Re: subject - why not all caps?

2005-07-10 Thread Jonathan Nichols
As for the all caps rule, it is hard to understand why it was written not to fire on a single excessively long word. Probably because end users are morons and think that if they put lots of capital letters in the subject that you'll somehow prioritize it differently. Our helpdesk guy is

Re: How can I correctly detect these spams?

2005-07-10 Thread jdow
From: Thomas Booms [EMAIL PROTECTED] Here's the content of my local.cf: rewrite_subject 1 report_safe 2 trusted_networks user_scores_dsn DBI:mysql:: user_scores_sql_username user_scores_sql_password user_scores_sql_custom_query SELECT preference, value FROM

Restart to learn spam/ham

2005-07-10 Thread Thomas Booms
Hi all, due to some config probs i believe, i need to learn the machine spams/hams new. How can i do that? Thomas -- Booms EDV - hosting more - Herrenstrasse 10 D-59073 Hamm www.booms-edv.de [EMAIL PROTECTED]

Re: SURBL, SA 3.0.4, and firewalls

2005-07-10 Thread Dr Robert Young
Is there documentation available on all the prerequisites and setup necessary for it to operate correctly? On Jul 9, 2005, at 8:39 PM, Theo Van Dinter wrote: On Sat, Jul 09, 2005 at 07:47:22PM -0400, Dr Robert Young wrote: Is there any information available on what configuration your

Re: SURBL, SA 3.0.4, and firewalls

2005-07-10 Thread JamesDR
Dr Robert Young wrote: Is there documentation available on all the prerequisites and setup necessary for it to operate correctly? On Jul 9, 2005, at 8:39 PM, Theo Van Dinter wrote: On Sat, Jul 09, 2005 at 07:47:22PM -0400, Dr Robert Young wrote: Is there any information available on what

Re: Remote tests and candidate scam rules

2005-07-10 Thread Loren Wilton
Hi Cedric. Welcome to the group. I can make some suggestions, although I can't answer all your questions. 1.You should almost certainly have the SURBL rules enabled. Maybe this is what you mean by spamcop rules, or maybe that is something else. The SURBL rules should be enabled by default

Re: messages with no body

2005-07-10 Thread Loren Wilton
This brings up a question. Why are these sent out? To validate addresses perhaps? Virtually all of the ones I see typically also lack either or both of a subject and a To: address. They very typically have some header information mangled also. My belief is that one of the spammer tools (I

Re: messages with no body

2005-07-10 Thread Eric A. Hall
On 7/10/2005 3:12 PM, Loren Wilton wrote: Anybody got a rule that will catch messages that don't have a body? There are things like that around. I have a rather draconian pesonal rule I use. There is a much milder form in one of the SARE rulesets. The problem is you can't check just

Re: messages with no body

2005-07-10 Thread Loren Wilton
I guess I should have asked the obvious question: and if so, could you post it? Well, I'd hoped that the 'draconian' would detract from that idea. But since you ask anyway, I went looking. And discovered that I *don't* have a rule for this anymore! I'm just getting by on the SARE rules

RE: messages with no body

2005-07-10 Thread Dallas L. Engelken
Anybody got a rule that will catch messages that don't have a body? 3.1.0-pre3 has this already... - # __MIME_ATTACHMENT defined in 20_html_tests.cf body __NONEMPTY_BODY/\S/ meta EMPTY_MESSAGE !__MIME_ATTACHMENT !__NONEMPTY_BODY describe EMPTY_MESSAGE Message appears

Re: messages with no body

2005-07-10 Thread Eric A. Hall
On 7/10/2005 3:49 PM, Loren Wilton wrote: However, if you want something like this, just off the top of my head: header __HAS_TOTo =~/\S/ body__HAS_BODY/\S/ metaEMPTY_MSG(!__HAS_TO !__HAS_BODY) Good idea. rawbody works better but the model is right. -- Eric A. Hall

Re: messages with no body

2005-07-10 Thread Loren Wilton
Rawbody will miss the subject, so you will need to add a test for that too. Loren

Re: messages with no body

2005-07-10 Thread Eric A. Hall
On 7/10/2005 4:56 PM, Loren Wilton wrote: Rawbody will miss the subject, so you will need to add a test for that too. I'm not looking for that -- Eric A. Hallhttp://www.ehsco.com/ Internet Core Protocols http://www.oreilly.com/catalog/coreprot/

SA 2.63 vs 2.64

2005-07-10 Thread Matthias Fuhrmann
Hello, nearly a year ago, i had trouble upgrading to 2.64. the problem ist still present. running 2.64 leads to mass syslog filling due to this lines: Jul 10 22:41:35 xx spamd[15244]: Use of uninitialized value in concatenation (.) or string at /opt/gnu/lib/perl5/site_perl/5.8.3/Mail/S

Re: md5sum/sha1sum signatures available, was RE: Gif-Only spams

2005-07-10 Thread Dirk Bonengel
Just to add my 2 Euro-Cent: Something like this might actually exist (in as far as gif-only spams are of interest). Bert Ungerer, an editor with the German IT magazine 'iX', developed a procmail-based AntiSpam-System he called 'NiXSpam'. One part of it is a list of MD5-hashes of parts of the

Rule: envelope to header to - help?

2005-07-10 Thread Michael W Cocke
Does anyone have a rule to chech the envelope To: against the header to: ? I'm sure that there's a reason why it's allowed to be different, but it doesn't apply here, and almost half of the spam that gets thru everything else would get stopped by that. Thanks! Mike- -- Mornings: Evolution in

Re: Restart to learn spam/ham

2005-07-10 Thread Kai Schaetzl
Thomas Booms wrote on Sun, 10 Jul 2005 16:40:56 +0200: due to some config probs i believe, i need to learn the machine spams/hams new. How can i do that? Delete the Bayes db files (files starting with bayes_). Kai -- Kai Schätzl, Berlin, Germany Get your web at Conactive Internet Services:

RE: Rule: envelope to header to - help?

2005-07-10 Thread Herb Martin
Does anyone have a rule to chech the envelope To: against the header to: ? I'm sure that there's a reason why it's allowed to be different, but it doesn't apply here, and almost half of the spam that gets thru everything else would get stopped by that. [First I am new here and so may know

Re: update on floating dividing score between spam and ham messages

2005-07-10 Thread Joe Flowers
Loren Wilton wrote: This is quite interesting, and seems reasonably obvious that with the right sort of mail (at least, maybe with any mail) this shoudl work better, since it self tunes to your conditions. It does of course assume a reasonable fp/fn rate to start, but SA is generally pretty