Re: FPs on FORGED_MUA_MOZILLA (for my own hand-typed messages from my latest-version Thunderbird)

2018-10-02 Thread Dave Warren
> On Oct 2, 2018, at 13:49, Bill Cole > wrote: > > On 2 Oct 2018, at 13:39, Matus UHLAR - fantomas wrote: > >>> On 2 Oct 2018, at 9:36, Rob McEwen wrote: SIDE NOTE: I don't think there was any domain my message that was blacklisted on URIBL - so I can't explain the "URIBL_BLOCKED",

Re: FPs on FORGED_MUA_MOZILLA (for my own hand-typed messages from my latest-version Thunderbird)

2018-10-02 Thread Bill Cole
On 2 Oct 2018, at 13:39, Matus UHLAR - fantomas wrote: On 2 Oct 2018, at 9:36, Rob McEwen wrote: SIDE NOTE: I don't think there was any domain my message that was blacklisted on URIBL - so I can't explain the "URIBL_BLOCKED", but that only scored 0.001, so that was innocuous. I suspect that th

Re: FPs on FORGED_MUA_MOZILLA (for my own hand-typed messages from my latest-version Thunderbird)

2018-10-02 Thread John Hardin
On Tue, 2 Oct 2018, Matus UHLAR - fantomas wrote: On 2 Oct 2018, at 9:36, Rob McEwen wrote: SIDE NOTE: I don't think there was any domain my message that was blacklisted on URIBL - so I can't explain the "URIBL_BLOCKED", but that only scored 0.001, so that was innocuous. I suspect that that ru

Re: FPs on FORGED_MUA_MOZILLA (for my own hand-typed messages from my latest-version Thunderbird)

2018-10-02 Thread Matus UHLAR - fantomas
On 10/2/2018 9:59 AM, Matus UHLAR - fantomas wrote: can you post the headers? or at least the Message-Id? On 02.10.18 11:07, Rob McEwen wrote: Here is the message as THEIR system saw it (with my client's info masked)  - but it looks like their Kerio (or the customer's email client?) might be

Re: FPs on FORGED_MUA_MOZILLA (for my own hand-typed messages from my latest-version Thunderbird)

2018-10-02 Thread Matus UHLAR - fantomas
On 2 Oct 2018, at 9:36, Rob McEwen wrote: SIDE NOTE: I don't think there was any domain my message that was blacklisted on URIBL - so I can't explain the "URIBL_BLOCKED", but that only scored 0.001, so that was innocuous. I suspect that that rule is malfunctioning on their end, and then they ch

Re: iXhash service issues

2018-10-02 Thread sebast...@debianfan.de
Soweit ich das richtig verstanden habe, ist http://www.dnsbl.manitu.net/ der „inhaltliche Nachfolger“ dieser Liste oder ? Gruß Sebastian > Am 02.10.2018 um 14:37 schrieb Jakob Hirsch : > > Hi, > >> On 2018-09-30 18:06, Alex wrote: >> 30-Sep-2018 12:03:24.249 query-errors: client @0x7ff3f01a

Re: FPs on FORGED_MUA_MOZILLA (for my own hand-typed messages from my latest-version Thunderbird)

2018-10-02 Thread Rob McEwen
Bill, Even though this part wasn't the main purpose of the thread, that is still very helpful information. I will pass that along to my client so that they can hopefully fix their configuration problem with regards to their usage of URIBL. Thanks! Rob McEwen Sent from my Verizon Motorola Dro

Re: FPs on FORGED_MUA_MOZILLA (for my own hand-typed messages from my latest-version Thunderbird)

2018-10-02 Thread Bill Cole
On 2 Oct 2018, at 9:36, Rob McEwen wrote: SIDE NOTE: I don't think there was any domain my message that was blacklisted on URIBL - so I can't explain the "URIBL_BLOCKED", but that only scored 0.001, so that was innocuous. I suspect that that rule is malfunctioning on their end, and then they c

Re: FPs on FORGED_MUA_MOZILLA (for my own hand-typed messages from my latest-version Thunderbird)

2018-10-02 Thread Rob McEwen
On 10/2/2018 9:59 AM, Matus UHLAR - fantomas wrote: can you post the headers? or at least the Message-Id? Matus... first, THANKS for your help with this! Here is the message as THEIR system saw it (with my client's info masked)  - but it looks like their Kerio (or the customer's email clien

Re: sa-update and signature verification

2018-10-02 Thread Kevin A. McGrail
Hi Daniele, You are correct.  3.4.2 does not support rule channels that only use SHA1. Please contact the other rule channels and tell them to add sha256.  We have moved away from SHA1.  It should be trivial on their end to generate a sha256sum. Regards, KAM On 10/2/2018 10:00 AM, Daniele Duca w

sa-update and signature verification

2018-10-02 Thread Daniele Duca
Hello, since updating to 3.4.2 I can't download rules from unofficial channels. The problem is that in version 3.4.1 sa-update checks the hash of the downloaded file using file.sha1 , while version 3.4.2 uses file.sha256 or file.sha512. See the relevant differences in the following sa-update

Re: FPs on FORGED_MUA_MOZILLA (for my own hand-typed messages from my latest-version Thunderbird)

2018-10-02 Thread Matus UHLAR - fantomas
On 02.10.18 09:36, Rob McEwen wrote: A client of mine wasn't getting my own hand-typed messages. Unfortunately, they had their SA set to block on a score of 3 (which is aggressive), and this particular rule hit plus a tiny bit of other things put it above 3. But what is weird - is that it was h

FPs on FORGED_MUA_MOZILLA (for my own hand-typed messages from my latest-version Thunderbird)

2018-10-02 Thread Rob McEwen
A client of mine wasn't getting my own hand-typed messages. Unfortunately, they had their SA set to block on a score of 3 (which is aggressive), and this particular rule hit plus a tiny bit of other things put it above 3. But what is weird - is that it was hitting on hand typed-messages from me

Re: iXhash service issues

2018-10-02 Thread Jakob Hirsch
Hi, On 2018-09-30 18:06, Alex wrote: > 30-Sep-2018 12:03:24.249 query-errors: client @0x7ff3f01a43d0 > 68.195.193.45#44607 > (230fe40b1401cf8c3fe2b8699cdb91bf.generic.ixhash.net): query failed > (SERVFAIL) for 230fe40b1401cf8c3fe2b8699cdb91bf.generic.ixhash.net/IN/A > at query.c:8580 According to

Re: Unexpected error spotted by --lint check

2018-10-02 Thread Martin Gregorie
On Tue, 2018-10-02 at 12:20 +0300, Henrik K wrote: > Are you talking about the .cf file and line that contains rule being > warned about? I don't see how it could be done, looking at how the > cf and stuff are processed. > Yes I was, but if it can';t be done, fair enough. > I already patched the

Re: Unexpected error spotted by --lint check

2018-10-02 Thread Henrik K
On Tue, Oct 02, 2018 at 09:44:41AM +0100, Martin Gregorie wrote: > On Tue, 2018-10-02 at 07:57 +0300, Henrik K wrote: > > This is also nothing else than a warn, the rule works regardless. > > > That makes warnings like this somewhat useless because this makes > locating them rather difficult. Is t

Re: iXhash service issues

2018-10-02 Thread Alessio Cecchi
Il 30/09/2018 18:06, Alex ha scritto: Hi all, I'm pretty sure this is a problem on their side, but can anyone else confirm ixhash is having a problem? Anyone else using the iXhash plugin? Their site http://www.ixhash.net/ also appears to be down. 30-Sep-2018 12:03:24.249 query-errors: client @0x

Re: Unexpected error spotted by --lint check

2018-10-02 Thread Martin Gregorie
On Tue, 2018-10-02 at 07:57 +0300, Henrik K wrote: > This is also nothing else than a warn, the rule works regardless. > That makes warnings like this somewhat useless because this makes locating them rather difficult. Is there any possibility of showing the filename and line number in the --lint