Re: [SAtalk] Memory usage

2002-11-17 Thread Jan Korger
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Search the archive. I had the same problem. My solution was changing from call spamassassin for any mail received to spamc/spamd and using the mda option in fetchmail instead of delievering via port 25 causing only one mail to be delievered (and proces

Re: [SAtalk] Semi Spamtrap

2002-11-17 Thread Jan Korger
On Sun, 17 Nov 2002, Claudio Clemens wrote: > Hi, > > I have an old e-mail address, which receive mostly SPAM (but not 100%). > I wrote a rule to give some points to e-mails headed to this address, > but the e-mails aren't caught. > > Here is the rule: > > header INFORMATIK Delivered-To

Re: [SAtalk] SpamAssassin per user (MySQL)

2002-11-16 Thread Jan Korger
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Sat, 16 Nov 2002, Rick Macdougall wrote: > Hi, > > Moved over to satalk from vchkpw since this is really an satalk issue not > vpopmail... > > I think the most interesting way to handle it is... > > Set required_hits to a default value of 0 > Call

Re: [SAtalk] SA I18N: German body rules

2002-11-15 Thread Jan Korger
good job on english and portuguese spam) and I'm going to check which [custom] rules will catch them when I got some spare time. Jan > On Wed, 6 Nov 2002, Jan Korger wrote: > > > Hi, > > I don't see any German language rules in SA's default configuration and > > m

Re: [SAtalk] Really bad false positive

2002-11-14 Thread Jan Korger
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Thu, 14 Nov 2002, Ross Vandegrift wrote: > Check this message my boss forwarded to me. It came from his lawyer and > was tagged by SA via the CAPS rules and some URL rules. > > Funny thing is, there nothing in all caps, and there's absolutely no >

[SAtalk] false negatives with fake email address in From: header

2002-11-14 Thread Jan Korger
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 I got some false negatives here which contain a fake email address as real name. As many MUAs display real names instead of addresses if real name is present, most people will think the From: address is what's in the real name part if this looks like a

[SAtalk] spamd died. can't see why? [2.43; debian testing]

2002-11-08 Thread Jan Korger
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hi, Today it noticed a high percentage of (what I considered) "false negatives" and very few postives. Checking mail headers I found out that most of the messages had no SA markup at all, i.e. was very probably never processed with SA. To make it short

[SAtalk] SA I18N: German body rules

2002-11-06 Thread Jan Korger
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hi, I don't see any German language rules in SA's default configuration and most of my German spam (about 1 message a day) does not get tagged by SA. Is someone working a on German ruleset already, collecting German spam or anything related? Jan -

Re: [SAtalk] 60_whitelist.cf

2002-11-06 Thread Jan Korger
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Wed, 6 Nov 2002, John Schutz wrote: > Date: Wed, 06 Nov 2002 11:31:46 -0600 > From: John Schutz <[EMAIL PROTECTED]> > To: Jan Korger <[EMAIL PROTECTED]> > Cc: SpamAssassin ML <[EMAIL PROTECTED]> > Subject: Re:

[SAtalk] 60_whitelist.cf

2002-11-06 Thread Jan Korger
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 What's the point of this configuration file? Why should some sites generally be allowed to send spamy looking messages. Take amazon for example. They send a lot of commercial emails, people did never ask for. They tell you you could opt out (as just ab

Re: [SAtalk] Understanding Spamassassin

2002-11-04 Thread Jan Korger
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Mon, 4 Nov 2002, Thomas Nyman wrote: > Hi > > Thankfully spamassassin works without much configuration. However its very > hard to learn how to do special configurations. I have looked thouroughly > at the documents on the Spamassassin.org site, an

Re: [SAtalk] Well written spam advertising how to spam

2002-11-03 Thread Jan Korger
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Sun, 3 Nov 2002, John Rudd wrote: > > > Jan Korger <[EMAIL PROTECTED]> writes: > > > > Therefore I suggest adding a rule with a negative score assigned matching > > > > spam reports in message bodies

Re: [SAtalk] Well written spam advertising how to spam

2002-11-02 Thread Jan Korger
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 2 Nov 2002, Daniel Quinlan wrote: > Jan Korger <[EMAIL PROTECTED]> writes: > > Therefore I suggest adding a rule with a negative score assigned matching > > spam reports in message bodies. This is especially usefull for SA

Re: [SAtalk] Well written spam advertising how to spam

2002-11-02 Thread Jan Korger
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Sat, 2 Nov 2002, Jan Korger wrote: > I'm thinking of something linke > > body SA_REPORT_START /SPAM:\s-+ Start SpamAssassin results -+/ > body SA_REPORT_END /SPAM:\s-+ End SpamAssassin results -+/ > body SA_REPORT_

Re: [SAtalk] Well written spam advertising how to spam

2002-11-02 Thread Jan Korger
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Not surprisingly, your message quoting the spam message got caught by SA as well. Someone else noticed that the phrases inside "SpamAssassim results" are often caught by the rule that produces them. This again is obvious ("BODY: Free money!" will allwa

Re: [SAtalk] How do I know if razor-checking is active?

2002-11-01 Thread Jan Korger
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Fri, 1 Nov 2002, Henry Kwan wrote: > Hi. > > Have been using SA for a little while and with the 2.43 update, finally > decided to install razor as well. But when I do 'make test', it reports > back that both razor tests have been skipped with no r

Re: [SAtalk] SA knocked out my maching and "killed" my email!

2002-11-01 Thread Jan Korger
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Thu, 31 Oct 2002, Jeff Burstein wrote: > You seem to be running into two main problems: > > 1) Your mail traffic is extremely bursty (it all comes at once!). > > 2) Your MTA doesn't seem to do anything to limit resource consumption. (I'm > not fam

RE: [SAtalk] You have a secret admirer

2002-10-31 Thread Jan Korger
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Thu, 31 Oct 2002, Tony L. Svanstrom wrote: > On Thu, 31 Oct 2002 the voices made Steve Thomas write: > > > | what about changing the tld to .invalid? > > > > Too easy for the spammers to spot. I'd rather they waste their time and > > resources and a

Re: [SAtalk] Kmail problem

2002-10-31 Thread Jan Korger
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Thu, 31 Oct 2002, Kyle Maus wrote: > I recently upgraded to SuSE 8.1. I then upgraded the KDE to 3.0.4 and > upgraded > SpamAssassin to 2.43. > > When Kmail shows e-mails, I see no SA markup in them, yet when I more > the same > e-mail file, I see t

Re: [SAtalk] You have a secret admirer

2002-10-31 Thread Jan Korger
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 > > The list mail gets through without being challenged, as procmail > > scoops it off before SA could see it. But even if SA saw it, it > > would pass as a false negative. Not in my case (v.2.43): SPAM: Content analysis details: (8.20 hits, 5 requi

Re: [SAtalk] You have a secret admirer

2002-10-31 Thread Jan Korger
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Wed, 30 Oct 2002, Matt Kettler wrote: > As far as the tagging of this particular email as spam or not, this is a > "semi legitimate" service. They don't email anyone unless someone who is > registered with their service enters you on their website.

Re: [SAtalk] spamc/spamd vs. SA speed comparison

2002-10-30 Thread Jan Korger
9034]: [identified spam (14.7/5.0) for kibab] 1000 in 0.2 seconds, 4656 > bytes. > > That's a *huge* difference. It shouldn't be my internet connection as it is > pretty good. Well, I guess it's due to the internet connection of the other peer.. Jan - -- Jan

Re: [SAtalk] This should go to the sightings list, but it brings upan important flaw

2002-10-30 Thread Jan Korger
On Wed, 30 Oct 2002, Tim Helton wrote: > score USER_AGENT_OE -0.3 > score USER_AGENT_MUTT-4.109 > score USER_AGENT -1.143 > > > Maybe it would be beneficial to see if more than 1 user agent is > detected, and give it a +2, instead of a -5 defini

Re: [SAtalk] New method of verifying Mail addresses?

2002-10-30 Thread Jan Korger
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Wed, 30 Oct 2002, Andre Bonhote wrote: > Hi SA-Talkers > > I just received the attached mail this morning, and I was quite upset. > For me, this is a completely new way of validating an email address. It > might be hard to catch this with SA ... F

Re: [SAtalk] SA and Postfix

2002-10-29 Thread Jan Korger
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Tue, 29 Oct 2002, Thomas Nyman wrote: > I have to admit that at the moment I dont have a good grip on Spamassassin > and how it works. For instance, how would I go about getting a whitelist > to work and also starting automatic whitelist? Is this s

[SAtalk] quarantine likely spam messages?

2002-10-29 Thread Jan Korger
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 I don't get a lot of false negative (SA developers: I owe you some pizza & beer) and those are get are usually spam without a lot of spam features. Therefore if it's not yet in razor or dns-blocklisted they will score very low. Sometimes when I run 'sp

[SAtalk] 3.70 _after_ reporting to razor1: My Daughters Friend 2/22/02

2002-10-29 Thread Jan Korger
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 before reporting it was 1.10. Can we create some rules to make this score way higher... -BEGIN PGP SIGNATURE- Version: GnuPG v1.0.6 (GNU/Linux) Comment: pgpenvelope 2.10.2 - http://pgpenvelope.sourceforge.net/ iD8DBQE9vuVMY6Nk2Nv6ZRcRAu9JAJ4ru

RE: [SAtalk] What should I report to Razor[2] or similar

2002-10-28 Thread Jan Korger
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Mon, 28 Oct 2002, Tony Hoyle wrote: > > Besides, do you > > guys consider those "news[letters]" or "promotions" or "special offer" > > mailings sent by companies selling via the net spam. I'm > > thinking of the > > emails from promotion?@amazon.co

Re: [SAtalk] spamd ignores custom rules and runs very slowly

2002-10-27 Thread Jan Korger
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Sun, 27 Oct 2002, Brian Kendig wrote: > Another interesting thing -- spamc is being called with the argument > '-s 256000', which ought to just refuse to process any message longer > than 256K, right? But I just tried sending through an email with

[SAtalk] What should I report to Razor[2] or similar

2002-10-27 Thread Jan Korger
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hi, I wonder what messages are supposed to be in razor's db. Should I report any spam messages here or only those not recognized by SA? Besides, do you guys consider those "news[letters]" or "promotions" or "special offer" mailings sent by companies s

Re: [SAtalk] rechecking reduces hits

2002-10-26 Thread Jan Korger
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 26 Oct 2002, Daniel Quinlan wrote: > Jan Korger <[EMAIL PROTECTED]> writes: > > > I had two spam messages (files s1 and s2) not filtered by SA with my usual > > setup, so I tried whether enabling RBLs would help. I did h

Re: [SAtalk] make install failing!

2002-10-26 Thread Jan Korger
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Sat, 26 Oct 2002, Sadiq Al-Lawatia wrote: > I got past the first error, thanks to Bob who told me to add hte path > toperl5 in my list. Anyways, after getting past that stage, the > installation fails at $make install > > $make install > Warning: Y

[SAtalk] rechecking reduces hits

2002-10-26 Thread Jan Korger
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hi, I had two spam messages (files s1 and s2) not filtered by SA with my usual setup, so I tried whether enabling RBLs would help. I did help with one message but noticed somethind odd by the way: jk@jan:/tmp$ spamc -c < s1 - -0.4/5.0 jk@jan:/tmp$ sp

[SAtalk] spammotel (was: 2 spam message not caught...)

2002-10-26 Thread Jan Korger
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Fri, 25 Oct 2002, Matt Kettler wrote: > I took the first message in this, removed the spammotel banner HTML and the > SpamAssassin markups and ran in through 2.43. Are you running SpamAssassin > with all the DNSBLs turned off? Yes, my ISP does RBL

[SAtalk] 2 spam message not caught even after reporting to Razor (4.80 hits)

2002-10-25 Thread Jan Korger
From MAILER-DAEMON Fri Oct 25 23:04:43 2002 Date: 25 Oct 2002 23:04:43 +0200 From: Mail System Internal Data <[EMAIL PROTECTED]> Subject: DON'T DELETE THIS MESSAGE -- FOLDER INTERNAL DATA Message-ID: <[EMAIL PROTECTED]> X-IMAP: 1035579857 02 Status: RO This text is part of the int

[SAtalk] Fuck. SA knocked out my maching and "killed" my email!

2002-10-25 Thread Jan Korger
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hi, I installed SA on Debian woody to filter my POP3 email. Therefore fetchmail is used, forwarding fetched mail to localhost:smtp. Thus, exim will be run through inetd. Exim will then find .procmailrc in my home directory and run procmail. Procmail wi

Re: [SAtalk] TOD score for SPAM

2002-10-24 Thread Jan Korger
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Thu, 24 Oct 2002, SpamTalk wrote: > Would the delivery time of day be a useful value for nudging the score > for > spam. ??? I don't think so. I write most of my personal email at nights whereas emails sent from offices will mostly be sent during

Re: re : [SAtalk] run SA/procmail in background

2002-10-24 Thread Jan Korger
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Thu, 24 Oct 2002 [EMAIL PROTECTED] wrote: > >> i am running SA on slackware with procmail/sendmail and its also > behaving the same way. it eats a lot of CPU whenever the mail servers > gets loads of messages at a time. and the load for each process

[SAtalk] run SA/procmail in background

2002-10-24 Thread Jan Korger
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hi, After rebooting (~100 new messages) using my box is no fun at all due to a lot of spamassassin processes running. Except for using spamd what can I do against this? I'm running SA on Debian woody with exim as MTA and fetchmail. Running the MTA nice

[SAtalk] spamassassin -r and pine

2002-10-23 Thread Jan Korger
l for pine users (like mutt's hotkey for 'spamassassin -r')? Thanks in advance. Jan - -- Jan Korger ICQ: 151683517 NS/AIM: JPKorger spacezone.de tel +49-711-7547512mobil +49-177-7788034fax +49-711-7547511 OpenPGP/GnuPG key OxDBFA6517: http://www.s

[SAtalk] a couple of newbie questions

2002-10-23 Thread Jan Korger
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hi all, 1. Why does the third line of yelling account for a negative score? It's quite common for UCE to have multiply lines in ALLCAPS. 2. I don't think that auto_report (to Vazor) is a good feature because anything that can be automatically spotted