Re: Mailbox for auto learning
Le mardi 11 août 2009 05:12:05, Cedric Knight a écrit : Luis Daniel Lucio Quiroz wrote: Le lundi 10 août 2009 19:15:15, Cedric Knight a écrit : Stefan wrote: [...] You have to forward the message as an attachment un unpack it after receiving. Have a look at: https://po2.uni-stuttgart.de/~rusjako/sal-wrapper Yes, I find this approach works well. It's the simplest way for me to train Bayes, and most users can cope with it, providing they're not using Outlook 2003/XP which can't forward as an attachment. But Thunderbird, Outlook Express, Squirrelmail and Pine all can easily. It's not as simple as a 'This Is Spam' button perhaps, and that's a *good* thing. Requiring a little bit of thought stops people using it as an alternative to the delete key for 'OK, perhaps I did subscribe to this but I don't want it now'. [...] Yes but problem is that 99% of users are about using some kind of outlook Well then, tell them not to :) Outlook Express and Windows Mail are fine. Outlook 2003 supposedly needs a special program like http://www.olspamcop.org/ to forward properly, although if you select multiple messages to forward, then it will forward them in some kind of possibly useful digest format. Outlook 2007 introduces an explicit menu item called forward as an attachment (Ctrl+Alt+F) but still mangles the headers: http://forum.spamcop.net/forums/index.php?showtopic=10241st=0p=70453#ent ry70453 Outlook 2007 also mangles the headers (kind of reconstructing a misleading semblance of what the original was) when moving between IMAP folders. Therefore, I wouldn't use spamassassin -r on spam from Outlook users, but sa-learn to get tokens from the body text may be OK. Actually, some users of Outlook 2003 do seem to be able to forward as intact message/rfc822 attachment. Not exactly sure how. Anyway, the 1% using a better e-mail program may be all that's needed to train Bayes. CK Tha nkx I did resolve it by using altermime+postfix solution. I look my X-quarantine heather to get the mail_id and then i add that file. Rustique, mais il marche LD
Re: Mailbox for auto learning
Luis Daniel Lucio Quiroz wrote: Le lundi 10 août 2009 19:15:15, Cedric Knight a écrit : Stefan wrote: [...] You have to forward the message as an attachment un unpack it after receiving. Have a look at: https://po2.uni-stuttgart.de/~rusjako/sal-wrapper Yes, I find this approach works well. It's the simplest way for me to train Bayes, and most users can cope with it, providing they're not using Outlook 2003/XP which can't forward as an attachment. But Thunderbird, Outlook Express, Squirrelmail and Pine all can easily. It's not as simple as a 'This Is Spam' button perhaps, and that's a *good* thing. Requiring a little bit of thought stops people using it as an alternative to the delete key for 'OK, perhaps I did subscribe to this but I don't want it now'. [...] Yes but problem is that 99% of users are about using some kind of outlook Well then, tell them not to :) Outlook Express and Windows Mail are fine. Outlook 2003 supposedly needs a special program like http://www.olspamcop.org/ to forward properly, although if you select multiple messages to forward, then it will forward them in some kind of possibly useful digest format. Outlook 2007 introduces an explicit menu item called forward as an attachment (Ctrl+Alt+F) but still mangles the headers: http://forum.spamcop.net/forums/index.php?showtopic=10241st=0p=70453#entry70453 Outlook 2007 also mangles the headers (kind of reconstructing a misleading semblance of what the original was) when moving between IMAP folders. Therefore, I wouldn't use spamassassin -r on spam from Outlook users, but sa-learn to get tokens from the body text may be OK. Actually, some users of Outlook 2003 do seem to be able to forward as intact message/rfc822 attachment. Not exactly sure how. Anyway, the 1% using a better e-mail program may be all that's needed to train Bayes. CK
Re: Mailbox for auto learning
Am Sonntag, 9. August 2009 07:36:54 schrieb Luis Daniel Lucio Quiroz: Hi SAs, Well, after reading this link http://spamassassin.apache.org/full/3.2.x/doc/sa-learn.html I'm still looking for an easy-way to let my mortal users to train our antispam. I was thinking a mailbox such as h...@antispamserver and s...@antispamserver to let users to forward their false positivos or their false netgatives. In isde each box (ham or spam), of course a procmail with sa-learn input will be forwarded. My doubts are nexts: 1. Will forwarded mails be usefull for training, I mean if spam was: From: spa...@example.netTo: u...@mydomain, when forwarding it will be From: mu...@mydomain To: s...@antispamserver. Change of this and forwarding (getting rid of headers because mail-clients) wont change learning? You have to forward the message as an attachment un unpack it after receiving. Have a look at: https://po2.uni-stuttgart.de/~rusjako/sal-wrapper 2. If technique in question 1 is usless, what other way would be nice to let user to report a false positive/negative for training. TIA LD Greetings Stefan
Re: Mailbox for auto learning
Stefan wrote: Am Sonntag, 9. August 2009 07:36:54 schrieb Luis Daniel Lucio Quiroz: Hi SAs, Well, after reading this link http://spamassassin.apache.org/full/3.2.x/doc/sa-learn.html I'm still looking for an easy-way to let my mortal users to train our antispam. I was thinking a mailbox such as h...@antispamserver and s...@antispamserver to let users to forward their false positivos or their false netgatives. In isde each box (ham or spam), of course a procmail with sa-learn input will be forwarded. My doubts are nexts: 1. Will forwarded mails be usefull for training, I mean if spam was: From: spa...@example.netTo: u...@mydomain, when forwarding it will be From: mu...@mydomain To: s...@antispamserver. Change of this and forwarding (getting rid of headers because mail-clients) wont change learning? You have to forward the message as an attachment un unpack it after receiving. Have a look at: https://po2.uni-stuttgart.de/~rusjako/sal-wrappe 2. If technique in question 1 is usless, what other way would be nice to let user to report a false positive/negative for training. This may not be ideal, but in Thunderbird, you can drag messages between mailboxes. You could setup each user to have access to their own account and the two learning mailboxes. You can then have your users drag the false positives/negatives to the appropriate box. I have not testing this 100%, so I don't know if any headers get re-written or not. -- Dan Schaefer Web Developer/Systems Analyst Performance Administration Corp.
Re: Mailbox for auto learning
Stefan wrote: This may not be ideal, but in Thunderbird, you can drag messages between mailboxes. You could setup each user to have access to their own account and the two learning mailboxes. You can then have your users drag the false positives/negatives to the appropriate box. I have not testing this 100%, so I don't know if any headers get re-written or not. This is possible only when using IMAP. Not POP. When using IMAP, it is also possible to use folders, no need for separate mailboxes. But there will be no difference in using mailboxes or folders, it just works. No header modifications take place on a message when dragging it from folder into another, or from mailbox to another. But as the OP thinks about separate mailboxes, I am afraid that is because he has no folders available. That must be because his users are tied to POP3.
Re: Mailbox for auto learning
Stefan wrote: Am Sonntag, 9. August 2009 07:36:54 schrieb Luis Daniel Lucio Quiroz: Hi SAs, Well, after reading this link http://spamassassin.apache.org/full/3.2.x/doc/sa-learn.html I'm still looking for an easy-way to let my mortal users to train our antispam. I was thinking a mailbox such as h...@antispamserver and s...@antispamserver to let users to forward their false positivos or their false netgatives. In isde each box (ham or spam), of course a procmail with sa-learn input will be forwarded. My doubts are nexts: 1. Will forwarded mails be usefull for training, I mean if spam was: From: spa...@example.netTo: u...@mydomain, when forwarding it will be From: mu...@mydomain To: s...@antispamserver. Change of this and forwarding (getting rid of headers because mail-clients) wont change learning? You have to forward the message as an attachment un unpack it after receiving. Have a look at: https://po2.uni-stuttgart.de/~rusjako/sal-wrapper Yes, I find this approach works well. It's the simplest way for me to train Bayes, and most users can cope with it, providing they're not using Outlook 2003/XP which can't forward as an attachment. But Thunderbird, Outlook Express, Squirrelmail and Pine all can easily. It's not as simple as a 'This Is Spam' button perhaps, and that's a *good* thing. Requiring a little bit of thought stops people using it as an alternative to the delete key for 'OK, perhaps I did subscribe to this but I don't want it now'. My script is very similar to sal-wrapper, using Postfix check_recipient_access to ensure only authenticated users can send to the reporting address; triggered from procmail; using MIME::Parser to extract (possibly multiple) message/rf822 attachments; feed through sa-learn --ham or spamassassin -r as appropriate and send an acknowledgement back to the user, to remind them to also send spam/non-spam to the corresponding address and correct any mistakes. One thing I notice from sal-wrapper however is that it pipes the header and body to sa-learn without passing a file as parameter. I found that although sa-learn didn't complain, this didn't work at all well, and quite short ham messages were scoring BAYES_99. You can pipe to spamassassin -r just like you can to spamassassin in any other mode, but I think if you pipe to sa-learn, you need to do it as sa-learn --ham - with the '-' as parameter, so it reads the standard input. Alternatively feed it a temporary message file. Or am I misreading something? CK
Re: Mailbox for auto learning
Le lundi 10 août 2009 19:15:15, Cedric Knight a écrit : Stefan wrote: Am Sonntag, 9. August 2009 07:36:54 schrieb Luis Daniel Lucio Quiroz: Hi SAs, Well, after reading this link http://spamassassin.apache.org/full/3.2.x/doc/sa-learn.html I'm still looking for an easy-way to let my mortal users to train our antispam. I was thinking a mailbox such as h...@antispamserver and s...@antispamserver to let users to forward their false positivos or their false netgatives. In isde each box (ham or spam), of course a procmail with sa-learn input will be forwarded. My doubts are nexts: 1. Will forwarded mails be usefull for training, I mean if spam was: From: spa...@example.netTo: u...@mydomain, when forwarding it will be From: mu...@mydomain To: s...@antispamserver. Change of this and forwarding (getting rid of headers because mail-clients) wont change learning? You have to forward the message as an attachment un unpack it after receiving. Have a look at: https://po2.uni-stuttgart.de/~rusjako/sal-wrapper Yes, I find this approach works well. It's the simplest way for me to train Bayes, and most users can cope with it, providing they're not using Outlook 2003/XP which can't forward as an attachment. But Thunderbird, Outlook Express, Squirrelmail and Pine all can easily. It's not as simple as a 'This Is Spam' button perhaps, and that's a *good* thing. Requiring a little bit of thought stops people using it as an alternative to the delete key for 'OK, perhaps I did subscribe to this but I don't want it now'. My script is very similar to sal-wrapper, using Postfix check_recipient_access to ensure only authenticated users can send to the reporting address; triggered from procmail; using MIME::Parser to extract (possibly multiple) message/rf822 attachments; feed through sa-learn --ham or spamassassin -r as appropriate and send an acknowledgement back to the user, to remind them to also send spam/non-spam to the corresponding address and correct any mistakes. One thing I notice from sal-wrapper however is that it pipes the header and body to sa-learn without passing a file as parameter. I found that although sa-learn didn't complain, this didn't work at all well, and quite short ham messages were scoring BAYES_99. You can pipe to spamassassin -r just like you can to spamassassin in any other mode, but I think if you pipe to sa-learn, you need to do it as sa-learn --ham - with the '-' as parameter, so it reads the standard input. Alternatively feed it a temporary message file. Or am I misreading something? CK Yes but problem is that 99% of users are about using some kind of outlook
Re: Mailbox for auto learning
Luis Daniel Lucio Quiroz wrote: Hi SAs, Well, after reading this link http://spamassassin.apache.org/full/3.2.x/doc/sa-learn.html I'm still looking for an easy-way to let my mortal users to train our antispam. I was thinking a mailbox such as h...@antispamserver and s...@antispamserver to let users to forward their false positivos or their false netgatives. In isde each box (ham or spam), of course a procmail with sa-learn input will be forwarded. My doubts are nexts: 1. Will forwarded mails be usefull for training, I mean if spam was: From: spa...@example.netTo: u...@mydomain, when forwarding it will be From: mu...@mydomain To: s...@antispamserver. Change of this and forwarding (getting rid of headers because mail-clients) wont change learning? Forwarded mails are NOT useful. You also neglected to mention the change of Received headers, and pretty much every header in the message, the re-encoding of the body by your mail client, etc. Since SA's bayes tokenizes headers, that's disastrous. 2. If technique in question 1 is usless, what other way would be nice to let user to report a false positive/negative for training. In some cases you can have the client forward as attachment, and use a mailbox that strips attachments and feeds them to sa-learn. As long as the client being used forwards the entire original message, with complete headers, this should work fine. TIA LD
Re: Mailbox for auto learning
Le dimanche 9 août 2009 06:52:49, vous avez écrit : Luis Daniel Lucio Quiroz wrote: Hi SAs, Well, after reading this link http://spamassassin.apache.org/full/3.2.x/doc/sa-learn.html I'm still looking for an easy-way to let my mortal users to train our antispam. I was thinking a mailbox such as h...@antispamserver and s...@antispamserver to let users to forward their false positivos or their false netgatives. In isde each box (ham or spam), of course a procmail with sa-learn input will be forwarded. My doubts are nexts: 1. Will forwarded mails be usefull for training, I mean if spam was: From: spa...@example.netTo: u...@mydomain, when forwarding it will be From: mu...@mydomain To: s...@antispamserver. Change of this and forwarding (getting rid of headers because mail-clients) wont change learning? Forwarded mails are NOT useful. You also neglected to mention the change of Received headers, and pretty much every header in the message, the re-encoding of the body by your mail client, etc. Since SA's bayes tokenizes headers, that's disastrous. 2. If technique in question 1 is usless, what other way would be nice to let user to report a false positive/negative for training. In some cases you can have the client forward as attachment, and use a mailbox that strips attachments and feeds them to sa-learn. As long as the client being used forwards the entire original message, with complete headers, this should work fine. TIA LD I understand and if I use altemime to add a link, to identify email in a quarantine? will tex in altermime change learning?
Re: Mailbox for auto learning
On Sun, 9 Aug 2009 00:36:54 -0500 Luis Daniel Lucio Quiroz luis.daniel.lu...@gmail.com wrote: Hi SAs, Well, after reading this link http://spamassassin.apache.org/full/3.2.x/doc/sa-learn.html I'm still looking for an easy-way to let my mortal users to train our antispam. If your users use webmail, imap etc , the most convenient approach is to have folders for learning spam and ham.
Re: Mailbox for auto learning
On Sun, 9 Aug 2009 00:36:54 -0500, Luis Daniel Lucio Quiroz 1. Will forwarded mails be usefull for training, I mean if spam was: From: spa...@example.netTo: u...@mydomain, when forwarding it will be From: mu...@mydomain To: s...@antispamserver. Change of this and forwarding (getting rid of headers because mail-clients) wont change learning? 2. If technique in question 1 is usless, what other way would be nice to let user to report a false positive/negative for training. dovecot-antispam solves it with dovecot all users need to do is move mail in imap to junk folder, in that task dovecot-antispam call sa-learn this means no junk plugins to windows clients and last but not least no header changes mail that is moved out of the junk folder is learned as ham, intuitive like an amiga :) -- Benny Pedersen
Re: Mailbox for auto learning
Le dimanche 9 août 2009 10:56:59, Benny Pedersen a écrit : On Sun, 9 Aug 2009 00:36:54 -0500, Luis Daniel Lucio Quiroz 1. Will forwarded mails be usefull for training, I mean if spam was: From: spa...@example.netTo: u...@mydomain, when forwarding it will be From: mu...@mydomain To: s...@antispamserver. Change of this and forwarding (getting rid of headers because mail-clients) wont change learning? 2. If technique in question 1 is usless, what other way would be nice to let user to report a false positive/negative for training. dovecot-antispam solves it with dovecot all users need to do is move mail in imap to junk folder, in that task dovecot-antispam call sa-learn this means no junk plugins to windows clients and last but not least no header changes mail that is moved out of the junk folder is learned as ham, intuitive like an amiga :) Yes but worst scenario is best for me. POP users with MS outlook. Then I was wondering to add with altermime somethin like this at footer: if you think this mail is spam please click here (also for ham), and here is a link with message-id (i have a CC of all mails). So, other doutbt, altering mail by adding a footer will alter SA learning?
Mailbox for auto learning
Hi SAs, Well, after reading this link http://spamassassin.apache.org/full/3.2.x/doc/sa-learn.html I'm still looking for an easy-way to let my mortal users to train our antispam. I was thinking a mailbox such as h...@antispamserver and s...@antispamserver to let users to forward their false positivos or their false netgatives. In isde each box (ham or spam), of course a procmail with sa-learn input will be forwarded. My doubts are nexts: 1. Will forwarded mails be usefull for training, I mean if spam was: From: spa...@example.netTo: u...@mydomain, when forwarding it will be From: mu...@mydomain To: s...@antispamserver. Change of this and forwarding (getting rid of headers because mail-clients) wont change learning? 2. If technique in question 1 is usless, what other way would be nice to let user to report a false positive/negative for training. TIA LD
