So this user's e-mail keeps getting tagged with rules that aren't
right. There's no base64 here, at all (looked at the raw text) and
there's certainly no stock spam. What's going on here?
Is the charset triggering the base64 rules? They are false hits...
Begin forwarded message:
From: "J
On Wed, 7 Feb 2007, Jo Rhett wrote:
> So this user's e-mail keeps getting tagged with rules that aren't
> right. There's no base64 here, at all (looked at the raw text) and
> there's certainly no stock spam. What's going on here?
Have you run "spamassassin --lint" to see if there are any pr
On Feb 7, 2007, at 1:47 PM, John D. Hardin wrote:
On Wed, 7 Feb 2007, Jo Rhett wrote:
So this user's e-mail keeps getting tagged with rules that aren't
right. There's no base64 here, at all (looked at the raw text) and
there's certainly no stock spam. What's going on here?
Have you run "spam
Jo Rhett wrote:
> So this user's e-mail keeps getting tagged with rules that aren't
> right. There's no base64 here, at all (looked at the raw text) and
> there's certainly no stock spam. What's going on here?
>
> Is the charset triggering the base64 rules? They are false hits...
No, the charset
On Wed, 2007-02-07 at 23:31 -0500, Matt Kettler wrote:
> No, the charset isn't triggering the base64 rules. The fact that the
> Content-Transfer-Encoding declares the message is base-64 encoded is
> causing it.
>
> >> Content-Transfer-Encoding: base64
> As for LW_STOCK_SPAM4, it's being triggered
On Feb 7, 2007, at 8:31 PM, Matt Kettler wrote:
As for LW_STOCK_SPAM4, it's being triggered by the fact that the
message
is base-64 encoded text AND has a Date: header that's missing a proper
timezone. Apparently a batch of stock spam went out at some point with
both of these abnormal features.
As for LW_STOCK_SPAM4, it's being triggered by the fact that the message
is base-64 encoded text AND has a Date: header that's missing a proper
timezone. Apparently a batch of stock spam went out at some point with
both of these abnormal features. I have to admit, it's a pretty rare
combination.
Jo Rhett wrote:
> On Feb 7, 2007, at 8:31 PM, Matt Kettler wrote:
>> As for LW_STOCK_SPAM4, it's being triggered by the fact that the message
>> is base-64 encoded text AND has a Date: header that's missing a proper
>> timezone. Apparently a batch of stock spam went out at some point with
>> both o
Matt Kettler wrote:
Jo Rhett wrote:
On Feb 7, 2007, at 8:31 PM, Matt Kettler wrote:
As for LW_STOCK_SPAM4, it's being triggered by the fact that the message
is base-64 encoded text AND has a Date: header that's missing a proper
timezone. Apparently a batch of stock spam went out at some point w
Jo Rhett wrote:
As for LW_STOCK_SPAM4, it's being triggered by the fact that the
message
In the standard config? No.. It's not a FP in the standard config, so
there's no reason to modify it.
Can you explain how this isn't an FP in the standard config? There's
absolutely nothing custom abou
On Friday 09 February 2007 09:00, Loren Wilton wrote:
> > Jo Rhett wrote:
> As for LW_STOCK_SPAM4, it's being triggered by the fact that the
> message
> No you don't. I wrote that rule. That's why it starts with my
> initials. I didn't submit it to SA, and while it I think exists in S
Jo Rhett wrote:
>
> Again, I have a 100% stock SA configuration.
No you don't have a 100% stock config. There are at least two
differences relevant to them message you posted:
1) you have the SARE STOCKS ruleset. LW_STOCK_SPAM4 is NOT a stock
spamassasssin rule. It's part of an add-on ruleset, no
Loren Wilton wrote:
>
>
> Now, that said, the forwarded Blackberry message you posted would not
> have hit the rule in the first place, unless someone took my original
> rule and modified it. So you not only don't have a standard config,
> you have apparently locally-modified versions of rules you
* Loren Wilton wrote (08/02/07 19:46):
>> As for LW_STOCK_SPAM4, it's being triggered by the fact that the message
>> is base-64 encoded text AND has a Date: header that's missing a proper
>> timezone. Apparently a batch of stock spam went out at some point with
>> both of these abnormal features.
At 01:00 09-02-2007, Loren Wilton wrote:
Now, that said, the forwarded Blackberry message you posted would
not have hit the rule in the first place, unless someone took my
original rule and modified it. So you not only don't have a
standard config, you have apparently locally-modified versions
On Feb 9, 2007, at 2:41 AM, Matt Kettler wrote:
Jo Rhett wrote:
Again, I have a 100% stock SA configuration.
No you don't have a 100% stock config. There are at least two
differences relevant to them message you posted:
1) you have the SARE STOCKS ruleset. LW_STOCK_SPAM4 is NOT a stock
spama
On Fri, 2007-02-09 at 09:01 -0800, Jo Rhett wrote:
> On Feb 9, 2007, at 2:41 AM, Matt Kettler wrote:
> > Jo Rhett wrote:
> >>
> >> Again, I have a 100% stock SA configuration.
> > No you don't have a 100% stock config. There are at least two
> > differences relevant to them message you posted:
> >
Jo Rhett wrote:
>
>>> Why do I need a custom rule to work around an FP in the ruleset?
>> See above.
>
> It's really hard not to be really annoyed with this answer.
If you don't like my answers, you're free to not accept my help.
But please keep in mind two things:
1) I often come across as mor
Jo Rhett wrote:
Can you explain how this isn't an FP in the standard config?
There's absolutely nothing custom about my config, so what
"standard" are you applying here?
Again, I have a 100% stock SA configuration. Why do I need a
custom rule to work around an FP in the ruleset?
On Feb
On Feb 9, 2007, at 2:53 AM, Matt Kettler wrote:
I just assumed the __RATWARE_0_TZ_DATE half was picking up on the lack
of a valid timezone. It's looking for the timezone to literally be
"+", which it is not.
I over-looked that entirely.
Jo, can you check your copy of this rule? The relevan
On Feb 9, 2007, at 7:45 AM, SM wrote:
Blackberry messages will hit the LW_STOCK_SPAM4 rule. There is
nothing wrong with the LW_STOCK_SPAM4 rule as such. The overall
score in a standard configuration with that rule added averages
around two points. It shouldn't cause any false positives as
On Feb 9, 2007, at 9:34 AM, Adam Lanier wrote:
On Fri, 2007-02-09 at 09:01 -0800, Jo Rhett wrote:
It's really hard not to be really annoyed with this answer. What
kind of nonsense did you think my question was?
If LW_STOCK_SPAM is a SARE RULE, then I am requesting a revision to
the SARE rule.
Jo Rhett wrote:
> You're making all sorts of claims that I can positively tell you are
> wrong. I have *NO* local customizations to SpamAssassin other than
> the use of SA-update to retrieve the recommended SARE rules.
That would be the very definition of a local customization.
Just sayin'.
Jo Rhett wrote:
If you want a change to a SARE rule, go talk to the SARE people.
I am. They answer questions about the rules on this list, and nowhere
else.
I guess then the [EMAIL PROTECTED] list isn't where SARE helps with
rules... news to me. Since I happen to run that list.
--
-
Jo Rhett wrote:
And frankly I disagree with the logic that rules that hit wrongly
shouldn't be fixed unless it raises the score about 5.0. I simply
couldn't function with *ANY* of my mailboxes at 5.0 -- I'd be deleting
1-2 pieces of spam per minute. I run my public mailboxes at 3.8 and I'm
t
Hi Jo,
At 12:36 21-02-2007, Jo Rhett wrote:
However, all blackberry messages also hit base64 text and excess
base64 which puts them right on the edge. Anything that hits any
other rule will cause a problem.
The alternatives are:
1. Fix the rule
2. Lower the score for the rule
3. Remove the ru
On Feb 21, 2007, at 3:02 PM, Kris Deugau wrote:
-> (at least, once Bayes was part of SA ) feed missed spam back
into Bayes manually to complement the autolearning (which worked
pretty well for me, and without which I'd have very VERY little ham
learned at all).
I spent about a year trainin
On Feb 21, 2007, at 3:19 PM, SM wrote:
At 12:36 21-02-2007, Jo Rhett wrote:
However, all blackberry messages also hit base64 text and excess
base64 which puts them right on the edge. Anything that hits any
other rule will cause a problem.
The alternatives are:
1. Fix the rule
2. Lower the sc
On Feb 21, 2007, at 12:54 PM, Coffey, Neal wrote:
Jo Rhett wrote:
You're making all sorts of claims that I can positively tell you are
wrong. I have *NO* local customizations to SpamAssassin other than
the use of SA-update to retrieve the recommended SARE rules.
That would be the very defin
Hi Jo,
At 16:17 21-02-2007, Jo Rhett wrote:
The point of sending a note about this to the mailing list is that
this problem will effect *EVERYONE* who gets crackberry messages, and
thus it could probably use a real fix instead of forcing everyone to
fix it locally.
The problem affects people us
>
> However, all blackberry messages also hit base64 text and excess
> base64 which puts them right on the edge. Anything that hits any
> other rule will cause a problem.
>
> And frankly I disagree with the logic that rules that hit wrongly
> shouldn't be fixed unless it raises the score about
At 16:17 21-02-2007, Jo Rhett wrote:
The point of sending a note about this to the mailing list is that
this problem will effect *EVERYONE* who gets crackberry messages, and
thus it could probably use a real fix instead of forcing everyone to
fix it locally.
SM wrote:
The problem affects people
Jo Rhett wrote:
And frankly I disagree with the logic that rules that hit wrongly
shouldn't be fixed unless it raises the score about 5.0. I simply
couldn't function with *ANY* of my mailboxes at 5.0 -- I'd be deleting
1-2 pieces of spam per minute. I run my public mailboxes at 3.8 and I'm
t
Loren Wilton wrote:
4.He then COMPLAINS that rules are causing him FPs and demands that
the rules be changed.
Your rule is matching against messages which it shouldn't.
5.He THEN claims I am lying and making false assertions when I state
that the rule in question (that I wrote) would
poof!
Could the next person passing the record player give it a jolt? It
seems to be stuck on the same track... and I wasn't too keen on this
track the 1st few times I heard it either ;-D
>>> Jo Rhett <[EMAIL PROTECTED]> 02/22/07 01:20AM >>>
Loren Wilton wrote:
> 4.He then COMPLAINS that rules are causing him FPs and demands that
> the rules be changed.
Your rule is matching against messages which it shouldn't.
> 5.He THEN claims I am lying and making false assertions w
On Feb 22, 2007, at 6:23 AM, Rob Anderson wrote:
Jo...you catch more flies (fixes to your problems) with sugar
(being nice, even if you don't want to) than with a machete (the
way you are).
I wasn't trying to be nice or mean. I'm working on real problems,
and I reported them as problems w
38 matches
Mail list logo