collaborative bayes bases

2005-11-18 Thread qMax
in wiki://BayesInSpamAssassin it is said: Do not train Bayes on different mail streams or public spam corpora. These method will mislead Bayes into believing certain tokens are spammy or hammy when they are not. Could you explain why it is so, and what could happen if to teach nayes from several

Unicode right to left HTML override obsfucation

2005-11-18 Thread Sean Doherty
Is there any rules available for catching messages that use the unicode right to left override in HTML to reverse text (sample attached)? For instance 'H#8236;olle#8238; W#8236;dlro#8238;' would render as 'Hello World' I've seen a couple of these sneak thru recently. I don't want to create a

Help with bayes configuration

2005-11-18 Thread Pierre Faudon
Hello, I installed spamassassin a month agowiththebayes auto learn option, but there is still 60% of spam that is not detected. In my bayes db there was nothing ... [EMAIL PROTECTED] root]# sa-learn --dump magic0.000 0 3 0 non-token data: bayes db version0.000 0 0 0 non-token data: nspam0.000 0

Re:Help with bayes configuration

2005-11-18 Thread Pierre Faudon
I forgot ... the version ! [EMAIL PROTECTED] spamassassin]# spamassassin -VSpamAssassin version 3.0.4 running on Perl version 5.8.0 Hello, I installed spamassassin a month agowiththebayes auto learn option, but there is still 60% of spam that is not detected. In my bayes db there was

Re: collaborative bayes bases

2005-11-18 Thread David A . Roth
If I am understanding this correctly...the concern is that the Bayes should match the mail server in which the ham and spam was received on only? David Roth rothmail (at) comcast.net (dot) net On Nov 18, 2005, at 5:10 AM, qMax wrote: in wiki://BayesInSpamAssassin it is said: Do not train

Re: collaborative bayes bases

2005-11-18 Thread Anthony Peacock
Hi, I actually think it is more to do with the fact that one person's spam could be another person's ham. If the mail streams and servers are carrying messages for a community of users who receive (and want to receive) similar types of email messages, I can't see any major problem with using

RE: Re[2]: RATWARE_ZERO_TZ=4.1

2005-11-18 Thread Bowie Bailey
From: Robert Menschel [mailto:[EMAIL PROTECTED] Wednesday, November 16, 2005, 1:47:24 PM, you wrote: SL I guess if this is the case I need to lower SL the score for that rule as my kill value is a 3.5, ... SpamAssassin scores are optimized for a this is spam threshold of 5. Anyone who

Re: collaborative bayes bases

2005-11-18 Thread David A . Roth
I see. That's a very good point, about sharing the Bayes within a different community. Anyone see a problem with a single-user collecting spam (and ham) from various personal mailboxes that came in from different internet service providers and doing a sa-learn on it? David Roth rothmail

Re: collaborative bayes bases

2005-11-18 Thread Anthony Peacock
Hi, I see. That's a very good point, about sharing the Bayes within a different community. Anyone see a problem with a single-user collecting spam (and ham) from various personal mailboxes that came in from different internet service providers and doing a sa-learn on it? This really

RE: Rule for this

2005-11-18 Thread Casey King
I am still receiving spam, that is wrapped in html code. I am not sure why this rule I added is not picking it up. From what I read, it seems to work for others, but adding it to my local.cf, and running -lint with no errors, my spam checks still ignore it. What can I do to stop this?

Return-Path: ([EMAIL PROTECTED])

2005-11-18 Thread Elton Ramos Carvalho
I`m getting some spams with Return-Path: ([EMAIL PROTECTED]). Return-Path: [EMAIL PROTECTED] Return-Path: [EMAIL PROTECTED] Then I did this rule. header EL_NOBODY_RP Return-Path =~ /[EMAIL PROTECTED]/i describe EL_NOBODY_RP Contém nobody no return path score EL_NOBODY_RP 1.0 What do you

Avoiding FP on domain fragments?

2005-11-18 Thread David Gibbs
Folks: I just got a message that was flagged as spam due to the URIBL_JP_SURBL rule ... it matched on the URI 'range.com' ... my domain, midrange.com, is what triggered it. 3.4 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist [URIs: range.com]

Re: OT: Spammers' reactions to rejection

2005-11-18 Thread John Hardin
On Thu, 2005-11-17 at 11:55, Christian Recktenwald wrote: On Thu, Nov 17, 2005 at 11:42:44AM -0800, John Woolsey wrote: It would be an interesting addition to a honeypot. Make the mail server just hang up and not respond to tie up connections on the spammer. There's a cool piece of

Re: Return-Path: ([EMAIL PROTECTED])

2005-11-18 Thread Matt Kettler
Elton Ramos Carvalho wrote: I`m getting some spams with Return-Path: ([EMAIL PROTECTED]). Return-Path: [EMAIL PROTECTED] Return-Path: [EMAIL PROTECTED] Then I did this rule. header EL_NOBODY_RP Return-Path =~ /[EMAIL PROTECTED]/i describe EL_NOBODY_RP Contém nobody no return path

Re: Avoiding FP on domain fragments?

2005-11-18 Thread Matt Kettler
David Gibbs wrote: Folks: I just got a message that was flagged as spam due to the URIBL_JP_SURBL rule ... it matched on the URI 'range.com' ... my domain, midrange.com, is what triggered it. 3.4 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

Re: collaborative bayes bases

2005-11-18 Thread Kevin W. Gagel
in wiki://BayesInSpamAssassin it is said: Do not train Bayes on different mail streams or public spam corpora. These method will mislead Bayes into believing certain tokens are spammy or hammy when they are not. Could you explain why it is so, and what could happen if to teach nayes from several

Re: [sa-list] Re: OT: Spammers' reactions to rejection

2005-11-18 Thread Kris Deugau
Dan Mahoney, System Admin wrote: Three firewall rules I think nobody should live without: 1) ipfw add 500 allow tcp from any to me 25 limit src-addr 2 setup Yup, you read that right. Limits tcp connections to no more than two per connecting address. You could probably even drop that to

Re: collaborative bayes bases

2005-11-18 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Kevin W. Gagel writes: in wiki://BayesInSpamAssassin it is said: Do not train Bayes on different mail streams or public spam corpora. These method will mislead Bayes into believing certain tokens are spammy or hammy when they are not. Could

Re: Return-Path: ([EMAIL PROTECTED])

2005-11-18 Thread Matt Kettler
Elton Ramos Carvalho wrote: Matt Kettler wrote: Elton Ramos Carvalho wrote: I`m getting some spams with Return-Path: ([EMAIL PROTECTED]). Return-Path: [EMAIL PROTECTED] Return-Path: [EMAIL PROTECTED] Then I did this rule. header EL_NOBODY_RP Return-Path =~ /[EMAIL

Re: OT: Spammers' reactions to rejection

2005-11-18 Thread Vivek Khera
On Nov 17, 2005, at 2:05 PM, Kelson wrote: incoming mail. I turned them back on, unsubscribed from everything for a few months to weed out any legitimate mailing lists that the old users might have subscribed to, and eventually turned them into spam I would vote that these ligitimate

Re: OT: Spammers' reactions to rejection

2005-11-18 Thread Dave Pooser
I would vote that these legitimate mailing list are not so legitimate if they can't clean up bounces after several years of getting them. Legitimate != well-run. -- Dave Pooser Cat-Herder-in-Chief, Pooserville.com In our family, happy usually involves gunfire and at least two patrol cars

test for sql user prefs fails - debug not helpful

2005-11-18 Thread Dale Morin
Hello, OS: RHES 3.0 SA 3.1.0 spamd start options: SPAMDOPTIONS=-d -D -q -x -m5 -H -u qscand --max-conn-per-child=10 spamass-milter 0.3.0 spamass-milter start options: SM_EXTRA_FLAGS=-i xx.xxx.xx.0/24 -r 21 -u qscand -x -- -f -s 64000 Here is the output from running spamd -q -D, then running echo

do not add 'new line' if the description of a _SUMMARY_ line is too long

2005-11-18 Thread Philipp Snizek
Hi I would like to display SA summaries in HTML tables. I have a problem with 'new lines' added of summary items that are too long to fit in one line, e.g. please see the summary below. The description of a test does not fit in one line. URIBL_JP_SURBL Contains an URL listed in the JP SURBL