RE: non-free Services

2024-09-18 Thread Simon Standley
We use invalument.com ... good for the stuff that often slips by. Your mileage may vary, etc. -Original Message- From: Philipp Ewald Sent: 18 September 2024 11:27 To: users@spamassassin.apache.org Subject: Re: non-free Services Hello, >The idea is that you can use those services for f

Re: whitelist_auth return_path / from

2024-07-03 Thread Simon Wilson via users
On Thursday, July 04, 2024 02:01 AEST, Benny Pedersen wrote: > Simon Wilson via users skrev den 2024-07-03 15:54: > > > header AUTHRES_DKIM_PASS eval:check_authres_result('dkim', 'pass') > > header USER_IN_DKIM_WHITELIST eval:check_for_dkim_whitelist_f

Re: whitelist_auth return_path / from

2024-07-03 Thread Simon Wilson via users
On Thursday, July 04, 2024 01:11 AEST, Bill Cole wrote: > On 2024-07-03 at 10:19:28 UTC-0400 (Thu, 04 Jul 2024 00:19:28 +1000) > Simon Wilson via users > is rumored to have said: > > > On 03.07.24 23:54, Simon Wilson via users wrote: > >> Simon Wilson via users

Re: whitelist_auth return_path / from

2024-07-03 Thread Simon Wilson via users
Simon Wilson via users skrev den 2024-07-03 14:56: > Do I also need to disable the normal SA DKIM plugin evaluation, i.e. > trusting my upstream authres_trusted_authserv only? both works in paralel, so no need to disable, best results came from  both enabled its up to you to ad

Re: whitelist_auth return_path / from

2024-07-03 Thread Simon Wilson via users
On 03.07.24 23:54, Simon Wilson via users wrote: >Simon Wilson via users skrev den 2024-07-03 14:56: >> Do I also need to disable the normal SA DKIM plugin evaluation, i.e. >> trusting my upstream authres_trusted_authserv only? > >both works in paralel, so no need to disab

Re: whitelist_auth return_path / from

2024-07-03 Thread Simon Wilson via users
Simon Wilson via users skrev den 2024-07-03 14:56: > Do I also need to disable the normal SA DKIM plugin evaluation, i.e. > trusting my upstream authres_trusted_authserv only? both works in paralel, so no need to disable, best results came from  both enabled its up to you to ad

Re: whitelist_auth return_path / from

2024-07-03 Thread Simon Wilson via users
  Simon Wilson via users skrev den 2024-07-03 14:13: > I don't think SA 3.4.6 on RH8 has AuthRes plugin: take it from spamassassin trunc, this plugin works on 3.4.6 aswell, but  was not released or tested on it, i have verify it does work #!/bin/sh svn checkout http://svn.apache.org/r

Re: whitelist_auth return_path / from

2024-07-03 Thread Simon Wilson via users
On Wednesday, July 03, 2024 22:06 AEST, "Simon Wilson via users" wrote:   Dave Funk skrev den 2024-07-03 09:29: > On Wed, 3 Jul 2024, Simon Wilson via users wrote: > You say "passing SPF and DKIM" however in the SA rules report it  > clearly says: > D

Re: whitelist_auth return_path / from

2024-07-03 Thread Simon Wilson via users
Dave Funk skrev den 2024-07-03 09:29: > On Wed, 3 Jul 2024, Simon Wilson via users wrote: > You say "passing SPF and DKIM" however in the SA rules report it  > clearly says: > DKIM_SIGNED=0.1, DKIM_INVALID=0.1 >  > So eventho you think 'passed DKIM' SA c

Re: whitelist_auth return_path / from

2024-07-03 Thread Simon Wilson via users
On Wed, 3 Jul 2024, Simon Wilson via users wrote: > Does whitelist_auth work on From header, or Return-Path? Reason I ask: > >  >  > I have two emails from “support .at. wasabi.com”. Due to their emails usually > triggering KAM rules I have (in > /etc/mail/

whitelist_auth return_path / from

2024-07-02 Thread Simon Wilson via users
: Subject: [SPAM] Wasabi Technologies LLC Invoice Reply-To: supp...@wasabi.com Do I need to add the return-path, i.e.:   ## Whitelist Wasabi, subject to passing of auth whitelist_auth supp...@wasabi.com whitelist_auth *@mmemail.wasabi.com ?   Thanks. Simon.

Re: DMARC Aggregate reports - false positives

2023-06-22 Thread Simon Wilson via users
On Thursday, June 22, 2023 23:05 AEST, Bill Cole wrote:  On 2023-06-22 at 06:29:53 UTC-0400 (Thu, 22 Jun 2023 20:29:53 +1000) Simon Wilson via users is rumored to have said: > I find most DMARC reports I receive are flagged as spam by SA.  > > How do people work around this? I&#

Re: DMARC Aggregate reports - false positives

2023-06-22 Thread Simon Wilson via users
On Thursday, June 22, 2023 20:37 AEST, Damian wrote:   I find most DMARC reports I receive are flagged as spam by SA.> Which submitters? I looked at a bunch of my reports and they are all MIME_GOOD. That one was from microsoft. --  Simon Wilson M: 0400 121 116

DMARC Aggregate reports - false positives

2023-06-22 Thread Simon Wilson via users
_DIFF=0.79, PYZOR_CHECK=1.392, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, T_TVD_MIME_NO_HEADERS=0.01] --  Simon Wilson M: 0400 121 116

Re: SHOPIFY_IMG_NOT_RCVD_SFY but from Shopify

2021-11-15 Thread Simon Wilson
is rule is triggering a lot on emails which are not Spam, reducing score from 2.497 score SHOPIFY_IMG_NOT_RCVD_SFY1.8 Simon -- Simon Wilson M: 0400 12 11 16

Re: CHAOS: v1.2.2: Of Documentation

2021-07-23 Thread Simon Wilson
- Message from Jared Hall - Date: Fri, 23 Jul 2021 00:07:52 -0400 From: Jared Hall Subject: CHAOS: v1.2.2: Of Documentation To: users@spamassassin.apache.org Simon Wilson wrote: could you, please, finally, describe what does this module do, here to the list and/or to

Re: CHAOS: v1.2.1 Released

2021-07-22 Thread Simon Wilson
art with the easy parts and follow with those more compliated functionality, because I feel the description starts with thelatter. I'm guessing from the silence in response that this will remain a mystery. Simon. ___ Simon Wilson M: 0400 12 11 16

Re: KAM_SENDGRID and SPF_HELO_NONE

2021-05-20 Thread Simon Wilson
result by applying the check_host() function to the "MAIL FROM" identity as the . A HELO SPF check is most certainly not a "fall-back". Whether the SPF checking tool used follows the RFC is another matter entirely :-) Simon. -- Simon Wilson M: 0400 12 11 16

Re: KAM_DMARC_REJECT on internal emails

2021-04-20 Thread Simon Wilson
INBOUND -- Simon Wilson M: 0400 12 11 16

Re: KAM_DMARC_REJECT on internal emails

2021-04-20 Thread Simon Wilson
> On Mon, Apr 19, 2021 at 10:05:21PM +1000, Simon Wilson wrote: rather than change the channel distributed KAM.cf, what needs to go in local.cf to tell that not to run? *CAN* it be disabled from local.cf, or can it only be done by commenting out the entry in KAM.cf? It would not make any se

Re: KAM_DMARC_REJECT on internal emails

2021-04-20 Thread Simon Wilson
e relevant milters have run and added trusted headers on inbound email. Simon. -- Simon Wilson M: 0400 12 11 16

Re: Senderscore

2021-04-20 Thread Simon Wilson
And btw, usually on the DNS infos of Senderscores, you can see about 3 days of lag compared to their online interface, dunno if expected on their side, or they're facing perf issues, but that service is not a top priority at all at least On Mon, Apr 19, 2021 at 7:29 PM Simon Bressier

Re: KAM_DMARC_REJECT on internal emails

2021-04-20 Thread Simon Wilson
- Message from Henrik K - Date: Mon, 19 Apr 2021 17:11:41 +0300 From: Henrik K Reply-To: users@spamassassin.apache.org Subject: Re: KAM_DMARC_REJECT on internal emails To: users@spamassassin.apache.org On Mon, Apr 19, 2021 at 10:05:21PM +1000, Simon Wilson wrote

Re: Senderscore

2021-04-19 Thread Simon Bressier
And btw, usually on the DNS infos of Senderscores, you can see about 3 days of lag compared to their online interface, dunno if expected on their side, or they're facing perf issues, but that service is not a top priority at all at least On Mon, Apr 19, 2021 at 7:29 PM Simon Bressier

Re: Senderscore

2021-04-19 Thread Simon Bressier
Hi Simon, For info for few days now, the Senderscore DNS server is failing to answer. I've pinged one relation I have at Validity so they can dig on it. Senderscore via DNS is a legacy service they just maintain but dunno for how long... They are more on a mood to stop that service in the f

Re: KAM_DMARC_REJECT on internal emails

2021-04-19 Thread Simon Wilson
pamassassin ?, it have to know all wan ips for your own server / servers Yes, my trusted_networks, internal_networks and msa_networks are all set correctly... I had a long discussion with this mailing list on the subject last year and got excellent help on resolving that! :) - End me

Re: KAM_DMARC_REJECT on internal emails

2021-04-19 Thread Simon Wilson
- Message from RW - Date: Mon, 19 Apr 2021 12:47:02 +0100 From: RW Subject: Re: KAM_DMARC_REJECT on internal emails To: users@spamassassin.apache.org On Mon, 19 Apr 2021 16:36:58 +1000 Simon Wilson wrote: Hi list, - I'm running KAM rules in Spamassassin - Po

Re: KAM_DMARC_REJECT on internal emails

2021-04-19 Thread Simon Wilson
I'd say that a proper solution would be to DKIM-sign mail before it's spam-scanned. On 19.04.21 19:39, Simon Wilson wrote: Good point. If DKIM is signed it should pass DMARC, even if SPF fails. Amavisd handles both pieces, including DKIM signing... from looking at the headers it

Re: KAM_DMARC_REJECT on internal emails

2021-04-19 Thread Simon Wilson
On 19.04.21 16:36, Simon Wilson wrote: - I'm running KAM rules in Spamassassin - Postfix port 587-submitted email is sent to Amavisd (as a content_filter) on port 10026 (tagged as ORIGINATING/MYNETS) and is spam-checked and DKIM-signed on its way out the door, sent back to Postfix at

KAM_DMARC_REJECT on internal emails

2021-04-18 Thread Simon Wilson
_50 results. sa-learn advises tokens learned, but it still seems to struggle with these. Other than that my Bayes is excellent, very effective and accurate. Any advice would be appreciated. Simon. -- Simon Wilson M: 0400 12 11 16

Senderscore

2021-04-18 Thread Simon Wilson
like every inbound email. From what I can see it's a genuine blocklist lookup by SA... (RCVD_IN_RP_RNBL in 20_dnsbl_tests.cf) but the error rate is strange. Am I the only one with high volume of lookup errors from that bl? :-) or do I need to be looking for an issue locally... Simon. --

Re: Update SA on CentOS

2021-04-04 Thread Simon Wilson
- Message from Bill Cole -    Date: Sun, 04 Apr 2021 15:16:32 -0400    From: Bill Cole Subject: Re: Update SA on CentOS      To: users@spamassassin.apache.org On 4 Apr 2021, at 0:19, Simon Wilson wrote: CentOS / RHEL backport critical security fixes into the stock versions

Re: Update SA on CentOS

2021-04-03 Thread Simon Wilson
- Message from Amir Caspi - Date: Sat, 3 Apr 2021 22:06:03 -0600 From: Amir Caspi Subject: Re: Update SA on CentOS To: si...@simonandkate.net Cc: users@spamassassin.apache.org On Apr 3, 2021, at 9:15 PM, Simon Wilson wrote: And then you are not stepping away

Re: Update SA on CentOS

2021-04-03 Thread Simon Wilson
ation (and teaching it when it fails to get it right) resulted in excellent spam prevention on CentOS 7 with its standard packaged SA. And then you are not stepping away from one of CentOS's main advantages - stable packages not built outside of RPM. Simon -- Simon Wilson M: 0400 12 11 16

Re: SA DKIM check

2021-04-02 Thread Simon Wilson
ernal by a properly configured SpamAssassin, please open a bug report. Yep, been through all of that with making sure SA knows what is internal and external, and what it can trust and not. No issues there. Simon -- Simon Wilson M: 0400 12 11 16

SA DKIM check

2021-04-01 Thread Simon Wilson
Does SA always do its "own" DKIM check, or can it be told to use an already written trusted AuthservId-written Authentication-Results header, e.g. from OpenDKIM? Thanks -- Simon Wilson M: 0400 12 11 16

Spamassassin reading inbound filter results; WAS: Re: Optimising DNS-based checks

2021-03-30 Thread Simon Wilson
d rules, but what is best practice for using DMARC results in Spamassassin? Simon -- Simon Wilson M: 0400 12 11 16

Re: Optimising DNS-based checks

2021-03-30 Thread Simon Wilson
ng a Received-SPF filter using python-policyd-spf (called as last check in smtpd_recipient_restrictions), so yes it would make sense for spamassassin to trust the check already made - I'll see if I can work out how to do that. Simon. -- Simon Wilson M: 0400 12 11 16

Optimising DNS-based checks

2021-03-29 Thread Simon Wilson
quick and consistent average < 0.4s Simon SA Timing Percentiles % TimeTotal (ms)0% 5% 25% 50% 75%

Re: AWL on 3.4

2021-03-21 Thread Simon Wilson
as Intended (TM). I've not set txrep_autolearn on yet, will monitor for a while. Simon On Sun, Mar 21, 2021 at 3:04 AM Simon Wilson wrote: - Message from John Hardin - Date: Sat, 20 Mar 2021 08:08:17 -0700 (PDT) From: John Hardin Subject: Re: AWL on

Re: AWL on 3.4

2021-03-21 Thread Simon Wilson
- Message from John Hardin - Date: Sat, 20 Mar 2021 08:08:17 -0700 (PDT) From: John Hardin Subject: Re: AWL on 3.4 To: users@spamassassin.apache.org On Sun, 21 Mar 2021, Simon Wilson wrote: I've just migrated and updated to SA 3.4, and have moved the Bayes

AWL on 3.4

2021-03-20 Thread Simon Wilson
it goes, but am interested in comments on its usefulness? Simon -- Simon Wilson M: 0400 12 11 16

Re: sa-update error 3 no mirrors.sought.rules.yerp.org

2021-03-13 Thread Simon Wilson
" You've not stated your OS but on a RHEL/CentOS 7 box the correct way to remove is to go to /etc/mail/spamassassin/channel.d and delete sought.conf. -- Simon Wilson M: 0400 12 11 16

Re: Mailspike rules all return 0.0

2020-07-29 Thread Simon Harwood
sassin/local.cf <http://local.cf>*, just add > something like this: > > score RCVD_IN_MSPIKE_BL 0 4 0 4 > score RCVD_IN_MSPIKE_L5 0 4 0 4 > > This would add 4 points to the scoring when these rules matched. > > On Wed, Jul 29, 2020 at 3:28 PM Simon Harwood > w

Mailspike rules all return 0.0

2020-07-29 Thread Simon Harwood
, Simon

Re: Trusted network mail spam detection

2019-10-17 Thread Simon Wilson
.. I now have the following in local.cf and it seems to be working OK, but I'll keep an eye on it. trusted_networks 192.168.1. 119.18.34.29 internal_networks 192.168.1. 119.18.34.29 msa_networks 192.168.1.230 score ALL_TRUSTED -1.4 Thanks again. -- Simon Wilson M: 0400 12 11 16

Re: Trusted network mail spam detection

2019-10-16 Thread Simon Wilson
Quoting Bill Cole : On 16 Oct 2019, at 7:55, Simon Wilson wrote: Quoting Tom Hendrikx : [...] RDNS_DYNAMIC tries to exclude authenticated email. Are you accepting email from senders without authentication? Or maybe your trusted_networks/internal_networks are misconfigured, so the

Re: Trusted network mail spam detection

2019-10-16 Thread Simon Wilson
Quoting Simon Wilson : Quoting Tom Hendrikx : On 16-10-19 12:19, Simon Wilson wrote: Hi, I have a Horde system submitting to a postfix/amavisd-new/spamassassin server for spam detection (different servers, same subnet). I *do* consciously run SA over internally submitted emails to catch

Re: Trusted network mail spam detection

2019-10-16 Thread Simon Wilson
Quoting Tom Hendrikx : On 16-10-19 12:19, Simon Wilson wrote: Hi, I have a Horde system submitting to a postfix/amavisd-new/spamassassin server for spam detection (different servers, same subnet). I *do* consciously run SA over internally submitted emails to catch compromised accounts (it

Trusted network mail spam detection

2019-10-16 Thread Simon Wilson
boost? Or anything more scientific?? Simon. -- Simon Wilson M: 0400 12 11 16

Re: tests_pri on new server

2017-04-30 Thread Simon Wilson
] - but is taking a LOT longer to complete them. Complete timing results are below. Is this just how long it takes now, or is there any tweaking I can be doing? Simon ** Full DNS timings Old server May 1 14:40:37.266 [14560] dbg: async: timing: 0.010 . dns:A:us-west-2.amazonses.com M

Re: tests_pri on new server

2017-04-30 Thread Simon Wilson
ical email takes about 4000ms. On each server it is tests_pri_0 that takes the majority of the time, which I understand from reading is to be expected. Is the extended duration to be expected with newer SA, or do I need to be digging deeper to try and find out why it's so much slower?

tests_pri on new server

2017-04-28 Thread Simon Wilson
erver, the identical email takes about 4000ms. On each server it is tests_pri_0 that takes the majority of the time, which I understand from reading is to be expected. Is the extended duration to be expected with newer SA, or do I need to be digging deeper to try and find out why it's so much

Re: USPS Spam

2013-08-30 Thread Simon Loewenthal
Plenty this week. I've just been sending to spamcop, but not a lot else. Matt wrote: >I am seeing tons of junk getting through claiming to be from the USPS >about a missed delivery package. Anyone else seeing this? > >I am running SpamAssassin 3.3.1 and execute sa-update weekly.

Re: SA Bugzilla – Bug 6558

2013-08-13 Thread Simon Loewenthal
Great. Thanks Anthony. -- as silly as fun simon@klunky / .co.uk / .net pgp 4BA78604 Antony Stone wrote: >On Tuesday 13 August 2013 at 17:17, Simon Loewenthal wrote: > >> Hi, >> >> Did this make it into 3.3.2? ( e.g mended ) >> >> https://issues.apache.o

SA Bugzilla – Bug 6558

2013-08-13 Thread Simon Loewenthal
Hi, Did this make it into 3.3.2? ( e.g mended ) https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6558 Cheers, S

Re: Test email hitting BAYES_00

2013-07-24 Thread Simon Loewenthal
On 2013-07-24 15:59, RW wrote: > On Wed, 24 Jul 2013 15:15:01 +0200 > Simon Loewenthal wrote: > >> I rewrote this (not GTUBE anymore) and had the same bayes score >> http://pastebin.com/ATqch32Y [1] [3] > > It's not particularly surprising it hits BAYES

Re: Test email hitting BAYES_00

2013-07-24 Thread Simon Loewenthal
On 2013-07-24 14:41, RW wrote: > On Wed, 24 Jul 2013 14:04:36 +0200 > JK4 wrote: > >> On 2013-07-24 13:31, RW wrote: > This isn't a GTUBE email, it's an email with lots of innocuous text and the > obfuscated name of a drug claiming to be a GTUBE email. > http://spamassassin.apache.org/gtube

Test email hitting BAYES_00

2013-07-24 Thread Simon Loewenthal
http://pastebin.com/5N0xhWms [1] Thanks, Simon. _*_ _# sa-learn --forget --username=spammyd aaa_ _Forgot tokens from 0 message(s) (1 message(s) examined)_ Links: -- [1] http://pastebin.com/5N0xhWms

Re: IP Blacklisting

2013-07-12 Thread Simon Loewenthal
d into the_ main.cf_ header_checks = pcre:/etc/postfix/header_checks Completely untested and not really thought about, of course. I suspect my regexes are broken, but this gives you an idea. -- "I decided that I was a lemon for a couple of weeks. I kept myself amused all that time jumping in and out of a gin and tonic." simon@klunky .co.uk / .org

Just interested: MIME validation ruleset and ASCII-0

2013-05-30 Thread Simon Loewenthal
! Simon

Re: CLAMAV skipped on same email when sent from spamd, yet not skipped when sent from spamc.

2013-05-29 Thread Simon Loewenthal
On 2013-05-29 12:43, Matus UHLAR - fantomas wrote: > On 29.05.13 12:29, Simon Loewenthal wrote: > >> The socket seems ok to me: srw-rw-rw- 1 clamav clamav 0 May 14 21:43 >> /var/run/clamav/clamd.ctl > > what are permissions for /var/run/clamav ? drwxr-xr-x Sin

Re: CLAMAV skipped on same email when sent from spamd, yet not skipped when sent from spamc.

2013-05-29 Thread Simon Loewenthal
On 2013-05-29 11:40, Mark Martinec wrote: > Simon, > >> I looked at scoring for an email on an SA installation and noticed >> differences between hand scanning with spamc and scanning with spamd. My >> manually scanned email hit CLAMAV sane security, (ignore Bayes

Re: CLAMAV skipped on same email when sent from spamd, yet not skipped when sent from spamc.

2013-05-29 Thread Simon Loewenthal
On 2013-05-29 9:21, Matus UHLAR - fantomas wrote: > On 28.05.13 17:30, Simon Loewenthal wrote: > >> I looked at scoring for an email on an SA installation and noticed >> differences between hand scanning with spamc and scanning with spamd. My >> manually scann

CLAMAV skipped on same email when sent from spamd, yet not skipped when sent from spamc.

2013-05-28 Thread Simon Loewenthal
Hallo there, I looked at scoring for an email on an SA installation and noticed differences between hand scanning with spamc and scanning with spamd. My manually scanned email hit CLAMAV sane security, (ignore Bayes because the user had Bayes process this and then asked me about this), whilst

Re: Bayes & sa-learn training question - How to exclude certain URLs found in emails

2013-05-16 Thread Simon Loewenthal
Thank-you everyone. I shall have Bayes forget emails, then retrain with a rule that counts linkedin invitations as spam. I have one I wrote earlier and implemented after Bayes had gone off track. Cheers, S. -- as silly as fun simon@klunky / .co.uk / .org / .net pgp 4BA78604 Benny

Re: Bayes & sa-learn training question - How to exclude certain URLs found in emails

2013-05-16 Thread Simon Loewenthal
On 2013-05-16 16:17, RW wrote: On Thu, 16 May 2013 15:17:14 +0200 Simon Loewenthal wrote: Hi all, I turned shortcircuit for BAYES_00 on a server, and noticed that LinkedIn invitation emails hit BAYES_00. When you say email, I presume you mean spam. Yep A bit strange I thought being

Bayes & sa-learn training question - How to exclude certain URLs found in emails

2013-05-16 Thread Simon Loewenthal
Hi all, I turned shortcircuit for BAYES_00 on a server, and noticed that LinkedIn invitation emails hit BAYES_00. A bit strange I thought being unlikely someone had run sa-learn on LinkedIn emails. I grepped on all the Ham and Spam directories and hit lots of "linkedin,com" in URLs in the bod

Re: Norwegian language spam

2013-05-02 Thread Simon Loewenthal
cided that I was a lemon for a couple of weeks. I kept myself amused all that time jumping in and out of a gin and tonic." simon@klunky .co.uk / .org On 2013-05-02 12:45, Martin Gregorie wrote: > The last two days I've started to get a small amount of spam with these > characteri

Re: pyzor 401/unauthorized?

2013-03-06 Thread Simon Loewenthal
fight apathy or don't simon@klunky / .co.uk / .org pgp 4BA78604 "Dan Mahoney, System Admin" wrote: >I was in the process of "linting" my SA config when I discovered that >the >pyzor servers are handing back this response to all commands: > >/usr/local/bin/

Re: Upgrade from SA 3.3.1 to 3.3.2 - increase in memory requirements on Debian 6

2013-03-06 Thread Simon Loewenthal
Guess what? After removal of, local_phishing_reply.cf 99_anonwhois.cf malware.blocklist.cf the memory usage dropped to 15% of RAM. Time to add more children into the mix. Cheers, S On 2013-03-06 15:55, Kevin A. McGrail wrote: > On 3/6/2013 9:53 AM, Simon Loewenthal wr

Re: Upgrade from SA 3.3.1 to 3.3.2 - increase in memory requirements on Debian 6

2013-03-06 Thread Simon Loewenthal
le sets. I shall drop some rule sets. An sa-compile is run every time the automatically downloaded rulesets change, but this won't necessarily cut here when so tight on ram. On 2013-03-06 15:36, Kevin A. McGrail wrote: > On 3/6/2013 9:17 AM, Simon Loewenthal wrote: > >> Op

Re: Upgrade from SA 3.3.1 to 3.3.2 - increase in memory requirements on Debian 6

2013-03-06 Thread Simon Loewenthal
e has dropped to 198 Mb, which is a relief, but this happened after I did a update on the server from squeeze/updates, squeeze, and security. Before time I just had security configured. Cheers, S On 2013-03-06 14:57, Kevin A. McGrail wrote: > On 3/5/2013 7:36 AM, Simon Loewenthal wrote:

Upgrade from SA 3.3.1 to 3.3.2 - increase in memory requirements on Debian 6

2013-03-05 Thread Simon Loewenthal
performance related dependencies on other packages? Currently, Perl is 5.10.1-17squeeze4. Regards, S -- "I decided that I was a lemon for a couple of weeks. I kept myself amused all that time jumping in and out of a gin and tonic." simon@klunky .co.uk / .org

Re: sa-learn " splice() offset past end of array at /usr/share/perl5/Mail/SpamAssassin/HTML.pm line 492 and 502.

2013-02-27 Thread Simon Loewenthal
Mark Martinec wrote: >Simon Loewenthal wrote: >> > Just notcied sa-learn kick up a fuss with some files fed into >> > it from a user's HAM directory in a dovecot directory. >> > >> > I put a copy of >> > the ham on http://pastebin.com/MLEh

sa-learn " splice() offset past end of array at /usr/share/perl5/Mail/SpamAssassin/HTML.pm line 492 and 502.

2013-02-27 Thread Simon Loewenthal
^s*([a-z_-]+)s*:s*(S.*?)s*$/i) { # "display: none", "visibility: hidden", etc. $new{'style_'.$1} = $2; } } } sa-learn still exits with a zero. Does any one know what may have tripped this up? Is it a bug, or some strange formatting in the email message?

Re: White Text Rule

2013-02-05 Thread Simon Loewenthal
Hi Mark, maybe this works. This I stole it from someone who posted here. # HTML - White text on a white background. What is the point? rawbody HTML_TEXT_WHITE_SHORT /style=.color#FFF;/ describe HTML_TEXT_WHITE_SHORT White html txt on white bg score HTML_TEXT_WHITE_SHORT 0.1 Simon --- &q

Re: Question about rule: 2.0 DEAR_SOMETHING BODY: Contains 'Dear (something)'

2012-10-25 Thread Simon Loewenthal
dar...@chaosreigns.com wrote: > >But more importantly, it's because we do not have have the rule >hit statistics from your email .. Which has been on my personal backlog for over a year. (It is self-serving & should have a higher priority thus) .

Re: Question about rule: 2.0 DEAR_SOMETHING BODY: Contains 'Dear (something)'

2012-10-25 Thread Simon Loewenthal
Except for formal letters to administrative addresses. Dear Bob was a frivolous and incorrect example. It is really Sir/Madam As Alex noted, I coils score it lower,bit am concerned on the overall effect. I'lltest first. Cheers. RW wrote: >On Thu, 25 Oct 2012 16:47:20 +0200 >Simon

Question about rule: 2.0 DEAR_SOMETHING BODY: Contains 'Dear (something)'

2012-10-25 Thread Simon Loewenthal
Evening all, A great majority of our ham starts with Dear Sir/ Dear Madam / Dear Bob. Therefore I've always wondered why this this is scored so highly: * 2.0 DEAR_SOMETHING BODY: Contains 'Dear (something)' Does anyone know the rational behind this, or is our user base simply communicating

Re: Academic interested in interviewing you for research paper.

2012-08-18 Thread Simon Loewenthal
>... for their own protection. What do we need protection from? s -- Dogs are tough. I've been interrogating this one for hours and he still won't tell me who's a good boy. simon@klunky / .co.uk / .org jonathonb wrote: >Hi All, > >Some interesting responses

Re: spamassassin bayesian training on foreign characters

2012-07-24 Thread Simon Loewenthal
Hi I have Bayes correctly scoring BAYES_99 on Dutch and French straight out of the box. No problems. -- Dogs are tough. I've been interrogating this one for hours and he still won't tell me who's a good boy. simon@klunky / .co.uk / .org John Hardin wrote: >On Mon,

Re: Where the spams are stored

2012-04-13 Thread Simon Loewenthal
Hi, SA does not store spam. It scans it. It is up to your to decide what to do with it. I send mine to Dovecot for delivery to the users' mailboxes. S -- Dogs are tough. I've been interrogating this one for hours and he still won't tell me who's a good boy. simon@kl

Re: Mail::SpamAssassin::Plugin::SpamCop

2012-04-11 Thread Simon Loewenthal
On 04/12/2012 12:58 AM, Benny Pedersen wrote: > Den 2012-04-11 15:37, Simon Loewenthal skrev: > >> Partially answered. >> # spamassassin --lint >> Apr 11 15:35:06.700 [24545] warn: config: failed to parse line, >> skipping, in "/etc/spamassassin/local.cf&q

Re: Mail::SpamAssassin::Plugin::SpamCop

2012-04-11 Thread Simon Loewenthal
On 11/04/12 15:30, Simon Loewenthal wrote: > Hi, > > Are these options still valid for > Mail::SpamAssassin::Plugin::SpamCop settings in the local.cf > http://spamassassin.apache.org/full/3.3.x/doc/Mail_SpamAssassin_Plugin_SpamCop.html > > (from spamcop.net http://spamco

Mail::SpamAssassin::Plugin::SpamCop

2012-04-11 Thread Simon Loewenthal
Hi, Are these options still valid for Mail::SpamAssassin::Plugin::SpamCop settings in the local.cf http://spamassassin.apache.org/full/3.3.x/doc/Mail_SpamAssassin_Plugin_SpamCop.html (from spamcop.net http://spamcop.net/fom-serve/cache/331.html ). *It is recommended the default settings in Sp

Re: Quick question about enabling a private rules in the local.cf

2012-03-26 Thread Simon Loewenthal
spamc >> run? >> >> spamc -y -R < /path/to/sampler >> >> What did you see here then? >> >> >> Banyan He >> Blog: http://www.rootong.com >> Email: ban...@rootong.com >> >> >> On 2012-03-23 8:49 PM, Simon Loewenthal wrote

Re: Quick question about enabling a private rules in the local.cf

2012-03-23 Thread Simon Loewenthal
; /path/to/sampler > > What did you see here then? > > > Banyan He > Blog: http://www.rootong.com > Email: ban...@rootong.com > > > On 2012-03-23 8:49 PM, Simon Loewenthal wrote: >> Indeed I certainly can. >> >> http://pastebin.com/c2an4

Re: Quick question about enabling a private rules in the local.cf

2012-03-23 Thread Simon Loewenthal
Indeed I certainly can. http://pastebin.com/c2an4irw On 23/03/12 13:44, Banyan He wrote: > Maybe you can share with us the debug output for the second thought in > this case, Simon. > > Best regards, > > > Banyan He > Blog: http://www.rootong.com > Email:

Quick question about enabling a private rules in the local.cf

2012-03-23 Thread Simon Loewenthal
|sucabikes\.com\.ar|mpe-export\.com|eceurop\.com|cdromland\.nl|buyshield\.com)/ scoreRBODY_PDOMAINS1 5.0 SA version is 3.3.1-1 running on Debian Squeeze. Something ought to have changed, because I swear these custom rules works last month. Regards, Simon -- PGP is optional

Re: Better phish detection

2012-03-12 Thread Simon Loewenthal
Paul Russell wrote: >On 3/12/2012 12:58, Simon Loewenthal wrote: >> >> At first glance: >> This is private black list of email assesses maintened by many. Free >to use, but it'll turn into a huge file for a server to parse. >> >> Eventually we m

Re: Better phish detection

2012-03-12 Thread Simon Loewenthal
"David F. Skoll" wrote: >Hi, > >I've been following this thread... not sure how many of you are aware >of >this project: > >http://code.google.com/p/anti-phishing-email-reply/ > >We use the phishing address list and it does catch a few things. We >don't yet use the phishing URL list, but it look

Re: Spamassassin detect my mails as spam

2012-03-09 Thread Simon Loewenthal
On 09/03/12 11:29, FC Mario Patty wrote: > I'm sorry for not giving full information before. > > We set our mail server to use SMTP with TLS (port 587) and the > outgoing server (of the mail client on android smart phone) as our > server itself (in other words, not relaying through the provider > s

Re: Some rules I created for suspicious Javascript practices

2012-03-06 Thread Simon Loewenthal
Hi, Were these rules, or an improved variant, added to the rules? Regards, Simon. On 16/02/12 01:43, neon_overload wrote: > Hello, > > I have created some rules which I have found to be very effective so far at > identifying a certain type of spam that spamassassin other

Re: uribl lastminute.com listed in uribl whte and is now used for nordea phisting mails

2012-03-02 Thread Simon Loewenthal
It was a last minute decision. Jeremy McSpadden wrote: >Ha. Nice > > >-- >Jeremy McSpadden > >On Mar 2, 2012, at 10:38 AM, "Michael Scheidell" > wrote: > >> On 3/2/12 11:36 AM, Benny Pedersen wrote: >>> just a note to whom it might concern :) >>> >> phisting? >> >> OUCH. >> >> >> -- >> Mich

Re: Bayes now changed to autolearn=unavailable.

2012-02-27 Thread Simon Loewenthal
On 27/02/12 15:29, Simon Loewenthal wrote: > On 27/02/12 15:24, Simon Loewenthal wrote: >> On 27/02/12 13:55, RW wrote: >>> On Mon, 27 Feb 2012 11:48:50 +0100 >>> Simon Loewenthal wrote: >>> >>> >>>> Recently I enabled shortcircuit for

Re: Bayes now changed to autolearn=unavailable.

2012-02-27 Thread Simon Loewenthal
On 27/02/12 15:24, Simon Loewenthal wrote: > On 27/02/12 13:55, RW wrote: >> On Mon, 27 Feb 2012 11:48:50 +0100 >> Simon Loewenthal wrote: >> >> >>> Recently I enabled shortcircuit for ham on a server because Bayes >>> seems reasonably well trained.

Re: Bayes now changed to autolearn=unavailable.

2012-02-27 Thread Simon Loewenthal
On 27/02/12 13:55, RW wrote: > On Mon, 27 Feb 2012 11:48:50 +0100 > Simon Loewenthal wrote: > > >> Recently I enabled shortcircuit for ham on a server because Bayes >> seems reasonably well trained. It works well. >> >> I noticed that emails that did

Bayes now changed to autolearn=unavailable.

2012-02-27 Thread Simon Loewenthal
: 4BA78604 simon @ klunky . org simon @ klunky . co.uk I won't accept your confidentiality agreement, and your Emails are kept. ~Ö¿Ö~

Re: warn: config: SpamAssassin failed to parse line, no value provided for "body", skipping: body

2012-02-16 Thread Simon Loewenthal
version eval stuff we've been trying to push out. > > On 2/3/2012 2:35 PM, Simon Loewenthal wrote: >> >> Yep, fails on standard rules. >> >> ( Excuse the slightly messy copy and paste, but I am using ConnectBot on a >> smartphone whilst travelling on

  1   2   >