Razor Client Tools 1.20, protocol version 2 Matt Kettler writes: >you can manually run razor to find out what version it is: > >I have both razor1 and razor2 installed (with razor1's razor-check renamed >to razor-check.v1 and so on), but I have razor1 disabled in my SpamAssassin >config so I'm not using it anymore. > >$ razor-check.v1 -v >Razor Client Tools 1.20, protocol version 2 > > >$ razor-check -v >Razor Agents 2.22, protocol version 3 > > >At 07:45 PM 1/30/2003 -0800, William R Ward wrote: >>That *is* odd. Well, if it happens again I'll let you know. >> >>Unfortunately I don't know what version of razor I have; I just know I >>have SpamAssassin 2.43 installed. >> >>--Bill. >> >>Matt Kettler writes: >> >As someone else already said, razor1 computes the 160-bit SHA1 hash of the >> >entire body and then asks the server if that hash is in the database. >> > >> >For 2 emails to randomly have the same SHA1 hash is hugely >> >improbable (It's late but I think it's 1 in 2^160 * 2*160, or 1 in >> >2^320... That's 1 in 2.1 x 10^96 in scientific notation.. big number..) >> > >> >However I do know that there were some hash calculation bugs in some >> >versions of razor2 causing false dupes.. I don't think razor1 would be >> >subject to the same bug, but perhaps a similar one exists in the version of >> >razor1 you are using? >> > >> >Seems very strange to me that you got such a dupe match in razor1 for >> >something with such erratically changing output. Possible, but I think the >> >odds of being struck by lightning on two different days of the same week >> >and surviving both are much better. >> > >> > >> > >> >At 05:46 PM 1/30/2003 -0800, William R Ward wrote: >> >>Oh! I thought Razor was some kind of "realtime black list" type >> >>thing, based on the IP address of the sender and such. I'm surprised >> >>to hear that it looks at the body. (I don't use Razor directly; it's >> >>only relevant to me because I use SpamAssassin.) >> >> >> >>The body of my message was pretty unique - it's a script I wrote and >> >>the output of the script is very specific to the task. Here's a >> >>sample. I changed the numbers to protect my privacy. >> >> >> >>Maybe it's the string "profit!" that's doing it? >> >> >> >>--begin quote-- >> >> >> >>ORACLE CORP >> >>Last trade: $XXX.XX (01/30/2003 12:57 PST) >> >>ESPP Period: 10/01/2002 - 03/31/2003 (121 days elapsed, 59 days to go) >> >>Change in price since start: $XXX.XX ($XXX.XX per day) >> >>At this rate, the ending price will be: $XXX.XX >> >> >> >>XXX shares purchased at $XXX.XXX ($XXX.XX) are currently worth $XXX.XX >> >>If sold today, profit would be $XXX.XX >> >> >> >>If the ending price is as predicted: >> >> Buy price: $XXX.XX (XXX.XX shares). >> >> Sell immediately at $XXX.XX for $XXX.XX profit! >> >> >> >>If the stock stays the same as it is right now: >> >> Buy price: $XXX.XX (XXX.XX shares). >> >> Sell immediately at $XXX.XX for $XXX.XX profit! >> >> >> >>If the stock ends at or below $XXX.XX, >> >>profit from immediate sale will be $XXX.XX. >> >> >> >>--end quote-- >> >> >> >>Matt Kettler writes: >> >> >Razor does not store, or operate based on what your email address is >> or who >> >> >your ISP is. >> >> > >> >> >Razor does NOT have your email address, nor the servers of your ISP, in >> >> >some kind of blacklist. >> >> > >> >> >Razor operates based on comparing hash results of the message body, it >> >> >doesn't even examine any of the headers at all. So things like "from" >> >> >aren't even a part of it's considerations. This is true of both >> razor1 and >> >> >razor2, the differences are in the details of how the hash is >> generated and >> >> >how reports are handled. >> >> > >> >> >Unless you send the same message to someone else, it will not be >> listed by >> >> >razor just because one of your other messages match. >> >> > >> >> >In this case it looks like someone mistakenly reported the cron-job >> output >> >> >of a common default OS install. Since it's cron output, the body of the >> >> >message they got is quite possibly the same as the one you have. >> >> > >> >> > >> >> >At 04:17 PM 1/30/2003 -0800, William R Ward wrote: >> >> >>My concern is that when I send mail to someone else, their spam filter >> >> >>might block it... >> >> >> >> >> >>Michael Loftis writes: >> >> >> >Add your sending address to the whitelist_from. >> >> >> > >> >> >> >Razor just make a 'hash' of the message which is anonymous esp. in >> >> that you >> >> >> >can get collisions like this one. Think of it as a really bad >> >> photocopy or >> >> >> >one of those government documents with all the really important stuff >> >> >> >blacked out. It's useful in that you can tell that you recieved >> >> basically >> >> >> >this message but not exactly the contents of it. >> >> >> > >> >> >> >Check out the SpamAssassin dox for more info, but the problem >> isn't with >> >> >> >Razor, you really need to add a whitelist_from for your sendint >> address >> >> >> > >> >> >> >--On Thursday, January 30, 2003 3:10 PM -0800 William R Ward >> >> >> ><[EMAIL PROTECTED]> wrote: >> >> >> > >> >> >> >> >> >> >> >> I have a script I run from a cron job that emails myself with my >> >> >> >> employer's stock quote at the end of each trading day. I was >> shocked >> >> >> >> to find that today's e-mail is flagged by SpamAssassin as >> spam! This >> >> >> >> is new - it has never been flagged as spam before. >> >> >> >> >> >> >> >> The reason I'm posting to razor-users is because the main reason it >> >> >> >> was labeled as spam was the RAZOR_CHECK rule. How can I prevent >> this >> >> >> >> in the future? >> >> >> >> >> >> >> >> I have a connection through AT&T Broadband (cable modem). Is that >> >> >> >> why? >> >> >> >> >> >> >> >> Most of my mail goes through a smarthost (my webhosting ISP, >> >> >> >> sasquatch.com) so it probably won't affect that. What's the >> solution? >> >> >> >> >> >> >> >> Here's the SpamAssassin report for the email in question: >> >> >> >> >> >> >> >> SPAM: -------------------- Start SpamAssassin results >> >> >> >> ---------------------- SPAM: This mail is probably spam. The >> original >> >> >> >> message has been altered SPAM: so you can recognise or block similar >> >> >> >> unwanted mail in future. SPAM: See http://spamassassin.org/tag/ for >> >> more >> >> >> >> details. >> >> >> >> SPAM: >> >> >> >> SPAM: Content analysis details: (6.00 hits, 5 required) >> >> >> >> SPAM: SPAM_PHRASE_00_01 (0.8 points) BODY: Spam phrases score is >> >> 00 to >> >> >> >> 01 (low) SPAM: RAZOR_CHECK (2.6 points) Listed in >> Razor1, see >> >> >> >> http://razor.sf.net/ SPAM: FROM_AND_TO_SAME_5 (1.3 points) From >> and To >> >> >> >> are same (5) >> >> >> >> SPAM: UPPERCASE_25_50 (1.3 points) message body is 25-50% >> uppercase >> >> >> >> SPAM: >> >> >> >> SPAM: -------------------- End of SpamAssassin results >> >> >> >> --------------------- >> >> >> >> >> >> >> >> >> >> >> >> -- >> >> >> >> William R Ward [EMAIL PROTECTED] >> >> >> >> http://www.wards.net/~bill/ >> >> >> >> >> >> ------------------------------------------------------------------------- >> >> >> >> ---- "A foolish consistency is the hobgoblin of little minds, >> adored by >> >> >> >> little statesmen and philosophers and divines." - Emerson >> >> >> >> >> >> >> >> >> >> >> >> ------------------------------------------------------- >> >> >> >> This SF.NET email is sponsored by: >> >> >> >> SourceForge Enterprise Edition + IBM + LinuxWorld = Something 2 See! >> >> >> >> http://www.vasoftware.com >> >> >> >> _______________________________________________ >> >> >> >> Razor-users mailing list >> >> >> >> [EMAIL PROTECTED] >> >> >> >> https://lists.sourceforge.net/lists/listinfo/razor-users >> >> >> > >> >> >> > >> >> >> > >> >> >> > >> >> >> >------------------------------------------------------- >> >> >> >This SF.NET email is sponsored by: >> >> >> >SourceForge Enterprise Edition + IBM + LinuxWorld = Something 2 See! >> >> >> >http://www.vasoftware.com >> >> >> >_______________________________________________ >> >> >> >Razor-users mailing list >> >> >> >[EMAIL PROTECTED] >> >> >> >https://lists.sourceforge.net/lists/listinfo/razor-users >> >> >> >> >> >>-- >> >> >>William R >> >> Ward [EMAIL PROTECTED] http://www.wards.net/~bill/ >> >> >>--------------------------------------------------------------------- >> --- >> >> ----- >> >> >>"A foolish consistency is the hobgoblin of little minds, adored by >> >> >> little statesmen and philosophers and divines." - Emerson >> >> >> >> >> >> >> >> >>------------------------------------------------------- >> >> >>This SF.NET email is sponsored by: >> >> >>SourceForge Enterprise Edition + IBM + LinuxWorld = Something 2 See! >> >> >>http://www.vasoftware.com >> >> >>_______________________________________________ >> >> >>Razor-users mailing list >> >> >>[EMAIL PROTECTED] >> >> >>https://lists.sourceforge.net/lists/listinfo/razor-users >> >> >> >>-- >> >>William R >> Ward [EMAIL PROTECTED] http://www.wards.net/~bill/ >> >>------------------------------------------------------------------------ >> ----- >> >>"A foolish consistency is the hobgoblin of little minds, adored by >> >> little statesmen and philosophers and divines." - Emerson >> > >> > >> > >> >------------------------------------------------------- >> >This SF.NET email is sponsored by: >> >SourceForge Enterprise Edition + IBM + LinuxWorld = Something 2 See! >> >http://www.vasoftware.com >> >_______________________________________________ >> >Razor-users mailing list >> >[EMAIL PROTECTED] >> >https://lists.sourceforge.net/lists/listinfo/razor-users >> >>-- >>William R Ward [EMAIL PROTECTED] http://www.wards.net/~bill/ >>----------------------------------------------------------------------------- >>"A foolish consistency is the hobgoblin of little minds, adored by >> little statesmen and philosophers and divines." - Emerson
-- William R Ward [EMAIL PROTECTED] http://www.wards.net/~bill/ ----------------------------------------------------------------------------- "A foolish consistency is the hobgoblin of little minds, adored by little statesmen and philosophers and divines." - Emerson ------------------------------------------------------- This SF.NET email is sponsored by: SourceForge Enterprise Edition + IBM + LinuxWorld = Something 2 See! http://www.vasoftware.com _______________________________________________ Razor-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/razor-users
