Re: Scores, razor, and other questions

2009-08-07 Thread Matt Kettler
MySQL Student wrote: > Hi, > > After another day of hacking, I have a handful of general questions > that I hoped you could help me to answer. > > - How can I find the score of a particular rule, without having to use > grep? I'm concerned that I might find it at some score, only for it to > be red

Scores, razor, and other questions

2009-08-07 Thread MySQL Student
Hi, After another day of hacking, I have a handful of general questions that I hoped you could help me to answer. - How can I find the score of a particular rule, without having to use grep? I'm concerned that I might find it at some score, only for it to be redefined somewhere else that I didn't

Re: OT: Nehelam's New HT ability.... and ability to handle spamd high load (preheating cache?)

2009-08-07 Thread Linda Walsh
My bios doesn't allow shutting off HT, but does allow turning off 2 or 3 cores (allowing dual or single) -- I'd rather see that type of feature at runtime - allowing system load to decide whether to activate another core -- though the diff on my 2.6GHZ in power consumption when from about 157 wat

Re: message was forwarded more than the maximum allowed times

2009-08-07 Thread Chris
On Fri, 2009-08-07 at 15:47 -0700, Evan Platt wrote: > At 03:27 PM 8/7/2009, you wrote: > >I sent a spam report to abuse and postmaster at webexmailer.com last > >night. This morning I received this failure message for both abuse and > >postmaster: > > > >Unable to deliver message to the following

Re: Geniuses at expedia.com

2009-08-07 Thread Mike Cappella
On 8/6/09 11:44 PM, Henrik K wrote: Pretty good here.. OVERALLSPAM% HAM% S/ORANK SCORE NAME 024942799550.238 0.000.00 (all messages) 0.676 2.7504 0.02880.990 0.000.01 T_TAB_IN_FROM For some reason all the FPs appeared to come throug

Re: message was forwarded more than the maximum allowed times

2009-08-07 Thread Evan Platt
At 03:27 PM 8/7/2009, you wrote: I sent a spam report to abuse and postmaster at webexmailer.com last night. This morning I received this failure message for both abuse and postmaster: Unable to deliver message to the following recipients, because the message was forwarded more than the maximum

message was forwarded more than the maximum allowed times

2009-08-07 Thread Chris
I sent a spam report to abuse and postmaster at webexmailer.com last night. This morning I received this failure message for both abuse and postmaster: Unable to deliver message to the following recipients, because the message was forwarded more than the maximum allowed times. This could indicate

Re: OT: Nehelam's New HT ability....

2009-08-07 Thread Nix
On 1 Aug 2009, Linda Walsh stated: > > > Per Jessen wrote: >> Not sure about that - AFAICT, it's exactly the same technology. (I >> haven't done in exhaustive tests though). > > > Supposedly 'Very' different (I hope)... Oh yes. I have a P4 here (2GHz Northwood), and two Nehalems (one

Re: Backscatter.org used as RBL??

2009-08-07 Thread Matus UHLAR - fantomas
> Matus UHLAR - fantomas wrote: >> I've read the "sender callouts" page and I don't see any evidence that it >> mentions the SAV problem. On 07.08.09 15:33, Mike Cardwell wrote: > I went to the front page, and then clicked "Sender Callouts" ... The > very first line says: > > "Sendercallouts (Se

Re: [sa] Re: RelayCountry Config

2009-08-07 Thread Martin Gregorie
On Fri, 2009-08-07 at 13:20 -0400, Charles Gregory wrote: > On Fri, 7 Aug 2009, Karsten Bräckelmann wrote: > >>> char > >>> *t="\10pse\0r\0dtu...@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4"; > >>> main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i >>> c<<=1: > >>> (c=*++x); c&128 && (

OT: Signatures and C code that doesn't look like Perl (was: RelayCountry Config)

2009-08-07 Thread Karsten Bräckelmann
On Fri, 2009-08-07 at 13:20 -0400, Charles Gregory wrote: > > > > char > > > > *t="\10pse\0r\0dtu...@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4"; > > > > main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i > > > c<<=1: > > > > (c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ > > >

Re: [sa] Re: RelayCountry Config

2009-08-07 Thread Charles Gregory
On Fri, 7 Aug 2009, Karsten Bräckelmann wrote: char *t="\10pse\0r\0dtu...@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4"; main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}} How did you get line noise from your modem to look so much like perl co

Re: [sa] Re: Backscatter.org used as RBL??

2009-08-07 Thread Charles Gregory
On Fri, 7 Aug 2009, Matus UHLAR - fantomas wrote: I hope those "good" SAV users are also using some good filtering policy (reject machines w/o DNS, machines in blacklists, SPF fails) before they are doing SAV, otherwise they just DoS the victims... (nod) These arguments (on this list :) convinc

Re: Trusted Site

2009-08-07 Thread Jari Fredriksson
> How do I add a mail server as trusted and score it > negative? > > I need to have mail from a specific site not tagged as > spam. I have the domain name and the IP. > > Thanks, > > Wes whitelist_from_rcvd domain IP

Re: Trusted Site

2009-08-07 Thread John Hardin
On Fri, 7 Aug 2009, twofers wrote: How do I add a mail server as trusted and score it negative? ?I need to have mail from a specific site not tagged as spam. I have the domain name and the IP. The best way is to have your MTA recognize mail from that site and not pass it to SA in the first p

Re: Backscatter.org used as RBL??

2009-08-07 Thread Mike Cardwell
Matus UHLAR - fantomas wrote: Do you say that backscatterer list contains IPs of servers that do _not_ send backscatter but are doing SAV? Do you have any proofs about that? The proof is on the front page of http://www.backscatterer.org/ in big red letters: "Every IP which backscatters or do

Re: RelayCountry Config

2009-08-07 Thread Karsten Bräckelmann
> > char > > *t="\10pse\0r\0dtu...@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4"; > > main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i > c<<=1: > > (c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; > > }}} > > How did you get line noise from your modem to loo

Re: Backscatter.org used as RBL??

2009-08-07 Thread Matus UHLAR - fantomas
On 07.08.09 06:55, Marc Perkel wrote: Oh, please, why html only? >> On 06.08.09 15:37, Marc Perkel wrote: >>> This might be an advanced concept for you but what I meant was - >>> deliberately send spam. Everyone doing sender verification is someone >>> who is trying to BLOCK spam, and therefore a

Re: Backscatter.org used as RBL??

2009-08-07 Thread Matus UHLAR - fantomas
> * Matus UHLAR - fantomas : > > On 06.08.09 15:37, Marc Perkel wrote: > > > This might be an advanced concept for you but what I meant was - > > > deliberately send spam. Everyone doing sender verification is someone > > > who is trying to BLOCK spam, and therefore are the good guys. I also

Re: Backscatter.org used as RBL??

2009-08-07 Thread Rick Macdougall
Marc Perkel wrote: What they should do is return different codes to indicate what got them on the list. SAV is not backscatter. So if it is from <> and there is DATA then it's someone who is sending bad bounce messages to faked sender addresses. But if there is nod DATA then it's SAV. These s

Re: Backscatter.org used as RBL??

2009-08-07 Thread Matus UHLAR - fantomas
> Matus UHLAR - fantomas wrote: > >> Do you say that backscatterer list contains IPs of servers that do _not_ >> send backscatter but are doing SAV? Do you have any proofs about that? On 07.08.09 14:37, Mike Cardwell wrote: > The proof is on the front page of http://www.backscatterer.org/ in big

Re: Backscatter.org used as RBL??

2009-08-07 Thread Marc Perkel
Matus UHLAR - fantomas wrote: On 06.08.09 15:37, Marc Perkel wrote: This might be an advanced concept for you but what I meant was - deliberately send spam. Everyone doing sender verification is someone who is trying to BLOCK spam, and therefore are the good guys. I also tr

Re: Backscatter.org used as RBL??

2009-08-07 Thread Mike Cardwell
Matus UHLAR - fantomas wrote: Do you say that backscatterer list contains IPs of servers that do _not_ send backscatter but are doing SAV? Do you have any proofs about that? The proof is on the front page of http://www.backscatterer.org/ in big red letters: "Every IP which backscatters or doe

Re: Backscatter.org used as RBL??

2009-08-07 Thread Ralf Hildebrandt
* Matus UHLAR - fantomas : > On 06.08.09 15:37, Marc Perkel wrote: > > This might be an advanced concept for you but what I meant was - > > deliberately send spam. Everyone doing sender verification is someone > > who is trying to BLOCK spam, and therefore are the good guys. I also > > track

Re: Backscatter.org used as RBL??

2009-08-07 Thread Matus UHLAR - fantomas
On 06.08.09 15:37, Marc Perkel wrote: > This might be an advanced concept for you but what I meant was - > deliberately send spam. Everyone doing sender verification is someone > who is trying to BLOCK spam, and therefore are the good guys. I also > track SAV calls and I use it as a WHITE lis

Trusted Site

2009-08-07 Thread twofers
How do I add a mail server as trusted and score it negative?   I need to have mail from a specific site not tagged as spam. I have the domain name and the IP.   Thanks,   Wes

Re: Geniuses at expedia.com

2009-08-07 Thread Mark Martinec
< header L_TAB_IN_FROM ALL =~ /\nFrom:\t/s -> header L_TAB_IN_FROM From:raw =~ /^\t/m Mark

Re: RelayCountry Config

2009-08-07 Thread RW
On Fri, 7 Aug 2009 00:46:46 -0400 MySQL Student wrote: > Hi, > > > I find ordinary header and meta rules are all I need: > > > > http://pastebin.com/f5e5232d1 > > Among those rules you have: > > meta RELAYCOUNTRY_MED ! RELAYCOUNTRY_HIGH && ( > __RELAYCOUNTRY_AF || __RELAYCOUNTRY_AS |