Re: learning from IMAP spam collection

2009-05-20 Thread martin f krafft
also sprach Jeff Mincy [2009.05.19.1445 +0200]: > formail -b -t -I X-Spam-Status: -I X-Spam-Flag: -I X-Spam-Checker-Version: -I > X-Spam-Rbl: -I X-Spam-Pyzor: -I X-Spam-DCC: -I X-Spam-Level: -I X-Spam-Bayes: > -I X-Spam-Relay: -I X-Spam-Report: -I X-Spam-AWL: -I X-Spam-Karma: -I > X-Spam-ASN: -

Re: Posioned MX is a bad idea [Was: Email forwarding and RBL trouble]

2007-08-27 Thread martin f krafft
also sprach mouss <[EMAIL PROTECTED]> [2007.08.26.1930 +0200]: > Indeed. reject != score. Moreover, I wouldn't put > - MX => private IP > - MX = "*.mx.*" Why *.mx.*? I happen to run all my MX as ?.mx.$my_domain and there is no reason why this should be indicative of anything. -- martin;

Re: Should I disable URIDNSBL plugin if I'm already rejecting based on BL with MTA

2007-08-17 Thread martin f krafft
also sprach Kai Schaetzl <[EMAIL PROTECTED]> [2007.08.16.2031 +0200]: > It will not have rejected them as it doesn't analyze URI's in bodies. That > talk was about URIDNSBL, not about RBL checks in general. aye. Then please pretend I never opened my mouth. In that case I'd have to agree that if y

Re: Question - How many of you run ALL your email through SA?

2007-08-17 Thread martin f krafft
also sprach Marc Perkel <[EMAIL PROTECTED]> [2007.08.16.0511 +0200]: > As opposed to preprocessing before using SA to reduce the load. (ie. using > blacklist and whitelist before SA) I have a bunch of postfix sanity checks, including RBLs running first. Then, everything is fed to spamc, which --p

Re: Should I disable URIDNSBL plugin if I'm already rejecting based on BL with MTA

2007-08-16 Thread martin f krafft
also sprach Jeff Chan <[EMAIL PROTECTED]> [2007.08.16.1125 +0200]: > The two do very different things. MTA blacklists are direct > rejection of incoming smtp connections by the MTA (in this case > postfix). URIDNSBL is a SpamAssassin check of web sites in > message bodies. Specifically it checks

Re: BAYES_99 and ham

2007-07-27 Thread martin f. krafft
also sprach Joe Zitnik <[EMAIL PROTECTED]> [2007.07.26.1340 +0200]: >Bump your BAYES_99 score. Thanks to all who have replied with this suggestion. Of course I am aware of the possibility to raise the scores, but I would not have turned to this list if it would have been sufficient. I agree

BAYES_99 and ham

2007-07-26 Thread martin f krafft
Hi list, I just had a flood of spam coming through, which SA classified as ham. On closer inspection, it turns out that the only tests triggered for all those mails were HTML_MESSAGE and BAYES_99. HTML messages are commonplace today (unfortunately), so they don't add anything to the score. BAYES

Re: Postfix auth headers (Re: Problem with false-positives for SASL users)

2006-07-11 Thread martin f krafft
also sprach Daryl C. W. O'Shea <[EMAIL PROTECTED]> [2006.07.11.2356 +0200]: > If the host that adds the auth line in the received header is trusted > then the authenticated client will also be trusted. > > See the third case here: http://wiki.apache.org/spamassassin/DynablockIssues Okay, so the

Re: Postfix auth headers (Re: Problem with false-positives for SASL users)

2006-07-11 Thread martin f krafft
also sprach Daryl C. W. O'Shea <[EMAIL PROTECTED]> [2006.07.11.0432 +0200]: > For those using Postfix, bug 4980 has a patch to support the auth > headers, available in Postfix 2.3 and later, that can be used to extend > your trust path to authenticated users. > > http://issues.apache.org/SpamAss

Re: RFC: spamd disables virtual-config when no @ in user name

2006-07-02 Thread martin f krafft
also sprach Bart Schaefer <[EMAIL PROTECTED]> [2006.07.02.1827 +0200]: > I run two copies of spamd with different -p port options, and point > the virtual users' spamc at the port corresponding to the spamd with > the --virtual-config-dir option. This isi actually another approach which had crosse

warning about data loss in -e option to spamc

2006-07-02 Thread martin f krafft
Hi, the spamc manpage says under option -e Note that there is a very slight chance mail will be lost here, because if the fork-and-exec fails there’s no place to put the mail message. under what conditions would such a failure occur? Is it not possible for spamc to await the successful com

Re: RFC: spamd disables virtual-config when no @ in user name

2006-07-02 Thread martin f krafft
also sprach martin f krafft <[EMAIL PROTECTED]> [2006.07.02.1616 +0200]: > I suggest that spamd is changed such that it disables virtual-config > when the user name passed by spamc does not include an @ sign. Sorry for the afterthought, but if the above is not a good idea, maybe spa

RFC: spamd disables virtual-config when no @ in user name

2006-07-02 Thread martin f krafft
On mail systems with virtual and local users, it's not easily possible to run per-user spamc with user configuration. Either the spamd process runs with --virtual-config, then local users need to have directories under the virtual mailbox base directory, or you run spamd without --virtual-confi

Re: Problem with false-positives for SASL users

2006-06-30 Thread martin f krafft
also sprach martin f krafft <[EMAIL PROTECTED]> [2006.06.06.1401 +0200]: > Regarding the issue I raised in February (to which I have not yet > found an answer), you may be interested in checking out the last > paragraph of http://blog.madduck.net/geek/2006.06.06-delayed-mail, > w

Re: Problem with false-positives for SASL users

2006-06-06 Thread martin f krafft
also sprach Daryl C. W. O'Shea <[EMAIL PROTECTED]> [2006.06.06.2021 +0200]: > If you provide a full set of received headers that are being > passed to SA, someone can help you out with the correct settings. I am having difficulties recreating the problem. Sometimes SA will happily include the RBL

Re: Problem with false-positives for SASL users

2006-06-06 Thread martin f krafft
also sprach Daryl C. W. O'Shea <[EMAIL PROTECTED]> [2006.06.06.1848 +0200]: > Really? That makes no sense to me. I don't see anything in your > example header that we use as auth tokens. Actually, I don't see any > auth tokens. What's to stop someone from connecting with SSL but not > authen

Re: Problem with false-positives for SASL users

2006-06-06 Thread martin f krafft
also sprach martin f krafft <[EMAIL PROTECTED]> [2006.06.06.1401 +0200]: > Regarding the issue I raised in February (to which I have not yet > found an answer) I am sorry (again), I only just saw http://mail-archives.apache.org/mod_mbox/spamassassin-users/200602.mbox/[EMAIL PROT

Re: Problem with false-positives for SASL users

2006-06-06 Thread martin f krafft
also sprach martin f krafft <[EMAIL PROTECTED]> [2006.06.06.1401 +0200]: > Regarding the issue I raised in February (to which I have not yet > found an answer) Sorry, that would be http://mail-archives.apache.org/mod_mbox/spamassassin-users/200602.mbox/[EMAIL PROTECTED]

Re: Problem with false-positives for SASL users

2006-06-06 Thread martin f krafft
Regarding the issue I raised in February (to which I have not yet found an answer), you may be interested in checking out the last paragraph of http://blog.madduck.net/geek/2006.06.06-delayed-mail, which also includes a link to postfix patch addressing the issue. -- martin; (greeting

Re: Problem with false-positives for SASL users

2006-02-23 Thread martin f krafft
also sprach mouss <[EMAIL PROTECTED]> [2006.02.23.2324 +0100]: > how do you integrate SA with postfix? I don't. It's called by procmail. -- martin; (greetings from the heart of the sun.) \ echo mailto: !#^."<*>"|tr "<*> mailto:"; [EMAIL PROTECTED] invalid/expired pgp (sub)ke

Problem with false-positives for SASL users

2006-02-23 Thread martin f krafft
Hi, we have a bunch of users who use our SASL-enabled SMTP server to relay their mail when on the road. This causes the following Received header: Received: from septumania (217-162-227-XXX.dclient.hispeed.ch [217.162.227.XXX]) (using SSLv3 with cipher RC4-MD5 (128/128 bits)) (

Re: Subject spam tag not working

2004-10-27 Thread martin f krafft
also sprach marti <[EMAIL PROTECTED]> [2004.10.27.2107 +0200]: > rewrite_subject 1 > subject_tag **SPAM** rewrite_header subject **SPAM** this could have been better highlighted. but oh well... -- martin; (greetings from the heart of the sun.) \ echo mailto: !#^."<*>"|tr "<*>

Re: [ot] comments about the mailing list

2004-10-13 Thread martin f krafft
also sprach M.Lucas <[EMAIL PROTECTED]> [2004.10.13.0847 +0200]: > send an empty email from your 2nd,3th,.. email address to > [EMAIL PROTECTED] > and you will only be allowed to post and you don't get any mail to this > address Great. I did search for this, i promise. ezmlm.org does not have it

Re: feeding frenzy for ws.surbl.org!!!

2004-10-12 Thread martin f krafft
also sprach Justin Mason <[EMAIL PROTECTED]> [2004.10.12.1851 +0200]: > hold on a minute guys -- this is a FAQ. > > http://wiki.apache.org/spamassassin/DoYouWantMySpam /me sits back and sighs -- martin; (greetings from the heart of the sun.) \ echo mailto: !#^."<*>"|tr "<

Re: feeding frenzy for ws.surbl.org!!!

2004-10-12 Thread martin f krafft
also sprach martin f krafft <[EMAIL PROTECTED]> [2004.10.12.1420 +0200]: > > Only forward spam that SpamAssassin does not currently > > automatically detect correctly. > > All of it? And with or without Bayesian stuff enabled? -- martin; (greetings f

Re: feeding frenzy for ws.surbl.org!!!

2004-10-12 Thread martin f krafft
also sprach Jeff Chan <[EMAIL PROTECTED]> [2004.10.12.1414 +0200]: > Only forward spam that SpamAssassin does not currently > automatically detect correctly. All of it? -- martin; (greetings from the heart of the sun.) \ echo mailto: !#^."<*>"|tr "<*> mailto:"; [EMAIL PROTECTE

Re: feeding frenzy for ws.surbl.org!!!

2004-10-12 Thread martin f krafft
also sprach jdow <[EMAIL PROTECTED]> [2004.10.12.1158 +0200]: > Feed us spam, please. Avoid the middle man. It makes our response > quicker. Should I set up an autoreply to all my spam from the address of the list, or simply forward all my spam? -- martin; (greetings from the heart

Re: [ot] comments about the mailing list

2004-10-12 Thread martin f krafft
also sprach Kai Schaetzl <[EMAIL PROTECTED]> [2004.10.12.1131 +0200]: > Again, discussing religion is off-topic here, really. I am not here to discuss religion but usability of your mailing list. But hey, since nobody seems to care, and mutt *does* provide for broken setups (again), I'll shut up.

Re: feeding frenzy for ws.surbl.org!!!

2004-10-12 Thread martin f krafft
also sprach Jeff Chan <[EMAIL PROTECTED]> [2004.10.12.1115 +0200]: > It's been mentioned before several times on this list. Otherwise > all I can say is that it's standard practice. :-) Well, I am not here to argue, but apparently the anti-spam lists to which I subscribe do not follow the standa

Re: [ot] comments about the mailing list

2004-10-12 Thread martin f krafft
also sprach Nick Leverton <[EMAIL PROTECTED]> [2004.10.12.1108 +0200]: > It can, the option is called "envelope_from", and it's designed for > situations like yours (and mine). Oh wow, I am totally out of the loop. This certainly did not exist when I hand-crafted my configuration file. Is there an

Re: feeding frenzy for ws.surbl.org!!!

2004-10-12 Thread martin f krafft
also sprach Jeff Chan <[EMAIL PROTECTED]> [2004.10.12.1030 +0200]: > This only applies to spams that SpamAssassin does not already > successfully detect, i.e. new, undetected classes. Well, with Bayesian filtering, it is perfectly possible that many spam filters already catch such a message. > >

Re: [ot] comments about the mailing list

2004-10-12 Thread martin f krafft
also sprach Niek <[EMAIL PROTECTED]> [2004.10.12.0946 +0200]: > Who cares what software is being used ? Well, if the software lowers the usability, people should care. > This is not quantum physics, maybe mutt has some features to help > you with the tough task of posting to this list ? No, beca

Re: feeding frenzy for ws.surbl.org!!!

2004-10-12 Thread martin f krafft
also sprach Jeff Chan <[EMAIL PROTECTED]> [2004.10.12.0931 +0200]: > Well in some cases, such as debugging an undetected spam, it's > quite useful to see the entire message to determine whether the > results can be duplicated on another system. If so, it can be > a genuine bug in SA. So there are

Re: does spamassassin -rR call sa-learn?

2004-10-12 Thread martin f krafft
also sprach Niek <[EMAIL PROTECTED]> [2004.10.12.0926 +0200]: > man spamassassin. Mh. Believe it or not, I never noticed the long descriptions to the manpage. Sorry for the noise, and thanks for your answer. -- martin; (greetings from the heart of the sun.) \ echo mailto: !#^.

[ot] comments about the mailing list

2004-10-12 Thread martin f krafft
Hi all, First of all, thank you for SpamAssassin and this mailing list. I have been able to extract many useful ideas in the past weeks. I would like to voice my concern with the lists setup though. Apparently it is subscriber-only (which is good), but as it uses ezmlm, it falls short in exactly

Re: inconsistencies in message checking

2004-10-12 Thread martin f krafft
stop forwarding your spam to lists! cut it to the bare essentials. -- martin; (greetings from the heart of the sun.) \ echo mailto: !#^."<*>"|tr "<*> mailto:"; [EMAIL PROTECTED] invalid/expired pgp subkeys? use subkeys.pgp.net as keyserver! spamtraps: [EMAIL PROTECTED] the

Re: feeding frenzy for ws.surbl.org!!!

2004-10-12 Thread martin f krafft
also sprach Keith Hackworth <[EMAIL PROTECTED]> [2004.10.11.1820 +0200]: > I just got a gold-mine for surbl canidates "wanna-bes" in a single spam > message. There's WAY too many domains listed below to add to SURBL > through the web pages. Is there a "bulk add" option to add to the > ws.surbl.or

does spamassassin -rR call sa-learn?

2004-10-12 Thread martin f krafft
When relearning a false-positive as ham, I wonder whether it's necessary to invoke `spamassassin -rR` as well as `sa-learn --ham`, or does either call the other? What does `spamassassin -r` do exactly? Revoking spam could be a plethora of things. -- martin; (greetings from the heart