Re: dealing with mail not yet listed in network tests

2014-11-14 Thread Matus UHLAR - fantomas
On Fri, 14 Nov 2014, Miles Fidelman wrote: Actually, the OPs notion is an interesting one. From the point of view of someone who administers a lot of systems and mailing lists, I end up getting multiple copies of lots of messages. I've been thinking for a while about how to implement anti-s

Re: Missing Modules

2014-11-14 Thread Reindl Harald
Am 14.11.2014 um 20:44 schrieb Axb: I don't use SA's SPF stuff so you caught me here... My repoforge suggestion was mainly for Centos 5.x I'd go for http://dl.fedoraproject.org/pub/epel/6/x86_64/perl-Mail-SPF-2.8.0-2.el6.noarch.rpm It installs without extra dependencies and plays nice with t

Re: Missing Modules

2014-11-14 Thread Axb
On 11/14/2014 08:18 PM, Niamh Holding wrote: Hello Axb, Thursday, November 13, 2014, 2:21:44 PM, you wrote: If you need need extra modules which are not provided by Centos go to http://pkgs.repoforge.org/ Just looking, so don't shoot me but http://pkgs.repoforge.org/perl-Mail-SPF/ has noth

Re: Missing Modules

2014-11-14 Thread Niamh Holding
Hello Axb, Thursday, November 13, 2014, 2:21:44 PM, you wrote: > If you need need extra modules which are not provided by Centos go to > http://pkgs.repoforge.org/ Just looking, so don't shoot me but http://pkgs.repoforge.org/perl-Mail-SPF/ has nothing listed later than CentOS 5 PS I hate hot

Re: SOUGHT 2.0 ?

2014-11-14 Thread Noah Meyerhans
On Thu, Nov 13, 2014 at 02:08:30PM +0100, Axb wrote: > >>As Alex has said there's a need for mirrors etc. - that could > >>potentially be the biggest impact on volunteers (assuming they offer > >>to help with that aspect) since they will be a more public facing > >>contribution and it would be grea

Re: dealing with mail not yet listed in network tests

2014-11-14 Thread David F. Skoll
On Fri, 14 Nov 2014 18:24:05 +0100 Matus UHLAR - fantomas wrote: > >I have an experimental botnet detector that looks for multiple > >messages with similar subjects that come from many different > >countries (as determined by geolocating the relay IP.) > isn't this what DCC is about? Similar id

Re: dealing with mail not yet listed in network tests

2014-11-14 Thread John Hardin
On Fri, 14 Nov 2014, listsb-spamassas...@bitrate.net wrote: one characteristic that appears to be pretty consistent is the age of the domain name that a given message references [from header, envelope sender, ptr record for remote mailservers referenced in received headers, etc]. quite often,

Re: dealing with mail not yet listed in network tests

2014-11-14 Thread John Hardin
On Fri, 14 Nov 2014, Miles Fidelman wrote: Actually, the OPs notion is an interesting one. From the point of view of someone who administers a lot of systems and mailing lists, I end up getting multiple copies of lots of messages. I've been thinking for a while about how to implement anti-sp

Re: dealing with mail not yet listed in network tests

2014-11-14 Thread John Hardin
On Fri, 14 Nov 2014, Reindl Harald wrote: if they would have that much ressources postscreen even without RBL's would not be that effective because they don't wait until their turn to speak most of the time and so have no chance for delivery - the 13407 pregreets this month are "hurry up i hav

Re: dealing with mail not yet listed in network tests

2014-11-14 Thread Matus UHLAR - fantomas
On Fri, 14 Nov 2014 07:45:49 -0500 Miles Fidelman wrote: From the point of view of someone who administers a lot of systems and mailing lists, I end up getting multiple copies of lots of messages. I've been thinking for a while about how to implement anti-spam rules based on receiving multiple

.red

2014-11-14 Thread Axb
untested.. unscored uri AXB_URI_SHADESOF_RED m{http://[a-z0-9]{5,15}\.red/} or if you need a bazooka if (version >= 3.004000) blacklist_uri_host red endif

Re: dealing with mail not yet listed in network tests

2014-11-14 Thread Reindl Harald
Am 14.11.2014 um 17:11 schrieb listsb-spamassas...@bitrate.net: one characteristic that appears to be pretty consistent is the age of the domain name that a given message references [from header, envelope sender, ptr record for remote mailservers referenced in received headers, etc]. quite

Re: dealing with mail not yet listed in network tests

2014-11-14 Thread listsb-spamassassin
> On Nov 14, 2014, at 00.35, John Hardin wrote: > > On Thu, 13 Nov 2014, listsb-spamassas...@bitrate.net wrote: > >> all of the emotional postulative opining aside, one possibility i have been >> considering is having postfix delay relay of messages to the content filter >> for a few minutes,

Re: dealing with mail not yet listed in network tests

2014-11-14 Thread David F. Skoll
On Fri, 14 Nov 2014 14:58:46 +0100 Reindl Harald wrote: [David] > > I don't agree with that contention. Botnet operators have so many > > resources at their disposal that I doubt they care about or even > > notice any sort of delaying or tarpitting. [Harald] > they don't because they have not m

Re: dealing with mail not yet listed in network tests

2014-11-14 Thread Reindl Harald
Am 14.11.2014 um 14:43 schrieb David F. Skoll: On Fri, 14 Nov 2014 13:35:34 +0100 Reindl Harald wrote: *but* it makes a ton of troubles for large *legit* sending clusters which often after a 4xx reject handover that mail to a different node and so get again a 4xx With very little loss of e

Re: dealing with mail not yet listed in network tests

2014-11-14 Thread David F. Skoll
On Fri, 14 Nov 2014 13:35:34 +0100 Reindl Harald wrote: > *but* it makes a ton of troubles for large *legit* sending clusters > which often after a 4xx reject handover that mail to a different node > and so get again a 4xx With very little loss of effectiveness, you can modify the algorithm so

Re: dealing with mail not yet listed in network tests

2014-11-14 Thread David F. Skoll
On Fri, 14 Nov 2014 07:45:49 -0500 Miles Fidelman wrote: > From the point of view of someone who administers a lot of systems > and mailing lists, I end up getting multiple copies of lots of > messages. I've been thinking for a while about how to implement > anti-spam rules based on receiving mu

Re: dealing with mail not yet listed in network tests

2014-11-14 Thread Miles Fidelman
Actually, the OPs notion is an interesting one. From the point of view of someone who administers a lot of systems and mailing lists, I end up getting multiple copies of lots of messages. I've been thinking for a while about how to implement anti-spam rules based on receiving multiple copies

Re: dealing with mail not yet listed in network tests

2014-11-14 Thread Reindl Harald
Am 14.11.2014 um 13:04 schrieb David F. Skoll: On Fri, 14 Nov 2014 08:39:13 +0100 Matthias Leisi wrote: On Fri, Nov 14, 2014 at 6:35 AM, John Hardin wrote: if you're in a business environment you may have an uphill battle with managing expectations, to wit: email is *not* intended to be i

Re: dealing with mail not yet listed in network tests

2014-11-14 Thread David F. Skoll
On Fri, 14 Nov 2014 08:39:13 +0100 Matthias Leisi wrote: > On Fri, Nov 14, 2014 at 6:35 AM, John Hardin > wrote: > > if you're in a business environment you may have an uphill battle > > with managing expectations, to wit: email is *not* intended to be > > instant messaging - and may run up aga

Re: Missing Modules

2014-11-14 Thread Giles Coochey
On 14/11/2014 11:26, Matus UHLAR - fantomas wrote: On 13.11.14 14:34, Giles Coochey wrote: I avoid the distribution perl completely, and use perlbrew and spamassassin 3.4.0 compiled from source, with a specific perlbrew perl version I avoid breaking the version of perl that comes with the syst

Re: Missing Modules

2014-11-14 Thread Matus UHLAR - fantomas
On 13.11.14 14:34, Giles Coochey wrote: I avoid the distribution perl completely, and use perlbrew and spamassassin 3.4.0 compiled from source, with a specific perlbrew perl version I avoid breaking the version of perl that comes with the system and can satisfy all dependencies via CPAN. how