RE: Suggested Approach

2023-04-27 Thread Fortney, James T - CSCCS
Marc (et all) - Thank you for the reply. I will first admit that my SA skills are very dated. I have not actively managed the product in over ten years. I distributed the 9 messages as a ZIP file because there were so many immediate instances. I typically refrain from trying to redact an

Suggested Approach

2023-04-26 Thread Fortney, James T - CSCCS
forwarding. Please discard if no interest. TNX - JimF - James T. Fortney, Principal CSC Consulting Services E-mail: fort...@cscconsulting.com Snail:P.O. Box 12589 Prescott AZ 86304-2589 -- <>

Detection rate of msbl.org

2020-06-22 Thread James Brown
I’m thinking about using the EBL from msbl.org with SA. Can anyone tell me what detection rate they are getting with it? Is it worth using, or would the spam be trapped by other methods (RBL, etc) anyway? Pretty hard to find much information about how useful it is. Thanks, James. smime.p7s

__FRAUD_JBU and __FRAUD_TCC

2019-08-13 Thread James Wilkinson
k. Is this worth raising as a bug (or improvement request)? Could someone try variants of the ADVANCE_FEE rules without __FRAUD_JBU and see if it performs better? Unfortunately, I can't see enough of the original email, and would be unlikely to have permission to supply it if I did. Thanks, James.

Re: more spam is getting through :-(

2019-03-20 Thread James
On 2019-03-20 12:07 p.m., Dave Warren wrote: What is the result when you train inbound spam as ham first, then as spam? As I understand it, forgetting is not required, SpamAssassin will handle this automatically. So as long as users move spam into the spam training folder (not deleting spam di

Re: more spam is getting through :-(

2019-03-20 Thread James
On 2019-03-18 7:40 p.m., @lbutlr wrote: On 18 Mar 2019, at 13:59, James wrote: The documentation says to use your inbox. :-) It does not. The example shows using your inbox. if possible. This will make it more accurate for your incoming mail. Do this using the "sa-learn" t

Re: more spam is getting through :-(

2019-03-18 Thread James
On 2019-03-17 5:43 p.m., @lbutlr wrote: On 17 Mar 2019, at 15:03, James wrote: I run sa-learn --ham on my inboxes. You inboxes likely contain spam messages that haven't been caught, so training on inbox will poison your bayes in favor of more spam. Unless your inbox is perfect (ent

Re: more spam is getting through :-(

2019-03-17 Thread James
On 2019-03-17 5:46 p.m., John Capo wrote: On Sun, March 17, 2019 17:03, James wrote: I've been getting a lot of spam so I'm thinking of lowering the "required" number. About 50 % spam gets a 4.4 so my required=4.5 is a tiny bit high. I run an IMAP server with my own

Re: more spam is getting through :-(

2019-03-17 Thread James
On 2019-03-17 5:45 p.m., John Hardin wrote: On Sun, 17 Mar 2019, James wrote: I've been getting a lot of spam so I'm thinking of lowering the "required" number. About 50 % spam gets a 4.4 so my required=4.5 is a tiny bit high. I run sa-learn --ham on my inboxes. Are

more spam is getting through :-(

2019-03-17 Thread James
I've been getting a lot of spam so I'm thinking of lowering the "required" number. About 50 % spam gets a 4.4 so my required=4.5 is a tiny bit high. I run sa-learn --ham on my inboxes. Is there a way to whitelist all the email addresses in my inboxes?

Re: SpamAssassin 3.4.2. - err.h requirement

2018-09-17 Thread James Hsieh
RED.BY <http://95.216.24.32/updates/MIRRORED.BY> you get a not found. I copied the MIRRORED.BY file from the 3.004001 directory then re-ran sa-update. It pulled down rules and I'm in business. Kevin, thanks for the patch. It works. Sorry for the extra noise and perhaps we need to

Re: SpamAssassin 3.4.2. - err.h requirement

2018-09-17 Thread James Hsieh
a PID file: %s", $pid, exit_status_str($child_stat,0)) unless $serverstarted; However, there's no waiting for things to start. I'm investigating this now. --James > On Sep 17, 2018, at 4:53 PM, Kevin A. McGrail wrote: > > This patch was added for wind

SpamAssassin 3.4.2. - err.h requirement

2018-09-17 Thread James Hsieh
ake: Fatal error: Command failed for target `spamc/spamc' Current working directory /export/src/Mail-SpamAssassin-3.4.2 *** Error code 1 make: Fatal error: Command failed for target `spamc/spamc' --James

Re: sa-update - no updates for 3 weeks?

2017-04-06 Thread James Hsieh
Thanks very much for everyone's quick responses (and sanity checks). :) I love this .cf file, Kevin. A more advanced and sophisticated version of the one I've been accumulating for a few years! Thanks again! --James > On Apr 6, 2017, at 10:12 AM, Kevin A. McGrail wrote: >

sa-update - no updates for 3 weeks?

2017-04-06 Thread James Hsieh
n.org => 1786640, parsed as 1786640 Apr 6 09:19:55.594 [10506] dbg: channel: current version is 1786853, new version is 1786640, skipping channel Apr 6 09:19:55.594 [10506] dbg: diag: updates complete, exiting with code 1 Update finished, no fresh updates were available superchicken# Any insights appreciated. Thanks! --James

Re: non-English sender and body

2015-07-12 Thread James
On 07/12/15 17:15, Reindl Harald wrote: Am 12.07.2015 um 21:40 schrieb Bill Cole: On 12 Jul 2015, at 11:28, James wrote: The problem is finding out which directory the running spamassassin uses, I can't seen to train the one it expects. I put this in my /etc/spamassassin/loc

Re: non-English sender and body

2015-07-12 Thread James
On 07/12/15 00:22, ch...@antennex.com wrote: Why not run: sa-learn --dump magic And you'll see the number of spams vs tyhe number of hams learned? The problem is finding out which directory the running spamassassin uses, I can't seen to train the one it expects. I put this i

Re: non-English sender and body

2015-07-11 Thread James
On 07/11/15 19:55, Reindl Harald wrote: Am 11.07.2015 um 17:36 schrieb James: Does Bayes catch them? === I don't know since I don't get any non-english emails. But, you could collect and feed them to "sa-

Re: non-English sender and body

2015-07-11 Thread James
English sender and body *From:* RW <mailto:rwmailli...@googlemail.com> *Date:* 2015-07-11 08:28 *To:* users <mailto:users@spamassassin.apache.org> *Subject:* Re: non-English sender and body On Fri, 10 Jul 2015 22:00:10 -0400 James wrote:

Re: non-English sender and body

2015-07-11 Thread James
lish sender and body > On Fri, 10 Jul 2015 22:00:10 -0400 > James wrote: > > > I get a lot of spam from Chinese senders and Chinese subjects but > > only an image for the body. > > I want to mark as spam any non-English sender names and subjects.

Re: non-English sender and body

2015-07-11 Thread James
On 07/11/15 09:32, ch...@antennex.com wrote: *From:* RW <mailto:rwmailli...@googlemail.com> *Date:* 2015-07-11 08:28 *To:* users <mailto:users@spamassassin.apache.org> *Subject:* Re: non-English sender and body On Fri, 10 Jul 2015 22:00:10 -0400 James wr

non-English sender and body

2015-07-10 Thread James
I get a lot of spam from Chinese senders and Chinese subjects but only an image for the body. I want to mark as spam any non-English sender names and subjects. I tried TextCat but either I did it wrong or it only looks at the Body.

Re: How to automatically train each users Bayes?

2015-03-30 Thread James Michael Keller
last expire atime delta 0.000 0 0 0 non-token data: last expire reduction count Obvious issues if users leave spam sitting in their inbox, but if they move to the spam folder it will get relearned correctly.In this case I trust the users with well behaved mail

Re: no BAYES checking

2015-02-26 Thread James
On 02/25/2015 10:03 PM, Dave Funk wrote: It looks like you either have a permissions problem or a confusion problem. Your run of 'sa-learn --dump magic' is looking at some Bayes which has enough ham/spam but what ever your spamassasin is looking at doesn't. Your 'sudo' isn't running that sa-l

no BAYES checking

2015-02-25 Thread James
I don't think I have the Bayesian filter working. This is some spam that wasn't marked as spam, shouldn't one of the tests be BAYES_00? X-Spam-Status: No, score=4.5 required=5.0 tests=FREEMAIL_FROM,FREEMAIL_REPLYTO, FSL_MY_NAME_IS,HTML_MESSAGE,RDNS_DYNAMIC,T_OBFU_JPG_ATTACH autolearn=no

Re: running spamassassin (or spamc) idempotently

2014-09-25 Thread James Michael Keller
are in the 20s or higher and would be rejected otherwise, assuming they made it past greylisting deferrals. For thew few low deferrals that did retry they eventually got over 5.0 after whitelisting due to the RBLs updating in the mean time. -- -James

Re: Missing rules

2014-08-08 Thread James B. Byrne
On Fri, August 8, 2014 09:14, Matus UHLAR - fantomas wrote: > On 06.08.14 16:19, James B. Byrne wrote: >>OS=CentOS-6.5 >>SA=3.3.1 >> >>I ran spamassassin -D -llint and see this in the output: >> >>Aug 6 15:59:03.983 [4533] dbg: config: warning: score set fo

Re: Missing rules

2014-08-07 Thread James B. Byrne
On Thu, August 7, 2014 15:53, Bob Proulx wrote: > James B. Byrne wrote: >> Quanah Gibson-Mount wrote: >> > Policies such as this show a complete lack of understanding on how to run >> > production infrastructure. RH will never update SA in RHEL6 to any new >>

Re: Missing rules

2014-08-07 Thread James B. Byrne
On Wed, August 6, 2014 17:30, Quanah Gibson-Mount wrote: > --On Wednesday, August 06, 2014 6:24 PM -0400 "James B. Byrne" > wrote: > >> I am constrained to run the version provided by the upstream distro >> packager (RedHat). When they update SA then, and only

Re: Missing rules

2014-08-06 Thread James B. Byrne
e (http://mailspike.org/usage.html) and read a brief introduction to the service. Am I to infer that one places the suggested configuration into ones own local.cf? If so then how do the scores get on my system without the associated rules? -- *** E-Mail is NOT a SECURE channel *** James

Missing rules

2014-08-06 Thread James B. Byrne
with the distribution packages. Does anyone have an idea as to why I have scores for non-existent rules? What is MSPIKE? -- *** E-Mail is NOT a SECURE channel *** James B. Byrnemailto:byrn...@harte-lyne.ca Harte & Lyne Limited http://www.harte-lyne.

Re: Domain ages (was Re: SPAM from a registrar)

2014-06-09 Thread James B. Byrne
* E-Mail is NOT a SECURE channel *** James B. Byrnemailto:byrn...@harte-lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3

Header present but MISSING_FROM triggered

2014-06-02 Thread James B. Byrne
Postfix. Nonetheless, it has a MISSING_FROM tag. Thank you for your assistance. Any further help in explaining this situation to me will is most welcome. -- *** E-Mail is NOT a SECURE channel *** James B. Byrnemailto:byrn...@harte-lyne.ca Harte & L

Header present but MISSING_FROM triggered

2014-06-02 Thread James B. Byrne
cut out the SA headers from the messages that I pass to it on the command line. Has anyone else run into this? -- *** E-Mail is NOT a SECURE channel *** James B. Byrnemailto:byrn...@harte-lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Broc

Re: Header present but MISSING_FROM triggered

2014-06-02 Thread James B. Byrne
y lines * 1.8 MISSING_DATE Missing Date: header ; I do not know why this is happening. Is there some switch I am supposed to pass spamassasin when I use it on a message text file? -- *** E-Mail is NOT a SECURE channel *** James B. Byrnemailto:byrn...

Header present but MISSING_FROM triggered

2014-06-02 Thread James B. Byrne
e.ca with HTTP; > Mon, 2 Jun 2014 10:59:07 -0400 > Message-ID: <6f60bcdbaaa72e02b4633a40eb76a68e.squir...@webmail.harte-lyne.ca> > Date: Mon, 2 Jun 2014 10:59:07 -0400 > Subject: PKTA01453294 Guardian Drug PU#655787 > From: "James Byrne (Exports)" > To: . . . As f

Enom strikes back?

2014-05-26 Thread James B. Byrne
say about the registrar's ethics and the domains it hosts? Should such companies and their clients be boycotted and thereby coerced into dealing with these frauds? -- *** E-Mail is NOT a SECURE channel *** James B. Byrnemailto:byrn...@harte-lyne.ca Harte &a

Re: Blank line rules

2014-05-26 Thread James B. Byrne
apparently is not going to happen any time soon. On a related note, what is the difference between 'body' and 'rawbody' rules? -- *** E-Mail is NOT a SECURE channel *** James B. Byrnemailto:byrn...@harte-lyne.ca Harte & Lyne Limite

RE: SPAM from a registrar

2014-05-23 Thread James B. Byrne
Mail is NOT a SECURE channel *** James B. Byrnemailto:byrn...@harte-lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3

Blank line rules

2014-05-22 Thread James B. Byrne
even though the body of that message has 18 consecutive blank lines, also consisting of nothing but \n characters. So what is it about the regexp I am using that I evidently do not understand? -- *** E-Mail is NOT a SECURE channel *** James B. Byrnemailto:byrn

Re: SPAM from a registrar

2014-05-16 Thread James B. Byrne
00 SW 1st Avenue Suite 440 Portland OR 97201 US -- *** E-Mail is NOT a SECURE channel *** James B. Byrnemailto:byrn...@harte-lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive

RE: SPAM from a registrar

2014-05-16 Thread James B. Byrne
egistrar and be done with it. Is there a spamassassin whois plug-in that can parse and check the registrar and the domain creation date? -- *** E-Mail is NOT a SECURE channel *** James B. Byrnemailto:byrn...@harte-lyne.ca Harte & Lyne Limited http://w

It is a bit difficult to post to this list

2014-05-15 Thread James B. Byrne
is only by paid subscription? If it is not then paid then how long is the window between registration and inclusion in the RBL? -- *** E-Mail is NOT a SECURE channel *** James B. Byrnemailto:byrn...@harte-lyne.ca Harte & Lyne Limited http://www.h

Bayes refinement

2014-05-15 Thread James B. Byrne
space in most cases. -- *** E-Mail is NOT a SECURE channel *** James B. Byrnemailto:byrn...@harte-lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561

SPAM from a registrar

2014-05-15 Thread James B. Byrne
*** James B. Byrnemailto:byrn...@harte-lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3

Are messages bypassing Spamassassin checks? Why?

2014-05-11 Thread James B. Byrne
we handle this? -- *** E-Mail is NOT a SECURE channel *** James B. Byrnemailto:byrn...@harte-lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757

Re: sa-learn from a cronjob?

2014-04-21 Thread James Michael Keller
bin/sa-learn --username=Debian-exim --no-sync --dbpath=/var/spool/exim4/.spamassassin/bayes - -folders=/etc/spamassassin/sa-learn-folders.conf >> /var/log/sa-learn-run.log root@omega:/etc/cron.d# -- -James

Re: Problems in local.cf

2013-09-19 Thread James B. Byrne
been just keeping the local config file since then. I have made your suggested modifications to local.cf. Thank you again for your assistance. Regards, -- *** E-Mail is NOT a SECURE channel *** James B. Byrnemailto:byrn...@harte-lyne.ca Harte & Lyn

Problems in local.cf

2013-09-19 Thread James B. Byrne
/32 trusted_networks 192.168.0.0/16 . . . auto_whitelist_factor 1 num_check_received 10 . . . Are these directives deprecated? What misconfiguration is causing the warnings to appear? -- *** E-Mail is NOT a SECURE channel *** James B. Byrnemailto:byrn...@harte-lyne.ca

Re: one word spam

2013-08-28 Thread James Griffin
mails with just hi! will be spam. I have people/friends, that send mails like that to me, just to see if i'm there/available. Spammers would most likely have more than just "Hi!" in the mail body. -- James Griffin: jmz at kontrol.kode5.net A4B9 E875 A18C 6E11 F46D B788 BEE6 1251 1D31 DC38

Re: skipped due to message size

2013-08-23 Thread James Griffin
s? A quick > >scan of the usual sources did not satisfy. > > man spamc should say it: > >-s max_size, --max-size=max_size Are you invoking spamc with procmail, which may specify a file size in the procmail recipe? -- James Griffin: jmz at kontrol.kode5.net A4B9 E875 A18C 6E11 F46D B788 BEE6 1251 1D31 DC38

Re: SA both at external and internal servers

2013-08-03 Thread James Griffin
Sat 3.Aug'13 at 9:19:49 +0530, N. Raghavendra > At 2013-08-02T09:38:42+01:00, James Griffin wrote: > > > Yes, of course you can. You can put SA on any machine that processes > > mail no matter if it's been scanned prior to arriving at

Re: SA both at external and internal servers

2013-08-02 Thread James Griffin
Fri 2.Aug'13 at 12:55:40 +0530, N. Raghavendra > At 2013-08-02T01:39:45+05:30, N. Raghavendra wrote: > > > I work in a setup where the external mail server (say, > > extmail.example.com) in a DMZ runs Spamassassin as soon as mail arrives > > from the Internet, and

Re: Piping to sa-learn

2013-07-25 Thread James Griffin
Thu 25.Jul'13 at 1:31:16 +0200, Karsten Bräckelmann [ ... ] > NOTE: Be careful of using sa-learn in different environments or ways in > parallel. For example via the dovecot anti-spam plugin, from a cron job > harvesting mbox files, maildir, processed through f

Re: latest rules

2012-09-23 Thread James
On 09/23/12 18:28, John Hardin wrote: > On Sun, 23 Sep 2012, James wrote: > >> I wrote this little script to update the bayes rules. I can do this on my >> imap account but my pop3 account gets way more spam and the messages are no >> longer on the machine with sa once I

Re: latest rules

2012-09-23 Thread James
On 09/22/12 22:38, John Hardin wrote: > On Sat, 22 Sep 2012, James wrote: >> On 09/22/12 20:50, Glenn Sieb wrote: >>> On 9/22/12 8:36 PM, Glenn Sieb wrote: >>>> On 9/22/12 8:32 PM, James wrote: >>>>> It didn't help. :-( >>>>> I got s

Re: latest rules

2012-09-22 Thread James
On 09/22/12 20:50, Glenn Sieb wrote: > On 9/22/12 8:36 PM, Glenn Sieb wrote: >> On 9/22/12 8:32 PM, James wrote: >>> It didn't help. :-( >>> I got spam with a low score. >>> X-Spam-Status: No, score=2.4 required=3.0 tests=BAYES_00,HTML_MESSAGE, >

Re: latest rules

2012-09-22 Thread James
On 09/22/12 17:11, Daniel McDonald wrote: > > > > On 9/22/12 3:31 PM, "James" wrote: > >> Great thanks. >> >> I am lowering the required score to 3. > > That is generally not a desirable practice. It didn't help. :-( I got spam with

Re: latest rules

2012-09-22 Thread James
On 09/22/12 15:38, Martin Hepworth wrote: > Itll use the lastest rule you downloaded as these are your core rules now > > Martin > > On Saturday, 22 September 2012, James wrote: > > I've been getting more spam recently so I did sa-update for the first > tim

latest rules

2012-09-22 Thread James
I've been getting more spam recently so I did sa-update for the first time in a year (I thought it was automatic :-()). I restarted the spamassassin service (Ubuntu). $ /var/lib/spamassassin$ ll total 16 drwxr-xr-x 4 root root 4096 Oct 15 2011 ./ drwxr-xr-x 45 root root 4096 Jun 12 06:40 ../ d

Re: Request to change rule RCVD_IN_RP_CERTIFIED

2012-03-31 Thread Fortney, James T - CSCCS
s for having an address removed. One list manager's opinion. - JimF - James T. Fortney, Principal CSC Consulting Services E-mail: fort...@cscconsulting.com Snail:P.O. Box 3419 Camarillo, CA 93011-3419 --

Re: Rules to block non-english

2011-02-25 Thread James Lay
On 2/25/11 6:32 AM, "Giles Coochey" wrote: >On 25/02/2011 14:31, Giles Coochey wrote: >> On 25/02/2011 14:18, James Lay wrote: >>> Hi folks, >>> >>> SoŠI was sent an email that was pretty much all in ChineseŠheaders >>> below: &g

Rules to block non-english

2011-02-25 Thread James Lay
Any way to tag this stuff as spam? Thanks folks! James

Re: Help with new install

2011-01-30 Thread James Lay
On 1/29/11 5:15 PM, "Mark Martinec" wrote: >On Saturday January 29 2011 15:51:25 James Lay wrote: >> Just did a new install and I'm seeing the below when spamassassin is >> checking an email: >> >> Jan 29 07:47:42 gateway spamd[15540]: dns: sendto(

Help with new install

2011-01-29 Thread James Lay
teway spamd[15540]: Use of uninitialized value in string ne at /usr/lib64/perl5/site_perl/5.10.1/Mail/SpamAssassin/AsyncLoop.pm line 174, line 158. DNS is working fine on the machine, resolve.conf is set with the right information as well. Any hints on to why this is happening? Thanks all. James

Re: SARE and RulesDuJour still relevant

2011-01-14 Thread James Lay
On 1/14/11 6:38 AM, "Jason Bertoch" wrote: >On 2011/01/14 7:28 AM, James Lay wrote: >> Hey All! >> >> Been a while since I did a full blown install of SpamAssassin, and as >> I'm looking at my old setup, I see a fair amount of changes. I have the &g

SARE and RulesDuJour still relevant

2011-01-14 Thread James Lay
files (the bulk of which are in /var/lib/spamassassin/3.003001/). Have rules been optimized or something? Should I copy over all the SARE rules and setup RulesDuJour to update, or leave as is? Thanks for the input. James

RE: List of "banned" words/bounce to sender

2010-08-05 Thread Kelly, James
iler also works great for stopping targeted phishing attacks, too, which as a university we get a lot of. Scamnailer is at http://www.scamnailer.info/ Thanks, James __ James Kelly Network Administrator IS&T Network Operations Chapman University Phone: 714-744-7833 Email: jake...@chapman.edu ---

Re: Rules updates

2010-06-08 Thread James Ralston
On 2010-05-21 at 03:09+02 Karsten Bräckelmann wrote: > 3.2.x is in maintenance, and gets emergency rule updates > *exclusively*. As it has been for quite a long time. > > 3.3.x uses a new rule update model, and gets frequent updates. IFF > the mass-check corpus is large enough. And exactly whe

Treat MAPI submitted mail like SMTP

2010-06-07 Thread James Roman
We are using the CommuniGate Pro mail server, which allows Outlook user to submit messages using the Microsoft's MAPI protocol to submit messages across the IMAP port. The problem that we are having is that although the messages are submitted directly from an authenticated client connection, sp

Re: Reprocess emails that end up in /var/virusmails

2010-03-24 Thread James R. Marcus
Yes I'm using amavisd-new, this got me on the right track. Thanks, James On Mar 23, 2010, at 7:39 PM, Mark Martinec wrote: James, I have a few emails from internal servers that got flagged as SPAM. I added trusted_networks 10.10.10.0/24 to my local.cf so that emails from those servers a

Reprocess emails that end up in /var/virusmails

2010-03-23 Thread James R. Marcus
there a way I can reprocess those emails so they are delivered? SpamAssassin V. 3.002005 Thanks, James

Re: SA 3.3.0 depends on Perl 5.10 (FreeBSD Ports)???

2010-03-05 Thread James Smallacombe
On Fri, 5 Mar 2010, LuKreme wrote: On 04-Mar-10 21:41, James Smallacombe wrote: I tried to upgrade from SA 3.2.5 to 3.3.0 by installing the newer one from FreeBSD Ports. Really? I just did a update of the port tree and yet $ portversion p5-Mail-SpamAssassin p5-Mail-SpamAssassin

Re: SA 3.3.0 depends on Perl 5.10 (FreeBSD Ports)???

2010-03-05 Thread James Smallacombe
On Fri, 5 Mar 2010, RW wrote: On Fri, 5 Mar 2010 10:21:28 -0500 (EST) James Smallacombe wrote: I actually meant spamc's that had no spamd children to talk to. It seems the ports version of SA replaced my original sa-spamd startup script, which raised the max children from (default?) of

Re: SA 3.3.0 depends on Perl 5.10 (FreeBSD Ports)???

2010-03-05 Thread James Smallacombe
On Fri, 5 Mar 2010, Michael Scheidell wrote: On 3/4/10 11:41 PM, James Smallacombe wrote: I tried to upgrade from SA 3.2.5 to 3.3.0 by installing the newer one from FreeBSD Ports. It seems that at least the Ports version thinks that the latest SA requires perl 5.10.x, rather than 5.8.9

Re: SA 3.3.0 depends on Perl 5.10 (FreeBSD Ports)???

2010-03-05 Thread James Smallacombe
On Fri, 5 Mar 2010, RW wrote: On Thu, 4 Mar 2010 23:41:38 -0500 (EST) James Smallacombe wrote: Installing from ports automatically installs perl 5.10.1 which causes spamc children to run wild and basically, spamd can't cope with it. I don't need or w

SA 3.3.0 depends on Perl 5.10 (FreeBSD Ports)???

2010-03-04 Thread James Smallacombe
, but SA just keeps looking for 510 and installing it when it doesn't find it. Reading the SA docs, it doesn't seem to require anything later than 5.8.8...can anyone clue me in as to how to tell the ports version of it to use 5.8.9? Or should I just use the source

Re: [OT?] Web Form Spam

2010-01-29 Thread James Butler
Charles Gregory wrote: > On Fri, 29 Jan 2010, James Butler wrote: >> . Gibberish in the form is just a probe. > > My experience has been that the gibberish gets around simplistic tests > for 'empty' fields. That's why I advocate the use of a field that > *

Re: [OT?] Web Form Spam

2010-01-29 Thread James Butler
Jason Bertoch wrote: > On 1/29/2010 12:44 PM, te...@cnysupport.com wrote: >> >> Really, I was just trying to figure out what the point would be for >> someone to fill out the form with obviously invalid data. >> > > My guess is that it's a spammer's bot looking for a broken web form to > abuse. > M

Re: Project Honeypot URLs

2009-12-16 Thread James Butler
laying the Klingons) on the mainframe side. The game ended up being installed on HP calculators, where it undoubtedly played better than during our mainframe sessions. Talk about network latency! Fire a photon torpedo and wait about 5 minutes to find out if you hit anything. Good times. Sorry about the sidetrack ... carry on! James Butler

Re: there goes the uri scripts..

2009-10-30 Thread James Butler
Oh yes ... there's no denying its complexity. But the desire to use one's native tongue is quite simple. James Butler Pete McNeil wrote: > James Butler wrote: >> We've fielded many, many inquiries about the availability of Arabic >> domain names over the past seve

Re: there goes the uri scripts..

2009-10-30 Thread James Butler
We've fielded many, many inquiries about the availability of Arabic domain names over the past several years. Don't underestimate the backlash against everything being in English for so long ... there are hordes (sorry) of folks who want to be able to use their native charactersets. Ja

Re: SORBS bites the dust

2009-06-24 Thread James Wilkinson
wo countries, and probably doesn’t include email from other countries where this takes place. But by this definition, false positives do occur, and my company’s SpamAssassin installation has to try to handle them. James. ¹ Fortunately, they’re also unaware that signatures should be removed when re

Re: 'anti' AWL

2009-05-02 Thread James Wilkinson
means that AWL really does work as an auto-white-list for us. James. -- E-mail: james@ | ... clueless he is not. He's just selective about which aprilcottage.co.uk | clues to pay attention to. | -- Shmuel (Seymour J.) Metz

Re: Image spam and failing rule

2009-05-02 Thread James Wilkinson
name. > >>> full /Content-Type: image\/gif;\n[^a-z]+name=""/ I think you’ll find that’s one header on two lines, and mimeheader copes with it. Hope this helps, James. -- E-mail: james@ | “As for Nitel, the state telephone monopoly, the less aprilcottage.co.uk | s

Re: Image spam and failing rule

2009-04-25 Thread James Wilkinson
of a spam > > --=_NextPart_000_0075_01C9C5DF.A7950570 > Content-Type: image/png; >name="DSL6672.png" > Content-Transfer-Encoding: base64 > Content-ID: > Content-Disposition: inline > > Any ideas ? mimeheader LOCAL_DSL_ATTACHMENT Content-Type =~ /name=

Re: Another bad kind of spams, for Pfizer knockoffs with image

2009-04-24 Thread James Wilkinson
ndows Mail be counted as a variant of Outlook/Outlook Express? It’s not caught in __ANY_OUTLOOK_MUA: should it be? Hope this helps, James. -- E-mail: james@ | ... a sign carefully conveying in pictograms the fact aprilcottage.co.uk | that you should not leave wheelchairs on a certain river

Re: sa-compile

2009-04-23 Thread James Wilkinson
hashes, and is inherently present in the naming scheme Justin as chosen. James. -- E-mail: james@ | top! to bottom from or backwards read not do I, post top aprilcottage.co.uk | not do Please | -- Jeff Vian

Re: sa-compile

2009-04-21 Thread James Wilkinson
on the names being derived from the string. Thanks, James. -- E-mail: james@ | Humans are humans. No one grouping is all good or all aprilcottage.co.uk | bad, no one group has a monopoly on honour, decency or | truth. Anyone that claims to have one is a

Re: spamc: oops! message_dump

2009-04-17 Thread James Butler
James Butler wrote: > System: Fedora 10, Spamassassin 3.2.5, Perl 5.10.0 > > The following error is preceded by log entry: > spamc[PID]: skipped message, greater than max message size (512000 bytes) > > Error: spamc[PID]: oops! message_dump of 8192 returned different > (there

spamc: oops! message_dump

2009-04-16 Thread James Butler
this? (I understand the error is related to spamc reading in one size and writing out another. What I don't understand is why it is trying to check the >512kb attachment after it claims to be skipping it.) Thank you. James

Re: Near capitable punishment for all capitals?

2009-04-06 Thread James Wilkinson
for this rule. I’m not sure it’s worth putting these emails in a corpus: once you start cherrypicking emails to make a point, the automatic score generation is no longer statistically relevant. James. -- E-mail: james@ | “The duke had a mind that ticked like a clock and, like a aprilcottage

Re: quirks with bayes ?

2009-03-31 Thread James Wilkinson
by default: see http://svn.apache.org/viewvc/spamassassin/trunk/rules/v310.pre?r1=563527&r2=759790&pathrev=759790 James. -- E-mail: james@ | Q. "Why can't I print?" aprilcottage.co.uk | A. "Because you're not a printer." | -- Stephen Judd

Re: quirks with bayes ?

2009-03-31 Thread James Wilkinson
https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6059) one can do a crude approximation by periodically resetting it. Yes, you lose a lot of history. But it’s no worse than not having it at all, which is what is due for 3.3.0. James. ¹ Unless one uses a real SQL database. -- E-mail: j

Re: interesting flash attack in spam

2009-03-19 Thread James Wilkinson
John Hardin wrote: > No reason it shouldn't be. I'd suggest something like a rawbody match on > /]/i meta'd with HTML_MESSAGE should be worth a few (dozen) > points. This would seem to FP on Microsoft HTML generated by certain versions of Word. One example:

Re: Dealing with low scoring spam - tighter MTA integration

2009-03-05 Thread James Wilkinson
one or two DNSBLs? And you’re missing the possibility of doing reverse DNS lookups, too. James. -- E-mail: james@ | A: Because people don’t normally read bottom to top. aprilcottage.co.uk | Q: Why is top-posting such a bad thing? | A: Top-posting. | Q:

Re: does SBL/XBL have a plugin?

2009-03-01 Thread James Wilkinson
Ricardo Kleemann wrote: > Are SBL/XBL tests automatically enabled or is there a plugin I need to enable? SBL/XBL are tested as part of the SpamAssassin ZEN list for 3.2.x if you have network tests enabled. Hope this helps, James. -- E-mail: james@ | “Sir, they’ve taken Mr. Rim

Re: Spamassassin Upgrade

2009-03-01 Thread James Wilkinson
Kban35 wrote: > I just upgraded my SA to 3.2.5 and now when I look in my /etc/init.d I do not > see spamassassin listed anywhere in there. Which OS? How did you upgrade – cpan? yum? apt-get? From where did you get 3.2.5? Thanks, James. -- E-mail: james@ | “Drums must never stop. Ve

Re: Googlegroups related spam

2009-02-24 Thread James Wilkinson
ate links to Usenet posts, too – make sure that the group name doesn’t contain a dot. James. -- E-mail: james@ | Q. "Why can't I print?" aprilcottage.co.uk | A. "Because you're not a printer." | -- Stephen Judd

Re: not seeing any advantage to sa-learn?

2009-02-08 Thread James Wilkinson
les aimed at them can be very effective. Alternatively, you could post sightings on news.admin.net-abuse.sightings and see if Spamhaus pick up on them. That way, more people can be spared their spam. James. -- E-mail: james@ | Remember, half-measures can be very effective if all you aprilcotta

  1   2   3   4   >