Re: The googolbees are getting craftier

2008-01-22 Thread Chr. v. Stuckrad
On Mon, 21 Jan 2008, John D. Hardin wrote: m,https?://(?:[^\./]+\.)*goo+gle(?:pages)?\.(?:[a-z][a-z][a-z]?(?:\.[a-z][a-z])?)/+.*[?](?:btni|adurl),i If I understand that pattern, both the '*' are 'unbounded'??? This might 'break' your spamfilter, if spamassassin gobbles up all memory during

Re: The googolbees are getting craftier

2008-01-22 Thread Karsten Bräckelmann
On Tue, 2008-01-22 at 13:01 +0100, Chr. v. Stuckrad wrote: On Mon, 21 Jan 2008, John D. Hardin wrote: m,https?://(?:[^\./]+\.)*goo+gle(?:pages)?\.(?:[a-z][a-z][a-z]?(?:\.[a-z][a-z])?)/+.*[?](?:btni|adurl),i If I understand that pattern, both the '*' are 'unbounded'??? This might

Odd code at end of spam

2008-01-22 Thread Joseph Brennan
Bank phish in our spam trap ends as follows. Is it just junk, or is it trying to do something? Joseph Brennan Columbia University Information Technology pfont face=Times New Roman, Times, serifThank you for banking with us!/font/p pfont face=Times New Roman, Times,

Re: more efficent big scoring

2008-01-22 Thread George Georgalis
On Sun, Jan 20, 2008 at 09:41:58AM -0800, John D. Hardin wrote: On Sat, 19 Jan 2008, Loren Wilton wrote: I would not be terribly surprised to find out that on average there was no appreciable difference in running all rules of all types in priority order, over the current method; Neither am

Spamd and MySQL userprefs/ AWL/ Bayes

2008-01-22 Thread Rubin Bennett
Hello all... I've spent the past 2 days trying, utterly unsuccessfully, to get spamd to run against a MySQL database. My head is bloody from banging it on the wall, and now I prostrate myself to the mailing list gods in the hopes that you may be able to help me :) I'm running SpamAssassin 3.2.3

Re: The googolbees are getting craftier

2008-01-22 Thread John D. Hardin
On Tue, 22 Jan 2008, Chr. v. Stuckrad wrote: On Mon, 21 Jan 2008, John D. Hardin wrote: m,https?://(?:[^\./]+\.)*goo+gle(?:pages)?\.(?:[a-z][a-z][a-z]?(?:\.[a-z][a-z])?)/+.*[?](?:btni|adurl),i If I understand that pattern, both the '*' are 'unbounded'??? This might 'break' your

Re: more efficent big scoring

2008-01-22 Thread John D. Hardin
On Tue, 22 Jan 2008, George Georgalis wrote: On Sun, Jan 20, 2008 at 09:41:58AM -0800, John D. Hardin wrote: Neither am I. Another thing to consider is the fraction of defined rules that actually hit and affect the score is rather small. The greatest optimization would be to not test REs you

RE: whois plugin .. where to get it

2008-01-22 Thread Chris Santerre
As far as blacklisting entire registrars, can you tell us any registrars that are 100% bad? I can't. Jeff C. Allegedly 100% spam. Innocent until proven guilty, ect. NUCLEAR NAMES, INC. RED PILLAR, INC. MOUZZ INTERACTIVE INC. NAMEVIEW, INC. SOLID HUB, INC. COMPANA, LLC RED

Re: Spamd and MySQL userprefs/ AWL/ Bayes

2008-01-22 Thread Michael Parker
On Jan 22, 2008, at 10:12 AM, Rubin Bennett wrote: WTF am I doing wrong?! Not including debug logs in your message. User prefs does not work with spamassassin, so you won't see anything there, but you should be seeing something for Bayes SQL and AWL SQL if they are configured correctly.

Re: more efficent big scoring

2008-01-22 Thread Justin Mason
John D. Hardin writes: On Tue, 22 Jan 2008, George Georgalis wrote: On Sun, Jan 20, 2008 at 09:41:58AM -0800, John D. Hardin wrote: Neither am I. Another thing to consider is the fraction of defined rules that actually hit and affect the score is rather small. The greatest

Re: more efficent big scoring

2008-01-22 Thread Jim Maul
Justin Mason wrote: John D. Hardin writes: On Tue, 22 Jan 2008, George Georgalis wrote: On Sun, Jan 20, 2008 at 09:41:58AM -0800, John D. Hardin wrote: Neither am I. Another thing to consider is the fraction of defined rules that actually hit and affect the score is rather small. The

Re: more efficent big scoring

2008-01-22 Thread Justin Mason
Jim Maul writes: Justin Mason wrote: John D. Hardin writes: On Tue, 22 Jan 2008, George Georgalis wrote: On Sun, Jan 20, 2008 at 09:41:58AM -0800, John D. Hardin wrote: Neither am I. Another thing to consider is the fraction of defined rules that actually hit and affect the score

Re: more efficent big scoring

2008-01-22 Thread John D. Hardin
John D. Hardin writes: Loren mentioned to me in a private email: common subexpressions. Whoops! Matt Kettler mentioned it to me, not Loren. Sorry! -- John Hardin KA7OHZhttp://www.impsec.org/~jhardin/ [EMAIL PROTECTED]FALaholic #11174 pgpk -a [EMAIL PROTECTED]

Re: Spamd and MySQL userprefs/ AWL/ Bayes

2008-01-22 Thread Rubin Bennett
On Tue, 2008-01-22 at 10:45 -0600, Michael Parker wrote: On Jan 22, 2008, at 10:12 AM, Rubin Bennett wrote: WTF am I doing wrong?! Not including debug logs in your message. User prefs does not work with spamassassin, so you won't see anything there, but you should be seeing

Re: Spamd and MySQL userprefs/ AWL/ Bayes

2008-01-22 Thread Rubin Bennett
On Tue, 2008-01-22 at 19:12 +0100, Alex Woick wrote: Rubin Bennett schrieb am 22.01.2008 17:12: I'm running SpamAssassin 3.2.3 (from Mandriva 2008.0), MySQL 5.0.45, perl-DBD-mysql-4.005, libdbi-drivers-dbd-mysql-0.8.2. What about perl-DBI-*? The libdbi-* drivers are not for perl, they

Re: Spamd and MySQL userprefs/ AWL/ Bayes

2008-01-22 Thread Alex Woick
Rubin Bennett schrieb am 22.01.2008 17:12: I'm running SpamAssassin 3.2.3 (from Mandriva 2008.0), MySQL 5.0.45, perl-DBD-mysql-4.005, libdbi-drivers-dbd-mysql-0.8.2. What about perl-DBI-*? The libdbi-* drivers are not for perl, they are for C programming. For database access to MySQL from

Re: Spamd and MySQL userprefs/ AWL/ Bayes

2008-01-22 Thread Michael Parker
On Jan 22, 2008, at 12:17 PM, Rubin Bennett wrote: On Tue, 2008-01-22 at 10:45 -0600, Michael Parker wrote: On Jan 22, 2008, at 10:12 AM, Rubin Bennett wrote: WTF am I doing wrong?! Not including debug logs in your message. User prefs does not work with spamassassin, so you won't see

Re: more efficent big scoring

2008-01-22 Thread George Georgalis
On Tue, Jan 22, 2008 at 05:24:00PM +, Justin Mason wrote: Jim Maul writes: Justin Mason wrote: John D. Hardin writes: On Tue, 22 Jan 2008, George Georgalis wrote: On Sun, Jan 20, 2008 at 09:41:58AM -0800, John D. Hardin wrote: Neither am I. Another thing to consider is the

Google link spam?

2008-01-22 Thread Mike Yrabedra
Is anyone else getting these google link spams? They all seem to be endowment ad. Like this... Is it small? http://www.gooogle.com/search? Anyone got a rule to kill these? -- Mike B^)

Ruleset load order dependencies

2008-01-22 Thread byrnejb
OS - CentOS-5.1 / Redhat ES5 I am getting messages of this from when I start up SpamAssassin v.3.1.9 from MailScanner v.4.66.5 in --debug-sa mode: info: rules: meta test DIGEST_MULTIPLE has undefined dependency 'RAZOR2_CHECK' info: rules: meta test DIGEST_MULTIPLE has undefined dependency

Re: Ruleset load order dependencies

2008-01-22 Thread Theo Van Dinter
On Tue, Jan 22, 2008 at 05:25:19PM -0800, byrnejb wrote: info: rules: meta test DIGEST_MULTIPLE has undefined dependency 'RAZOR2_CHECK' info: rules: meta test DIGEST_MULTIPLE has undefined dependency 'DCC_CHECK' info: rules: meta test DIGEST_MULTIPLE has undefined dependency 'PYZOR_CHECK'

Re: Google link spam?

2008-01-22 Thread John D. Hardin
On Tue, 22 Jan 2008, Mike Yrabedra wrote: Is anyone else getting these google link spams? Yes, we've been discussing them for the past week. It's a good idea to check the list archives before asking if there are rules for a particular type of spam. http://www.gooogle.com/search?

Re: Ruleset load order dependencies

2008-01-22 Thread Loren Wilton
info: rules: meta test DIGEST_MULTIPLE has undefined dependency 'RAZOR2_CHECK' info: rules: meta test DIGEST_MULTIPLE has undefined dependency 'DCC_CHECK' info: rules: meta test DIGEST_MULTIPLE has undefined dependency 'PYZOR_CHECK' You don't have the DCC plugin enabled, so the DCC_CHECK rule

Re: Ruleset load order dependencies

2008-01-22 Thread byrnejb
No. The problem is that you don't have the modules loaded which would let the rules get defined. The meta dependencies are checked after everything has loaded. -- How do I ensure that the proper modules are loaded and what are they called? -- View this message in context:

Re: Ruleset load order dependencies

2008-01-22 Thread byrnejb
You don't have the DCC plugin enabled, so the DCC_CHECK rule doesn't exist. It is surrounded by #ifplugin lines. OK, I modified v310.pre and I will see if that works -- View this message in context: http://www.nabble.com/Ruleset-load-order-dependencies-tp15032984p15033115.html Sent from

Re: more efficent big scoring

2008-01-22 Thread Loren Wilton
John D. Hardin writes: Loren mentioned to me in a private email: common subexpressions. Whoops! Matt Kettler mentioned it to me, not Loren. Sorry! I was going to mention that I didn't think that had been me. Unless I was asleep when I wrote the reply. Which could have been the case. :-)

Re: more efficent big scoring

2008-01-22 Thread Loren Wilton
maybe if there was some way to establish a hierachy at startup which groups rule processing into nodes. some nodes finish quickly, some have dependencies, some are negative, etc. Just wanted to point out, this topic came out when site dns cache service started to fail due to excessive dnsbl

Re: Ruleset load order dependencies

2008-01-22 Thread Loren Wilton
You don't have the DCC plugin enabled, so the DCC_CHECK rule doesn't exist. It is surrounded by #ifplugin lines. OK, I modified v310.pre and I will see if that works Note that some of the net checks require more setup than simply removing the hash mark from the ifplugin line. You may need

Re: Google link spam?

2008-01-22 Thread McDonald, Dan
On Tue, 2008-01-22 at 17:31 -0800, John D. Hardin wrote: On Tue, 22 Jan 2008, Mike Yrabedra wrote: Is anyone else getting these google link spams? I've not had any complaints about them sneaking past the existing rules. Yes, we've been discussing them for the past week. It's a good

RE: whois plugin .. where to get it

2008-01-22 Thread ram
On Tue, 2008-01-22 at 11:34 -0500, Chris Santerre wrote: As far as blacklisting entire registrars, can you tell us any registrars that are 100% bad? I can't. Jeff C. Allegedly 100% spam. Innocent until proven guilty, ect. NUCLEAR NAMES, INC. RED PILLAR, INC. MOUZZ