After updating to 2.21 with SA 2.43, restarting spamd, mail started to be rejected (postfix) due to the following error:
Nov 21 06:36:00 myserver spamc[81240]: spamd responded with bad string 'Number of lines: 12' Did a backout to 2.20 and all is back to normal... don't have time right now to dig more. Gael On Wed, Nov 20, 2002 at 03:05:58PM -0800, Vipul Ved Prakash wrote: > I just release 2.21 that fixes 2 bugs related to the empty/whitespace > mime parts. > > cheers, > vipul > > On Wed, Nov 20, 2002 at 04:58:04PM -0500, Matt Kettler wrote: > > Hmm.. that's mail 1.1, which implies that it's the second part of a > > multi-part mime message. Did you look at the mime to see if that block was > > a null block? > > > > Note that by default razor will flag if *any* mime part matches a part that > > was on known spam. This means that a lot of messages containing null > > blocks, or common image attachments, etc, wind up being tagged, because a > > lot of spam has the same dumb mime block. > > > > You can "fix" this feature of razor by changing the logic_method from 4 > > (match if any non-contention part is spam) to 5 (match only if all > > non-contention parts are spam). Of course, this reduces the hit rate. > > Eventually razor will be fixed to start ignoring null blocks (a byproduct > > of some mailers) but in the meantime nearly everything that has one matches > > unless you change the logic method. > > > > > > and as far as I know, a cf of 5 is pretty low. A lot of "known spam" has > > cf's well over 20. > > > > I have my min_cf set to 11 and my logic_method set to 5 still get a good > > amount of hits. (99 of 730 total emails inbound on my server in one > > particular batch I have on hand). Since making this change as far as I know > > there have been no more problems with false positives on razor here, except > > for one SA-Talk posting in which the body is almost entirely quote of a > > spam message. > > > > > > > > > > > > > > > > At 02:58 PM 11/20/2002 -0600, Jon Gabrielson wrote: > > >I received a false positive from discover card. > > >the line that caused the false positive was: > > > > > >mail 1.1 e=4 sig=FOS353pJ7d8nosBKnYowlZ9MyWsA: Is spam: cf 5 >= min_cf 1 > > > > > >sorry, i can't send the entire message because it is personal in nature. > > >Does anyone know why this would be in the razor database. > > >I know that the razor database is suppose to ignore personalizations, > > >but this seems a bit extreme. Also, a cf of 5 seems a bit high for something > > >that should have only been reported by accident. > > > > > >Jon. > > > > > > > > > > > > > > >------------------------------------------------------- > > >This sf.net email is sponsored by: > > >Battle your brains against the best in the Thawte Crypto > > >Challenge. Be the first to crack the code - register now: > > >http://www.gothawte.com/rd521.html > > >_______________________________________________ > > >Razor-users mailing list > > >[EMAIL PROTECTED] > > >https://lists.sourceforge.net/lists/listinfo/razor-users > > > > Note: Emails authored under this address do not reflect the opinions of my > > employer unless otherwise stated. Facts contained are also prone to human > > error. If either of these statements are not humanly obvious to you, I > > suggest careful thought before leaping to any other conclusions. > > > > > > > > ------------------------------------------------------- > > This sf.net email is sponsored by: > > Battle your brains against the best in the Thawte Crypto > > Challenge. Be the first to crack the code - register now: > > http://www.gothawte.com/rd521.html > > _______________________________________________ > > Razor-users mailing list > > [EMAIL PROTECTED] > > https://lists.sourceforge.net/lists/listinfo/razor-users > > -- > > Vipul Ved Prakash | "The future is here, it's just not > Software Design Artist | widely distributed yet." > http://vipul.net/ | -- William Gibson > > > > ------------------------------------------------------- > This sf.net email is sponsored by: > Battle your brains against the best in the Thawte Crypto > Challenge. Be the first to crack the code - register now: > http://www.gothawte.com/rd521.html > _______________________________________________ > Razor-users mailing list > [EMAIL PROTECTED] > https://lists.sourceforge.net/lists/listinfo/razor-users ------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf _______________________________________________ Razor-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/razor-users
