Bill Sent: Thursday, December 04, 2003 7:55 AM
What if we were to setup some kind of automatic update script
that would wget the latest version of the file every evening?
That way we would all be up to date all the time. To that
end, we could even setup a little web-based app whereby a
: Vivek Khera [mailto:[EMAIL PROTECTED]
| Sent: Wednesday, December 03, 2003 2:29 PM
| To: [EMAIL PROTECTED]
| Subject: Re: [SAtalk] BIG HUGE EVIL RULE NEWS
|
| Nice list. I have two recommendations/suggestions:
|
| 1) put the full URL of the canonical source into the file itself, so
To throw oil into the flames:
On Wed, Dec 03, 2003 at 08:10:17PM -0500, Carl R. Friend wrote:
Why are we hiding from the police, daddy?
Because we use vi, son, and they use emacs.
Why not use 'vim' (multi window / multi file / macrolanguage / ... )
All luxuries included, and no need to
At 19:13 12/3/2003 -0600, mikea wrote:
On Wed, Dec 03, 2003 at 07:17:28PM -0500, Rick Macdougall wrote:
Peter P. Benac wrote:
I have been using Emacs for almost 20 years. Is there any other
editor :)
:s/old stuff/newstuff/g only works if you only have one instance of
old
stuff per
-Original Message-
From: Larry Rosenman [mailto:[EMAIL PROTECTED]
Sent: Thursday, December 04, 2003 4:30 PM
To: Bart Schaefer; [EMAIL PROTECTED]
Subject: Re: [SAtalk] BIG HUGE EVIL RULE NEWS
--On Thursday, December 04, 2003 13:26:27 -0800 Bart Schaefer
[EMAIL
On Thu, Dec 04, 2003 at 03:38:29PM -0600, Mark Muller wrote:
Because I've never opted into anything, yet I get spam with images hosted on
akamaitech/akamai.
Perhaps hate was a strong word, I dislike them very much? :) The fact that
it found it's way into evil rules (in 3 separate places no
Santerre; [EMAIL PROTECTED]
Subject: RE: [SAtalk] BIG HUGE EVIL RULE NEWS
I was getting quite envious of you people seeing the bigevil list working.
Now I got my first bigevil catch:
Content analysis details: (9.5 points, 5.0 required)
pts rule name description
, 2003 4:07 PM
To: Chris Santerre; [EMAIL PROTECTED]
Subject: RE: [SAtalk] BIG HUGE EVIL RULE NEWS
I was getting quite envious of you people seeing the
bigevil list working.
Now I got my first bigevil catch:
Content analysis details: (9.5 points, 5.0 required)
pts rule name
Thus spake Chris Santerre ([EMAIL PROTECTED]) [04/12/03 16:48]:
That is the problem we are now facing. Would a spammer need high volume web
access? My corpa says yes. I obviously can't tag this now. I removed the
first 2, but I have left bfast.com and xmr3.com in for now. I may remove
OK. I'm hoping this is it for a week. I'm away from email after tomorrow.
People checking here for me have been informed to No touchy! my project :)
1.59 is up.
The 3 below, plus xmr3.com have been moved to a seperate rule for watching.
I will add more domains as they are found to be both
I can see how using image references could be problematic... just because
an image is referenced, it doesn't mean the spammer controls it.
Personally, for my home grown additions to the evil list, I've been adding
only the domains or IPs that the spammer wants me to click on... but even
this
On Thu, 4 Dec 2003, jenni baier wrote:
For example, I get a few Stock Pick spams that reference legitimate
quote sites... they don't necessarily want you to respond directly to
them, they just want you to buy their stock.
The answer, in this case, is to isolate the portion of the
URI
On Tue, 2 Dec 2003, Chris Santerre wrote:
BIG HUGE NEWS
A major breakthrough has taken place
ALL EVILRULES FILES HAVE BEEN COMBINED!! 2622 domains into 178 rules!!!
Ramdon/tracking hosts tags removed!
They only increase spamd memory by 1 meg!!! 1 meg!
You read correctly!
On Tue, 2 Dec 2003 15:56:15 -0500
Chris Santerre [EMAIL PROTECTED] wrote:
(...)
ALL EVILRULES FILES HAVE BEEN COMBINED!! 2622 domains into 178 rules!!!
Ramdon/tracking hosts tags removed!
(...)
Real big work! Grats!
But, for the sake of archiveness, and for one less dumb in the world,
why
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
Sent: Tuesday, December 02, 2003 10:07 PM
To: Chris Santerre
Subject: Re: [SAtalk] BIG HUGE EVIL RULE NEWS
I've been using your popcorn, weeds and nov2rules.cf rules for about a
month now
PM
To: Chris Santerre; 'Marc Steuer'; 'Spamassassin-Talk (E-mail)'
Subject: RE: [SAtalk] BIG HUGE EVIL RULE NEWS
--On Tuesday, December 02, 2003 17:22:00 -0500 Chris Santerre
[EMAIL PROTECTED] wrote:
ALL EVILRULES FILES HAVE BEEN COMBINED!! 2622 domains into
178 rules
:/
-Original Message-
From: David B Funk [mailto:[EMAIL PROTECTED]
Sent: Wednesday, December 03, 2003 5:59 AM
To: Chris Santerre
Cc: Spamassassin-Talk (E-mail)
Subject: Re: [SAtalk] BIG HUGE EVIL RULE NEWS
On Tue, 2 Dec 2003, Chris Santerre wrote:
BIG HUGE NEWS
!!
- Original Message -
From: Chris Santerre [EMAIL PROTECTED]
To: 'David B Funk' [EMAIL PROTECTED]
Cc: Spamassassin-Talk (E-mail) [EMAIL PROTECTED]
Sent: Wednesday, December 03, 2003 6:40 AM
Subject: RE: [SAtalk] BIG HUGE EVIL RULE NEWS
Fixed, thanks. Version 1.52 posted. Once
--On Wednesday, December 03, 2003 09:31:24 -0500 Chris Santerre
[EMAIL PROTECTED] wrote:
What version of Bigevil do you have? 1.51 has fixed 2 typos in 141 and
153. I had
'.com||somedome'
empty pipes. site updated within minutes. You got version 1.5 I expect :)
Yep. updated to 1.52.
Thanks!
] BIG HUGE EVIL RULE NEWS
--On Wednesday, December 03, 2003 09:31:24 -0500 Chris Santerre
[EMAIL PROTECTED] wrote:
What version of Bigevil do you have? 1.51 has fixed 2 typos in 141 and
153. I had '.com||somedome'
empty pipes. site updated within minutes. You got version 1.5 I expect
(...)
ALL EVILRULES FILES HAVE BEEN COMBINED!! 2622 domains into
178 rules!!!
Ramdon/tracking hosts tags removed!
(...)
Real big work! Grats!
But, for the sake of archiveness, and for one less dumb in the world,
why you use rawbody on those rules instead of uri?
On time: the
Chris Santerre said:
snip
That domain got there from an SA post. SA list was CC'd instead of To:'d.
So
It got filtered :/
Chris,
Instead of checking To or CC, you might want to look for headers the list
software adds:
http://www.mail-archive.com/[EMAIL PROTECTED]/msg25589.html
--
Chris
2003-12-02 kl. 21.56 skrev Chris Santerre:
BIG HUGE NEWS
A major breakthrough has taken place
ALL EVILRULES FILES HAVE BEEN COMBINED!! 2622 domains into 178 rules!!!
Ramdon/tracking hosts tags removed!
They only increase spamd memory by 1 meg!!! 1 meg!
You read correctly! Every
On 2003/12/03 09:31:24 -0500, Chris Santerre wrote:
What version of Bigevil do you have? 1.51 has fixed 2 typos in 141 and 153.
I had
'.com||somedome'
empty pipes. site updated within minutes. You got version 1.5 I expect :)
The first few lines of:
latest is 1.52. Fixed 2 typos and 3 domains. An SF
project..Hm... :)
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
Sent: Wednesday, December 03, 2003 11:32 AM
To: Chris Santerre
Cc: 'Spamassassin-Talk (E-mail)'
Subject: Re: [SAtalk] BIG HUGE EVIL
[EMAIL PROTECTED] said:
On 2003/12/03 09:31:24 -0500, Chris Santerre wrote:
What version of Bigevil do you have? 1.51 has fixed 2 typos in 141
and 153.
I had
'.com||somedome'
empty pipes. site updated within minutes. You got version 1.5 I
expect :)
The first few lines of:
... :)
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
Sent: Wednesday, December 03, 2003 11:32 AM
To: Chris Santerre
Cc: 'Spamassassin-Talk (E-mail)'
Subject: Re: [SAtalk] BIG HUGE EVIL RULE NEWS
On 2003/12/03 09:31:24 -0500, Chris Santerre wrote:
What
How can I tell that SA is actually using these rules (located in
/etc/mail/spamassassin/bigevil.cf) ?
---
This SF.net email is sponsored by OSDN's Audience Survey.
Help shape OSDN's sites and tell us what you think. Take this
five minute
Watch for hits? It shouldn't take long, those rules hit about 1 in 5 for
me.
-Original Message-
From: Vee Persaud [mailto:[EMAIL PROTECTED]
Sent: Wednesday, December 03, 2003 10:48 AM
To: Spamassassin-Talk (E-mail)
Subject: RE: [SAtalk] BIG HUGE EVIL RULE NEWS
How can I tell
On Wed, Dec 03, 2003 at 11:48:03AM -0500, Vee Persaud wrote:
How can I tell that SA is actually using these rules (located in
/etc/mail/spamassassin/bigevil.cf) ?
Feed your MTA a mail designed to match one or more of the rules, and
look for the match in your logs.
: Adam Denenberg [mailto:[EMAIL PROTECTED]
Sent: Wednesday, December 03, 2003 11:57 AM
To: 'Spamassassin-Talk (E-mail)'
Subject: RE: [SAtalk] BIG HUGE EVIL RULE NEWS
how agressive are these rules? I am hearing great things
about them but
dont want to produce FP's on my production
: [SAtalk] BIG HUGE EVIL RULE NEWS
How can I tell that SA is actually using these rules (located
in /etc/mail/spamassassin/bigevil.cf) ?
---
This SF.net email is sponsored by OSDN's Audience Survey.
Help shape OSDN's sites
] BIG HUGE EVIL RULE NEWS
On 2003/12/03 09:31:24 -0500, Chris Santerre wrote:
What version of Bigevil do you have? 1.51 has fixed 2 typos
in 141 and 153.
I had
'.com||somedome'
empty pipes. site updated within minutes. You got version
1.5 I expect
Santerre
-Original Message-
From: Adam Denenberg [mailto:[EMAIL PROTECTED]
Sent: Wednesday, December 03, 2003 11:57 AM
To: 'Spamassassin-Talk (E-mail)'
Subject: RE: [SAtalk] BIG HUGE EVIL RULE NEWS
how agressive are these rules? I am hearing great things
about them
PROTECTED] On
Behalf Of Jennifer Wheeler
Sent: Wednesday, December 03, 2003 12:43 PM
To: 'Chris Santerre'; 'Adam Denenberg'; 'Spamassassin-Talk (E-mail)'
Subject: RE: [SAtalk] BIG HUGE EVIL RULE NEWS
snip
You could always lower the score. Only 178 to change :)
(Hey that is nothing
)
Subject: RE: [SAtalk] BIG HUGE EVIL RULE NEWS
Not to start a text editor war, but it can be done in Textpad with a regex
search and replace. Hit F8, check the Regular Expression textbox
- Find: \t3.0$ - Replace with: \t1.0 (or whatever you want the score
to be).
Mike
-Original Message
Jennifer Wheeler said:
snip
You could always lower the score. Only 178 to change :)
(Hey that is nothing compared to how many times I had to hit ' | ,
DELETE,
END ' because I was in a hurry to get done!)
Hi Chris,
You should grab multiedit. Rockage. You can do your edits with little
Scott Harris said:
Doesn't anyone use VI anymore?!! :-)
Sorry, couldn't resist adding to the war.
:%s/old stuff/new stuff/g
Or even better:
:g/^score/s/3.0/1.0/
---
This SF.net email is sponsored by OSDN's Audience Survey.
Help shape
I am trying to test out these new rules, but so far all of my tests have
not showing them as being active.
$ ls /etc/mail/spamassassin
bigevil.cf local.cf
And I restarted spamd... What else do I have to do to make them work?
Thanks for the help.
--
:wq!
Matthew Daubenspeck
Shhh1.57:)
Sorry. But there are a few things. 100% spam rate is the goal. So any chance
of FP can't happen. I removed the domain with the tomshardware fp in it.
Also Matt Yackley, (What is it with Matts straightening me out!), has shown
me an error in my ways. With such wide use of this
Nice list. I have two recommendations/suggestions:
1) put the full URL of the canonical source into the file itself, so
people know from where to get updates
2) put a date into the file, so people will know how fresh the info
is.
And add china-inflatable.com and cn-inflatables.com ;-)
--On Wednesday, December 03, 2003 15:29:05 -0500 Vivek Khera
[EMAIL PROTECTED] wrote:
Nice list. I have two recommendations/suggestions:
1) put the full URL of the canonical source into the file itself, so
people know from where to get updates
2) put a date into the file, so people will
:)
--Chris (I top post in your general direction) Santerre
-Original Message-
From: Vivek Khera [mailto:[EMAIL PROTECTED]
Sent: Wednesday, December 03, 2003 3:29 PM
To: [EMAIL PROTECTED]
Subject: Re: [SAtalk] BIG HUGE EVIL RULE NEWS
Nice list. I have two recommendations
On Dec 3, 2003 at 12:43, Jennifer Wheeler wrote:
You should grab multiedit. Rockage. You can do your edits with little
macros.
Perl! sed! Makefiles!
--
Satya. URL:http://www.thesatya.com/
The lab called: your brain is ready
---
This
1) put the full URL of the canonical source into the file itself, so
people know from where to get updates
Or, for those who like a little automation:
#!/bin/sh
wget -N http://www.merchantsoverseas.com/wwwroot/gorilla/bigevil.cf \
-O /etc/mail/spamassassin/bigevil.cf \
21 | grep
PROTECTED]
Sent: Thursday, December 04, 2003 8:42 AM
To: [EMAIL PROTECTED]
Subject: Re: [SAtalk] BIG HUGE EVIL RULE NEWS
1) put the full URL of the canonical source into the file itself, so
people know from where to get updates
Or, for those who like a little automation:
#!/bin/sh
wget -N
-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On
Behalf Of Adam Lanier
Sent: Wednesday, December 03, 2003 14:36
To: SA List
Subject: RE: [SAtalk] BIG HUGE EVIL RULE NEWS
On Wed, 2003-12-03 at 14:25, Chris Thielen wrote:
Did somebody mention editor wars? C'mon let's hear
Peter P. Benac wrote:
I have been using Emacs for almost 20 years. Is there any other editor :)
:s/old stuff/newstuff/g only works if you only have one instance of old
stuff per line!!
H?
What you talking about Willis?
:s/old stuff/newstuff/g will replace ALL instances of old stuff
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On
Behalf Of Rick Macdougall
Sent: Wednesday, December 03, 2003 4:17 PM
To: 'SA List'
Subject: Re: [SAtalk] BIG HUGE EVIL RULE NEWS
Peter P. Benac wrote:
I have been using Emacs for almost 20 years
On Wed, 3 Dec 2003, Scott Harris wrote:
Ahh, the great editor debate :-)
Why are we hiding from the police, daddy?
Because we use vi, son, and they use emacs.
Disclaimer: The above is not my creation. I pilfered it from
somewhere. I forget where. I wasn't even there. You can
On Wed, Dec 03, 2003 at 07:17:28PM -0500, Rick Macdougall wrote:
Peter P. Benac wrote:
I have been using Emacs for almost 20 years. Is there any other editor :)
:s/old stuff/newstuff/g only works if you only have one instance of old
stuff per line!!
H?
What you talking
Khera'; [EMAIL PROTECTED]
Subject: RE: [SAtalk] BIG HUGE EVIL RULE NEWS
Done and Done and Will do :)
Yes I even put the time. No need to update if you have 1.57, as these were
just info changes. I'm sure 1.58 could be lurking just around the corner.
I'm just waiting for the next Matt email
[EMAIL PROTECTED] wrote:
BIG HUGE NEWS
A major breakthrough has taken place
ALL EVILRULES FILES HAVE BEEN COMBINED!! 2622 domains into 178
rules!!! Ramdon/tracking hosts tags removed!
They only increase spamd memory by 1 meg!!! 1 meg!
You read correctly! Every evil domain
--On Tuesday, December 02, 2003 16:26:11 -0500 Vee Persaud
[EMAIL PROTECTED] wrote:
[EMAIL PROTECTED] wrote:
BIG HUGE NEWS
This seems awesome. If I never used EvilRules before, is it easy to
start using it ? Do I have to modify any other config files ?
nope. just drop it in the
Chris Santerre. I genuflect! Thanks for the effort. I must
decline the hockey game; I live in the middle of basketball country and
would have to make quite a pilgrimage to get to a game of any caliber.
Would you settle for my switching from cokes to hot chocolates with
coffee mate for a
Chris,
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]
On Behalf Of Chris Santerre
Sent: Tuesday, December 02, 2003 12:56 PM
To: Spamassassin-Talk (E-mail)
Subject: [SAtalk] BIG HUGE EVIL RULE NEWS
BIG HUGE NEWS
A major breakthrough has taken place
ALL EVILRULES FILES
ALL EVILRULES FILES HAVE BEEN COMBINED!! 2622 domains into
178 rules!!!
Ramdon/tracking hosts tags removed!
Thanks a lot for your work on this.
BigEvilList_74 hit on a message we received from the
Financial Executives
Institute because it contained ...fasb.org. Is the Financial
I can only think to say muhahahaha... Thanks for the work on this
Chris!
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On
Behalf Of Chris Santerre
Sent: Tuesday, December 02, 2003 3:56 PM
To: Spamassassin-Talk (E-mail)
Subject: [SAtalk] BIG HUGE EVIL RULE
--On Tuesday, December 02, 2003 17:22:00 -0500 Chris Santerre
[EMAIL PROTECTED] wrote:
ALL EVILRULES FILES HAVE BEEN COMBINED!! 2622 domains into
178 rules!!!
Ramdon/tracking hosts tags removed!
Thanks a lot for your work on this.
BigEvilList_74 hit on a message we received from the
Thanks Chris - great work!
--Larry
-Original Message-
From: Chris Santerre
BIG HUGE NEWS
A major breakthrough has taken place
ALL EVILRULES FILES HAVE BEEN COMBINED!! 2622 domains into
178 rules!!! Ramdon/tracking hosts tags removed!
They only increase spamd
On Tue, 02 Dec 2003 15:29:37 -0600 Larry Rosenman [EMAIL PROTECTED] wrote:
--On Tuesday, December 02, 2003 16:26:11 -0500 Vee Persaud
[EMAIL PROTECTED] wrote:
[EMAIL PROTECTED] wrote:
BIG HUGE NEWS
This seems awesome. If I never used EvilRules before, is it easy to
start
61 matches
Mail list logo
