Re: List of 700,000 IP addresses of virus infected computers

2007-09-13 Thread Nigel Frankcom
Don't feed the animals ? I must have been dreaming when I saw the post about this and OT posts (said he joining in an OT post)

Unique nigerian spam

2007-09-13 Thread ram
Now we have nigerian spam that actually refers to compensating victims of scam https://ecm.netcore.co.in/tmp/nigerian.txt The spammer is insane. Does he thing a real victim would be foolish enough to fall in his trap again OTOH Unfortunately , this mail went clean thru all my SA-rules ( SA

Re: How to analyze scan time

2007-09-13 Thread ram
On Thu, 2007-09-13 at 00:26 -0400, François Rousseau wrote: Hello, I have recently change my SA server for another really similar server but many software version have change between the 2 servers (include SA 3.1.7 -- 3.2.3) My old server scan the messages much faster (around 3-4 seconds

RE: Unique nigerian spam

2007-09-13 Thread Rob Sterenborg
ram wrote: Now we have nigerian spam that actually refers to compensating victims of scam https://ecm.netcore.co.in/tmp/nigerian.txt The spammer is insane. Does he thing a real victim would be foolish enough to fall in his trap again OTOH Unfortunately , this mail went clean thru all

Re: Suggestion to developers

2007-09-13 Thread Crocomoth
Matt Kettler-3 wrote: SA 3.2.x already does this, you just need to know how. Read the docs on the shortcircuit plugin, and the priority option for rules: Shortcircuit allows you to define when to bail out

RE: Unique nigerian spam

2007-09-13 Thread ram
On Thu, 2007-09-13 at 08:38 +0200, Rob Sterenborg wrote: ram wrote: Now we have nigerian spam that actually refers to compensating victims of scam https://ecm.netcore.co.in/tmp/nigerian.txt The spammer is insane. Does he thing a real victim would be foolish enough to fall in his

Re: Suggestion to developers

2007-09-13 Thread Matt Kettler
Crocomoth wrote: Matt Kettler-3 wrote: SA 3.2.x already does this, you just need to know how. Read the docs on the shortcircuit plugin, and the priority option for rules: Shortcircuit allows you to define when to bail out

Re: spamassassin management by file deletion

2007-09-13 Thread newby 23
Hmm. Do you have shell access? It's not necessary, but it'll make things easier if you do. No, I don't have shell access. I can access the file space by FTP, though. How big are each of those files? auto-whitelist = 0.7MB bayes_journal = 70kB bayes_seen = 0.3MB bayes_toks = 5.3MB

Re: Suggestion to developers

2007-09-13 Thread Crocomoth
Matt Kettler-3 wrote: 1. Using this method, admin must understand that the fate of every message (for all users) will depend from the single rule. Not if you set it up properly.. You can have multiple rules run with a very early priority (low number), then have another one run with a

RE: How to analyze scan time

2007-09-13 Thread Skip
This is probably going to be a stupid question, but how do I go about implementing patches like this? Should this file be copied in place of the file located here?: /usr/lib/perl5/site_perl/5.8.0/Mail/SpamAssassin/ - Skip

Re: How to analyze scan time

2007-09-13 Thread Luis Hernán Otegui
2007/9/13, Skip [EMAIL PROTECTED]: This is probably going to be a stupid question, but how do I go about implementing patches like this? Should this file be copied in place of the file located here?: /usr/lib/perl5/site_perl/5.8.0/Mail/SpamAssassin/ - Skip ASQ (another stupid question):

RE: List of 600,000 IP addresses of virus infected computers

2007-09-13 Thread Rick Cooper
I have noted one FP so far, lists.sophos.com and it was sending the latest new viruses, I get this list a couple times per day on average Rick -Original Message- From: Marc Perkel [mailto:[EMAIL PROTECTED] Sent: Monday, September 10, 2007 1:26 PM To: SpamAssassin Users List

Automatic Deployment

2007-09-13 Thread Rense Buijen
Hi Group, I was wondering, setting up a mailserver with spamassassin and optionaly amavis and/or mailscanner takes a big amount of time if you want to do it right. Is there a system or set of scripts that can speed things up and maybe with some dialoques to configure a debian or redhat box

RE: List of 600,000 IP addresses of virus infected computers

2007-09-13 Thread Rick Cooper
My bad, I had 127.0.0.1 in the blacklist on that host instead of 127.0.0.2 Sorry -Original Message- From: Rick Cooper [mailto:[EMAIL PROTECTED] Sent: Thursday, September 13, 2007 9:03 AM To: 'Marc Perkel'; 'SpamAssassin Users List' Subject: RE: List of 600,000 IP addresses of

Re: Automatic Deployment

2007-09-13 Thread Rick Macdougall
Rense Buijen wrote: Hi Group, I was wondering, setting up a mailserver with spamassassin and optionaly amavis and/or mailscanner takes a big amount of time if you want to do it right. Is there a system or set of scripts that can speed things up and maybe with some dialoques to configure a

RE: How to analyze scan time

2007-09-13 Thread ram
On Thu, 2007-09-13 at 07:33 -0500, Skip wrote: This is probably going to be a stupid question, but how do I go about implementing patches like this? Should this file be copied in place of the file located here?: /usr/lib/perl5/site_perl/5.8.0/Mail/SpamAssassin/ No problems. You could

Re: Automatic Deployment

2007-09-13 Thread ram
On Thu, 2007-09-13 at 15:12 +0200, Rense Buijen wrote: Hi Group, I was wondering, setting up a mailserver with spamassassin and optionaly amavis and/or mailscanner takes a big amount of time if you want to do it right. Is there a system or set of scripts that can speed things up and maybe

Re: List of 600,000 IP addresses of virus infected computers

2007-09-13 Thread Marc Perkel
Yeah - 127.0.0.1 means white listed. :) Rick Cooper wrote: My bad, I had 127.0.0.1 in the blacklist on that host instead of 127.0.0.2

Re: spamassassin management by file deletion

2007-09-13 Thread Kris Deugau
newby 23 wrote: How do I disable AWL? Not sure; check the docs for the version of SA you're using. It *has* changed more than once in the last year or so IIRC. My users_prefs file does not currently have a bayes_expiry_max_db_size option in it. Do I simply add one, setting a smaller

re the 419 scam apologizing for 419 scams

2007-09-13 Thread John D. Hardin
I just got one and it sailed through SA here, too, as it had a 400+Kb JPEG attachment. It seems they are attacking via SA message size limits now. -- John Hardin KA7OHZhttp://www.impsec.org/~jhardin/ [EMAIL PROTECTED]FALaholic #11174 pgpk -a [EMAIL PROTECTED] key:

Re: re the 419 scam apologizing for 419 scams

2007-09-13 Thread Rick Zeman
Guess that's not a throwaway dial up connection then. Wow. I'd think that size would make the cost/benefit analysis skew even further to making a spam run unprofitable as they'd be sending so many fewer before they're shut down. -- Rick Zeman Manager of Information Technology Melwood

Re: Suggestion to developers

2007-09-13 Thread Matt Kettler
Crocomoth wrote: Matt Kettler-3 wrote: 1. Using this method, admin must understand that the fate of every message (for all users) will depend from the single rule. Not if you set it up properly.. You can have multiple rules run with a very early priority (low number), then have

Re: re the 419 scam apologizing for 419 scams

2007-09-13 Thread Bob McClure Jr
On Thu, Sep 13, 2007 at 11:57:23AM -0700, Loren Wilton wrote: Guess that's not a throwaway dial up connection then. Wow. I'd think that size would make the cost/benefit analysis skew even further to making a spam run unprofitable as they'd be sending so many fewer before they're shut down.

Re: Suggestion to developers

2007-09-13 Thread Justin Mason
Matt's generally nailed it. I would say that it should be easy enough to write a plugin which reorders rule priorities into a desired order, then implements the have_shortcircuited plugin hook to return 1 at the desired point... so if anyone feels like trying it out to see if they can make an

Re: spamassassin management by file deletion

2007-09-13 Thread Theo Van Dinter
On Thu, Sep 13, 2007 at 10:24:08AM -0400, Kris Deugau wrote: How do I disable AWL? Not sure; check the docs for the version of SA you're using. It *has* changed more than once in the last year or so IIRC. It's still the same use_auto_whitelist 0, though it's recommended to just not load

Re: Suggestion to developers

2007-09-13 Thread Bart Schaefer
On 9/13/07, Justin Mason [EMAIL PROTECTED] wrote: if anyone feels like trying it out to see if they can make an auto-shortcircuiting plugin which outperforms base SpamAssassin over a mixed corpus of 50:50 nonspam and spam, go for it ;) I dunno about your mail, but if it outperformed base SA

Re: spamassassin management by file deletion

2007-09-13 Thread newby 23
Theo Van Dinter-2 wrote: On Thu, Sep 13, 2007 at 10:24:08AM -0400, Kris Deugau wrote: How do I disable AWL? Not sure; check the docs for the version of SA you're using. It *has* changed more than once in the last year or so IIRC. It's still the same use_auto_whitelist 0, though

Re: FW: List of 700,000 IP addresses of virus infected computers

2007-09-13 Thread jdow
From: Phil Barnett [EMAIL PROTECTED] On Wednesday 12 September 2007, Jason Bertoch wrote: Is there any chance we can get a moderator on this, please? This is clearly not a SA topic and I'm weary of insults, flames, and advertisements from Marc. You guys are almost as good as smurf

Re: FW: List of 700,000 IP addresses of virus infected computers

2007-09-13 Thread jdow
From: jdow [EMAIL PROTECTED] Sent: Thursday, 2007, September 13 14:24 Subject: Re: FW: List of 700,000 IP addresses of virus infected computers From: Phil Barnett [EMAIL PROTECTED] On Wednesday 12 September 2007, Jason Bertoch wrote: Is there any chance we can get a moderator on this,

Re: FW: List of 700,000 IP addresses of virus infected computers

2007-09-13 Thread Phil Barnett
On Thursday 13 September 2007, jdow wrote: And you just fed the troll-chain, yourself, silly person. {^_-} At least I trim my replies... -- Phil Barnett AI4OF SKCC #600

Objective site to run spamcheck against?

2007-09-13 Thread Tuc at T-B-O-H.NET
Hi, An inordinate amount of people are telling me I'm ending up in spam folders, so I wondered if there was some objective site where I might be able to run a message through and have it score an email. I realize this could also be used by spammers to check about getting past the

Re: List of 700,000 IP addresses of virus infected computers

2007-09-13 Thread Meng Weng Wong
me too! hitler! On Sep 13, 2007, at 5:22 PM, Phil Barnett wrote: On Thursday 13 September 2007, jdow wrote: And you just fed the troll-chain, yourself, silly person. {^_-} At least I trim my replies... -- Phil Barnett AI4OF SKCC #600

Re: Objective site to run spamcheck against?

2007-09-13 Thread Jerry Durand
At 05:35 PM 9/13/2007, Tuc at T-B-O-H.NET wrote: Hi, An inordinate amount of people are telling me I'm ending up in spam folders, so I wondered if there was some objective site where I might be able to run a message through and have it score an email. I realize this could also be used

RE: Suggestion to developers

2007-09-13 Thread Michał Jęczalik
On Wed, 12 Sep 2007, Jason Burzenski wrote: How would you account for negative scoring rules? (if your message hit's score=5 it may soon be socre=-2 after a negative scoring rule is applied). It is stupid simple - run them first. :) -- Michał Jęczalik, +48.603.64.62.97 INFONAUTIC,