RE: MISSING_SUBJECT and RATWARE_OUTLOOK_NONAME disappeared from 3.1.x tests?

2007-08-12 Thread Leon Kolchinsky
> They no longer hit enough spam to be worth keeping, so they were removed. > Just remove the scores when you upgrade. > > Loren Thanks, I've suspected that :) Leon

Re: MS outlook can't read parsed email... HELP!!

2007-08-12 Thread Nigel Frankcom
On Sun, 12 Aug 2007 21:52:28 -0700, Evan Platt <[EMAIL PROTECTED]> wrote: >At 08:19 PM 8/12/2007, lynk wrote: > >>I'm totally confused re this spamassassin thingy... i can't seem to get MS >>outlook to read the email i received (spam/ham) after spamassassin(3.1.9) >>scanned the message. > >You pos

Re: MS outlook can't read parsed email... HELP!!

2007-08-12 Thread Evan Platt
At 08:19 PM 8/12/2007, lynk wrote: I'm totally confused re this spamassassin thingy... i can't seem to get MS outlook to read the email i received (spam/ham) after spamassassin(3.1.9) scanned the message. You posted this 2 days ago. If no one answers again, I have two suggestions: First would

rewrite_header To not work for collect spam mail to one account

2007-08-12 Thread tangaish.en
hi,everyone! I want use "rewrite_header To" rewrite the spam mail "rcpt to:" address to one accont named "[EMAIL PROTECTED]", I know there's private problem, but the mail box is for business use only, the user ask administrator(me) to pick up normal mail from spam mark mails, I really hate this wo

So lets change it to "sa-update doesn't"

2007-08-12 Thread Gene Heskett
On Sunday 12 August 2007, Kai Schaetzl wrote: >Gene Heskett wrote on Sat, 11 Aug 2007 23:43:38 -0400: >> 1: sa-update is NOT pulling new PDFInfo.pm or pdfinfo.cf files even when >> they are available. > >of course not! > And why not? They've been announced as available, so one would assume a simp

Re: SA rule for userid in subject?

2007-08-12 Thread Loren Wilton
I was wondering how to modify Lorens rule for the follwing type of emails which I have been getting a lot of: In the subject I get: "some word[s]-userid" or "some word[s]-some word[s]-userid" You aren't too specific about the subject form, and you aren't specific about the To: form. That lea

userid in subject

2007-08-12 Thread jeffsal
I was wondering how to modify Lorens rule for the follwing type of emails which I have been getting a lot of: In the subject I get: "some word[s]-userid" or "some word[s]-some word[s]-userid" > > > > Loren answered that a month ago. Is in the archives. You may use: > > > > header RULE_NA

RE: SA rule for userid in subject?

2007-08-12 Thread jeffsal
I was wondering how to modify Lorens rule for the follwing type of emails which I have been getting a lot of: In the subject I get: "some word[s]-userid" or "some word[s]-some word[s]-userid" > > > > Loren answered that a month ago. Is in the archives. You may use: > > > > header RULE_NAME AL

Re: Dns Resolver problem

2007-08-12 Thread Pawel Sasin
> > I want to be able to make SA rotate DNS servers. > > Apparently that is a limitation of Net::DNS. There was some > discussion of it on-list a few weeks back; I don't clearly remember the > details. > > You might want check the current status of Net::DNS w/r/t fallback, > rotation, etc., and wo

Re: Dns Resolver problem

2007-08-12 Thread Pawel Sasin
> > I want to be able to make SA rotate DNS servers. > > Apparently that is a limitation of Net::DNS. There was some > discussion of it on-list a few weeks back; I don't clearly remember the > details. > > You might want check the current status of Net::DNS w/r/t fallback, > rotation, etc., an

Re: Detecting short-TTL domains?

2007-08-12 Thread Steve Freegard
[ repost: obfusicating domains to avoid the apache.org SMTP filter... ] Hi John, John Rudd wrote: I'm a prophet now!? :-) Hm. So, I'm sure I can figure this out eventually, but does anyone know the right Net::DNS way to extract the TTL? I could probably set it up as a value in Botnet.cf,

Re: SOLVED: How can I write my own plugins?

2007-08-12 Thread Paul Lenz
"John D. Hardin" <[EMAIL PROTECTED]> wrote: > > After "chmod 777" the logfile, > > Bad practice. I know. I did this only to make the logfile working for a short time. Since I know that my plugin works, I deleted the logfile. Paul Lenz

Re: SOLVED: How can I write my own plugins?

2007-08-12 Thread John D. Hardin
On Sun, 12 Aug 2007, Paul Lenz wrote: > After "chmod 777" the logfile, Bad practice. Bad practice. Please don't develop the habit of reflexively "chmod 777"ing things. I dealt with that from my firm's support department for five years and I still have the twitch. (1) It completely turns o

Re: Detecting short-TTL domains?

2007-08-12 Thread Jeff Chan
Quoting Kai Schaetzl <[EMAIL PROTECTED]>: > Thomas Raef wrote on Sun, 12 Aug 2007 06:19:43 -0500: > > > a dnsbl is the way to go. > > On first look I disagree. We already have SURBL and URIBL. I don't see how > this would add any benefit on top of that. We are talking about URI's in > mail, not ab

RE: Detecting short-TTL domains?

2007-08-12 Thread Thomas Raef
Yes you are correct. I got so focused on the improper identification of fast-flux that I lost sight of the details. I stand, maybe not corrected, but at least with a broader understanding of the real issue. There must be some way of better identifying these domains in a URI. Thank you for poin

Re: Detecting short-TTL domains?

2007-08-12 Thread Kai Schaetzl
Kai Schaetzl wrote on Sun, 12 Aug 2007 14:31:15 +0200: > SA is all about storing SA is all about *scoring* Kai -- Kai Schätzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.conactive.com

I send 5 million spams a day

2007-08-12 Thread Marc Perkel
But I send them to people who are building public blocklists. I've expanded my delivery system so I can keep up with the load. If anyone out there is running a public black lists and wants a free feed contact me privately and I'll set it up. I have 2 main feeds. One is mostly messages determin

Re: some of you have bad meta rules...

2007-08-12 Thread Justin Mason
Loren Wilton writes: > Ok. Sounds like they removed some base rules we were depending on. Maybe > time to remove those rules based on them, or recreate the base rules as our > own. Feel free to recreate them; 3.2.x will efficiently merge duplicates anyway so it won't have any runtime effect.

Re: Detecting short-TTL domains?

2007-08-12 Thread Kai Schaetzl
Thomas Raef wrote on Sun, 12 Aug 2007 06:19:43 -0500: > a dnsbl is the way to go. On first look I disagree. We already have SURBL and URIBL. I don't see how this would add any benefit on top of that. We are talking about URI's in mail, not about hostnames of mailservers or email adresses. The o

Re: How can I write my own plugins?

2007-08-12 Thread Kai Schaetzl
Paul Lenz wrote on Sun, 12 Aug 2007 12:23:52 +0300: > PS. Sorry for multiple postings, I only saved my message during > editing, but it seems to be sent every time BTW, it looks like you are using an outdated version of your mail client, upgrade! Kai -- Kai Schätzl, Berlin, Germany Get your

SOLVED: How can I write my own plugins?

2007-08-12 Thread Paul Lenz
"Alex Woick" <[EMAIL PROTECTED]> wrote: > This is already very good. You have it. That text is the text > of the internal test message that is processed on every > SpamAssassin startup or --lint. Ah! It does not come from an email, only from the startup! Now I got it. I stored the log file in

Re: How can I write my own plugins?

2007-08-12 Thread Alex Woick
Paul Lenz wrote on 12.08.2007 11:23: Actually I write Perl programs since many years, but I am not so familiar with the object oriented programming and I can not discover the secrets of Spamassassin. Contretely: I was not able to access the body of a mail. You should consult "man perltoot" fir

RE: Detecting short-TTL domains?

2007-08-12 Thread Thomas Raef
I agree. To catch the fast-flux servers you have to check not only low ttl values but ALSO how frequently the IP addresses assigned to that domain change. I think everyone is looking for a fast fast-flux fix. I believe, and this is just my opinion, that a dnsbl is the way to go. That way if the pe

Re: How can I write my own plugin?

2007-08-12 Thread jdow
From: "Paul Lenz" <[EMAIL PROTECTED]> Actually I write Perl programs since many years, but I am not so familiar with the object oriented programming and I can not discover the secrets of Spamassassin. Contretely: I was not able to access the body of a mail. I included Plugin\Test.pm into my con

Re: How can I write my own plugins?

2007-08-12 Thread jdow
From: "Paul Lenz" <[EMAIL PROTECTED]> PS. Sorry for multiple postings, I only saved my message during editing, but it seems to be sent every time :( Control-S save draft. Alt-S send. Easy way to make the mistake. Control-Enter is an instant send, which is annoying when you fat finger and hit

Re: rule for empty text + GIF or PDF ?

2007-08-12 Thread Kai Schaetzl
Gene Heskett wrote on Sat, 11 Aug 2007 23:43:38 -0400: > 1: sa-update is NOT pulling new PDFInfo.pm or pdfinfo.cf files even when they > are available. of course not! > 2: spamassassin --lint -D ignores these rules when we install them by hand. which means you probably haven't installed PDFInf

Re: Detecting short-TTL domains?

2007-08-12 Thread Kai Schaetzl
John D. Hardin wrote on Sat, 11 Aug 2007 18:21:35 -0700 (PPT): > I think there was some consensus about using that in concert with an > excessive number of A records as a spam sign. Check the thread > history. I don't think anyone is suggesting by itself it's a useful > indicator. This is what I

How can I write my own plugin?

2007-08-12 Thread Paul Lenz
Actually I write Perl programs since many years, but I am not so familiar with the object oriented programming and I can not discover the secrets of Spamassassin. Contretely: I was not able to access the body of a mail. I included Plugin\Test.pm into my configuration: loadplugin Mail::SpamAss

How can I write my own plugins?

2007-08-12 Thread Paul Lenz
Actually I write Perl programs since many years, but I am not so familiar with the object oriented programming and I can not discover the secrets of Spamassassin. Contretely: I was not able to access the body of a mail. I included Plugin\Test.pm into my configuration: loadplugin Mail::SpamAss

How to write my own plugin

2007-08-12 Thread Paul Lenz
Actually I write Perl programs since many years, but I am not so familiar with the object oriented programming and I can not discover the secrets of Spamassassin. Contretely: I was not able to access the body of a mail. I included Plugin\Test.pm into my configuration and gave it a score of 0.1. Th

How to write my own plugin

2007-08-12 Thread Paul Lenz
Actually I write Perl programs since many years, but I am not so familiar with the object oriented programming and I can not discover the secrets of Spamassassin. Contretely: I was not able to access the body of a mail. I included Plugin\Test.pm into my configuration and gave it a score of 0.1. Th