Re: Best Choice for Bayes filtering on SpamAssassin

2006-12-02 Thread Craig Morrison
Michael Scheidell wrote: -Original Message- From: Nigel Frankcom [mailto:[EMAIL PROTECTED] Sent: Saturday, December 02, 2006 2:24 PM To: SpamAssassin Subject: Re: Best Choice for Bayes filtering on SpamAssassin My MTA has a list of SA servers it will use in series; if 1 is

Re: Easyjet e-mail scoring very high

2006-12-01 Thread Craig Morrison
Chris Lear wrote: * Loren Wilton wrote (01/12/06 14:54): The html contains this sort of thing: http://www#46;easyjet#46;com/EN/Members/ Which looks like the culprit. In fact, every full stop in the html is represented as #46; for some reason. Still wondering though... how do you solve a

Re: forged spam emails from my own domain

2006-12-01 Thread Craig Morrison
vertito wrote: config: SpamAssassin failed to parse line, [EMAIL PROTECTED] is not valid for whitelist_from_rcvd, skipping: whitelist_from_rcvd [EMAIL PROTECTED] i tried your advise but i had a line of error from my maillog, which is shown above. [EMAIL PROTECTED] is just for a test.

Re: This is so obvious...

2006-11-30 Thread Craig Morrison
Jon D. Slater wrote: To me, they look like Perl regular expressions (which I **have** written). Do I add my new rule to my local.cf or directly to 70_sare_specific.cf? local.cf is the best place. Placing them in any of the stock SA rule files or in the RDJ files will cause you to lose

Re: forged spam emails from my own domain

2006-11-30 Thread Craig Morrison
vertito wrote: i am receiving spam emails coming from my own domain.com but that email address does not existing from my own domain.com. say my domain is mydomain.com and that spam email had FROM header that shows [EMAIL PROTECTED] which is currently whitelisted from spamassassin global rules

Re: Prevent scanning internal mail

2006-11-30 Thread Craig Morrison
Theo Van Dinter wrote: On Thu, Nov 30, 2006 at 01:02:29PM -0800, leemansvg wrote: This might be a simple question for most of you. How would I prevent spamassassin from scanning my internal mail, e.g from a particular server, or originating from my internal network. Don't pass those to

Re: webg bug

2006-11-30 Thread Craig Morrison
Jean-Paul Natola wrote: I was wondering if there is a way to either strip away, or totally block messages that have web bugs that report back to servers like www.readnotify.com plug type=shameless http://www.impsec.org/email-tools/procmail-security.html /plug Can someone help a newbie

Re: whitelisted where?

2006-11-30 Thread Craig Morrison
Scott Kopel wrote: I'm noticing a bunch of obviously spam that is getting thru because it is whitelisted where is this whitelist? it's not something I created. it's not the auto_whitelist is it? wouldn't that say AWL is it the phishing whitelist? when I start MailScanner I see Read 755

Re: whitelisted where?

2006-11-30 Thread Craig Morrison
Scott Kopel wrote: I'm noticing a bunch of obviously spam that is getting thru because it is whitelisted where is this whitelist? it's not something I created. it's not the auto_whitelist is it? wouldn't that say AWL is it the phishing whitelist? when I start MailScanner I see Read 755

Re: Prevent scanning internal mail

2006-11-30 Thread Craig Morrison
Gary V wrote: Exactly. How you prevent sending the message through SA is not a function of SA itself, but of the implementation, and because of the large number of implementations and configurations I question whether it would be practical (or even related) to provide examples of the various

Re: tagging based on score level

2006-11-29 Thread Craig Morrison
beast wrote: Is it possible to make different tag for a different score/classes, for example: high: [SPAM!!!] if score 50 medium: [SPAM!!] if score between 20 - 50 low: [SPAM] if score between treshold - 20 The reason is client filter or other redirection program (for example to be

Re: Loads of 'xxx wrote:' Spam

2006-11-27 Thread Craig Morrison
Theo Van Dinter wrote: On Mon, Nov 27, 2006 at 09:48:03PM +, Justin Mason wrote: As has been the suggestion for the past X months, run sa-update. :) we've got to make this a more prominent FAQ somehow... Yeah, I keep coming across people on IRC and such that don't know about sa-update,

Re: How to use --allow-tell?

2006-11-26 Thread Craig Morrison
Todd A. Jacobs wrote: I was perusing the man pages for spamd in spamassassin 3.1.7, and came across something that seems to imply that I can use spamc to tell spamd to update a sitewide bayesian database: -l, --allow-tell Allow learning and forgetting (to a local Bayes database),

Re: How to use --allow-tell?

2006-11-26 Thread Craig Morrison
Craig Morrison wrote: Todd A. Jacobs wrote: I was perusing the man pages for spamd in spamassassin 3.1.7, and came across something that seems to imply that I can use spamc to tell spamd to update a sitewide bayesian database: -l, --allow-tell Allow learning and forgetting (to a local

Re: Who wants my spam - seriously!

2006-11-25 Thread Craig Morrison
Marc Perkel wrote: As you all know I'm in the spam blocking business and looking to share my information with others to help them block spam for everyone. I'm currently feeding my spam to several people now. You asked Feedback welcome. Given the rants on your website and just your

Re: A false positive...

2006-11-23 Thread Craig Morrison
Justin Mason wrote: Steve [Spamassasin] writes: An ebay watched item email has been wrongly tagged as spam... with the following rules: -- 2.2 INVALID_DATE Invalid Date: header (not RFC 2822) 0.8 DATE_IN_PAST_06_12 Date: is 6 to 12 hours before Received: date 0.1 TW_SJ

Re: saupdate

2006-11-23 Thread Craig Morrison
Jack Gostl wrote: I'm trying to understand saupdate and how to use it. I have two questions. I'm running AIX 5.3. Question 1: I run the following command: /usr/opt/perl5/bin/sa-update --nogpg -D --updatedir /tmp/update It finishes with a return code of 1. It sounds to me like something

Re: saupdate

2006-11-23 Thread Craig Morrison
Please keep replies on the list for the benefit of others.. Comments inline.. Jack Gostl wrote: Question 2: After running saupdate, I assume that all I have to do is to restart spamd. How can I force spamd to restart and reload its rules? Can a do a simple kill -1? Or do I need an

Re: A false positive...

2006-11-23 Thread Craig Morrison
Michael Scheidell wrote: -Original Message- From: Craig Morrison [mailto:[EMAIL PROTECTED] Sent: Thursday, November 23, 2006 12:53 PM To: users@spamassassin.apache.org Subject: Re: A false positive... TZ format you should consider sa-learn'ing the messages as ham. On your SA setup

Re: saupdate

2006-11-23 Thread Craig Morrison
Jack Gostl wrote: - Original Message - From: Craig Morrison [EMAIL PROTECTED] To: Jack Gostl [EMAIL PROTECTED] Cc: spamassassin users@spamassassin.apache.org Sent: Thursday, November 23, 2006 2:40 PM Subject: Re: saupdate Please keep replies on the list for the benefit of others

Slow scan time

2006-08-11 Thread Craig Morrison
http://www3.2cah.com/spam/sa_slowhtml.txt I got inundated with messages similar to this today. The average scan time here for these is 25+ seconds when the box is under _low_ load. My guess is that it has to do with the number of URLs. Any thoughts on this? -- Craig

Re: SPF and envelope senders

2006-08-10 Thread Craig Morrison
Daryl C. W. O'Shea wrote: Logan Shaw wrote: So I looked in my own personal mailbox to see which messages have Return-Path headers, and out of the hundreds of messages in there, basically all messages do have a Return-Path header, except that not a single one from from majorcustomer.com does.

Re: Always add report headers

2006-08-05 Thread Craig Morrison
Arik Raffael Funke wrote: Nigel Frankcom wrote: On Sat, 05 Aug 2006 14:08:45 +0200, Arik Raffael Funke [EMAIL PROTECTED] wrote: how to I get spamd/spamc to always add the spamassassin report headers? I.e. also to ham messages... I have the following in my local.cf and user_pref.cf but to no

Re: What changes would you make to stop spam? - United Nations Paper

2006-08-04 Thread Craig Morrison
John Rudd wrote: I've been re-thinking Marc's IMAP for sending, instead of SMTP proposal. And this block Bcc part got me thinking even more. I think he may be on to something. But lets take it one step further. Email via fingerd. That'll throw off the spammers. Wouldn't identd be more

Re: SPAM: Re: Re[2]: Hiring for Spam Assassin Troubleshooting

2006-06-03 Thread Craig Morrison
I usually don't top quote, but folks, this is a troll.. And we all bit.. So troller, you have been sourced, go away.. WFGB Team wrote: Spam detection software, running on the system DEDE143, has identified this incoming email as possible spam. The original message has been attached to this

Re: INVALID_DATE

2006-03-23 Thread Craig Morrison
[EMAIL PROTECTED] wrote: c:\man strftime 'man' is not recognized as an internal or external command, operable program or batch file. The mere fact that documentation is less accessible on windows should not be taken as an excuse by programmers to reinvent the wheel as an egg-shaped thingy

Re: INVALID_DATE

2006-03-23 Thread Craig Morrison
David Lee wrote: On Thu, 23 Mar 2006, Craig Morrison wrote: At any rate and to try and bring this discussion somewhat back on topic, strftime makes it trivial to change date formats merely by changing the format string given as one of its arguments. Any debate regarding difficulty of change

Re: Training SA with Thunderbird Junk folder

2006-03-22 Thread Craig Morrison
JamesDR wrote: Edward Diener wrote: Does anybody know the instructions for training SA with the contents of the Thunderbird Junk folder ? Upload them as single messages to your ISP account. If you have a special folder in TB (Thunderbird) for the messages you want to train on you can find

Re: INVALID_DATE

2006-03-22 Thread Craig Morrison
David Lee wrote: Date: Wed, 22 Mar 06 12:00:00 GMT Standard Time [snip.] The main addressable issue here seems to be the INVALID_DATE. The Date: supplied by Mmail does not have a simple timezone (e.g. expect GMT), but rather GMT Standard Time. (Correct?) This seems to me to be a clear

Re: INVALID_DATE

2006-03-22 Thread Craig Morrison
Randal, Phil wrote: For what it's worth, Vodafone's as bad (stuff changed to protect the innocent): From: [EMAIL PROTECTED] [EMAIL PROTECTED] Reply-To: [EMAIL PROTECTED] To: [EMAIL PROTECTED] Date: Nov 9, 2005 4:53 PM Subject: You have received a new message RFC2822 is unequivocal about

Re: SUBJ_ILLEGAL_CHARS

2006-03-15 Thread Craig Morrison
Милен Панков wrote: Matt Kettler написа: Note that SUBJ_ILLEGAL_CHARS is NOT concerned with what language or character set is used. It is concerned about it not being encoded properly. Per RFC specifications, all characters in email-headers that aren't in the normal ascii ranges must be QP

Re: HTML Validator

2006-03-15 Thread Craig Morrison
Philip Prindeville wrote: I'm wondering what would be involved in putting in an HTML parser that could call various rules to check things, like the case of: a href=http://www.foo.com/xyzzy;http://www.bar.com/aardvark/a where the link disagrees with the text between the anchor tags (yeah, you

Re: Possibly useful Stats Script.

2005-06-09 Thread Craig Morrison
Nigel Frankcom wrote: A colleague has written a script to supply some summary (and detail) statistics for SA. Actually its a work in progress, but what it does it does well. Craig Morrison has written a script for logwatch that shows message scan times and a mean average - plus a few other