[Assp-test] fixes in assp 2.8.2 *SPAM-Eliminator* build 23331

2023-11-27 Thread Thomas Eckardt
fixed in assp 2.8.2 *SPAM-Eliminator* build 23331: - the memory footprint of the rebuild spamdb task is reduced - the output for the size of the tmpDB folder in the rebuild report was wrong - some GUI corrections - wrong configuration of the database drivers DBD::ODBC and DBD::ADO crashed assp

[Assp-test] Perl 5.38.0.1 for Windows - updated

2023-11-12 Thread Thomas Eckardt
Hi all, a new build of perl 5.38.0.1 for windows is available at sourceforge https://sourceforge.net/projects/assp/files/ASSP%20V2%20multithreading/ASSP%20V2%20module%20installation/strawberry-perl-5.38.0.1-64bit_gcc13-relocateable_4-assp.7z This perl was build using the GNU GCC version 13 (the

[Assp-test] fixes in assp 2.8.2 *SPAM-Eliminator* build 23251

2023-09-08 Thread Thomas Eckardt
Hi all, fixed in assp 2.8.2 *SPAM-Eliminator* build 23251: - In IP-address lists it is now possible to define an ASN (Autonomous System Number) for an IP-address. The IP-address-range for the IP in the ASN is resolved and used instead of the defined IP-address. Even the ASN contains more

[Assp-test] fixes in assp 2.8.2 *SPAM-Eliminator* build 23225

2023-08-13 Thread Thomas Eckardt
Hi all, fixed in assp 2.8.2 *SPAM-Eliminator* build 23225: - because of a DNS-answer layout change of asn.routeviews.org, the ASN (Autonomous System Number) for the IP-address was no longer shown in the analyzer output and in the results of the "work with IP-addresses" dialog Thomas

[Assp-test] fixes in assp 2.8.2 *SPAM-Eliminator* build 23214

2023-08-02 Thread Thomas Eckardt
Hi all, fixed in assp 2.8.2 *SPAM-Eliminator* build 23214: changed: related to SF ticket(150) : DQS Service spamhaus.net is not working correctly - The spamhaus offers a new service 'DQS Service spamhaus.net'. Since 06/2023 they are blocking legacy (spamhaus.org) requests from different

[Assp-test] fixes in assp 2.8.2 *SPAM-Eliminator* build 23198

2023-07-17 Thread Thomas Eckardt
Hi all, fixed in assp 2.8.2 *SPAM-Eliminator* build 23198: changed: - an alias for the charset 'ISO-8859-8-I' is added to Encode, if the charset is not supported by the currently installed version of Encode - the modus used to delay connections, if the connected IP matches the provided

[Assp-test] fixes in assp 2.8.2 *SPAM-Eliminator* build 23195

2023-07-14 Thread Thomas Eckardt
Hi all, fixed in assp 2.8.2 *SPAM-Eliminator* build 23195: - if a user,sender based (a privat) whitelist entry like user@local.domain,sender@other.domain was created using the 'work with lists' GUI dialog, an existing related personal-black-list entry was not removed - if a mail contained

[Assp-test] fixes in assp 2.8.2 *SPAM-Eliminator* build 23187

2023-07-06 Thread Thomas Eckardt
Hi all, fixed in assp 2.8.2 *SPAM-Eliminator* build 23187: - added support for Perl 5.38.0 Thomas ___ Assp-test mailing list Assp-test@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-test

[Assp-test] perl 5.38.0

2023-07-06 Thread Thomas Eckardt
Hi all, perl 5.38.0 was released some days ago. I've finished compiling it for 64bit windows and added all components required by assp. If you want to try it out, it is available at

[Assp-test] fixes in assp 2.8.2 *SPAM-Eliminator* build 23184

2023-07-03 Thread Thomas Eckardt
Hi all, fixed in assp 2.8.2 *SPAM-Eliminator* build 23184: - if a backend-server (e.g. bad configured exim) offered the SMTP-extension PIPECONNECT and a client/server used the pipelining option, the connection failed after the DATA command changed: - the at least recommended version of the

[Assp-test] fixes in assp 2.8.2 *SPAM-Eliminator* build 23136

2023-05-16 Thread Thomas Eckardt
Hi all, fixed in assp 2.8.2 *SPAM-Eliminator* build 23136: - if openssl 3.0.0 or higher was installed, the installed openssl library version was not shown in the "Perl Modules" status page Thomas ___ Assp-test mailing list

[Assp-test] fixes in assp 2.8.2 *SPAM-Eliminator* build 23130

2023-05-09 Thread Thomas Eckardt
Hi all, fixed in assp 2.8.2 *SPAM-Eliminator* build 23130: - the latest Net::DNS module version 1.38 throws a deprecation warning about the usage of the function rr->rdatastr (instead of using rr->rdstring) this build uses rr->rdstring it is expected, that in any of the next versions of

[Assp-test] fixes in assp 2.8.2 *SPAM-Eliminator* build 23116

2023-04-26 Thread Thomas Eckardt
Hi all, fixed in assp 2.8.2 *SPAM-Eliminator* build 23116: - the download URL's for the two- and third-level-tld files are changed to (the download was no longer woring using the old URL's) https://www.surbl.org/static/two-level-tlds https://www.surbl.org/static/three-level-tlds - wrong

[Assp-test] fixes in assp 2.8.2 *SPAM-Eliminator* build 23089

2023-03-30 Thread Thomas Eckardt
Hi all, fixed in assp 2.8.2 *SPAM-Eliminator* build 23089: - if the bulkimport of the spamdb and hmmdb were disabled for MSSQL-Databases, the import failed because of the usage of wrong table names - it was possible that preHeaderRe matched in the analyzer but not in the real mail

[Assp-test] fixes in assp 2.8.2 *SPAM-Eliminator* build 23072

2023-03-13 Thread Thomas Eckardt
Hi all fixed in assp 2.8.2 *SPAM-Eliminator* build 23072: ** * * !!! ATTENTION !!! * * *this version of

Re: [Assp-test] ASSP and chatgpt

2023-03-07 Thread Thomas Eckardt
1. a perl module OpenAI::API is already available - its not really nice because it uses Moo, but this can be changed 2. using OpenAI for spam detection would be very expensive - you are charged by tokens - reaching several million "Usage" and "Training" tokens per day is possible ... 9.

Re: [Assp-test] ASSP can't create socket on port 55555 for web admin.

2023-03-05 Thread Thomas Eckardt
0) (on darwin) running on server:xxx [init] IO::Socket::IP module version 0.41 installed and available And in Activity Monitor I can see that Perl is running as root. What am I missing? Thanks, Jammes[Anhang "attu4spk.txt" gelöscht von Thomas Eckardt/eck] [Anhang "attyhzf

[Assp-test] fixes in assp 2.6.8 *SPAM-Evaporator* build 23002

2023-01-02 Thread Thomas Eckardt
Hi all, fixed in assp 2.6.8 *SPAM-Evaporator* build 23002: - ASSP_AFC.pm is upgraded to version 5.45 - on several linux version assp throws an error "Error: Schedule entry '0-59/10 * * * *' for MemoryUsageCheckSchedule is not valid" this should no longer happen Thomas

Re: [Assp-test] Unable to create UDP Socket errors

2022-11-22 Thread Thomas Eckardt
found this in the assp dev forum https://unix.stackexchange.com/questions/714901/dns-broken-when-using-ifupdown-and-systemd-resolved-after-upgrade-to-ubuntu-22-0?newreg=c4cc3942d61140858fd6815357211bba it's related to ubuntu, but it may help to get an idea Thomas Von:"Mr. Courtney

[Assp-test] fixes in assp 2.6.8 *SPAM-Evaporator* build 22326

2022-11-22 Thread Thomas Eckardt
Hi all, fixed in assp 2.6.8 *SPAM-Evaporator* build 22326: - several interal statistics were unexpected cleared at startup, if 'useDB4IntCache' was not set - if a mail with the empty envelope recipient was received and the sending domain (from: or sender:) provided a DMARC record the DMARC

Re: [Assp-test] Unable to create UDP Socket errors

2022-11-19 Thread Thomas Eckardt
hoot this, and also wondering if anyone else is seeing anything similar. -C [Anhang "attmrm6l.txt" gelöscht von Thomas Eckardt/eck] [Anhang "att9qtoe.txt" gelöscht von Thomas Eckardt/eck] ___ Assp-test mailing list Assp-test@lists.source

[Assp-test] fixes in assp 2.6.8 *SPAM-Evaporator* build 22318

2022-11-14 Thread Thomas Eckardt
Hi all, fixed in assp 2.6.8 *SPAM-Evaporator* build 22318: - some spam messages were not forwarded even 'ccSpamAlways' was configured NOTICE: if 'ccSpamAlways' is configured and 'SpamVirusLog' is not set to 'quarantine' (even it is set to 'no collect' !!), the virus mails will be

[Assp-test] fixes in assp 2.6.8 *SPAM-Evaporator* build 22313

2022-11-09 Thread Thomas Eckardt
Hi all, fixed in assp 2.6.8 *SPAM-Evaporator* build 22313: - if any of DKIMWLAddresses or DKIMNPAddresses was used and a mail contained more than one DKIM signature (eg. for different identities) only the first (header - top to bottom) valid DKIM identity was checked against both parameters

[Assp-test] fixes in assp 2.6.8 *SPAM-Evaporator* build 22310

2022-11-06 Thread Thomas . Eckardt
Hi all, fixed in assp 2.6.8 *SPAM-Evaporator* build 22310: - on non english linux installations some times the connection retry was not working changed: - in 'ccSpamInDomain' it is now possible to use the USERNAME literal The literal USERNAME is replaced by the user part of the

Re: [Assp-test] Allowing certain javascript in HTML to pass

2022-11-01 Thread Thomas Eckardt
>it appears that it is showing the sha256 of the .html file yes, the javascript is in the html file - - the fault is "javascript used in html", not the base64 encoded javascript part >That means that the sha256 that shows in the log is different each time and can't be use for the exception.

[Assp-test] ASSP_AFC 5.42 available at SVN

2022-10-27 Thread Thomas Eckardt
Hi all, ASSP_AFC.pm 5.42 is released on the SVN repo. The last days have shown an extensive usage of very smart attacks, which are based on native integrated code in SVG images and HTML pages. This release is able to detect native integrated Base64 encoded as well as javascript code in

[Assp-test] fixes in assp 2.6.8 *SPAM-Evaporator* build 22293

2022-10-20 Thread Thomas . Eckardt
Hi all, fixed in assp 2.6.8 *SPAM-Evaporator* build 22293: - if BlockRepForwHost was configured and any of EmailBlockReportDomain, EmailBlockReport or BlockRepForwHost was changed, queued forwarding requests failed in case any of these vales is changed, the BlockReport-Forwarding queue is

[Assp-test] fixes in assp 2.6.8 *SPAM-Evaporator* build 22280

2022-10-07 Thread Thomas Eckardt
Hi all, fixed in assp 2.6.8 *SPAM-Evaporator* build 22280: - after an upgrade of the perl module Schedule::Cron to version 1.03 the assp scheduler was no longer working Thomas ___ Assp-test mailing list Assp-test@lists.sourceforge.net

[Assp-test] fixes in assp 2.6.8 *SPAM-Evaporator* build 22279

2022-10-06 Thread Thomas Eckardt
Hi all, fixed in assp 2.6.8 *SPAM-Evaporator* build 22279: - griplist uploads and downloads were no longer working, because the sourceforge http server no longer accepts plain http transfer NOTICE: ALL older versions of assp will fail to upload to the griplist server! - statistc uploads

[Assp-test] fixes in assp 2.6.8 *SPAM-Evaporator* build 22252

2022-09-09 Thread Thomas Eckardt
Hi all, fixed in assp 2.6.8 *SPAM-Evaporator* build 22252: - if line continuation '\' was used in a regular expression file, the regex was no longer working like expected - if line continuation '\' was used in a regular expression file, the analyzer has'nt shown the matching file and line

Re: [Assp-test] Line Continuation in config files

2022-09-09 Thread Thomas Eckardt
)\@(?:(?)\.)+(?)|(?from):(?)\@(?:(?)\.)*?(?(?))\.(?)).+?\n\ (?!\k)(?:to:(?)\k\@(?:(?)\.)+(?)|from:(?)\@(?:(?)\.)*?\k\.(?))~=>-10 Saving the file does not trigger an error in the GUI, but the analyze GUI no longer shows matches for the same email that does when the regex is on a single line. Thanks![Anhang "att948xp.t

[Assp-test] fixes in assp 2.6.8 *SPAM-Evaporator* build 22251

2022-09-08 Thread Thomas Eckardt
Hi all, fixed in assp 2.6.8 *SPAM-Evaporator* build 22251: - some unexpected log lines about unresolveable IP-addresses were shown by assp (since build 22200) - the attachment 'NoCheckIf' rule was not working, if the SPF-check or the DKIM-check was skipped because of any condition

Re: [Assp-test] soft hyphen fooling Bayesian analysis

2022-09-07 Thread Thomas Eckardt
r to catch commonly obscured words (like GeekSquad). Is it okay if I reply further in my August 1 post here to keep that in the same thread? On Tue, Sep 6, 2022 at 2:06 PM Thomas Eckardt wrote: >HTML::strip html parsing to get text parts has nothing to do with html de(en)coding >i

Re: [Assp-test] soft hyphen fooling Bayesian analysis

2022-09-06 Thread Thomas Eckardt
the end of a line. I suspect that other characters will be abused in the same way. This kind of obfuscation goes hand in hand with my previous questions about considering some non-Latin characters that look like Latin characters as those Latin alphabet characters. Thanks [Anhang "a

Re: [Assp-test] Warnings for unable to resolve IP

2022-08-14 Thread Thomas Eckardt
ed on the warning, I just wanted to see if these are new / different warnings that ASSP is doing now or if there's been an uptick in bulk sending services doing things wrong. Thanks [Anhang "attm5aih.txt" gelöscht von Thomas Eckardt/eck] [Anhang "att78ilr.t

[Assp-test] fixes in assp 2.6.8 *SPAM-Evaporator* build 22209

2022-07-28 Thread Thomas . Eckardt
Hi all, fixed in assp 2.6.8 *SPAM-Evaporator* build 22209: - If an EmailAdmin requested a resend of a blocked mail (for another person) and the blocked mail was originally sent to multiple envelope recipients, the mail was only resent to the first original envelope recipient, because only

[Assp-test] ASSP_AFC version 5.41

2022-07-20 Thread Thomas Eckardt
I released ASSP_AFC.pm version 5.41 at SVN. If a mail was blocked because of a bad attachment and an admin requested a resend without using the 'noscan' tag or without defining the 'X-Assp-ForceResend:' header, assp has possibly moved and renamed the original file (most times in to

[Assp-test] ASSP_AFC version 5.40

2022-07-19 Thread Thomas Eckardt
I released ASSP_AFC.pm version 5.40 at SVN. It fixes a problem were the attachment parser was running in to a processing timeout, if an extracted attachment was a corrupt .eml file. Thomas DISCLAIMER: *** This email and any files

Re: [Assp-test] blockStrictDKIMRe -- also thoughts on DMARC rejects

2022-07-19 Thread Thomas Eckardt
equation in the last 2 years. I'm still in touch with their staff. While the like 365's features, they can't stand the spam filtering. You've spoiled them with never having to sort through a junk folder!! On Fri, Jul 15, 2022 at 6:37 AM Thomas Eckardt wrote: Ken - learn perl regular express

[Assp-test] fixes in assp 2.6.8 *SPAM-Evaporator* build 22200

2022-07-19 Thread Thomas Eckardt
Hi all, fixed in assp 2.6.8 *SPAM-Evaporator* build 22200: - if 'runAsUser' was used on nix systems, it was possible that the file assp/tmpDB/files/SPFRecCache.sav was saved using a wrong owner (root) - which may be caused a permission error at the next start of assp - if setFilePermOnStart

Re: [Assp-test] blockStrictDKIMRe -- also thoughts on DMARC rejects

2022-07-15 Thread Thomas Eckardt
/xis; return ($match !~ /$re/); } seems to return if there's no DKIM (return unless $this->{isDKIM};) wouldn't that not match the regex, so the 60 score wouldn't be applied? Part of my goal is to require DKIM signature for certain domain names, not only requiring valid DKIM

Re: [Assp-test] blockStrictDKIMRe -- also thoughts on DMARC rejects

2022-07-09 Thread Thomas Eckardt
eturn ($match !~ /$re/); } Thomas Von:"Thomas Eckardt" An: "ASSP development mailing list" Datum: 08.07.2022 16:53 Betreff:Re: [Assp-test] blockStrictDKIMRe -- also thoughts on DMARC rejects If such a feature would be implemented, it will result

Re: [Assp-test] blockStrictDKIMRe -- also thoughts on DMARC rejects

2022-07-08 Thread Thomas Eckardt
reject the message (just like their DMARC policy says to do). Is there another way with current ASSP features to accomplish this only if a message matches this proposed regex? Ken On Fri, Jun 17, 2022 at 4:35 AM Thomas Eckardt wrote: >Would you please consider adding a featur

[Assp-test] fixes in assp 2.6.8 *SPAM-Evaporator* build 22187

2022-07-06 Thread Thomas Eckardt
Hi all, fixed in assp 2.6.8 *SPAM-Evaporator* build 22187: - it was possible to define a colon (:) in 'proxyuser' - this is no longer allowed - as stated in rfc7235 - the upload of Stats and Griplist to the sourceforge servers failed, if 'proxyserver' and 'proxyuser' and 'proxypass' were

Re: [Assp-test] blockStrictDKIMRe -- also thoughts on DMARC rejects

2022-06-17 Thread Thomas Eckardt
>Would you please consider adding a feature to do the same for a failed DKIM signature? NO! Contrary to SPF, a DKIM signature has only two options : OK and FAIL - Based on the signature it self or based on a trusted forwarders authentication result (ARC). A DKIM signature has to be valid

Re: [Assp-test] blocking new MS doc vunerability (URI attack vector)

2022-06-17 Thread Thomas Eckardt
document relationships are too commonly used to block them if you really need to block them, use the implemented calls to our $checkExeExternal; # custom subroutine to check executables external (eg. lib/CorrectASSPcfg.pm) - $ASSP_AFC::checkExeExternal->($self,\$sk,\$buff,$raf,\$pdf) if the

[Assp-test] fixes in assp 2.6.8 *SPAM-Evaporator* build 22165

2022-06-14 Thread Thomas Eckardt
Hi all, fixed in assp 2.6.8 *SPAM-Evaporator* build 22165: - all plugins failed to detect assp.pl versions with two digit version numbers all plugins are updated - assp on perl 5.36.0 showed unexpected warnings at compile time - SSL renegotiations at a tranparent proxy connection caused

Re: [Assp-test] blocking new MS doc vunerability (URI attack vector)

2022-06-13 Thread Thomas Eckardt
This is not possible because: Note that the suspicious scheme ("ms-msdt:/") is not present in the document. It's present in the first stage payload that will be downloaded by Office. and The document contains an external reference pointing to a malicious URL: If the

[Assp-test] perl / assp and openssl v3.0.x

2022-06-10 Thread Thomas Eckardt
Hi all, If anyhow possible you should consider to not switch openssl to version 3.0.x. There are currently too many openssl related perl modules at CPAN, which can't be compiled using openssl v3. ASSP seems not to be affected by any of these incompatible modules! Thomas DISCLAIMER:

[Assp-test] perl version switched to 5.36

2022-06-10 Thread Thomas Eckardt
Hi all, the development of assp V2 is switched to perl version 5.36.0. The latest available assp version 2.6.8 build 22125 still shows a hint at startup that perl 5.36 is too new - but works. The next build will accept perl 5.36.x and will fix some minor 5.36 warnings. There is no need to

Re: [Assp-test] bombHeaderRe matching every email

2022-06-10 Thread Thomas Eckardt
it all of my BombRE's. Your suggestion did work: (?:^|\n)from:\s*_+ However, if you add scoring to it: (?:^|\n)from:\s*_+=>1.5 ASSP rejects it as invalid Regex. On 6/9/2022 5:05, Thomas Eckardt wrote: >>I know regex fairly well > > hmm. > > > from\

Re: [Assp-test] bombHeaderRe matching every email

2022-06-09 Thread Thomas Eckardt
>I know regex fairly well hmm. from\:.*\_ looks very bad - it is read like: look for from: followed by anything any long (or nothing) followed by _ in the complete header keep in mind: all bombRE's are using the /s regex switch (ignoring CR and LF) So, if there is an underscore

[Assp-test] fixes in assp 2.6.8 *SPAM-Evaporator* build 22125

2022-05-05 Thread Thomas Eckardt
Hi all, fixed in assp 2.6.8 *SPAM-Evaporator* build 22125: - TLSv1.3 connections from assp to a backend-server were running in to a SMTP-timeout. This was caused by an unhandled second session-ID transmission in TLSv1.3. changed: - 'forceTLSIP' can now be configured for selected sender

[Assp-test] fixes in assp 2.6.8 *SPAM-Evaporator* build 22080

2022-03-21 Thread Thomas Eckardt
Hi all, fixed in assp 2.6.8 *SPAM-Evaporator* build 22080: - if 'myGreeting' was configured as multiline greeting, assp has prepended '220 ' even the first line was starting with '220-' changed: The literal 'LASTCOMMAND' will be replaced by the last used SMTP-command in every SMTP error

[Assp-test] fixes in assp 2.6.8 *SPAM-Evaporator* build 22075

2022-03-16 Thread Thomas Eckardt
Hi all, fixed in assp 2.6.8 *SPAM-Evaporator* build 22075: - if a DNS-TXT record contained more than one entry (multi line), only the first entry was read some SPF-records were not processed correctly for this reason this is fixed changed: - the GUI dialog "working with IP-addresses"

Re: [Assp-test] Auto plugin update

2022-03-15 Thread Thomas Eckardt
Yes, only GPB registered assp instances will update plugins and library files. Thomas Von:"Daniel Miller via Assp-test" An: "ASSP development mailing list" Kopie: "Daniel Miller" Datum: 14.03.2022 22:08 Betreff:[Assp-test] Auto plugin update Is a subscription to the

Re: [Assp-test] Empty folder created on startup

2022-03-08 Thread Thomas Eckardt
Looks like your assp.cfg contains an invalid encrypted folder name. Thomas Von:"Daniel Miller via Assp-test" An: "ASSP development mailing list" Kopie: "Daniel Miller" Datum: 09.03.2022 03:26 Betreff:[Assp-test] Empty folder created on startup At some point soon after

Re: [Assp-test] assp development switched to perl 5.34.0

2022-03-08 Thread Thomas Eckardt
switched to perl 5.34.0 Nicely done! How'd you get this done it's released at strawberryperl.com? On Tue, Mar 8, 2022 at 10:18 AM Thomas Eckardt wrote: Hi all, the assp development is switched to perl 5.34.0 strawberry perl 5.34.0 (for win_x64) is available at the sourceforge assp downlo

[Assp-test] assp development switched to perl 5.34.0

2022-03-08 Thread Thomas Eckardt
Hi all, the assp development is switched to perl 5.34.0 strawberry perl 5.34.0 (for win_x64) is available at the sourceforge assp download repository ASSP V2 multithreading/ASSP V2 module installation/strawberry-perl-5.34.0.1-64bit-relocateable_4-assp.7z Thomas DISCLAIMER:

[Assp-test] fixes in assp 2.6.8 *SPAM-Evaporator* build 22063

2022-03-04 Thread Thomas Eckardt
Hi all, fixed in assp 2.6.8 *SPAM-Evaporator* build 22063: added: - The XOAUTH2 authentication mechanism is implemented (IN and OUT/relay). A SSL/TLS protected connection is required in every case for XOAUTH2 - independend from the setting of AUTHrequireTLS. The help text for

[Assp-test] fixes in assp 2.6.8 *SPAM-Evaporator* build 22058

2022-02-27 Thread Thomas Eckardt
Hi all, fixed in assp 2.6.8 *SPAM-Evaporator* build 22058: - because of a MIME decoding BUG, reported mails with very long subjects were not processed correctly - if a blocked mail eml-file was moved from the spam folder to the discarded folder, it was sometimes no longer found by the

[Assp-test] fixes in assp 2.6.6 *SPAM-Evaporator* build 22019

2022-01-19 Thread Thomas Eckardt
Hi all, fixed in assp 2.6.6 *SPAM-Evaporator* build 22019: - If the used perl version was compiled without linking to libcypto, the perl 'crypt' command was without function. This caused the assp internal encryption engine to fail and all encrypted configuration values and files were

Re: [Assp-test] [CANCELLED] Timeout for 3rd DNS?

2022-01-02 Thread Thomas Eckardt
sourceforge.net. (33) Does anyone have an idea what the difference between the two queries might be? Thanks Dirk Von: Thomas Eckardt Gesendet: Samstag, 1. Januar 2022 08:05 An: ASSP development mailing list Betreff: Re: [Assp-test] [CANCELLED] Timeout for 3rd DNS? >(two internet uplinks) It ma

Re: [Assp-test] [CANCELLED] Timeout for 3rd DNS?

2021-12-31 Thread Thomas Eckardt
>(two internet uplinks) It may be possible that you need to setuo 'dnsLocalIPAddress' on a multihomed system! Thomas Von:"Dirk Kulmsee" An: "'ASSP development mailing list'" Datum: 31.12.2021 19:49 Betreff:Re: [Assp-test] [CANCELLED] Timeout for 3rd DNS? I think I

[Assp-test] fixes in assp 2.6.6 *SPAM-Evaporator* build 21351

2021-12-17 Thread Thomas Eckardt
Hi all, fixed in assp 2.6.6 *SPAM-Evaporator* build 21351: - if 'onlyAUTHHeloRe' was used, a logline for a match was written after each SMTP command - now the match is shown only after the HELO/EHLO command was used changed: - ASSP_AFC.pm version 5.37 is now able to detect template

Re: [Assp-test] onlyAUTHHeloRe gets checked repeatedly

2021-11-26 Thread Thomas Eckardt
Everything is OK. onlyAUTHHeloRe is checked as part of the internal 'DisableAUTH' check. This has to be done multiple times, if the 'DisableAUTH'-state was never reached for any reason. For now, you can skip the logging using 'noLogLineRe'. I'll see, if I can skip the logging - the check itself

[Assp-test] fixes in assp 2.6.6 *SPAM-Evaporator* build 21328

2021-11-24 Thread Thomas Eckardt
Hi all, fixed in assp 2.6.6 *SPAM-Evaporator* build 21328: - If 'AddRWLHeader' was enabled and a RWLCache hit was found, no RWL-header was added to the mail. changed: - text/plain parts of a mail are now also cleanedup from (badly) added HTML-tags, which improves all text based features,

Re: [Assp-test] Concept Question: Scan entire message for Bombs, regardless of MaxBytes setting? New MaxBytes recommendation?

2021-11-15 Thread Thomas Eckardt
for the rest of the quiet spam fighters on this list. On Sun, Nov 14, 2021 at 5:59 AM Thomas Eckardt wrote: >How many of the changes in the last 10 or so versions of ASSP have been from the requests of anyone else on this list? how many? 1 at 5.11.2021 - weight bug most - where? ->

Re: [Assp-test] No more update to the "http" repository ?

2021-11-15 Thread Thomas Eckardt
Depending on the version you use the download location is different. Links are provided in GUI-Stats page. 2.6.5 (odd minor number) - public release (SF http download) 2.6.6 (even minor number) - development release (SVN) Thomas Von:"Davide Yachaya" An:

Re: [Assp-test] Concept Question: Scan entire message for Bombs, regardless of MaxBytes setting? New MaxBytes recommendation?

2021-11-15 Thread Thomas Eckardt
would you have known what I was talking about? I will now step away from this form as requested for as long as I am able. I do hope that you are willing to entertain future questions/concerns once I return, if not for me, then for the rest of the quiet spam fighters on this list. On Sun, Nov 14

Re: [Assp-test] Concept Question: Scan entire message for Bombs, regardless of MaxBytes setting? New MaxBytes recommendation?

2021-11-14 Thread Thomas Eckardt
en if I can be frustrating that I'm ultimately bring some good to the ASSP world by offering suggestions and asking questions. On Sat, Nov 13, 2021 at 3:56 AM Thomas Eckardt wrote: Ken , it would be nice if you consider to signoff this list or at least to no longer post here. Thank you. Thoma

Re: [Assp-test] PenaltyExtreme not used?

2021-11-14 Thread Thomas Eckardt
Just checked this again. worker_1 - AUTH failes and switched on DelayIP for the IP worker_2 - DelayIP delays the IP ExtremeIP is checked very much later. Thomas Von:"Dirk Kulmsee" An: Datum: 12.11.2021 14:47 Betreff:[Assp-test] PenaltyExtreme not used? Hi all, I'm

[Assp-test] fixes in assp 2.6.6 *SPAM-Evaporator* build 21317

2021-11-13 Thread Thomas Eckardt
Hi all, fixed in assp 2.6.6 *SPAM-Evaporator* build 21317: - If a line in a regular expression file was protected from regex optimization using the <<<...>>> pagma, a possibly defined weight (...=>ddd) was ignored and the default penalty points were used. - If a predefinition of regular

Re: [Assp-test] Concept Question: Scan entire message for Bombs, regardless of MaxBytes setting? New MaxBytes recommendation?

2021-11-13 Thread Thomas Eckardt
you just don't think it's necessary? I'm most interested in your opinion on that before I move forward. On Fri, Nov 12, 2021 at 1:08 PM Thomas Eckardt wrote: Nov-12-21 04:00:20 RebuildSpamDB-thread rebuildspamdb-version 8.14 started in ASSP version 2.6.6(21314) Nov-12-21 04:00:20 detection of lo

Re: [Assp-test] Concept Question: Scan entire message for Bombs, regardless of MaxBytes setting? New MaxBytes recommendation?

2021-11-12 Thread Thomas Eckardt
that would let bombs later in the body be detected. I don't know what the downside to having such a feature would be. Based on your reaction to my question, I'm obviously missing something important. On Thu, Nov 11, 2021 at 1:38 AM Thomas Eckardt wrote: >Is there logic to having a se

Re: [Assp-test] PenaltyExtreme not used?

2021-11-12 Thread Thomas Eckardt
worker_1 is blocked because the AUTH check comes first and AUTH was used worker_2 is blocked by PenaltyDelay - AUTH was not used both are blocked before the PenaltyExtreme check is done Thomas Von:"Dirk Kulmsee" An: Datum: 12.11.2021 14:47 Betreff:[Assp-test]

Re: [Assp-test] Concept Question: Scan entire message for Bombs, regardless of MaxBytes setting? New MaxBytes recommendation?

2021-11-10 Thread Thomas Eckardt
>Is there logic to having a separate MaxBytes setting like MaxBytesForBombs that's used only during message delivery? That way, the entire message can be scanned for bombs, but the rebuild could use a lower number to better balance the differential between the average sized spam and average

Re: [Assp-test] Another Concept Question: DKIMBousScoreList

2021-11-08 Thread Thomas Eckardt
ll getting the bonus score, but this will have to do. Thanks. On Mon, Nov 8, 2021 at 12:01 PM Thomas Eckardt wrote: I told you to score such domains elsewhere - just do it and the result is the same like you wanted. for example: bombHeaderRe: \nDKIM-Signature:(?:[ \t]*[^= \;]+=[^= \;

Re: [Assp-test] Another Concept Question: DKIMBousScoreList

2021-11-08 Thread Thomas Eckardt
a scenario in which it's a good idea. On Fri, Nov 5, 2021 at 10:37 AM Thomas Eckardt wrote: Another useless post about concepts without reading the manual. >dkimBonusValancePB there is already dkimOkValencePB - increase it and reduce the score for certain domains by blackList

Re: [Assp-test] Another Concept Question: DKIMBousScoreList

2021-11-05 Thread Thomas Eckardt
Another useless post about concepts without reading the manual. >dkimBonusValancePB there is already dkimOkValencePB - increase it and reduce the score for certain domains by blackListedDomains, SenderBase or anywhere else - if needed Thomas Von:"K Post" An: "ASSP development

Re: [Assp-test] RegEx Backreferences - the basics

2021-11-05 Thread Thomas Eckardt
ters ending in space or < \g{FROMFirstMatch}\@ now look for the second level domain match from the from: line immediately followed by an @ sign (?:[a-z\d\-]+\.)+ then hostnames separated by dots, at least 1 [a-z]{2,6}\>?\r?\n) followed by a 2-6 character tld, an optional > and a \n

Re: [Assp-test] RegEx Backreferences - the basics

2021-11-04 Thread Thomas Eckardt
>>If "searchstring" is to the right and left of an @ sign, it should match. After having some time while driving a car today - my 2 cents for using a named capture group and backreference ? \k - instead of numbered (...) \1 (?searchstring)[^@\r\n]{0,64}\@[^@\r\n]{0,64}\k When ever

Re: [Assp-test] RegEx Backreferences - the basics

2021-11-04 Thread Thomas Eckardt
:"Thomas Eckardt" An: "ASSP development mailing list" Datum: 04.11.2021 09:22 Betreff:Re: [Assp-test] RegEx Backreferences - the basics to make backreferences working, regex optimization must be switched off for the complete regex -> tested -> worked >I'

Re: [Assp-test] RegEx Backreferences - the basics

2021-11-04 Thread Thomas Eckardt
to make backreferences working, regex optimization must be switched off for the complete regex -> tested -> worked >I've seen posts here indicating that backreferencing matches is possible with an unoptimized expression. so - the problem is sitting in front of the monitor :):)

[Assp-test] fixes in assp 2.6.6 *SPAM-Evaporator* build 21306

2021-11-02 Thread Thomas Eckardt
Hi all fixed in assp 2.6.6 *SPAM-Evaporator* build 21306: - An email, starting with an invalid MIME header, sent to the analyzer - prevented the analyzer from finding the subject of the mail. - If the same regular expression was used with different weights, tagged by different 'NWLI'

Re: [Assp-test] fixes in assp 2.6.6 *SPAM-Evaporator* build 21302

2021-11-01 Thread Thomas Eckardt
you have the time and energy to review what's going on with the above, maybe you could also consider fixing (adding?) this functionality? ...as always... Thank you Ken On Sun, Oct 31, 2021 at 5:50 AM Thomas Eckardt wrote: It's always been like this - outlook forwards WRONG. To

Re: [Assp-test] fixes in assp 2.6.6 *SPAM-Evaporator* build 21302

2021-10-31 Thread Thomas Eckardt
It's always been like this - outlook forwards WRONG. To send a mail to an SMTP-based analysis system (this applies to all, not just ASSP) for analysis purposes: - the mail is to be exported (.msg or .eml) and then (possibly zip) sent to the system - or to attach the mail to a new mail via drag

Re: [Assp-test] fixes in assp 2.6.6 *SPAM-Evaporator* build 21302

2021-10-30 Thread Thomas Eckardt
ubmitted reclassifications vs ones I've done through the GUI. Could we have it use the same file extension as we use for the corpus? (maillogExt) In the code, in some places X-Assp- headers are referenced, others have X-ASSP- All of the compares I've seen appear to be case insensitive, b

[Assp-test] fixes in assp 2.6.6 *SPAM-Evaporator* build 21302

2021-10-29 Thread Thomas Eckardt
Hi all, fixed in assp 2.6.6 *SPAM-Evaporator* build 21302: - Improved email address detection in the emailinterface list reports (whitelistadd , whitelistremove, ). - The change time for include files used in the 'Groups' feature were not recorded in workers. This caused unexpected

Re: [Assp-test] Main_Thread is unable to transfer connection to any worker - try again

2021-10-27 Thread Thomas Eckardt
ct-26-21 10:37:33 Worker_6 will sleep now Oct-26-21 10:37:33 Info: Worker_3 is interrupted to get new connection Oct-26-21 10:37:33 Connected: session:8FC33A40 104.237.139.48:57300 > a.b.c.60:25 > a.b.c.35:25 Oct-26-21 10:37:33 Worker_4 wakes up Oct-26-21 10:37:33 Info: Worker_4 got connectio

Re: [Assp-test] Main_Thread is unable to transfer connection to any worker - try again

2021-10-26 Thread Thomas Eckardt
>I tried to see where SaveConfig() SaveConfig() is called in the Main_Thread (Worker_0) every time, anything in the assp configuration was changed. And under normal cirumstances, after that, all workers are told to check there configuration (and reload) in relation to the new one (lists, files,

Re: [Assp-test] Concept question: At rebuild, look at DKIMWLAddresses?

2021-10-26 Thread Thomas Eckardt
>without rebuild taking too much of a performance hit? fastest case: all in the file model slowest case: - no file model - checking whiteRe, whitelist, npRe, DKIMWLAddresses, DKIMNPAddresses, redRe - for assp/spam - checking denySMTPConnectionsFromAlways, denySMTPConnectionsFrom,

Re: [Assp-test] Concept question: At rebuild, look at DKIMWLAddresses?

2021-10-24 Thread Thomas Eckardt
>During rebuild, ASSP runs rb_whitelisted against each message in the spam corpus only for spam (not for corrected spam) AND only if enabled (DoRBWhite , DoRBRed) ! Thomas Von:"K Post" An: "ASSP development mailing list" Datum: 24.10.2021 02:40 Betreff:[Assp-test]

Re: [Assp-test] Concept question with sample code: DKIMWLAddresses single line for .domain.com and @domain.com?

2021-10-24 Thread Thomas Eckardt
(@|.)domain.com Thomas Von:"K Post" An: "ASSP development mailing list" Datum: 24.10.2021 04:36 Betreff:[Assp-test] Concept question with sample code: DKIMWLAddresses single line for .domain.com and @domain.com? (I believe I have this working, see code please) I

[Assp-test] fixes in assp 2.6.6 *SPAM-Evaporator* build 21293

2021-10-20 Thread Thomas Eckardt
Hi all, fixed in assp 2.6.6 *SPAM-Evaporator* build 21293: - if a file for regular expressions contained an incomplete default definition for the !!!NWLI!!! directive, this directive was not applied to the regexes in the file changed: - some corrections and additions to the main help text

Re: [Assp-test] Does Message Score build from Bomb matches override a DKIMNP match??

2021-10-18 Thread Thomas Eckardt
misperception as I do on this. I suggest we add: Note: Messages flagged as "no processing" will not contribute to the corpus and will not be scored based on Bayesian/HMM detection. However, by default, "Penalty Box" / Bomb scroing will still take place. See !!!NWLI!!! option to

[Assp-test] fixes in assp 2.6.6 *SPAM-Evaporator* build 21290

2021-10-17 Thread Thomas Eckardt
Hi all, fixed in assp 2.6.6 *SPAM-Evaporator* build 21290: - build 21287 caused an error 'BerkeleyDB-ERROR: in start rebuildAddCorrections - syntax error at (eval 679) line 5, near "$main::$BDBerrLog "' - fixes a STATS counting mistake since 21280 - if an IP was blocked by an early blocking

Re: [Assp-test] fixes in assp 2.6.6 *SPAM-Evaporator* build 21287

2021-10-17 Thread Thomas Eckardt
P use some magic to trap any BDB error or warning that may occur? On Fri, Oct 15, 2021 at 5:35 AM Thomas Eckardt wrote: >If msvcrt is being used, would 512 open files ever not be enough? No, not in every case. This depends on the configuration and the workload. > $winSetMaxIO_DLL and $winS

Re: [Assp-test] Does Message Score build from Bomb matches override a DKIMNP match??

2021-10-17 Thread Thomas Eckardt
>(not sure why this line is in the log twice) because the string was found twice >msg rejected, even though no processing I can't find anything in the manual, which states that 'noprocessing' mails are not processed by the penaltybox Scores are added by the bomb feature, because assp is

Re: [Assp-test] fixes in assp 2.6.6 *SPAM-Evaporator* build 21287

2021-10-15 Thread Thomas Eckardt
tallations at https://strawberryperl.com/releases.html compiled with DUSE_PERLIO?I tried looking it up, but I'm coming up empty With BDBErrLog set to 0, I assume that any error with BDB files would still be spit out to the maillog.txt file so we can be alerted that something's wrong? On Thu, Oct

  1   2   3   4   5   6   7   8   9   10   >