Re: new paradigm

2011-11-28 Thread Emmanuel Seyman
* Benny Pedersen [25/11/2011 17:54] : > > maillists often not remove originating sender addr, if thay did how > can i get all that private emails orinating from maillists ? I believe that rh is suggesting not to put email adresses in the body of your mail if you're replying to a mailing-list. Mos

Re: Question for experts....

2011-11-28 Thread RW
On Sun, 27 Nov 2011 22:43:00 +0100 Thierry Besancon wrote: > On 2011-11-27 13:26:43, jdow wrote: > > Which browser(s) treat addresses of the form > > 178.000235.150.000372 as actual addresses? That seems like a > > serious fault in the browsers. > > According to C standards, a number beginnin

Re: Has the effect of '__' changed recently?

2011-11-28 Thread RW
On Sun, 27 Nov 2011 15:27:53 -0600 (CST) Dave Funk wrote: > On Sun, 27 Nov 2011, RW wrote: > > > If you actually want give a score to a hidden rule (to see whether > > it's being hit), I would do it this way: > > > > metaBAR __FOO > > score BAR 0.001 > > > > Another way to

What is the best RBL list?

2011-11-28 Thread Sergio
Hi, in your opinion, what it will be the best RBL Anti Spam list that could not be left in a server, payed or free? My server is an small server with a few accounts, but it seems that my RBLs are not the best ones and I will like to have your inputs in which ones I will need to relay on. Best Reg

Re: What is the best RBL list?

2011-11-28 Thread darxus
On 11/28, Sergio wrote: >in your opinion, what it will be the best RBL Anti Spam list that could >not be left in a server, payed or free? All the best known RBLs are enabled in spamassassin by default. You may get more useful suggestions if you provide several example spam emails using so

Re: What is the best RBL list?

2011-11-28 Thread Daniel McDonald
On 11/28/11 12:55 PM, "dar...@chaosreigns.com" wrote: > On 11/28, Sergio wrote: >>in your opinion, what it will be the best RBL Anti Spam list that could >>not be left in a server, payed or free? > > All the best known RBLs are enabled in spamassassin by default. > > If there are be

Re: What is the best RBL list?

2011-11-28 Thread Robert Schetterer
Am 28.11.2011 20:17, schrieb Daniel McDonald: > > > > On 11/28/11 12:55 PM, "dar...@chaosreigns.com" > wrote: > >> On 11/28, Sergio wrote: >>>in your opinion, what it will be the best RBL Anti Spam list that could >>>not be left in a server, payed or free? >> >> All the best known RBLs

Re: What is the best RBL list?

2011-11-28 Thread Chris Owen
On Nov 28, 2011, at 1:17 PM, Daniel McDonald wrote: > The best RBLS for getting rid of snow-shoe spammers are from Invaluement, > but it is avaiable by subscription only. I don't know if Rob McEwen > has any interest in running it through GA... But the subscription rates are very reasonable com

Re: Question for experts....

2011-11-28 Thread jdow
On 2011/11/28 05:43, RW wrote: On Sun, 27 Nov 2011 22:43:00 +0100 Thierry Besancon wrote: On 2011-11-27 13:26:43, jdow wrote: Which browser(s) treat addresses of the form 178.000235.150.000372 as actual addresses? That seems like a serious fault in the browsers. According to C standards,

Re: Question for experts....

2011-11-28 Thread darxus
On 11/28, jdow wrote: > >>>Which browser(s) treat addresses of the form > >>>178.000235.150.000372 as actual addresses? That seems like a If you have multiple emails with this pattern that spamassassin is not catching, please provide them via something like pastebin. We can create rules to ma

Re: Question for experts....

2011-11-28 Thread jdow
On 2011/11/28 14:36, dar...@chaosreigns.com wrote: On 11/28, jdow wrote: Which browser(s) treat addresses of the form 178.000235.150.000372 as actual addresses? That seems like a If you have multiple emails with this pattern that spamassassin is not catching, please provide them via someth

using thunderbird - or other client - junk control data

2011-11-28 Thread Tim
In the recent discussion someone suggested using the junk data that Thunderbird or other email client that have a learning mechanism to make rules for spamassassin. Has anyone done or looked into what it would take to do this. I imagine it would be quite expensive processor wise. But Thunder

Re: Question for experts....

2011-11-28 Thread C. Bensend
> Why bug such people unless their product IS vulnerable? Note that this > seems > to be an email trying to get people who have a "vulnerable" browser to > click > a specific link. I'd expect that link to be loaded with a zero day or the > likes that the browser exhibits. > > I figured people here

Re: Question for experts....

2011-11-28 Thread jdow
On 2011/11/28 17:05, C. Bensend wrote: Why bug such people unless their product IS vulnerable? Note that this seems to be an email trying to get people who have a "vulnerable" browser to click a specific link. I'd expect that link to be loaded with a zero day or the likes that the browser exhib

Re: Question for experts....

2011-11-28 Thread C. Bensend
>> I guess I'm confused why you think this is a vulnerability... It's >> simply another way to represent an IP address that browsers grok. >> Is it obfuscation? Sure. But hell, for the average internet user, >> a NON-obfuscated IP address is cryptic enough. ;) This is just >> another way to d

Re: Question for experts....

2011-11-28 Thread jdow
On 2011/11/28 17:49, C. Bensend wrote: I guess I'm confused why you think this is a vulnerability... It's simply another way to represent an IP address that browsers grok. Is it obfuscation? Sure. But hell, for the average internet user, a NON-obfuscated IP address is cryptic enough. ;) Th

Re: Question for experts....

2011-11-28 Thread Jason Haar
Don't have an answer for you, but I can say that the following URL works under FF-8.0 http://0x12.0x12.0x12.0x12/ (resolves to 18.18.18.18) However, if you force browsers through a squid proxy, squid-2.6 at least treats that as borked and won't play with it. So even proxies are out of step with

Re: Question for experts....

2011-11-28 Thread Martin Gregorie
On Mon, 2011-11-28 at 18:35 -0800, jdow wrote: > It is a way of obfuscating that's over the top and nobody has a way to > get those oddball formulations easily from standard tools. They become > an excellent way of leading people to strange addresses with strings > that include ?ASFDikmedsfok3l1ma

Re: Question for experts....

2011-11-28 Thread Benny Pedersen
On Tue, 29 Nov 2011 16:21:56 +1300, Jason Haar wrote: http://0x12.0x12.0x12.0x12/ does not work in chrome they're http://0x12.0x12.com/ or the like! is working as clickbar, maybe 0x12 is not a valid tld ?

Re: Question for experts....

2011-11-28 Thread Dave Warren
On 11/28/2011 7:37 PM, Martin Gregorie wrote: On Mon, 2011-11-28 at 18:35 -0800, jdow wrote: It is a way of obfuscating that's over the top and nobody has a way to get those oddball formulations easily from standard tools. They become an excellent way of leading people to strange addresses with

Re: Question for experts....

2011-11-28 Thread Dave Warren
On 11/28/2011 7:41 PM, Benny Pedersen wrote: On Tue, 29 Nov 2011 16:21:56 +1300, Jason Haar wrote: http://0x12.0x12.0x12.0x12/ does not work in chrome I tried in Chrome 16.0.912.41 beta-m and 17.0.953.0 canary, both instantly changed the displayed URL to "18.18.18.18" then timed out tryin

Re: Question for experts....

2011-11-28 Thread John Hardin
On Tue, 29 Nov 2011, Martin Gregorie wrote: On Mon, 2011-11-28 at 18:35 -0800, jdow wrote: It is a way of obfuscating that's over the top and nobody has a way to get those oddball formulations easily from standard tools. They become an excellent way of leading people to strange addresses with

Re: Question for experts....

2011-11-28 Thread John Hardin
On Mon, 28 Nov 2011, John Hardin wrote: firefox 8.0: Error: Firefox can't establish a connection to the server at 0012.0012.0012.0012. That appears to have been an artifact of randomly choosing 12, which maps to the 10-net and falls afoul of my local network setup. http://00200.00200.00200

Re: Question for experts....

2011-11-28 Thread Benny Pedersen
On Mon, 28 Nov 2011 20:21:23 -0800, Dave Warren wrote: I tried in Chrome 16.0.912.41 beta-m and 17.0.953.0 canary, both instantly changed the displayed URL to "18.18.18.18" then timed out trying to browse. yep, if i add this ip it gives error in 15.x.x.x chrome dont know how to make chrome as

A SpamAssassin Crash Course for Admins

2011-11-28 Thread antiamoeba
Hi, I'm currently working on a crash course for administrators as part of Google Code-in. I would really appreciate it if you could provide any feedback for this project. This is still a big work in process and multiple definitions still need to be added/revised. Please let me know if you have any

Re: A SpamAssassin Crash Course for Admins

2011-11-28 Thread Patrick Ben Koetter
* Dorian Chan : > Sorry, I don't really think the nabble attachment option really worked, so > I'll actually attach it. Sorry for that! It worked both times, but the document is almost unreadable because its filled with comments. Can you post a clean version? p@rick -- state of mind () Digitale