Re: Problems with Cyrillic spam

2011-12-14 Thread darxus
On 12/15, Martin Gregorie wrote: > Could somebody with access to the SA Bugzilla kindly add a comment to > bug 4078 saying that this is also an issue with Cyrillic encoded in > UTF-8? I'm asking because at present #4078 only mentions Windows code > pages and koi8. There is nothing to indicate that

Re: Problems with Cyrillic spam

2011-12-14 Thread Martin Gregorie
On Wed, 2011-12-14 at 19:38 -0500, dar...@chaosreigns.com wrote: > On 12/15, Martin Gregorie wrote: > > I'm getting spam with the Subject, Sender personal name and body all > > written in Cyrillic, but, despite having "ok_locales en fr de" defined > > in local.cf, no rules are fired to mark the mes

Re: DNSWL will be disabled by default as of tomorrow

2011-12-14 Thread Noel Butler
On Wed, 2011-12-14 at 11:58 +0100, Matus UHLAR - fantomas wrote: > On 12.12.11 12:58, dar...@chaosreigns.com wrote: > >Tomorrow's sa-update will include disabling of the DNSWL rules. If you > >wish to locally enable them with the same scores which had previously been > >default, use this: > > > >

Re: Problems with Cyrillic spam

2011-12-14 Thread Karsten Bräckelmann
On Thu, 2011-12-15 at 00:09 +, Martin Gregorie wrote: > I'm running SA 3.3.2 and would appreciate knowing how it recognises that > a message contains a language that is not listed as belonging to an OK > locale. It's based on the charset. For obvious reasons, UTF-8 is excluded here. What woul

Re: Problems with Cyrillic spam

2011-12-14 Thread darxus
On 12/15, Martin Gregorie wrote: > I'm getting spam with the Subject, Sender personal name and body all > written in Cyrillic, but, despite having "ok_locales en fr de" defined > in local.cf, no rules are fired to mark the message as being in an > unwanted language. Probably related to this: http

Re: DNS{B,W}Ls and blocking (was Re: DNSWL will be disabled by default as of tomorrow)

2011-12-14 Thread Benny Pedersen
On Wed, 14 Dec 2011 10:18:52 -0500, Kevin A. McGrail wrote: Not quite. We are working on return codes that lead to the end the purposefully wrong answers for DNSBLs so Blocked doesn't mean blackholing the requests. Confusing, I know. yes, its a hell out there in dns world, rbldnsd only suppor

Problems with Cyrillic spam

2011-12-14 Thread Martin Gregorie
I'm getting spam with the Subject, Sender personal name and body all written in Cyrillic, but, despite having "ok_locales en fr de" defined in local.cf, no rules are fired to mark the message as being in an unwanted language. The body text is in two MIME parts, one UTF-8 plaintext and the other c

Re: Using ZMI_GERMAN ruleset

2011-12-14 Thread Michael Monnerie
On Dienstag, 13. Dezember 2011 Axb wrote: > patterns with >120 characters are not really efficient, in terms of > speed and hit rate. They are very specific to certain campaigns and > minimal template changes will render them useless as in: > > body __ZMIde_STOCK34 /Wir sind .{0,2}berzeugt,

Re: Fwd: DNSWL will be disabled by default as of tomorrow

2011-12-14 Thread Kevin A. McGrail
On 12/14/2011 2:11 PM, Sergio wrote: Thank you Kam. You are welcome. And as pointed out by others: score __RCVD_IN_DNSWL 0 might also be needed to actually stop the query. However, DNSWL and SA have been working to implement some rules that let admins know they are blocked without misfirin

Re: Fwd: DNSWL will be disabled by default as of tomorrow

2011-12-14 Thread Sergio
Thank you Kam. Regards, Sergio On Mon, Dec 12, 2011 at 7:37 PM, Kevin A. McGrail wrote: > On 12/12/2011 8:35 PM, Sergio wrote: > >> (in case I don't want to wait until tomorrow) >> What is the best way to dissable DNSWL manually? >> > > Add this to your local.cf and reload spamd (if you use th

Re: DNS{B,W}Ls and blocking (was Re: DNSWL will be disabled by default as of tomorrow)

2011-12-14 Thread Kevin A. McGrail
On 12/14/2011 4:24 AM, Benny Pedersen wrote: On Tue, 13 Dec 2011 09:21:47 -0500, David F. Skoll wrote: I think we need an informational RFC that specifies best-practices for a DNS{B,W}L to inform clients that they have been blocked. good intention, but if dns is blocket there is no result anyw

Question about why we blocked DNSWL

2011-12-14 Thread Kevin A. McGrail
well, same thing hapened with some blacklists in the past, which resulted to high number of FP's. While FNs mean (much/all) mail not to be detected, FP's are uch worse. I wonder why SA disables DNWSL rules, with this logic blacklists, not whitelists, should be disabled... The logic is th

Re: DNS{B,W}Ls and blocking (was Re: DNSWL will be disabled by default as of tomorrow)

2011-12-14 Thread David F. Skoll
On Wed, 14 Dec 2011 10:24:47 +0100 Benny Pedersen wrote: > good intention, but if dns is blocket there is no result anyway so it > does not work If DNS is completely blocked, then there's not much harm done. If a DNSBL returns a hit for any query, then there's a lot of harm done and there shou

Re: DNSWL will be disabled by default as of tomorrow

2011-12-14 Thread Matus UHLAR - fantomas
On 12.12.11 12:58, dar...@chaosreigns.com wrote: Tomorrow's sa-update will include disabling of the DNSWL rules. If you wish to locally enable them with the same scores which had previously been default, use this: score RCVD_IN_DNSWL_NONE -0.0001 score RCVD_IN_DNSWL_LOW -0.7 score RCVD_IN_DNSWL

Re: DNS{B,W}Ls and blocking (was Re: DNSWL will be disabled by default as of tomorrow)

2011-12-14 Thread Benny Pedersen
On Tue, 13 Dec 2011 09:21:47 -0500, David F. Skoll wrote: I think we need an informational RFC that specifies best-practices for a DNS{B,W}L to inform clients that they have been blocked. good intention, but if dns is blocket there is no result anyway so it does not work