Re: SORBS bites the dust

2009-06-24 Thread Matus UHLAR - fantomas
> > On Wed, June 24, 2009 13:59, Per Jessen wrote: > >> Blacklisting a large and serious hosting provider is just not serious > >> and very bad for business. > Benny Pedersen wrote: > > http://rfc-ignorant.org/tools/lookup.php?domain=yahoo.com > > http://rfc-ignorant.org/tools/lookup.php?domain=ho

Re: SORBS bites the dust

2009-06-24 Thread rich...@buzzhost.co.uk
On Thu, 2009-06-25 at 09:16 +1000, Res wrote: > On Wed, 24 Jun 2009, rich...@buzzhost.co.uk wrote: > > >> This is wrong. if you have evidence, show it. if not, stop spreading > >> rumours. I have delisted an IP in the past, and I have been watching > >> people trying to delist a block but without

user filtering attachments

2009-06-24 Thread fernando
Hi, I'm trying to find a solution allowing user filtering attachments. My environment uses sql user tables. I was using mimeheader, it works at local.cf but no inside userpref table. Spamassassin shows the rules at debug, but it doesn't work (with allow_user_rules 0 or 1). Do you have any idea h

Re: I have an SA problem with Thunderbird.

2009-06-24 Thread Lee
Steven W. Orr wrote: Is there a way to shut off all spam filtering that thunderbird might want to be doing, but at the same time, allow me to click on a message and then click on the "Junk" button and cause that Junk button to run the sa-learn --spam command on the message? That's a nice idea; i

Re: SA on Windows XP + POP to desktop client?

2009-06-24 Thread Lee
Thanks for the below, René, I think you mentioned SpamAware earlier but I either forgot or I couldn't find it; I'll certainly look into what you've suggested. By the way, you've inspired me to add something I thought about earlier but didn't write: it seems a viable idea for an individual or g

Re: SORBS bites the dust

2009-06-24 Thread Res
On Wed, 24 Jun 2009, rich...@buzzhost.co.uk wrote: This is wrong. if you have evidence, show it. if not, stop spreading rumours. I have delisted an IP in the past, and I have been watching people trying to delist a block but without clues on how to do it... I have to agree with Mouss here. I'v

Re: [sa] Re: SORBS bites the dust

2009-06-24 Thread mouss
Charles Gregory a écrit : > On Wed, 24 Jun 2009, Matus UHLAR - fantomas wrote: >>> somewhat hesitant to use spamcop as our own servers once had a brief >>> listing with them (and it wasn't due to spam). >> Got more info? > > Sadly, we're dealing with my aging memory. :) > > While I cannot remembe

Re: SORBS bites the dust

2009-06-24 Thread James Wilkinson
mouss wrote (about the PBL): > stop spreading FUD. if you know of false positives, show us so that we > see what you exactly mean. > > a lot of people, including $self, use the PBL at smtp time. As usual, it depends on your definition of “false positive”. If you mean “IP address that should not

Re: I have an SA problem with Thunderbird.

2009-06-24 Thread Steven W. Orr
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 06/24/09 16:15, quoth René Berber: > Steven W. Orr wrote: > > [snip] >> What I really want to do is something that TB doesn't seem to support. i.e., >> I >> and lots of other people want the ability to pipe a message to a program. I >> have looked

Re: I have an SA problem with Thunderbird.

2009-06-24 Thread René Berber
Steven W. Orr wrote: [snip] > What I really want to do is something that TB doesn't seem to support. i.e., I > and lots of other people want the ability to pipe a message to a program. I > have looked, lots of people have asked for years, and there seems to be no > addon to provide that capability

Re: SA on Windows XP + POP to desktop client?

2009-06-24 Thread René Berber
Lee wrote: [snip] > I appreciate however those instructions may be aimed at a mindset and > application at server level rather than desktop, but I assume there are > others like me who would love SA's excellent spam filtering in a Windows > desktop email client. [snip] The best choice for this (d

Re: I have an SA problem with Thunderbird.

2009-06-24 Thread RW
On Wed, 24 Jun 2009 19:58:56 +0300 "Jari Fredriksson" wrote: > I do it so, that a cron-job grabs all mail from my confirmed-spam > folder on server, and learns it and reports to dcc, razor and > spamcop. It currently does only the report part, but I think it > learns it as --spam in the same pro

Plugin extracting text from docs (was: new spam using large images)

2009-06-24 Thread Jonas Eckerman
Jason Haar wrote: Speaking of image/rtf/word attachment spam; is there any work going on to standardize this so that the textual output of such attachments could be fed back into SA? Just as a note: I'm currently working on a modular plugin for extracting text and add it to SA message parts.

Re: SORBS bites the dust

2009-06-24 Thread Arvid Picciani
serious hosting providers" - I was thinking more of organisations such as 1and1, hetzner, rackspace etc. etc. whats the issue with hetzner? I'm a customer so i'd be very interested in any spam issue not beeing processed by them.

Re: SORBS bites the dust

2009-06-24 Thread rich...@buzzhost.co.uk
On Wed, 2009-06-24 at 19:00 +0200, Per Jessen wrote: > Benny Pedersen wrote: > 2) I didn't include free email providers in my list of "large and > serious hosting providers" - I was thinking more of organisations such > as 1and1, hetzner, rackspace etc. etc. My special award goes to 1and1. I get

Re: SORBS bites the dust

2009-06-24 Thread Per Jessen
Benny Pedersen wrote: > > On Wed, June 24, 2009 13:59, Per Jessen wrote: >> Blacklisting a large and serious hosting provider is just not serious >> and very bad for business. > > http://rfc-ignorant.org/tools/lookup.php?domain=yahoo.com > http://rfc-ignorant.org/tools/lookup.php?domain=hotmail.

Re: I have an SA problem with Thunderbird.

2009-06-24 Thread Jari Fredriksson
> Spamasassin and retraining a false negative > > What I really want to do is something that TB doesn't > seem to support. i.e., I and lots of other people want > the ability to pipe a message to a program. I have > looked, lots of people have asked for years, and there > seems to be no addon to p

I have an SA problem with Thunderbird.

2009-06-24 Thread Steven W. Orr
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 I tried asking this question on the TB forum, but they're tied up with their own problems right now. I'd like to try here because I frequently get my problems solved. Here is what I posted on the TB help forum. Spamasassin and retraining a false nega

Re: SA on Windows XP + POP to desktop client?

2009-06-24 Thread Lee
Thanks for your further replies on this. It indeed appears what I have now may well currently be the most convenient approach, all things considered. To clarify, when I talk about running the SAwin32 program, what I am actually running on my desktop is SAproxy which is part of the click-and-i

Re: [sa] Re: SORBS bites the dust

2009-06-24 Thread Charles Gregory
On Wed, 24 Jun 2009, Matus UHLAR - fantomas wrote: somewhat hesitant to use spamcop as our own servers once had a brief listing with them (and it wasn't due to spam). Got more info? Sadly, we're dealing with my aging memory. :) While I cannot remember precisely, categorically it was a situati

Re: A difficult one to weed out?

2009-06-24 Thread Roger Marquis
Jeremy Morton wrote: ... cPanel... or any web-based server config software, for that matter. They (unsurprisingly) allow you to do a bunch of basic stuff much more easily, but anything as complex as a DNSBL and you're back to the command line (sometimes with hacks)... DNSBLs aren't that complex

Re: why is some users get maillist mails from a PBL listed ip ? :)

2009-06-24 Thread Benny Pedersen
On Wed, June 24, 2009 14:48, Matus UHLAR - fantomas wrote: > On 24.06.09 14:39, Benny Pedersen wrote: >> X-crabtree-dweezil-us-MailScanner-SpamCheck: spam, SpamAssassin (not >> cached, >> score=30.667, required 5, autolearn=spam, AWL -1.67, BAYES_50 0.00, >> CRM114_PROB_SPAM 0.50, CTYME_

Re: why is some users get maillist mails from a PBL listed ip ? :)

2009-06-24 Thread Matus UHLAR - fantomas
On 24.06.09 14:39, Benny Pedersen wrote: > X-crabtree-dweezil-us-MailScanner-SpamCheck: spam, SpamAssassin (not cached, > score=30.667, required 5, autolearn=spam, AWL -1.67, BAYES_50 0.00, > CRM114_PROB_SPAM 0.50, CTYME_IXHASH 2.50, FH_RELAY_NODNS 1.45, > GENERIC_IXHASH 2.50, KAM_ST

why is some users get maillist mails from a PBL listed ip ? :)

2009-06-24 Thread Benny Pedersen
X-crabtree-dweezil-us-MailScanner-SpamCheck: spam, SpamAssassin (not cached, score=30.667, required 5, autolearn=spam, AWL -1.67, BAYES_50 0.00, CRM114_PROB_SPAM 0.50, CTYME_IXHASH 2.50, FH_RELAY_NODNS 1.45, GENERIC_IXHASH 2.50, KAM_STOCKGEN 1.50, KARMA_CONNECT_NEGATIVE 2.00, R

backscatter source :/

2009-06-24 Thread Benny Pedersen
X-Amavis-PenPals: age 0 0:00:53 Received: from localhost.junc.org ([127.0.0.1]) by localhost.junc.org (localhost.junc.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dBpCCcpNuO0O for ; Wed, 24 Jun 2009 14:15:08 +0200 (CEST) Received: from wash1.inkorgen.com (wash1.inkorgen.

Re: SORBS bites the dust

2009-06-24 Thread Benny Pedersen
On Wed, June 24, 2009 13:59, Per Jessen wrote: > Blacklisting a large and serious hosting provider is just not serious > and very bad for business. http://rfc-ignorant.org/tools/lookup.php?domain=yahoo.com http://rfc-ignorant.org/tools/lookup.php?domain=hotmail.com http://rfc-ignorant.org/tools/l

Re: SORBS bites the dust

2009-06-24 Thread Per Jessen
rich...@buzzhost.co.uk wrote: > Some U.K. providers (such as Fasthosts & Rackspace(UK)) never seem to > get a listing for any of their ranges - which is interesting when you > consider they are probably the largest providers of hosting in the UK > and that Spamhaus hosts with one of them. Blackli

Re: [NEW SPAM FLOOD] www.shopXX.net

2009-06-24 Thread Michelle Konzack
Am 2009-06-22 13:04:49, schrieb Jari Fredriksson: > Well .. > > body AE_MEDS35: /\(\s?w{2,4}\s(meds|shop)\d{1,4}\s(?:net|com|org)\s?)/ ^^ ^^^ Oops, my fault... copied thr wong string... body AE_MEDS35: /\(\s?w{2,4}\s(?

Re: SORBS bites the dust

2009-06-24 Thread Matus UHLAR - fantomas
> On Tue, 23 Jun 2009, mouss wrote: >>> When I did my research for setting up RBL's, I found old comparisons >>> between RBL's that seemed to indicate that the spamhaus PBL and the >>> spamcop lists had slightly higher levels of flase postives. >> stop spreading FUD. if you know of false positives,

Re: SORBS bites the dust

2009-06-24 Thread Matus UHLAR - fantomas
> > 50_scores.cf:score RCVD_IN_SORBS_BLOCK 0 # n=1 n=2 n=3 > > 50_scores.cf:score RCVD_IN_SORBS_DUL 0 1.615 0 0.877 # n=0 n=2 > > 50_scores.cf:score RCVD_IN_SORBS_HTTP 0 0.001 0 0.001 # n=0 n=2 > > 50_scores.cf:score RCVD_IN_SORBS_MISC 0 0.001 0 0.353 # n=0 n=2 > > 50_scores.cf:score RCVD_IN_SORBS_