[SAtalk] CHARSET_FARAWAY_* question

2002-09-24 Thread Rob McMillin
What do I have to do to get the CHARSET_FARAWAY_* tests to work? I want it to immediately pitch any non-English (or ISO-8859*) charsets (big5 in particular) that it finds in Subject, etc. lines or body text. -- Palladium: First they came for the Linux desktop users, but I said nothing, becaus

[SAtalk] Whatever happened to SUBJ_FULL_OF_8BITS?

2002-09-20 Thread Rob McMillin
Whatever happened to the SUBJ_FULL_OF_8BITS test? It's no longer present in 2.41. -- Palladium: First they came for the Linux desktop users, but I said nothing, because I wasn't a Linux desktop user... -- future prisoner in the Microsoft gulag

Re: [SAtalk] Jane! Stop this crazy thing!

2002-07-15 Thread Rob McMillin
Theo Van Dinter wrote: >On Mon, Jul 15, 2002 at 07:40:58AM -0700, Rob McMillin wrote: > > >>Okay, I'm at wit's end. How do I unsubscribe? There aren't any >> >>https://lists.sourceforge.net/lists/listinfo/spamassassin-talk >> >> &

[SAtalk] Jane! Stop this crazy thing!

2002-07-15 Thread Rob McMillin
Okay, I'm at wit's end. How do I unsubscribe? There aren't any instructions for unsubscribing on the web page for this list, and -- disassembling the headers -- I don't recall any password I got for this list. Can someone in charge please, oh please, take me off the list? -- Palladium: First

Re: [SAtalk] INVESTMENT ASSISTANCE

2002-07-06 Thread Rob McMillin
Matthew Cline wrote: >On Wednesday 04 July 2001 09:56 pm, BASSY OKON wrote: > > > >>(b) That you would treat this transaction with utmost secrecy and >>confidentiality. >> >> > >Which is why you sent this to a mailing list... > >You know, I'm suprised at how little spam gets sent through ma

[SAtalk] [Fwd: IP: SIMSON SAYS: An End to Spam With SpamAssassin]

2002-05-30 Thread Rob McMillin
Via Dave Farber's IP list, http://www.interesting-people.org. Maybe in a newspaper near you. Original Message Subject: IP: SIMSON SAYS: An End to Spam With SpamAssassin Date: Thu, 30 May 2002 10:56:53 -0400 From: Dave Farber <[EMAIL PROTECTED]> Reply-To: [EMAIL PROTECTED] To:

Re: Removing rules with negative score? (Was: Re: [SAtalk] WEB_BUGStests a negative?)

2002-05-28 Thread Rob McMillin
Duncan Findlay wrote: >But, tests meant to catch spam are ill-suited for determining >non-spam. I agree that negative scores are a good thing, but only on >tests designed to do that. > >The GA is amazing. But humans are smarter than computers (we have to >program them after all). The GA is not pe

Re: [SAtalk] Apologies for absence/slowness this week

2002-05-26 Thread Rob McMillin
Craig R Hughes wrote: >If I've been somewhat unresponsive this week both to list mail and direct mail, >it's only because I'm getting married this Sunday, and with all the family in >town, etc. things are pretty hectic. Not to mention the hyper fiancee who keeps >thinking everything's going wron

[SAtalk] Proposition for

2002-05-26 Thread Rob McMillin
More mortgage spam. This one somehow evaded all the normal tests; I would propose the following modification to NORMAL_HTTP_TO_IP as a countermeasure: uri NORMAL_HTTP_TO_IP /https?\:\/\/\d+\.\d+\.\d+\.\d+/is describe NORMAL_HTTP_TO_IP Uses a dotted-decimal IP address in URL This may slow

Re: [SAtalk] Having trouble getting SA to work

2002-05-06 Thread Rob McMillin
Maurer, Kim wrote: Message Hello. I'm trying to get SpamAssassin working on Red Hat 7.2, and nothing seems to go right. I downloaded the RPM and loaded it using the rpm -i command. I've read all the documentation several times, and don't see anything to help me. Can anyo

Re: [SAtalk] hung spamd procs

2002-05-06 Thread Rob McMillin
Nate Campi wrote: >My mail server supports a couple hundred users but only about 10 or 15 >use spamassassin. Most of us using spamc/spamd are >root/hostmaster/postmaster types that get around 1500 emails/day. We use >procmail for filtering like this in each user's procmailrc (not >/etc/procmailr

Re: [SAtalk] Installing on a Raq; failed--compilation aborted

2002-05-06 Thread Rob McMillin
Matt wrote: >I have installed "MailScanner" on my Raq 4i and am trying to get >SpamAssassin going also since MailScanner supports it. I have run into to >the problem below. > >[root local]# rpm -ivh spamassassin-2.20-1.i586.rpm >spamassassin >## >[

Re: [SAtalk] [PATCH] DCC Support for SA

2002-04-30 Thread Rob McMillin
Kelsey Cummings wrote: >On Tue, Apr 30, 2002 at 01:42:26AM +0100, Sean Rima wrote: > >>-BEGIN PGP SIGNED MESSAGE- >>Hash: SHA1 >> >>On Tue, 30 Apr 2002, Sean Rima said: >> >> >SR> Use of uninitialized value at >SR> /usr/lib/perl5/site_perl/5.005/Mail/SpamAssassin/Dns.pm line >

Re: [SAtalk] uuencoded spam

2002-04-23 Thread Rob McMillin
Sean Harding wrote: >I don't know if this is a new trick, but it's a new one on me. I got a >couple of uuencoded spams today. By uuencoding, they manage to bypass any >body text filters. In this case, they were caught by other rules. > >Are there mail clients that automatically uudecode stuff so

Re: [SAtalk] Suggested Makefile.PL patch

2002-04-14 Thread Rob McMillin
Duncan Findlay wrote: >I don't know anything about RPM's (other than that they are far inferior to >.deb's). > >Debian's packages are installed with: >make install PREFIX="/some/local/dir/usr" >So, config files go in /some/local/dir/etc. (With LOCAL_RULES_DIR set to >'$(PREFIX)../etc/mail') > >Cl

Re: [SAtalk] Suggested Makefile.PL patch

2002-04-14 Thread Rob McMillin
Duncan Findlay wrote: >On Sun, Apr 14, 2002 at 12:21:35PM -0700, Bart Schaefer wrote: > >>I've been trying to think how to correctly relocate $(LOCAL_RULES_DIR) >>relative to $(PREFIX) when building SA. The problem of course being that >>in the "normal" case, /etc is not relative to $Config{pref

Re: [SAtalk] Suggested Makefile.PL patch

2002-04-14 Thread Rob McMillin
Bart Schaefer wrote: >>Why should it be necessary to be root in order to build an RPM?) >> > >No ... in fact, to build an RPM with the buildroot different from the >target install tree, you'd have more success as a non-root user. Right >now, installing NEVER puts local.cf anywhere but /etc/mail/

Re: [SAtalk] Suggested Makefile.PL patch

2002-04-14 Thread Rob McMillin
Bart Schaefer wrote: >I've been trying to think how to correctly relocate $(LOCAL_RULES_DIR) >relative to $(PREFIX) when building SA. The problem of course being that >in the "normal" case, /etc is not relative to $Config{prefix}, which is >the default value of $(PREFIX). This is particularly i

Re: [SAtalk] New Scientist article on an anti-spam using Razor

2002-04-11 Thread Rob McMillin
Sidney Markowitz wrote: >On Wed, 2002-04-10 at 17:04, Sidney Markowitz wrote: > >>It feels to me like the kind of thing a reporter would >>get wrong while being taken in by an business >>man's self promotion. >> > >I asked Vipul on the Razor mailing list and it turns out that my >intuition was wr

Re: [SAtalk] Chop, chop, chop

2002-04-11 Thread Rob McMillin
Jay Jacobs wrote: >Every once in a while (I'd say maybe 2 or 3 times a week), I get a header >chopped in two, I assume on the Second From field. Sometimes it's spam, >sometimes not. I just pipe the email through SA, with the -P and -F0, >without the -F0 it was really screwed up... also using qm

Re: [SAtalk] European Girls spam consistently scores 0.0

2002-04-08 Thread Rob McMillin
Craig R Hughes wrote: >Daniel Rogers wrote: > >>On Mon, Apr 08, 2002 at 09:15:24AM -, Nick Rothwell wrote: >> >>>...and I've had half a dozen copies now... >>> >>Odd, this same spam scores 4.8 on my machine. Also, this could be tickling >>the bug described in bugzilla bug #180, which is now

Re: [SAtalk] European Girls spam consistently scores 0.0

2002-04-08 Thread Rob McMillin
Nick Rothwell wrote: >...and I've had half a dozen copies now... > Yes, that's always a risk when they don't say much. I got that spam, too, and noticed that they have a random string at the bottom to evade signature tests like Vipul's Razor. We subscribe to some commercial anti-spam services,

[SAtalk] [Fwd: IP: more on ATTBI / Eudora / SSL]

2002-04-06 Thread Rob McMillin
Wonder if the open relay guys have caught on to this one yet. Sounds like false alarms aplenty if you rely exclusively on them for spam trapping (hee). Original Message Subject: IP: more on ATTBI / Eudora / SSL Date: Sat, 06 Apr 2002 14:18:57 -0500 From: Dave Farber <[EMAIL

Re: [SAtalk] Hi, I am the SpamAssassin maintainer

2002-04-05 Thread Rob McMillin
Craig Hughes wrote: >I disagree that Paul is an ass. He makes some semi-valid points about >people's fears, and about how sometimes ISPs misuse or misinstall tools >on their systems, and thereby negatively impact their users. What I >mostly disagree with him about is that SpamAssassin goes out

Re: [SAtalk] Hi, I am the SpamAssassin maintainer

2002-04-05 Thread Rob McMillin
Craig R Hughes wrote: >Hi there Paul. > [...] > > >Yours, > >Craig Hughes > Danged polite. I would have been sorely tempted to trail off with a, "and the horse you rode in on!" (or far worse) but I decline the invitation and leave it for others to attend to. What an ass this guy is. -- h

[SAtalk] Japanese encoding triggers

2002-04-05 Thread Rob McMillin
Interesting wrinkle on CASHCASHCASH: while I don't know for sure, it appears that this legitimate spam (I have the score for CASHCASHCASH overridden to 2.0) points out that three dollar signs in a row might be a bad test if the text body is encoded in iso-2022-jp, which seems to like dollar

Re: [SAtalk] "Broken CGI script message" specifics?

2002-04-03 Thread Rob McMillin
Mick Szucs wrote: > Hi There, > > My company is beginning to deploy spam-assassin for users who want > it. One issue that has come up is that messages being generated by a > mailto script on our company Website get tagged with - > > BODY: Broken CGI script message (3.9 points) > > Unfortunatel

Re: [SAtalk] Using SpamAssassin if you don't own the mail server?

2002-04-03 Thread Rob McMillin
Sundial Services International, Inc. wrote: >I understand that SA might not be exactly what I'm looking for in its >present form, but I know it's got to be close. Here in more detail is >exactly what I'd like to do. > >The Perl script I have in mind could use the Net::POP3 module to connect to >

Re: [SAtalk] Using SpamAssassin if you don't own the mail server?

2002-04-03 Thread Rob McMillin
Sundial Services International, Inc. wrote: >Here's my problem. We use an external ISP to handle our mail, and of course >we are getting pummeled with spam so fast that the mailbox can fill up >within hours. We use a different ISP to handle the web-site and can set up >programs on that. > >What

Re: [SAtalk] How to specify custom rules?

2002-04-02 Thread Rob McMillin
Tony L. Svanstrom wrote: >On Tue, 2 Apr 2002 the voices made Rob McMillin write: > >>There is already a "funky character set" test; see CHARSET_FARAWAY_BODY. >> > > But no "funky e-mailaddresses"? I got an e-mail with a from that was something >like

Re: [SAtalk] Where do scores come from?

2002-04-02 Thread Rob McMillin
David Coppit wrote: >Hi all, > >Can someone tell me how the values get assigned to the various "detectors" in >SpamAssassin? Has anyone explored automated techniques for assigning these >scores based on genetic algorithms, hill climbing with random restarts, >simulated annealing, or other optimiz

Re: [SAtalk] How to specify custom rules?

2002-04-02 Thread Rob McMillin
David Coppit wrote: >Hi folks, > >I'd like to add a couple rules to SpamAssassin: > >- Detect if the email is in some funky character set >- Detect if the email is not in english >- Detect if the subject ends in six or more digits > >How do I go about doing this? I hope I can just dump a couple f

Re: [SAtalk] Help with installation????

2002-04-01 Thread Rob McMillin
Theo Van Dinter wrote: >On Mon, Apr 01, 2002 at 07:51:36AM -0800, Rob McMillin wrote: > >>Good Morning America? No, that can't be. >> > >According to their webpage, they were going to have a "Web expert" on to >share some tips about filtering out junk em

Re: [SAtalk] Help with installation????

2002-04-01 Thread Rob McMillin
Cheryl Harlow wrote: I tried to download Spam Assassin and now I can't get it to work???  I tried downloading it as a zip and also the first version listed on the page.  Everytime I unzipped and attempted to load using WinZip I got an error message from Microsoft and

Re: [SAtalk] Just for kicks...

2002-03-31 Thread Rob McMillin
Tony L. Svanstrom wrote: >On Sun, 31 Mar 2002 the voices made Matthew Cline write: > >>I went through all the spam I have and used all of the removal processes I >>could find; even went to the DMA opt-out page and entered a spam-trap >>address. Now I'll see what happens to the amount of spam I g

Re: [SAtalk] Re: Let battle commence

2002-03-30 Thread Rob McMillin
Duncan Findlay wrote: >CBC is funded by the government, but there's lots of other channels, like >CTV, Global, and many smaller, often local or regional channels. And, of >course, we get all the big American networks, FOX, ABC, NBC, CBS, etc. (So, >why do we need our own broadcasting? is being de

Re: [SAtalk] Re: Let battle commence

2002-03-30 Thread Rob McMillin
Duncan Findlay wrote: >On Sat, Mar 30, 2002 at 05:25:44PM -0500, Alan Shutko wrote: > >>dman <[EMAIL PROTECTED]> writes: >> >>>The other problem with the election is that some people are sore >>>losers. >>> >>Yes, it's terrible anyone would want to know the actual results of the >>election. Why

Re: [SAtalk] Let battle commence

2002-03-30 Thread Rob McMillin
Craig Hughes wrote: >On Sat, 2002-03-30 at 11:54, dman wrote: > >>where you simply pull a labled lever. I remember in 3rd when the >>first Bush (Sr.) election was. The teachers took us all down and we >>got to vote in the voting machine. The other problem with the >> > >Uh, New York lets 3rd g

[SAtalk] State: Bush side scores McBride e-mail list

2002-03-28 Thread Rob McMillin
The Governor of Florida, a spammer? I wonder if that's against the law there... http://www.sptimes.com/2002/03/28/State/Bush_side_scores_McBr.shtml -- http://www.pricegrabber.com | Dog is my co-pilot. __

Re: [SAtalk] Missing 'F', corrupt mailfile

2002-03-27 Thread Rob McMillin
Stefan Fredriksson wrote: > Rob McMillin wrote: > >> Stefan Fredriksson wrote: >> >>> Hi >>> >>> something weird happens when I use spamassassin. >>> It seems to cut of the first "F" wich makes ofcourse the mailfile >>> co

Re: [SAtalk] Razor Checks Failing

2002-03-27 Thread Rob McMillin
Marc G. Fournier wrote: >Stupid question, but is this a bug in razor 1.20, or spamassassin? > IIRC, neither; the problem was a workaround installed in SA to deal with a Razor bug. -- http://www.pricegrabber.com | Dog is my co-pilot. __

Re: [SAtalk] Missing 'F', corrupt mailfile

2002-03-26 Thread Rob McMillin
Stefan Fredriksson wrote: > Hi > > something weird happens when I use spamassassin. > It seems to cut of the first "F" wich makes ofcourse the mailfile > corrupt. > Below is the output of my mailfile when I sent myself 2 simple message > with the subjects "test" and "test 2", no body. I was al

Re: [SAtalk] Freedom of Press / Speech / Junk Mail (yah right)

2002-03-26 Thread Rob McMillin
Bill Becker wrote: > >On Tue, 26 Mar 2002, Theo Van Dinter wrote: > >>Personally, I'm wondering when/if spammers have sued their ISPs for >>having an AUP that disallows spam. >> > >They could do that only with an inept ISP. Most US ISP agreements will >say somewhere that either party can termina

Re: [SAtalk] idea: Rules about other rules

2002-03-25 Thread Rob McMillin
Matthew Cline wrote: >I got the idea of creating rules that would be triggered depending upon what >other rules had already been triggered, so that you could combine different >tests for greater accuracy. For instance, the rule US_DOLLARS is described >as a "Nigerian scam key phrase", but it'

Re: [SAtalk] Patches and updates

2002-03-22 Thread Rob McMillin
Craig Hughes wrote: >Generally, patches which "make sense" (whatever that might mean) to a >wide audience I'll try and include in future releases. Some stuff (like >local rules, etc) won't necessarily make it in. ORBS checks have just >now been disabled in CVS. > What about ORBZ tests? --

Re: [SAtalk] COPYRIGHT_CLAIMED score way too negative

2002-03-19 Thread Rob McMillin
Rob McMillin wrote: > I'm starting to see spams with claimed copyright; I attach an example > written in Big5 that would have gone through, but for the fact that I > have CHARSET_FARAWAY_HEADERS set to a score of 5. The copyright claim > score is too negative, and the CHA

[SAtalk] COPYRIGHT_CLAIMED score way too negative

2002-03-19 Thread Rob McMillin
I'm starting to see spams with claimed copyright; I attach an example written in Big5 that would have gone through, but for the fact that I have CHARSET_FARAWAY_HEADERS set to a score of 5. The copyright claim score is too negative, and the CHARSET_FARAWAY_BODY didn't trigger on the BIG5 MIME

Re: [SAtalk] Having trouble getting people out of my auto-whitelist

2002-03-18 Thread Rob McMillin
Craig Hughes wrote: >I would strongly recommend against doing it this way -- it will >certainly break when the whitelist DB format changes. I would instead >recommend useing the SA classes and invoking >DBBasedAddrList->remove_entry() -- that method will continue to work >even if the storage for

Re: [SAtalk] Whitelist for Charlie Root

2002-03-18 Thread Rob McMillin
Craig R Hughes wrote: >Rob McMillin wrote: > >>1) Pick up the current CVS tree and set up a short-circuit rule that >>allows multiple tests. >> > >Wow! Did someone implement that while I wasn't looking? Seriously though, I >don't think that'

Re: [SAtalk] Dumb question

2002-03-17 Thread Rob McMillin
Barry Andersson wrote: >Hi there, > >I've installed SpamAssassin on my mail server and have it running >server-wide through the addition of procmailrc to the /etc directory. I'm >using the procmailrc.example exactly as shipped but with spamd as follows: > > :0fw > | spamc > >

Re: [SAtalk] Auto_whitelist after upgrade to 2.11

2002-03-17 Thread Rob McMillin
Rob McMillin wrote: > Erik van der Meulen wrote: > >> Dear all - I have upgraded SA from 2.01 to 2.11 recently and it seems to >> have improved the scoring a bit. >> On thing surprised me. My (Amanda) backup system sends me a daily mail >> report which was tagged

Re: [SAtalk] Auto_whitelist after upgrade to 2.11

2002-03-17 Thread Rob McMillin
Erik van der Meulen wrote: >Dear all - I have upgraded SA from 2.01 to 2.11 recently and it seems to >have improved the scoring a bit. >On thing surprised me. My (Amanda) backup system sends me a daily mail >report which was tagged 'A_FROM_IN_AUTO_WLIST' in the version 2.01. >After the upgrade th

Re: [SAtalk] Whitelist for Charlie Root

2002-03-17 Thread Rob McMillin
David G. Andersen wrote: >Note that whitelisting from 'root' is probably a bad idea: > >593 eep:spam/raw> grep -i "^From: .*root" * | wc > 19 56 841 > >weekly run output, however, is far safer: > >595 eep:spam/raw> grep -i 'weekly run' * | wc > 0 0 0 > > -Dave > C

Re: [SAtalk] Limiting Regex Set

2002-03-16 Thread Rob McMillin
Yevgeniy Miretskiy wrote: >Hello, > >Is there a way to configure spamassassin to run say, header checks only, >or body checks only? > Not that I know of -- you could set all the non-header checks to zero in your user_prefs file. -- http://www.pricegrabber.com | Dog is my co-pilot.

[SAtalk] Slashdot: Class Action Lawsuit Against Spammer

2002-03-15 Thread Rob McMillin
from the eggs-bacon-and-50-dollars-please dept. http://slashdot.org/article.pl?sid=02/03/15/1956200&mode=nested&tid=111 -- [EMAIL PROTECTED] | Dog is my co-pilot. ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists

Re: [SAtalk] make test fails

2002-03-15 Thread Rob McMillin
Jason Purdy wrote: >-BEGIN PGP SIGNED MESSAGE- >Hash: SHA1 > > >Trying to build SpamAssassin 2.01 and I get the following output when making >a test (failing for dir_based_whitelist tests): > >[root@www Mail-SpamAssassin-2.01]# make test >PERL_DL_NONLAZY=1 /usr/bin/perl -Iblib/arch -Ibli

Re: [SAtalk] Contributed rules: stock market spam

2002-03-15 Thread Rob McMillin
Bart Schaefer wrote: >On Fri, 15 Mar 2002, Michael Moncur wrote: > >>Here's my file of rules for stock-market spam. >> > >Almost all of my stock-market spam lately comes from (in order of >decreasing volume) > >stockadvisor.ws >stockgroup.com >[EMAIL PROTECTED] > >but SA is already catching all

Re: [SAtalk] Re: Messed emails

2002-03-15 Thread Rob McMillin
Greg Ward wrote: >On 15 March 2002, Rob McMillin said: > >>My setup is using procmail; question for you guys: are the incoming >>mails getting clobbered arriving near each other in time? I have a >>number of cron jobs on our servers that all occur simultaneously tha

Re: [SAtalk] Re: Messed emails

2002-03-15 Thread Rob McMillin
Henrik Enberg wrote: >"CertaintyTech - Ed Henderson" <[EMAIL PROTECTED]> writes: > >>I am using SA 2.11 and sometimes see messages that are messed up - all of >>the headers appear in the body of the message and the From: and To: headers >>are empty. This has happened very infrequently but I wond

Re: [SAtalk] Messed emails

2002-03-14 Thread Rob McMillin
CertaintyTech - Ed Henderson wrote: >I am using SA 2.11 and sometimes see messages that are messed up - all of >the headers appear in the body of the message and the From: and To: headers >are empty. This has happened very infrequently but I wonder if anyone else >is seeing this on occasion? Or

Re: [SAtalk] Some more rule ideas

2002-03-14 Thread Rob McMillin
Greg Ward wrote: >On 13 March 2002, Kerry Nice said: > >>Very cool. But it only worked when I changed it from body to rawbody. >>I assume that is because it is at the very end of the message. >> >>rawbody UNIQUE_BODY_ID/^(?:(?:[\w\d]{7,}-)+)[\w\d]{7,}$/ >> >

[SAtalk] More filter ideas

2002-03-13 Thread Rob McMillin
Is it too much to assume that eight-bit characters in the e-mail part of an address is a sign of junk? I get a lot of Asian spam in this form, but I understand Unicode domains are on their way, so it will now be possible for me to receive mail from a domain I can't possibly type in to my compu

Re: [SAtalk] Help the ignorant

2002-03-13 Thread Rob McMillin
Michael Clark wrote: > My user_prefs aren't being read. It seems that the user_prefs should > be read automagically when processing mail. I added -c > /home/mclark/.spamassassin/user_prefs and then -p > /home/mclark/.spamassassin/user_prefs to the .procmailrc and they > user_prefs aren't proc

[SAtalk] More RATWARE

2002-03-12 Thread Rob McMillin
This time, for sure! Found in an e-mail warning me that traderlist.com is using my e-mail address for spam. Yeah. Right. X-Mailer: Advanced Mass Sender v 3.21b (Smtp MultiSender v 2.5) Check their web page: http://www.massmailsoftware.com/ And talk about working both sides of the street: th

Re: [SAtalk] Re: CommuniGate is also RATWARE

2002-03-11 Thread Rob McMillin
Daniel Pittman wrote: >On Mon, 11 Mar 2002, Michael Moncur wrote: > >>>I just noticed that CommuniGate has its own test (COMMUNIGATE) but it >>>isn't listed in the RATWARE test. This is of interest because the >>>RATWARE test checks ALL headers, where COMMUNIGATE is a body test. It >>>should be l

[SAtalk] CommuniGate is also RATWARE

2002-03-11 Thread Rob McMillin
I just noticed that CommuniGate has its own test (COMMUNIGATE) but it isn't listed in the RATWARE test. This is of interest because the RATWARE test checks ALL headers, where COMMUNIGATE is a body test. It should be listed in RATWARE. -- http://www.pricegrabber.com | Dog is my co-pi

Re: [SAtalk] SUBJ_ALL_CAPS regex broken

2002-03-11 Thread Rob McMillin
Theo Van Dinter wrote: >On Mon, Mar 11, 2002 at 02:26:42PM +, Matt Sergeant wrote: > >>I think the original intention of the count was to make sure we had at >>least three upper case chars, in which case you could get away with: >> >>/^([A-Z]|[^a-z])*?[A-Z]{3,}([A-Z]|[^a-z])*$/ >> >>That need

Re: [SAtalk] SUBJ_ALL_CAPS regex broken

2002-03-11 Thread Rob McMillin
Matt Sergeant wrote: > >Wouldn't an easier fix be: > >/^([A-Z]|[^a-z])*$/ > Interesting. [^a-z] includes [A-Z]. It also matches a zero-length string. How about /^(?:[A-Z]|[^A-Za-z])+$/ ??? -- http://www.pricegrabber.com | Dog is my co-pilot.

Re: [SAtalk] installing in home dir

2002-03-11 Thread Rob McMillin
Faisal Jawdat wrote: > I had this question myself when first trying > SA, but wound up bending the ear of a friendly > sysadmin. Can we make this a FAQ or get it > added to the documentation? > > It *is* in the documentation -- in the README file. -- http://www.pri

Re: [SAtalk] Lot's of spam gets thru because of missing rules

2002-03-10 Thread Rob McMillin
Toni Willberg wrote: >Hi. > >I'm not (yet) familiar with creating new scoring rules, but I'll try to >help anyway. > >Attached spam is good example of spam I get which is scrored under 5.0 >by SpamAssassin. Spammer is trying to sell CD's of bulk email addresses >to spammers. :) > > >Following sco

Re: [SAtalk] SUBJ_ALL_CAPS regex broken

2002-03-10 Thread Rob McMillin
Bart Schaefer wrote: >On Sun, 10 Mar 2002, Rob McMillin wrote: > >>+ return !($subject cmp uc($subject)); >> > >Um, why not: > > return ($subject eq uc($subject)) > >?? > Sure, if you like: diff -c /usr/home/rlm/src/RPMS/BUILD/Mail-SpamAssassin

Re: [SAtalk] SUBJ_ALL_CAPS regex broken

2002-03-10 Thread Rob McMillin
Sidney Markowitz wrote: >I don't really know perl, but I tried to duplicate the slow match on the >rule in a little test program to see if I could experiment with ideas >for a working regexp. > >The following program did not take long to run. What am I doing wrong? > Probably using a different re

Re: [SAtalk] SUBJ_ALL_CAPS regex broken

2002-03-09 Thread Rob McMillin
Charlie Watts wrote: >On Sat, 9 Mar 2002, Rob McMillin wrote: > >> >>s/b >> >> return $subject cmp uc($subject); >> >> >> > >'s OK, I'll share my prize with you. Everybody goes home a winner here at >"The Regex is Right!&quo

Re: [SAtalk] SUBJ_ALL_CAPS regex broken

2002-03-09 Thread Rob McMillin
Charlie Watts wrote: >On Sat, 9 Mar 2002, Rob McMillin wrote: > >> >>s/b >> >> return $subject cmp uc($subject); >> >> >> > >'s OK, I'll share my prize with you. Everybody goes home a winner here at >"The Regex is Rig

Re: [SAtalk] SUBJ_ALL_CAPS regex broken

2002-03-09 Thread Rob McMillin
Charlie Watts wrote: >On Sat, 9 Mar 2002, Rob McMillin wrote: > >>Charlie Watts wrote: >> >>>The current SUBJ_ALL_CAPS is broken. >>> >>>(The one from CVS - this: >>>header SUBJ_ALL_CAPS Subject =~ /^[^a-z]*([A-Z][^a-z]*){3,}[^a-z]*$/ >&

Re: [SAtalk] SUBJ_ALL_CAPS regex broken

2002-03-09 Thread Rob McMillin
Charlie Watts wrote: >The current SUBJ_ALL_CAPS is broken. > >(The one from CVS - this: >header SUBJ_ALL_CAPS Subject =~ /^[^a-z]*([A-Z][^a-z]*){3,}[^a-z]*$/ >) > Congratulations, Charlie! You're the next winner on "The Regex Is Right!" Heh. The problem is that this RE has exponential backoff t

Re: [SAtalk] Misc. rule ideas

2002-03-09 Thread Rob McMillin
Kerry Nice wrote: >Here are some rules I added to my local.cf that seem >to be catching a few things. > >#Seems to be a broken bulk mail program that puts some >of the headers in the email body >rawbody MESSAGEIDINBODY /^Message-Id: ><.*\@message-Id>$/ >describe MESSAGEIDINBODY Distictive Mess

Re: [SAtalk] -W and -R not working

2002-03-08 Thread Rob McMillin
Mike Loiterman wrote: > >-BEGIN PGP SIGNED MESSAGE- >Hash: SHA1 > >Trying to set up aliases to spamassassin -W and spamassassin -R but >they don't seem to work. I get this error. > >- - The following addresses had permanent fatal errors - "| >/usr/bin/spamassassin -W" >(re

Re: [SAtalk] Re: Proposed 'FROM_SPAMLAND' user response summary

2002-03-08 Thread Rob McMillin
Justin Mason wrote: >Mind you, I don't think this is a good idea; it will make SA even more >westerner-oriented. :( Pretty much all the GA corpus is from western >sources and in western charsets, so the GA will totally skew it. > Further: the spam tests, body and keyword match, are virtually 10

Re: [SAtalk] Re: Catching virus distribution with SpamAssassin (was Re: Misc. rule ideas)

2002-03-08 Thread Rob McMillin
Matt Sergeant wrote: >>If you use a secure mailer, than viruses are not a threat, nothing but >>more junk. I don't see any reason not to consider them spam. >> > >They are junk, but not UCE. > >How would you, for example, propose to catch a polymorphic executable >virus? Our code catches these u

Re: [SAtalk] greylist?

2002-03-08 Thread Rob McMillin
Michael Moncur wrote: >>I was thinking that a greylist for to addresses would be a good idea. >> >>Give a small positive number (say 1.0-.3) to certain To: domains or >>addresses (not the CC's). It might help to push some spam over the top >>and still keep non-spam mail flowing freely. >> > >Thi

Re: [SAtalk] REMOVE_PAGE rule improvement

2002-03-08 Thread Rob McMillin
Matthew Cline wrote: >Currently the rule is: > > uri REMOVE_PAGE /^https?:\/\/[^\/]+\/remove/ > Aside: could this be written as uri REMOVE_PAGE m(^https?://[^/]+/remove) to avoid "flying slashes"? -- http://www.pricegrabber.com | Dog is my co-pilot.

Re: [SAtalk] Misc. rule ideas

2002-03-08 Thread Rob McMillin
Matthew Cline wrote: >First a few rules to match non-spam: > > body SIGNATURE_DELIM/^-- $/ > describe SIGNATURE_DELIMStandard signature delimiter present > >While there would be no effort in faking this, it might take a while for some of the >spammers to catch on. > I hav

Re: Proposed "FROM_SPAMLAND" user response summary (was Re: [SAtalk] A better alternative to test ROUND_THE_WORLD

2002-03-07 Thread Rob McMillin
Scott Doty wrote: >On Fri, Mar 01, 2002 at 09:50:03PM -0800, Rob McMillin wrote regarding >the "FROM_SPAMLAND" test: >] http://www.geocrawler.com/lists/3/SourceForge/11679/350/7984404/ > >>/\.(?:kr|cn|cl|ar|hk|il|th|tw|sg|za|tr|ma|ua|in|pe)(?:[\s\)\]]|$)/ >&

Re: [SAtalk] "make install" clobbers user_prefs

2002-03-07 Thread Rob McMillin
Greg Ward wrote: >Ooh, this is bad: it looks like "make install" in SA 2.11 clobbers your >~/.spamassassin/user_prefs file. *Very* annoying -- I had a lot of >stuff in mine! Waahhh!! > You do have backups, yes? -- http://www.pricegrabber.com | Dog is my co-pilot.

[SAtalk] [Fwd: IP: When spam relays become worm breeding grounds]

2002-03-06 Thread Rob McMillin
Via interesting-people... IMHO Gilmore has, by announcing his intention of maintaining an open relay as a moral stand, created a public nuisance. Any chance of adding a test for toad.com as an SA test? :-) === From: Brian McWilliams < @pc-radio.com=""> Date: Wed, 06 Mar 2002 14:2

[SAtalk] Collecting statistics on win/loss rates

2002-03-05 Thread Rob McMillin
I don't know if any of you folks have read bug 62: http://bugzilla.spamassassin.org/show_bug.cgi?id=62 but I have an idea that I'd like to sound out to see whether people would be interested in (a) participating in, (b) if someone else is doing something like this, and (c) if you can see any p

Re: [SAtalk] SUBJ_ALL_CAPS

2002-03-05 Thread Rob McMillin
Daniel Rogers wrote: >On Tue, Mar 05, 2002 at 09:00:33PM -0800, Rob McMillin wrote: > >>Should be busted, but see bug 39; I believe another patch has been >>accepted for this bug. >> > >Isn't that LINE_OF_YELLING, not SUBJ_ALL_CAPS? > >Or did the patch

Re: [SAtalk] SUBJ_ALL_CAPS

2002-03-05 Thread Rob McMillin
Daniel Rogers wrote: >I just noticed that SUBJ_ALL_CAPS matches on a blank subject. Is this >intentional? > >Should it maybe be rewritten as: > >Subject =~ /^[^a-z]+$/ instead of Subject =~ /^[^a-z]*$/ > >? > >(Would that even work?) > Should be busted, but see bug 39; I believe another patch ha

[SAtalk] China: Lawmakers protest e-mail blocks

2002-03-05 Thread Rob McMillin
http://news.com.com/2100-1023-850761.html -- [EMAIL PROTECTED] | Dog is my co-pilot. ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk

Re: [SAtalk] Another English-centric rule

2002-03-05 Thread Rob McMillin
Matthew Cline wrote: >On Tuesday 05 March 2002 02:08 am, I wrote: > >>header NON_ASCII_ENC_SUBJ Subject =~ >>/=\?(?:euc-kr|big5|iso-8859-1)\?/ >> > >Actually: > >header NON_ASCII_ENC_SUBJ Subject =~ /=\?(?:euc-kr|big5|iso-8859-1)\?/i > >as it needs to be case insensitive. > Already ex

Re: [SAtalk] Spammers get imaginative

2002-03-04 Thread Rob McMillin
Tony Hoyle wrote: > They've started using foreign languages now... Now? Now? I've been getting spam in Spanish, Portuguese, French, German, Chinese, and Japanese for a while now. I've even started getting spam on my phone (AT&T allows e-mail access for short messages). I have to admit, the w

[SAtalk] User code

2002-03-04 Thread Rob McMillin
I'm wondering if it might not be possible to add a user module containing Perl code. Currently, there's a user config which is fine, but IMHO more flexibility would be a Good Thing. -- http://www.pricegrabber.com | Dog is my co-pilot.

Re: [SAtalk] A better alternative to test ROUND_THE_WORLD]

2002-03-03 Thread Rob McMillin
Lars Hansson wrote: >On Sun, 03 Mar 2002 00:08:41 -0800 >"Rob McMillin" <[EMAIL PROTECTED]> wrote: > >>Let me get this straight -- we have ignorant and the willfully abusive >>people in these countries creating or abetting spam for others to deal >>

Re: [SAtalk] Country codes [was: A better alternative to test ROUND_THE_WORLD]

2002-03-03 Thread Rob McMillin
Craig R Hughes wrote: >Rob McMillin wrote: > >>>Both of them are code posted to BugTraq, one from Hong Kong and another >>> >>>from .ar[1]. >> > >>>Footnotes: >>>[1] I can't recall where this is. Austria, maybe? >>> &g

Re: [SAtalk] Country codes [was: A better alternative to test ROUND_THE_WORLD]

2002-03-03 Thread Rob McMillin
Daniel Pittman wrote: >Both of them are code posted to BugTraq, one from Hong Kong and another >from .ar[1]. > [...] >Footnotes: >[1] I can't recall where this is. Austria, maybe? > Yes. See http://www.oasis-open.org/cover/country3166.html -- http://www.pricegrabber.com | Dog is my

Re: [SAtalk] Having trouble getting people out of my auto-whitelist

2002-03-03 Thread Rob McMillin
Craig R Hughes wrote: >You can remove/add addresses to the AWL using spamassassin's "-R" and "-W" >flags. You can list the AWL contents using tools/check_whitelist > The problem is exactly that -R doesn't work for me. I wrote a quick script to delete everything in the dbm: use AnyDBM_File; t

[SAtalk] Having trouble getting people out of my auto-whitelist

2002-03-03 Thread Rob McMillin
I can't get addresses -- or anything, really -- out of my auto-whitelist. I'm running RedHat 7.2 with Perl 5.6. I've been able to generate standalone dbm applications that can delete entries in an arbitrary (ndbm?) database file, but I can't remove anything from the auto-whitelist, even with a

Re: [SAtalk] A better alternative to test ROUND_THE_WORLD]

2002-03-03 Thread Rob McMillin
Craig R Hughes wrote: >Olivier Nicole wrote: > >>It would be best to avoid ruining the slowly building good reputation >>of SA (attending Apricot yesterday, SA was cited as the best anti-spam >>product one could choose -- Apricot is a yearly international >>conference in Asia-Pacific). >> > >I ag

Re: [SAtalk] Re: A better alternative to test ROUND_THE_WORLD

2002-03-03 Thread Rob McMillin
Alan Shutko wrote: >OTOH, the vast majority of spam I get is cjk spam, as is the majority >of spam that gets through spamassassin. I would be quite in favor of >including this test, as the debian package could easily disable it by >default, and users could easily reenable it (as I have done so f

  1   2   >