web hosts or ISPs currently using SpamAssassin in > a production environment? Smaller but still significantly sized web > hosts or ISPs? I personally would really like to see us provide this to > our customer

Re: [SAtalk] Dumping email with spamass-milter

2002-05-29 Thread Daniel Rogers
On Tue, May 28, 2002 at 06:22:41PM -0700, Marc MERLIN wrote: > Does spamass-milter reject mail at SMTP time, or does it just tag it? So far as I know, it just tags it. However, if mimedefang were used instead of spamass-milter, you could reject the mail, as we do with anything that scores over 1

Re: [SAtalk] Dumping email with spamass-milter

2002-05-28 Thread Daniel Rogers
On Tue, May 28, 2002 at 05:21:39PM -0500, Eric Six wrote: > Is there a way to dump all "spam" email to a file or redirect it to another > user account? I am using the latest spamass-milter for spamassassin. Before > I can implement this company wide, we want to be able to see how much real > mail

Re: [SAtalk] One detected as -67 points??

2002-05-23 Thread Daniel Rogers
On Wed, May 22, 2002 at 05:49:59PM -0700, Craig R Hughes wrote: > Well, the trouble is that SA isn't on the outbound path, and it's often a lot > more difficult to insert ourselves into the outbound stream than to insert into > the inbound stream. What if you're reading your office email from you

Re: [SAtalk] [Celina1737e43@hanmail.net: Naked chixs]

2002-05-21 Thread Daniel Rogers
On Sat, May 18, 2002 at 09:10:06AM -0700, Scott Nelson wrote: > I see something in SA 2.20; > uri HTTP_ESCAPED_HOST /^https?\:\/\/[^\/]*%/ > describe HTTP_ESCAPED_HOST Uses %-escapes inside a URL's hostname > score HTTP_ESCAPED_HOST 1.849 > > I think ESCAPES_DIGIT /%3[0-9]

Re: [SAtalk] [Celina1737e43@hanmail.net: Naked chixs]

2002-05-18 Thread Daniel Rogers
On Sat, May 18, 2002 at 09:10:06AM -0700, Scott Nelson wrote: > I think ESCAPES_DIGIT /%3[0-9]/ might be a good test too, > and not just inside URIs. Escaping /any/ character that > doesn't need to be is suspect. Yeah, believe it or not, it some of these, they're even does %2E for the '.' betwe

[SAtalk] [Celina1737e43@hanmail.net: Naked chixs]

2002-05-18 Thread Daniel Rogers
These people have been obsfucating their URL in a bunch of diffrent ways. We don't seem to have any test that matches on that. Also, what happened to the test for this style of unique ID at the end of the body? Dan. - Forwarded message from [EMAIL PROTECTED] - Reply-To: <[EMAIL PROTEC

[SAtalk] mimedefang-filter

2002-05-16 Thread Daniel Rogers
d as the contact for site-wide # MIMEDefang policy. A good example would be '[EMAIL PROTECTED]' #*** $AdminAddress = '[EMAIL PROTECTED]'; $AdminName = "Daniel Rogers"; #*

Re: [SAtalk] Speed/Performance Issue

2002-05-16 Thread Daniel Rogers
On Thu, May 16, 2002 at 03:39:44PM -0400, Justin Robinson wrote: > We did a bit of an experiment in using SpamAssassin over the past month and > just disabled it last night. We have roughly 9000 email accounts on our > server and we mass-enabled spam assassin for them. Only 78 used the opt-out >

Re: [SAtalk] spamd 2.20 bad protocol

2002-05-14 Thread Daniel Rogers
On Wed, May 15, 2002 at 06:22:03AM +0700, Olivier Nicole wrote: > >Soem very huge Mails (about 2 MB) coming in, will be investigated by spamc > >(2.20), which is breaking after a few seconds because mail is too big (> > >25k). But then, the spamass-milter timout in sendmail works after 12 > >minut

[SAtalk] Re: spamc/d still dying

2002-05-14 Thread Daniel Rogers
On Tue, May 14, 2002 at 07:56:59PM -0400, Ross Vandegrift wrote: > While this state doesn't seem to usually impair SA's ability to process > mail, it will overflow the process table eventually. I've been unable > to figure out what makes them multiply like this. Is this > spamass-milter flakines

Re: [SAtalk] Can't get spamass-milter to load

2002-05-03 Thread Daniel Rogers
On Fri, May 03, 2002 at 05:47:51PM -0400, Ross Vandegrift wrote: > Have you had better luck with this patch applied? If so, kludge or not, > I'll certainly apply it. Yeah, it solved the deadlock problem completely. I think a big part of it was being caused by the milter writing to spamc in 4096

Re: [SAtalk] Can't get spamass-milter to load

2002-05-03 Thread Daniel Rogers
On Fri, May 03, 2002 at 04:17:43PM -0400, Ross Vandegrift wrote: > On a related note, is spamass-milter at all reliable for you? I have > huge amounts of problems with it spinning off a ridiculous number of > sub-processess (spamass-milter and spamc) that never return. I'm > considering figuring

[SAtalk] Rules analysis

2002-05-01 Thread Daniel Rogers
I found Bart's results interesting, so I asked him for a copy of it and ran it over my caught spam for the last 15 days. I'll include my results below. I find this quite interesting, beucase it gives and example of how ineffective some of the rules have become. (NIGERIAN_SCAM, for example) Per

Re: [SAtalk] Amazon.com message triggering USER_IN_WHITELIST

2002-04-27 Thread Daniel Rogers
On Sat, Apr 27, 2002 at 05:00:45PM -0500, Nathan Nichols wrote: > I installed SpamAssassin via CPAN a few days ago, and I've been pretty > impressed with it. Its pretty much ran flawlessly, but I've noticed one > case where I don't understand why a certain test is getting a hit. amazon.com is in

Re: [SAtalk] bouncing new false positive

2002-04-16 Thread Daniel Rogers
On Tue, Apr 16, 2002 at 07:44:10PM -0400, Joey Hess wrote: > I have obscured all names and email addresses since this was private > mail, but it is an interesting false positive. The big problem is: > SPAM: Hit! (4.5 points) HTML-only mail, with no text version Which, in my mind, is still _way

Re: [SAtalk] Re: [SAdev] spamd warnings

2002-04-16 Thread Daniel Rogers
On Tue, Apr 16, 2002 at 08:53:21AM -0700, Craig R Hughes wrote: > DR> Would you like me to file a bug for the undefined $ENV{PATH}? > > Sure, go ahead. Ok, created as http://bugzilla.spamassassin.org/show_bug.cgi?id=214 with a patch attached. Dan. __

Re: [SAtalk] Re: [SAdev] spamd warnings

2002-04-16 Thread Daniel Rogers
On Tue, Apr 16, 2002 at 12:17:09AM -0700, Craig R Hughes wrote: > Both spamassassin (Oct 20 2001) and spamd (Oct 23 2001) have had -w for a long > time now. Is there a problem with that and/or reason not to have it? I kind of > like it since it draws bugs to people's attentions faster. Not sure

[SAtalk] Re: [SAdev] spamd warnings

2002-04-15 Thread Daniel Rogers
On Mon, Apr 15, 2002 at 02:32:53PM -0700, Daniel Rogers wrote: > Also, can the -w be removed from CVS? Now that I look for it, spamassassin has '-w' too. Is this something that's done in CVS then removed for release, or what? Dan. __

[SAtalk] spamd warnings

2002-04-15 Thread Daniel Rogers
Here's what I get when I try to run the current CVS version of spamd: [root@nanaimo spamassassin]# spamd/spamd -d -x -u mail -s local6 Constant subroutine __stub_lgammal redefined at /usr/lib/perl5/5.00503/i386-linux/gnu/stubs.ph line 58. Constant subroutine __stub_lgammal_r redefined at /usr/l

Re: [SAtalk] Atttachment problems

2002-04-11 Thread Daniel Rogers
On Thu, Apr 11, 2002 at 09:04:27AM -0700, Craig R Hughes wrote: > Mike, I don't understand what you mean by "large attachments are blocking", or > by the stuff in parentheses. Could you clarify if I don't answer below? Is this perhaps a case of http://bugzilla.spamassassin.org/show_bug.cgi?id=1

Re: [SAtalk] European Girls spam consistently scores 0.0

2002-04-08 Thread Daniel Rogers
On Mon, Apr 08, 2002 at 09:15:24AM -, Nick Rothwell wrote: > ...and I've had half a dozen copies now... Odd, this same spam scores 4.8 on my machine. Also, this could be tickling the bug described in bugzilla bug #180, which is now fixed in CVS. Dan. ___

Re: [SAtalk] Scores on the Doors

2002-04-04 Thread Daniel Rogers
On Thu, Apr 04, 2002 at 09:31:50AM -0600, Casimir Couvillion wrote: > Highest in March was 43.4. Several 41s behind it. Sounds like a challenge! Ok, this one is from yesterday: X-Spam-Status: Yes, hits=47.8 required=5.0 tests=NO_REAL_NAME,SUBJ_ALL_CAPS,FROM_ENDS_IN_NUMS,INVALID_DATE_NO_TZ,PLIN

Re: [SAtalk] "Broken CGI script message" specifics?

2002-04-04 Thread Daniel Rogers
On Thu, Apr 04, 2002 at 01:33:58AM -0800, Craig Hughes wrote: > I'd say it's extremely unlikely to occur in anything other than a > Formail-generated email, or any discussion of Formail-generated emails. > In the corpus, it appears 6 times in nonspam, and 435 times in spam. > All the nonspam ins

Re: [SAtalk] DCC

2002-04-03 Thread Daniel Rogers
On Wed, Apr 03, 2002 at 04:59:36PM -0500, Keith Pitcher wrote: > Anyone else ever bother to implement this or try it out? It looks a lot like > razor, but another check couldn't hurt as a ruleset for SA. Anything to help > detect spam has to be good. There's a bugzilla bug at http://bugzilla.spam

Re: [SAtalk] Base 64 encoded body.

2002-03-30 Thread Daniel Rogers
On Fri, Mar 29, 2002 at 12:04:54PM -0600, Jay Jacobs wrote: > I just got some spam that had the entire body base64 encoded, it's > content-type was "multipart/mixed" with one part, the base64, which was > listed as type "text/html". > > Here's what hit: > PLING,BASE64_ENC_TEXT > > I see two big

[SAtalk] Canter Speaks!

2002-03-28 Thread Daniel Rogers
http://zdnet.com.com/2100-1106-868653.html Dan. ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk

Re: [SAtalk] Upgrade to SpamAssassin 2.11 (spamd not working!)

2002-03-27 Thread Daniel Rogers
On Wed, Mar 27, 2002 at 05:21:54PM -0800, Gene Ruebsamen wrote: > Apparently, the previous version of SA (2.01) used > /etc/mail/spamassassin/local.cf as the configuration file, and this new > version requires the configuration file to be called: spamassassin.cf That's odd, I'm using that file wi

Re: [SAtalk] Freedom of Press / Speech / Junk Mail (yah right)

2002-03-27 Thread Daniel Rogers
On Wed, Mar 27, 2002 at 07:35:11PM -0500, Duncan Findlay wrote: > My question is why would any company use brightmail? Is it actually that > much superior to spamassassin? I don't see how it _could_ be that much superior! Plus, when we looked at it for our ISP customers, it would have been about

Re: [SAtalk] [Bug 123] Attached Spam crashes spamassassin

2002-03-26 Thread Daniel Rogers
On Tue, Mar 26, 2002 at 05:51:23PM -0500, Duncan Findlay wrote: > But perhaps, that's just because I used to do a bit of work in the Mozilla > Bugzilla, where nothing is (ever?) closed. And few things are ever RESOLVED... (See http://bugzilla.mozilla.org/show_bug.cgi?id=55690 for example.) Dan.

Re: [SAtalk] Header oddities

2002-03-21 Thread Daniel Rogers
On Thu, Mar 21, 2002 at 12:18:18PM -0800, [EMAIL PROTECTED] wrote: > The same message also had a header > > > X-Mail-Format-Warning: Bad RFC822 header formatting in Subject:=?ISO-8859- > 1?Q?=A1=E3=A7A=A5u=ADn=C6[=AC=DD=A6=B9=BDu=A4W=BCv=A4=F9=BC=B7=A9=F1VCD=B4N=A6 > =B3=BE=F7=B7|=A7=EF=C5=DC

Re: [SAtalk] Skipping multipart/related is bad

2002-03-19 Thread Daniel Rogers
On Tue, Mar 19, 2002 at 02:58:52PM -0800, Craig Hughes wrote: > I think this is a more substantial problem than that which requires a > bit more work. Thanks for the patch though. I've made a note in > bugzilla #115 about my intention to incorporate MIME::Tools for doing a > lot of the hard work

Re: [SAtalk] Skipping multipart/related is bad

2002-03-19 Thread Daniel Rogers
On Tue, Mar 19, 2002 at 03:32:34PM -0700, Nels Lindquist wrote: > I posted a couple of messages about problems with base64 encoding > back in January and didn't get a single reply, not even a pointer to > the buglist. I just fixed some of this (at least the first part, and probably the second t

Re: [SAtalk] Skipping multipart/related is bad

2002-03-19 Thread Daniel Rogers
On Tue, Mar 19, 2002 at 01:45:40PM -0800, Bart Schaefer wrote: > This looks like it fixes the base64 decoder, but it remains the case that > a MIME structure of the form > > mutipart/anything > multipart/anything > text/anything > anything/anything c-t-e:base64 > > will cause get_decoded_bo

Re: [SAtalk] Skipping multipart/related is bad

2002-03-19 Thread Daniel Rogers
On Tue, Mar 19, 2002 at 10:03:25AM -0800, Bart Schaefer wrote: > It never occurred to me that SpamAssassin could lack a proper MIME parser. > Any nested multipart containing a base64'd sub-part can totally defeat all > body checks, and even if there's only one level of multipart the base64 > dec

[SAtalk] Bugzilla bug #83

2002-03-19 Thread Daniel Rogers
I just added a patch and some comments to bugzilla bug #83 (http://bugzilla.spamassassin.org/show_bug.cgi?id=83). This is the bug for spamassassin not decoding base64 encoded headers before parsing the message. I also fixed some other bugs relating to header decoding. If this affects you, pleas

Re: [SAtalk] Skipping multipart/related is bad

2002-03-19 Thread Daniel Rogers
On Tue, Mar 19, 2002 at 10:03:25AM -0800, Bart Schaefer wrote: > It never occurred to me that SpamAssassin could lack a proper MIME parser. > Any nested multipart containing a base64'd sub-part can totally defeat all > body checks, and even if there's only one level of multipart the base64 > dec

Re: [SAtalk] Spamc Not Tagging E-mail

2002-03-12 Thread Daniel Rogers
On Tue, Mar 12, 2002 at 12:36:03PM -0800, Jason A. Vest wrote: > :0fw > | spamc This needs to be: :0fw | /usr/bin/spamc -f Dan. ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-tal

Re: [SAtalk] Killing spamc

2002-03-07 Thread Daniel Rogers
On Thu, Mar 07, 2002 at 03:24:36PM -0800, Bart Schaefer wrote: > 3.21 is considered unstable; you should use either 3.15.2 or 3.22. I'm > checking on the procmail list whether one of those is known to fix this > particular bug. Yay for redhat issuing unstable versions as errata... I'm reading t

Re: [SAtalk] Killing spamc

2002-03-07 Thread Daniel Rogers
On Thu, Mar 07, 2002 at 02:01:47PM -0800, Bart Schaefer wrote: > This same symptom has just been (re-)reported on the procmail mailing > list. It appears to happen most often when the mailbox is also being > accessed via MS Outlook (presumably with IMAP, but that's not clear). I can tell you tha

[SAtalk] Killing spamc

2002-03-07 Thread Daniel Rogers
Sometimes I find it necessary to kill spamc (when I getting spammed especially hard for example). In this case, I wind up with message getting delivered to mailboxes with the 'F' in the 'From ' line missing, which results in the mailboxes becoming corrupted. I had a quick look at the spamc sourc

Re: [SAtalk] False positive/hard-coded whitelist

2002-03-07 Thread Daniel Rogers
On Thu, Mar 07, 2002 at 01:33:04PM -0500, Matthew T. Jachimstal wrote: > The following email (full headers and SA report only) is getting falsely > marked as spam, even though we have 'whitelist-from *@techdata.com' in > /etc/mail/spamassassin/local.cf. If you're using spamd, did you restart it a

Re: [SAtalk] SUBJ_ALL_CAPS

2002-03-05 Thread Daniel Rogers
On Tue, Mar 05, 2002 at 09:00:33PM -0800, Rob McMillin wrote: > Should be busted, but see bug 39; I believe another patch has been > accepted for this bug. Isn't that LINE_OF_YELLING, not SUBJ_ALL_CAPS? Or did the patch affect both? Dan. ___ Spamass

[SAtalk] HUNZA_DIET_BREAD

2002-03-05 Thread Daniel Rogers
It seems that part of the reason that the HUNZA_DIET_BREAD doesn't seem to be doing anything is that they've changed their message around so the rule doesn't match any more. Here's part of the message that was received a couple weeks ago: --- Hunza Bread Home made Hunza Bread is a simple, delic

[SAtalk] SUBJ_ALL_CAPS

2002-03-05 Thread Daniel Rogers
I just noticed that SUBJ_ALL_CAPS matches on a blank subject. Is this intentional? Should it maybe be rewritten as: Subject =~ /^[^a-z]+$/ instead of Subject =~ /^[^a-z]*$/ ? (Would that even work?) Dan. ___ Spamassassin-talk mailing list [EMAIL P

Re: [SAtalk] Combined subject and body tests?

2002-03-05 Thread Daniel Rogers
On Tue, Mar 05, 2002 at 01:28:20AM -0800, Matthew Cline wrote: > There's some body tests that would also work for the subject, like the > CASHCASHCASH test, and I've seen some spam were the tests didn't match the > body but would have matched the subject. Would it be worth it to make a > body_

Re: [SAtalk] Distributed Checksum Clearinghouse

2002-03-04 Thread Daniel Rogers
On Fri, Mar 01, 2002 at 10:26:49PM -0800, Craig Hughes wrote: > I also think DCC is possibly more promising than razor -- last time I looked > at it (increasingly long time ago now) DCC looked a bit immature though. > Stick a feature request in bugzilla though and I'll take a look again soon. I,

[SAtalk] The 40 X 40 X 40 Plan

2002-03-04 Thread Daniel Rogers
This one's been around so long, it should be able to drive by now. However, SA 2.11 only gives it 4.8. How about a Very Special rule for it? Say: body40X_40X_40X /40 ?x ?40 ?x ?40 plan/i describe40X_40X_40X 64000 worth of plan score 40X_40X_40X 3.0 Al

[SAtalk] Annoying spam

2002-03-01 Thread Daniel Rogers
I've attached an annoying spam that I've been getting repeatedly over the last few days. I just added a rule for 'sending mass messages' to score 2.0 and push this over five, However, I was thinking maybe a rule for 'sent to.*recipients' or something for 'messpro.com'. Any thoughts? Dan. -

Re: [SAtalk] Troubling new scores in 2.1 release

2002-02-27 Thread Daniel Rogers
On Wed, Feb 27, 2002 at 05:15:20PM -0800, Craig R Hughes wrote: > I meant single score, but yet, that message is pretty impressive. I assume it > was not a false-positive :) Uh, yeah, it was real spam. :) I just found a 47.1 hits one, even though it had two -ve scores (HTTP_USERNAME_USED and

Re: [SAtalk] Troubling new scores in 2.1 release

2002-02-27 Thread Daniel Rogers
On Wed, Feb 27, 2002 at 05:00:29PM -0800, Craig R Hughes wrote: > Yes, the large rule scores probably do make the system more sensitive to minor > variations in input. However, they also apparently lead to more accurate > scores. It is interesting that even running unconstrained over 50,000 >

[SAtalk] LINE_OF_YELLING

2002-02-27 Thread Daniel Rogers
LINE_OF_YELLING seems to have jumped from a score of 0.70 in SA 2.01 to a score of 5.442 in SA 2.1. This strikes me as rather a lot. Aren't there still people who still write their messages all in caps because they don't know any better? Also, any mail that uses a line of all caps as a title (s

Re: [SAtalk] Latest SUBJ_ALL_CAPS rule in CVS

2002-02-27 Thread Daniel Rogers
On Wed, Feb 27, 2002 at 11:21:30AM -0600, Mark Roedel wrote: > Posix character classes (a la [:lower:]) were apparently introduced in > Perl at v5.6.0. Is there anything in particular that'd be lost by > changing [:lower:] to [a-z] to maintain compatibility with the v5.0 > line? (Otherwise, this

Re: [SAtalk] testing spam

2002-02-21 Thread Daniel Rogers
On Thu, Feb 21, 2002 at 06:40:22PM -0500, Landy Roman wrote: > Header TEST_FROM From =~ /adomainname/i > describe TEST_tandom this is a test rr > score TEST_FOR_SPAM 7.0 The scond field needs to be the same for all three. ie: Header MY_TEST_FROM From =~ /adomainname/i describe MY_TEST_FROM th

[SAtalk] Scaling problems

2002-02-18 Thread Daniel Rogers
Recently, we've been the unfortunate recepients of several spams that are sent so quickly as to cause spamassassin to overwhelm our mail server. Here's what happens: Spammer connects to smtp port, gives his helo and mail from, then gives 10-15 "rcpt to:"s, essentially bcc'ing a bunch of people o

Re: [SAtalk] Another MX test?

2002-02-18 Thread Daniel Rogers
On Mon, Feb 18, 2002 at 12:25:19AM -0700, Charlie Watts wrote: > I don't think anybody has done this yet, but it would actually be a really > cool thing to have ... lots of spammers have a bunch of sender domains, > but their MX servers are all on the same box. My thought exactly. > I didn't tak

Re: [SAtalk] Non-essential feature request: spamd reload rules on SIGHUP

2002-02-18 Thread Daniel Rogers
On Sun, Feb 17, 2002 at 11:29:53AM -0800, Craig Hughes wrote: > I'll happily accept patches. In the meantime, killing spamd won't cause > any loss of mail, only loss of identification of spam messages for that > fraction of a second when it's not listening, or for those messages > already in proc

[SAtalk] Another MX test?

2002-02-17 Thread Daniel Rogers
It seems I've been getting a lot of spam lately that has a valid MX, but the MX is 127.0.0.1 (loopback). Any chance we could add a test for this? Dan. ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/sp

[SAtalk] Upper case headers fix?

2002-02-15 Thread Daniel Rogers
I've come up with a solution for the problem with not finding headers that are in uppercase (ie, TO: instead of To: and FROM: instead of From:). This problem affected mail from passport.com, as well as from other places. For example, here's scoring on the mail from passport.com before this fix

Re: [SAtalk] FAKED_UNDISC_RECIPS

2002-02-12 Thread Daniel Rogers
On Tue, Feb 12, 2002 at 02:56:25PM -0800, Craig Hughes wrote: > We could add a negative > > header OUTLOOK_EXPRESS /Microsoft Outlook Express/ > describe OUTLOOK_EXPRESS Spammers use real software > score OUTLOOK_EXPRESS -3.0 > > Something like that? Sounded g

[SAtalk] FAKED_UNDISC_RECIPS

2002-02-12 Thread Daniel Rogers
I know this was mentioned a while ago, but I couldn't find it in the archives... Bascially, the problem is that Outlook Express 6 uses a different format for Undisclosed Recipients. Here's the top of a message that got flagged: From: "Removed" <[EMAIL PROTECTED]> To: Subject: Fw: men vs women

Re: [SAtalk] New rules?

2002-02-06 Thread Daniel Rogers
On Wed, Feb 06, 2002 at 04:26:42PM -0800, Craig Hughes wrote: > > body HAVEN_IP /64\.118\.7\.|66\.163\.36\./ > > describe HAVEN_IP Contains an IP used by spammers > > score HAVEN_IP 3.0 > > I think IP matching is best left to the RBL folks; we can just call out > to them. Sorry, I guess I was

[SAtalk] New rules?

2002-02-06 Thread Daniel Rogers
Here's a couple rules I wrote to help catch stuff that was making it through. The scores are my own made-up numbers body INCREASE_EJACULATION /increase ejaculation/i describe INCREASE_EJACULATION Why would I want to do that? score INCREASE_EJACULATION 4.0 body HAVEN_IP /64\.118\.7\.

Re: [SAtalk] Oddity in message test match?

2002-02-05 Thread Daniel Rogers
On Wed, Feb 06, 2002 at 09:00:23AM +1100, Daniel Pittman wrote: > I just got a message that hit this test: > > X-Spam-Status: No, hits=1.9 required=5.0 tests=DATE_IN_FUTURE version=2.01 > > It had a date header that wasn't in the future, though. It was: > > Date: Mon, 5 Mar 2001 22:12:20 +1100

Re: [SAtalk] Scoring of "HTML only mail..."

2002-02-04 Thread Daniel Rogers
On Mon, Feb 04, 2002 at 02:41:35PM -0600, Donald Greer wrote: >The current scoring for HTML_Only mail may be just a little high. > I've recieved reports that some newsletters (which are html-only) are > being rejected as spam. Specifically I allow my users to signup to news > letters from