On Fri, 2007-02-16 at 08:55 -0300, Raul Dias wrote:
What happens when a clueless newbie tries to pass spam?
This happens = http://www.dias.com.br/worst-spam.txt
Regarding Received: from 192.168.0.%RND_DIGIT
I really found this in my quarantine:
Received: from unknown (HELO
Hi, I've been getting quite a few strange messages in my inbox lately,
they look like this: (I'm descring them instead of posting them in
full, because a lot probably already trained them as spam)
Starts with a hi and a call me (always exactly the same), next line
is random, next line talks
Doh, it's easier with some examples, didn't think of posting a link
until I saw another do it in the archives. (sorry for being a newbie :s)
http://www.hp23c.dk/~d/strangespam/
Notice how 3 of the lines stays exactly the same, while 2 are random.
Regards,
Dennis
smime.p7s
Hi!
Is it correct, with Spamassassin 3.1.7 and every Outlook Express
client, FORGED_MUA_OUTLOOK with simple test message?
Score for FORGED_MUA_OUTLOOK is set to 4.1!!
Thanks!
Sim
Example:
Delivered-To: [EMAIL PROTECTED]
Received: (qmail
yeah, it should be all versions *since* 3.1.0 (note that the
original mail was sent 2 years ago).
If you have a more recent mail that falls foul of the rule, open
a bug in the bugzilla and *attach* a sample message that demonstrates
the problem.
--j.
JP Kelly writes:
regarding the problem
C. Bensend wrote:
Perhaps this is trivial, or not desired by anyone else but myself,
but I'd _love_ to be able to strip SpamAssassin tags via spamc and
spamd, instead of having to fire up the full-blown spamassassin
for each message. :)
formail ?
/Per Jessen, Zürich
DAve writes:
Justin Mason wrote:
Theo Van Dinter writes:
I'm assuming that there will be a Google Summer of Code 2007 going on, and
that the ASF will be involved again. So it's a good time to start thinking
about things we'd like to put up as possible projects.
We still have a number of
Matthew Wilson writes:
- Full, tested, supportable multithreaded support
In my experience, perl threading is just not avialable in a reliable,
fast implementation -- this is not viable I'm afraid :(
- Full, tested, supportable support for an asynchronous I/O model (a la
qpsmtpd-async)
A pretty
Mark Martinec writes:
Also, any suggestions from outside the dev team? Anyone got good ideas
for new SpamAssassin features that would be good to pay someone to work on
for 3 months?
Here's another one, to seize the opportunity when internal changes
are being contemplated:
Split the process
Mark Martinec writes:
On Saturday February 17 2007 03:01, Quinn Comendant wrote:
How about an extensive statistics reporting tool, ..., that
can show how well a current spamassassin installation is performing
and where it needs improvements.
Well, not exactly by your words, but in the same
do you mean SA 3.1?
On Apr 14, 2005, at 3:08 PM, Justin Mason wrote:
check the bugzilla -- I'm pretty sure this is fixed for 3.1.0.
- --j.
Received: from 200-102-255-31.smace701.dsl.brasiltelecom.net.br
(200-102-255-31.smace701.dsl.brasiltelecom.net.br
[200.102.255.31]) by
regarding the problem where mail from horde gets hit with
HELO_DYNAMIC_DHCP rule due to sender's IP address.
see below...
do you mean SA 3.1?
On Apr 14, 2005, at 3:08 PM, Justin Mason wrote:
check the bugzilla -- I'm pretty sure this is fixed for 3.1.0.
- --j.
This is the IP from
Doc Schneider writes:
Justin Mason wrote:
Theo Van Dinter writes:
I'm assuming that there will be a Google Summer of Code 2007 going on, and
that the ASF will be involved again. So it's a good time to start thinking
about things we'd like to put up as possible projects.
We still have a
Raul Dias writes:
On Fri, 2007-02-16 at 15:35 +, Justin Mason wrote:
Theo Van Dinter writes:
I'm assuming that there will be a Google Summer of Code 2007 going on, and
that the ASF will be involved again. So it's a good time to start thinking
about things we'd like to put up as
Perhaps this is trivial, or not desired by anyone else but myself,
but I'd _love_ to be able to strip SpamAssassin tags via spamc and
spamd, instead of having to fire up the full-blown spamassassin
for each message. :)
formail ?
That would work in most cases, yes. Unfortunately, not in
Julian Field writes:
Justin Mason wrote:
DAve writes:
Justin Mason wrote:
Theo Van Dinter writes:
I'm assuming that there will be a Google Summer of Code 2007 going on,
and
that the ASF will be involved again. So it's a good time to start
thinking
about things we'd like to put
On Fri, 2007-02-16 at 15:35 +, Justin Mason wrote:
Theo Van Dinter writes:
I'm assuming that there will be a Google Summer of Code 2007 going on, and
that the ASF will be involved again. So it's a good time to start thinking
about things we'd like to put up as possible projects.
actually I think this is already implemented in 3.2.0 -- see
http://issues.apache.org/SpamAssassin/show_bug.cgi?id=4636 for details.
--j.
Raul Dias writes:
On Fri, 2007-02-16 at 15:35 +, Justin Mason wrote:
Theo Van Dinter writes:
I'm assuming that there will be a Google Summer of
Justin Mason wrote:
DAve writes:
Justin Mason wrote:
Theo Van Dinter writes:
I'm assuming that there will be a Google Summer of Code 2007 going on, and
that the ASF will be involved again. So it's a good time to start thinking
about things we'd like to put up as possible
Justin Mason wrote:
DAve writes:
Justin Mason wrote:
Theo Van Dinter writes:
I'm assuming that there will be a Google Summer of Code 2007 going on, and
that the ASF will be involved again. So it's a good time to start thinking
about things we'd like to put up as possible projects.
We still
On Wed, 2007-02-21 at 15:29 +0100, Justin Mason wrote:
actually I think this is already implemented in 3.2.0 -- see
http://issues.apache.org/SpamAssassin/show_bug.cgi?id=4636 for details.
Nice. This patch solves the message part problem.
With this, rules can be written in Unicode too.
A final
Raul Dias writes:
On Wed, 2007-02-21 at 15:29 +0100, Justin Mason wrote:
actually I think this is already implemented in 3.2.0 -- see
http://issues.apache.org/SpamAssassin/show_bug.cgi?id=4636 for details.
Nice. This patch solves the message part problem.
With this, rules can be
On Wed, 21 Feb 2007, Dean Clapper wrote:
Do the emails that I put in the spamtrap have to be in original form? Or, can
I Bounce them from my mail client to [EMAIL PROTECTED]
Bouncing preserves the original form of the message. What you don't
want to do is forward the messages.
Chris St.
following the numerous questions on list, i've gathered that fuzzyocr
is rather popular -- we use it, too.
i've not noticed recent bug-fixing, src dev (~ 1 month), or comments
here, from the dev.
just wondering -- is the proj still alive? dev vacation, maybe? or,
has the proj been subsumed
snowcrash+spamassassin wrote:
following the numerous questions on list, i've gathered that fuzzyocr
is rather popular -- we use it, too.
i've not noticed recent bug-fixing, src dev (~ 1 month), or comments
here, from the dev.
just wondering -- is the proj still alive? dev vacation, maybe? or,
I think hes just busy. AFAIK it is still being worked on.
if true, then certainly fair enough. thanks.
given that image-spam has become such a huge part of the battle, is
that a fuzzyocr should be _in_ the SA project/distribution.
i'm sure there are myriad reasons against it, not the least
May I ask...
Whis is this thread named as such.
Does Google help fund SA efforts in one or multiple ways?
If so, may I ask how or directions to already posted docs on it?
- rh
--
Robert - Abba Communications
Computer Internet Services
(509) 624-7159 - www.abbacomm.net
R Lists06 wrote:
May I ask...
Whis is this thread named as such.
Does Google help fund SA efforts in one or multiple ways?
If so, may I ask how or directions to already posted docs on it?
If you, uh, Google for Google Summer of Code I'm sure you'll find all
you want to know.
Daryl
Because of an NFS bottleneck I'd like to move users' .spamassassin
directories to a local directory such as /var/spool/sa/USERNAME/
Can someone tell me where this path is set?
Thanks,
Rich
On Wed, 2007-02-21 at 17:27 +0100, Justin Mason wrote:
Raul Dias writes:
On Wed, 2007-02-21 at 15:29 +0100, Justin Mason wrote:
actually I think this is already implemented in 3.2.0 -- see
http://issues.apache.org/SpamAssassin/show_bug.cgi?id=4636 for details.
Nice. This patch
On Wed, 21 Feb 2007, R Lists06 wrote:
May I ask...
Whis is this thread named as such.
Does Google help fund SA efforts in one or multiple ways?
If so, may I ask how or directions to already posted docs on it?
- rh
--
Robert - Abba Communications
Yes, if you Goole for Google Summer
Raul Dias writes:
On Wed, 2007-02-21 at 17:27 +0100, Justin Mason wrote:
Raul Dias writes:
On Wed, 2007-02-21 at 15:29 +0100, Justin Mason wrote:
actually I think this is already implemented in 3.2.0 -- see
http://issues.apache.org/SpamAssassin/show_bug.cgi?id=4636 for details.
Yes, if you Goole for Google Summer of Code+spamassassin
you'll get a bunch of relevant hits. ;)
For example, check out:
http://wiki.apache.org/spamassassin/SummerOfCode2006
Thank you
I was hoping for meaningful and relevant info from someone of authority and
in the know from the SA
Jo Rhett wrote:
Can you explain how this isn't an FP in the standard config?
There's absolutely nothing custom about my config, so what
standard are you applying here?
Again, I have a 100% stock SA configuration. Why do I need a
custom rule to work around an FP in the ruleset?
On Feb
On Feb 9, 2007, at 2:53 AM, Matt Kettler wrote:
I just assumed the __RATWARE_0_TZ_DATE half was picking up on the lack
of a valid timezone. It's looking for the timezone to literally be
+, which it is not.
I over-looked that entirely.
Jo, can you check your copy of this rule? The relevant
On Feb 9, 2007, at 7:45 AM, SM wrote:
Blackberry messages will hit the LW_STOCK_SPAM4 rule. There is
nothing wrong with the LW_STOCK_SPAM4 rule as such. The overall
score in a standard configuration with that rule added averages
around two points. It shouldn't cause any false positives
On Feb 9, 2007, at 9:34 AM, Adam Lanier wrote:
On Fri, 2007-02-09 at 09:01 -0800, Jo Rhett wrote:
It's really hard not to be really annoyed with this answer. What
kind of nonsense did you think my question was?
If LW_STOCK_SPAM is a SARE RULE, then I am requesting a revision to
the SARE rule.
Hi,
I wonder if it is posible to change the order in which the tests run.
Specially, I want the test RCVD_IN_BL_SPAMCOP_NET to be tested
firsts and then the others.
Thanks
Oliver
--
Oliver Schulze L. | Get my e-mail after a captcha in:
Asuncion - Paraguay | http://tinymailto.com/oliver
Jo Rhett wrote:
You're making all sorts of claims that I can positively tell you are
wrong. I have *NO* local customizations to SpamAssassin other than
the use of SA-update to retrieve the recommended SARE rules.
That would be the very definition of a local customization.
Just sayin'.
On Wed, Feb 21, 2007 at 05:30:01PM -0300, Oliver Schulze L. wrote:
I wonder if it is posible to change the order in which the tests run.
Specially, I want the test RCVD_IN_BL_SPAMCOP_NET to be tested
firsts and then the others.
You can change rule priority. However it doesn't actually get
Jo Rhett wrote:
If you want a change to a SARE rule, go talk to the SARE people.
I am. They answer questions about the rules on this list, and nowhere
else.
I guess then the [EMAIL PROTECTED] list isn't where SARE helps with
rules... news to me. Since I happen to run that list.
--
in 320.pre, re: ASN, i find,
# ASN - look up the Autonomous System Number of connecting IP
# requires additional configuration, see plugin's POD docs
# loadplugin Mail::SpamAssassin::Plugin::ASN
yet, in
man Mail::SpamAssassin::Plugin::ASN
i read,
Jo Rhett wrote:
And frankly I disagree with the logic that rules that hit wrongly
shouldn't be fixed unless it raises the score about 5.0. I simply
couldn't function with *ANY* of my mailboxes at 5.0 -- I'd be deleting
1-2 pieces of spam per minute. I run my public mailboxes at 3.8 and I'm
Hi Jo,
At 12:36 21-02-2007, Jo Rhett wrote:
However, all blackberry messages also hit base64 text and excess
base64 which puts them right on the edge. Anything that hits any
other rule will cause a problem.
The alternatives are:
1. Fix the rule
2. Lower the score for the rule
3. Remove the
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
We're running SA 3.1.7 with most of the SARE rulesets, including
70_sare_stocks. We're using DCC, Pyzor and Razor. The 'X-SA-Exim-*'
headers are from the source, not us.
Any suggestions as to other tests/checks that could be done to bump the
scores
Great!
So, would you please have a check to FPs produced by these rules:
body __TRUF_1 m'\Wr.+servation\W'i
body __TRUF_2
m'\W(?:carte\s+(?:internationales?\s+)?de\s+cr.+dit|carte\s+bancaire|visa\s+ou\s+mastercard|cr
edit\s+card|bank\s+card)\W'i
meta __TRUF_3
On Feb 21, 2007, at 3:02 PM, Kris Deugau wrote:
- (at least, once Bayes was part of SA g) feed missed spam back
into Bayes manually to complement the autolearning (which worked
pretty well for me, and without which I'd have very VERY little ham
learned at all).
I spent about a year
On Feb 21, 2007, at 3:19 PM, SM wrote:
At 12:36 21-02-2007, Jo Rhett wrote:
However, all blackberry messages also hit base64 text and excess
base64 which puts them right on the edge. Anything that hits any
other rule will cause a problem.
The alternatives are:
1. Fix the rule
2. Lower the
On Feb 21, 2007, at 12:54 PM, Coffey, Neal wrote:
Jo Rhett wrote:
You're making all sorts of claims that I can positively tell you are
wrong. I have *NO* local customizations to SpamAssassin other than
the use of SA-update to retrieve the recommended SARE rules.
That would be the very
Hi Jo,
At 16:17 21-02-2007, Jo Rhett wrote:
The point of sending a note about this to the mailing list is that
this problem will effect *EVERYONE* who gets crackberry messages, and
thus it could probably use a real fix instead of forcing everyone to
fix it locally.
The problem affects people
I received an odd email that makes spamd fall over. I'm using the SAWin32
port, and was wondering whether other users could also see the same problem
with this message or whether the problem is peculiar to the Windows port.
The glaring weirdness with this email is obviously the RSET in the To
Could someone please translate this to n00bese with helpful
suggestions/comments? It doesn't happen with all messages. I just noticed
this while tailing the mail log. THANKS - John
Feb 21 22:26:10 Luke spamd[5590]: spamd: setuid to elizabeth succeeded
Feb 21 22:26:10 Luke spamd[5590]:
Heute (22.02.2007/04:31 Uhr) schrieb John Fleming,
Could someone please translate this to n00bese with helpful
suggestions/comments? It doesn't happen with all messages. I just noticed
this while tailing the mail log. THANKS - John
Feb 21 22:26:10 Luke spamd[5590]: spamd: setuid to
John Fleming wrote:
Could someone please translate this to n00bese with helpful
suggestions/comments? It doesn't happen with all messages. I just
noticed this while tailing the mail log. THANKS - John
Feb 21 22:26:10 Luke spamd[5590]: spamd: setuid to elizabeth succeeded
Feb 21 22:26:10
On Wednesday 21 February 2007, Alexis Manning wrote:
I received an odd email that makes spamd fall over. I'm using the
SAWin32 port, and was wondering whether other users could also see the
same problem with this message or whether the problem is peculiar to
the Windows port.
The glaring
Alexis Manning wrote:
I received an odd email that makes spamd fall over. I'm using the
SAWin32 port, and was wondering whether other users could also see the
same problem with this message or whether the problem is peculiar to
the Windows port.
The glaring weirdness with this email is
Alexis Manning wrote:
I received an odd email that makes spamd fall over. I'm using the
SAWin32 port, and was wondering whether other users could also see the
same problem with this message or whether the problem is peculiar to
the Windows port.
The glaring weirdness with this email is
Great!
So, would you please have a check to FPs produced by these rules:
body __TRUF_1 m'\Wr.+servation\W'i
body __TRUF_2
m'\W(?:carte\s+(?:internationales?\s+)?de\s+cr.+dit|carte\s+bancaire|visa\s+ou\s+mastercard|cr
edit\s+card|bank\s+card)\W'i
meta __TRUF_3
1) are you using bayes_path ?
2) have you set bayes_file_mode 0777 in your local.cf?
If you use bayes_path in a multi-user environment, you *MUST* set
bayes_file_mode 0777 in local.cf.
Also, make sure that /var/.spamassassin has world rwx privileges.
Doesn't this create a potential
R Lists06 wrote:
1) are you using bayes_path ?
2) have you set bayes_file_mode 0777 in your local.cf?
If you use bayes_path in a multi-user environment, you *MUST* set
bayes_file_mode 0777 in local.cf.
Also, make sure that /var/.spamassassin has world rwx privileges.
Doesn't this
At 05:59 PM 2/21/2007, Ben Wylie wrote:
This geezer can't work out how to use his software - he gives us
ever alternative for what he wants to say!
Hello|Hi|Hi there|Good day
I hope|sincerely hope|wish this message finds
However, all blackberry messages also hit base64 text and excess
base64 which puts them right on the edge. Anything that hits any
other rule will cause a problem.
And frankly I disagree with the logic that rules that hit wrongly
shouldn't be fixed unless it raises the score about 5.0.
Evan Platt wrote:
At 05:59 PM 2/21/2007, Ben Wylie wrote:
This geezer can't work out how to use his software - he gives us ever
alternative for what he wants to say!
Hello|Hi|Hi there|Good day
I hope|sincerely hope|wish
Ok so since I am at the mercy of my hosting provider (Media Temple)
to upgrade SA, we are at 3.0.6, I attempted to apply the patch in
bugzilla to Received.pm.
it looks like the patch for SquirrelMail has already been applied so
I just added the lines for the 'Ignores Received header inserted
R Lists06 wrote:
Can you share your specific thought and implementation processes on this re:
possibly going from 3.8 to 3.2 and how and why etc please?
We for one am interested as we are trying to move in that direction too.
It's very simple. Tag messages above your soft limit and put them
At 16:17 21-02-2007, Jo Rhett wrote:
The point of sending a note about this to the mailing list is that
this problem will effect *EVERYONE* who gets crackberry messages, and
thus it could probably use a real fix instead of forcing everyone to
fix it locally.
SM wrote:
The problem affects
Jo Rhett wrote:
And frankly I disagree with the logic that rules that hit wrongly
shouldn't be fixed unless it raises the score about 5.0. I simply
couldn't function with *ANY* of my mailboxes at 5.0 -- I'd be deleting
1-2 pieces of spam per minute. I run my public mailboxes at 3.8 and I'm
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
Jim Knuth wrote:
Heute (22.02.2007/04:31 Uhr) schrieb John Fleming,
Could someone please translate this to n00bese with helpful
suggestions/comments? It doesn't happen with all messages. I just noticed
this while tailing the mail log. THANKS
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
Matt Kettler wrote:
Also, make sure that /var/.spamassassin has world rwx privileges.
Doesn't this create a potential or real giant type security risk?
Well, regardless, the current user SA is running as has to be able to
read and write to
Loren Wilton wrote:
4.He then COMPLAINS that rules are causing him FPs and demands that
the rules be changed.
Your rule is matching against messages which it shouldn't.
5.He THEN claims I am lying and making false assertions when I state
that the rule in question (that I wrote) would
It's very simple. Tag messages above your soft limit and put them in a
different folder. Check the folder periodically for false positives.
Try to identify why they are FP.
Look carefully at all of your normal mail, and confirm where it normally
scores.
Lower your score limit to the
poof!
72 matches
Mail list logo
