Re: spamer spoofing SA headers

2005-12-28 Thread List Mail User
>... >Paul, the procmail script Loren and I use simply strips it out. I've read >too many folks on this list talk about scanning outbound for one reason >or another to figure premarking is a good spam sign. > >Of course, there are odd cases to consider. > >Suppose somebody honest or at least passin

missing markup (was: Re: spamer spoofing SA headers)

2005-12-27 Thread Daryl C. W. O'Shea
On 12/28/2005 1:13 AM, jdow wrote: (So far nobody has nailed down the PerMsgStatus problems that result in logs that say a message is spam but no markups at all appear on the message. THIS is why I strip off spam markups. I trigger on their presence to indicate that I properly completed a spamc/

Re: spamer spoofing SA headers

2005-12-27 Thread jdow
From: "List Mail User" <[EMAIL PROTECTED]> >... >You can only safely skip messages with an X-Spam-Status: that reads "yes", >due to the fact that you can't trust it. Of course, spammers can always >forge a X-Spam-Status: on themselves that declares the message to be spam, >but if they do..

Re: spamer spoofing SA headers

2005-12-27 Thread List Mail User
>... >> >You can only safely skip messages with an X-Spam-Status: that reads >"yes", >> >due to the fact that you can't trust it. Of course, spammers can always >> >forge a X-Spam-Status: on themselves that declares the message to be >spam, >> >but if they do.. more power to em.. >> > >> >> Or even

Re: spamer spoofing SA headers

2005-12-27 Thread Jonn R Taylor
--- Begin Message --- Thanks for the help. I am useing CommuniGate ,clamav, and scanspam.sh to call spamc/spamd, in the rules I am checking for the SA header to prevent looping the message in the queue. Never thought that this would happen. If I read the docs right I can create a custom header

Re: spamer spoofing SA headers

2005-12-27 Thread Loren Wilton
> >You can only safely skip messages with an X-Spam-Status: that reads "yes", > >due to the fact that you can't trust it. Of course, spammers can always > >forge a X-Spam-Status: on themselves that declares the message to be spam, > >but if they do.. more power to em.. > > > > Or even better, you c

Re: spamer spoofing SA headers

2005-12-27 Thread Pollywog
On 12/27/2005 08:10 pm, Matt Kettler wrote: > Why bother? SA isn't confused by them. No sane spamassassin setup would > ever have this problem. Period. > > The problem lies in a user intentionally trying to bypass SA for already > scanned mail. The fix lies in not doing something so foolish in the

Re: spamer spoofing SA headers

2005-12-27 Thread Matt Kettler
Pollywog wrote: > On 12/27/2005 02:56 pm, Matt Kettler wrote: > >>At 08:48 AM 12/27/2005, Jonn R Taylor wrote: >> >>>How can I make this go thourgh SA when it thinks it allready has >> >>Why wouldn't it go through SA? >> >>SA doesn't have any built-in behaviors that will prevent it from >>re-s

Re: spamer spoofing SA headers

2005-12-27 Thread Pollywog
On 12/27/2005 02:56 pm, Matt Kettler wrote: > At 08:48 AM 12/27/2005, Jonn R Taylor wrote: > >How can I make this go thourgh SA when it thinks it allready has > > Why wouldn't it go through SA? > > SA doesn't have any built-in behaviors that will prevent it from > re-scanning a message. I had

Re: spamer spoofing SA headers

2005-12-27 Thread List Mail User
>At 08:48 AM 12/27/2005, Jonn R Taylor wrote: >>How can I make this go thourgh SA when it thinks it allready has > >Why wouldn't it go through SA? > >SA doesn't have any built-in behaviors that will prevent it from >re-scanning a message. > >Did you do something in your procmailrc to cause pro

Re: spamer spoofing SA headers

2005-12-27 Thread Matt Kettler
At 08:48 AM 12/27/2005, Jonn R Taylor wrote: How can I make this go thourgh SA when it thinks it allready has Why wouldn't it go through SA? SA doesn't have any built-in behaviors that will prevent it from re-scanning a message. Did you do something in your procmailrc to cause procmail