Re: Subtest __E_LIKE_LETTER and __LOWER_E listed many times in message header

2018-12-11 Thread Chris Pollock
On Tue, 2018-12-11 at 19:00 -0500, Bill Cole wrote: > On 11 Dec 2018, at 16:37, Chris Pollock wrote: > > > On Mon, 2018-12-10 at 13:09 -0500, Bill Cole wrote: > > [...] > > > Anyway, as of today I've capped those 2 subrules at levels which > > > leave ample space to still match the target spam. S

Re: Subtest __E_LIKE_LETTER and __LOWER_E listed many times in message header

2018-12-11 Thread Bill Cole
On 11 Dec 2018, at 16:37, Chris Pollock wrote: > On Mon, 2018-12-10 at 13:09 -0500, Bill Cole wrote: [...] >> Anyway, as of today I've capped those 2 subrules at levels which >> leave ample space to still match the target spam. Should show up in >> tomorrow's update. I was wrong. The addition of

Re: Subtest __E_LIKE_LETTER and __LOWER_E listed many times in message header

2018-12-11 Thread Chris Pollock
On Mon, 2018-12-10 at 13:09 -0500, Bill Cole wrote: > On 9 Dec 2018, at 18:23, Chris Pollock wrote: > > > On Sun, 2018-12-09 at 13:06 -0500, Bill Cole wrote: > > > On 9 Dec 2018, at 12:04, Chris Pollock wrote: > > > > > > > This is probably very trivial and doesn't affect anything > > > > except

Re: SpamSender with 2 @-signs in the address

2018-12-11 Thread John Hardin
regex rule, but I don't recall off the top of my head who that was. I was provided a spample by private email (and suggested they post it here) and it hits T_FROM_2_EMAILS from 20_khop_experimental.cf https://ruleqa.spamassassin.org/20181211-r1848660-n/T_FROM_2_EMAILS/detail Perhaps I&

Re: Subtest __E_LIKE_LETTER and __LOWER_E listed many times in message header

2018-12-11 Thread John Hardin
On Tue, 11 Dec 2018, Chris Pollock wrote: It's got the potential to be VERY noisy (as you've discovered) while not really providing much useful info. Not a big deal on a small system. I could just go through and comment out this line in my local.cf add_header all Subtest Ran _SUBTESTS(,)_ but

Re: Spamassassin using remote rules definition source?

2018-12-11 Thread Kris Deugau
Kevin A. McGrail wrote: On 12/10/2018 2:49 PM, Kris Deugau wrote: The master/reference files are stored in a Subversion repository. Commits to particular paths trigger the creation of the tarball, SHA* hash files, and GPG signature.  A cron job on our DNS master server polls the repository to se

Re: Subtest __E_LIKE_LETTER and __LOWER_E listed many times in message header

2018-12-11 Thread Chris Pollock
On Mon, 2018-12-10 at 13:09 -0500, Bill Cole wrote: > On 9 Dec 2018, at 18:23, Chris Pollock wrote: > > > On Sun, 2018-12-09 at 13:06 -0500, Bill Cole wrote: > > > On 9 Dec 2018, at 12:04, Chris Pollock wrote: > > > > > > > This is probably very trivial and doesn't affect anything > > > > except

Re: Another form of obfuscation email.

2018-12-11 Thread Bill Cole
On 11 Dec 2018, at 7:52, RW wrote: On Mon, 10 Dec 2018 16:02:33 -0500 Bill Cole wrote: On 10 Dec 2018, at 14:13, RW wrote: On Mon, 10 Dec 2018 12:45:53 -0500 Mark London wrote: Hi - Here's another form of obfuscation spam. This time, not a porn blackmail one. Almost the whole text is ob

Re: Another form of obfuscation email.

2018-12-11 Thread RW
On Mon, 10 Dec 2018 16:02:33 -0500 Bill Cole wrote: > On 10 Dec 2018, at 14:13, RW wrote: > > > On Mon, 10 Dec 2018 12:45:53 -0500 > > Mark London wrote: > > > >> Hi - Here's another form of obfuscation spam. This time, not a > >> porn blackmail one. Almost the whole text is obfuscated. > >>