Re: GnuPG mutt on Woody 3.0r2.

2003-12-23 Thread Adeodato Simó
* s. keeling [Mon, 22 Dec 2003 23:52:30 -0700]: With help from one of the list recipients, this is now verified and reproducible. Something between me and those people whose keys are determined by my copy of gpg to be Bad signature, is mangling mail. Specifically, that something is fixing

Attempts to poison bayesian systems

2003-12-23 Thread Dale Amon
I've been noticing loads of mails like this lately: Date: Sun, 21 Dec 2003 16:25:34 +0500 From: Joseph Jenkins [EMAIL PROTECTED] Subject: Re: MIT, rest in peace! To: [EMAIL PROTECTED] X-Mailer: mPOP Web-Mail 2.19 emery atrocious larval drippy elate incontrollable raster anglicanism

Re: Attempts to poison bayesian systems

2003-12-23 Thread tps
On Tue, Dec 23, 2003 at 01:25:30PM +, Dale Amon wrote: I've been noticing loads of mails like this lately: Date: Sun, 21 Dec 2003 16:25:34 +0500 From: Joseph Jenkins [EMAIL PROTECTED] Subject: Re: MIT, rest in peace! To: [EMAIL PROTECTED] X-Mailer: mPOP Web-Mail 2.19

Re: Attempts to poison bayesian systems

2003-12-23 Thread Russell Coker
This discussion has some minor relevance to debian-isp, but nothing to do with debian-security. Let's move the discussion to debian-isp. On Wed, 24 Dec 2003 00:25, Dale Amon [EMAIL PROTECTED] wrote: I've been noticing loads of mails like this lately: emery atrocious larval drippy elate

Re: Attempts to poison bayesian systems

2003-12-23 Thread Kalle Kivimaa
Dale Amon [EMAIL PROTECTED] writes: I can only assume someone out there is trying to attack bayesian systems by loading them up with all sorts of normal words so that good mail gets false positives, thus breaking the systems. I have yet to see a false positive caused by this even though I get

Re: GnuPG mutt on Woody 3.0r2.

2003-12-23 Thread s. keeling
Incoming from Adeodato Sim?: * s. keeling [Mon, 22 Dec 2003 23:52:30 -0700]: With help from one of the list recipients, this is now verified and reproducible. Something between me and those people whose keys are determined by my copy of gpg to be Bad signature, is mangling mail.

Re: Attempts to poison bayesian systems

2003-12-23 Thread Noah L. Meyerhans
On Tue, Dec 23, 2003 at 01:36:20PM +, Dale Amon wrote: I have yet to see a false positive caused by this even though I get quite a lot of this stuff and routinely mark it as spam. I can't think of any other reason for someone to do it though. There has to be a point. Someone is going

Re: Attempts to poison bayesian systems

2003-12-23 Thread Jason Lim
One technique that's being used a lot is to get books in electronic form and put a coupld of sentences in every spam (sentences from a book will pass gramatical checking etc, unlike the example you posted above). Also text from a book will have the right ratio of words, you will almost never

suspicious smbd connections

2003-12-23 Thread outsider
Hi, Last time I frequently get messages like smbd[949]: refused connect from in my /var/log/syslog. Every time with new IP-address. What are these connections? Is somebody trying to scan me or what is the reason for these messages? Thank you in advance! -- To UNSUBSCRIBE, email to [EMAIL

Re: suspicious smbd connections

2003-12-23 Thread Noah L. Meyerhans
On Tue, Dec 23, 2003 at 07:01:01PM +0100, outsider wrote: Last time I frequently get messages like smbd[949]: refused connect from in my /var/log/syslog. Every time with new IP-address. What are these connections? Is somebody trying to scan me or what is the reason for these messages? You

Re: Attempts to poison bayesian systems

2003-12-23 Thread Marcel Weber
Noah L. Meyerhans wrote: This method is especially effective in the case where the bayesian classifier only looks at the first MIME attachment, because the second is then free to contain whatever spam tokens they want to put in it. IIRC, this is how most bayesian filters behave. noah I got such

Re: Attempts to poison bayesian systems

2003-12-23 Thread Matt Zimmerman
On Tue, Dec 23, 2003 at 01:25:30PM +, Dale Amon wrote: I've been noticing loads of mails like this lately: Date: Sun, 21 Dec 2003 16:25:34 +0500 From: Joseph Jenkins [EMAIL PROTECTED] Subject: Re: MIT, rest in peace! To: [EMAIL PROTECTED] X-Mailer: mPOP Web-Mail 2.19

Re: suspicious smbd connections

2003-12-23 Thread Phillip Hofmeister
You may wish to enable an iptables filter to block all ports except those you explicitly allow. On Tue, 23 Dec 2003 at 01:01:01PM -0500, outsider wrote: Hi, Last time I frequently get messages like smbd[949]: refused connect from in my /var/log/syslog. Every time with new IP-address. What

IPSec WinXP interop

2003-12-23 Thread Antony Gelberg
Hi all, My first post here - long time d-u subscriber. I'm trying to set up a VPN where WinXP roadwarriors can access a LAN that sits behind a Linux router. I want to use X.509 certificates rather than PSKs. So I've installed freeswan and l2tpd on the router. There is quite a bit of

Re: Attempts to poison bayesian systems

2003-12-23 Thread Nick Boyce
On Tue, 23 Dec 2003 13:25:30 +, Dale Amon wrote: I've been noticing loads of mails like this lately: Date: Sun, 21 Dec 2003 16:25:34 +0500 From: Joseph Jenkins [EMAIL PROTECTED] Subject: Re: MIT, rest in peace! To: [EMAIL PROTECTED] X-Mailer: mPOP Web-Mail 2.19 emery atrocious

Re: GnuPG mutt on Woody 3.0r2.

2003-12-23 Thread s. keeling
Incoming from s. keeling: Incoming from Thomas Sj?gren: On Mon, Dec 22, 2003 at 12:35:49PM -0700, s. keeling wrote: gpg: Signature made Sun Dec 21 17:50:12 2003 MST using DSA key ID 946886AE gpg: BAD signature from Trey Sizemore [EMAIL PROTECTED] Now, from the same guy, same

Re: GnuPG mutt on Woody 3.0r2.

2003-12-23 Thread Adeodato Simó
* s. keeling [Mon, 22 Dec 2003 23:52:30 -0700]: With help from one of the list recipients, this is now verified and reproducible. Something between me and those people whose keys are determined by my copy of gpg to be Bad signature, is mangling mail. Specifically, that something is fixing

Attempts to poison bayesian systems

2003-12-23 Thread Dale Amon
I've been noticing loads of mails like this lately: Date: Sun, 21 Dec 2003 16:25:34 +0500 From: Joseph Jenkins [EMAIL PROTECTED] Subject: Re: MIT, rest in peace! To: [EMAIL PROTECTED] X-Mailer: mPOP Web-Mail 2.19 emery atrocious larval drippy elate incontrollable raster anglicanism

Re: Attempts to poison bayesian systems

2003-12-23 Thread Dale Amon
On Tue, Dec 23, 2003 at 01:32:23PM +, Kalle Kivimaa wrote: I have yet to see a false positive caused by this even though I get quite a lot of this stuff and routinely mark it as spam. I can't think of any other reason for someone to do it though. There has to be a point. Someone is going to

Re: Attempts to poison bayesian systems

2003-12-23 Thread tps
On Tue, Dec 23, 2003 at 01:25:30PM +, Dale Amon wrote: I've been noticing loads of mails like this lately: Date: Sun, 21 Dec 2003 16:25:34 +0500 From: Joseph Jenkins [EMAIL PROTECTED] Subject: Re: MIT, rest in peace! To: [EMAIL PROTECTED] X-Mailer: mPOP Web-Mail 2.19

Re: Attempts to poison bayesian systems

2003-12-23 Thread Russell Coker
This discussion has some minor relevance to debian-isp, but nothing to do with debian-security. Let's move the discussion to debian-isp. On Wed, 24 Dec 2003 00:25, Dale Amon [EMAIL PROTECTED] wrote: I've been noticing loads of mails like this lately: emery atrocious larval drippy elate

Re: Attempts to poison bayesian systems

2003-12-23 Thread Kalle Kivimaa
Dale Amon [EMAIL PROTECTED] writes: I can only assume someone out there is trying to attack bayesian systems by loading them up with all sorts of normal words so that good mail gets false positives, thus breaking the systems. I have yet to see a false positive caused by this even though I get

Re: GnuPG mutt on Woody 3.0r2.

2003-12-23 Thread s. keeling
Incoming from Adeodato Sim?: * s. keeling [Mon, 22 Dec 2003 23:52:30 -0700]: With help from one of the list recipients, this is now verified and reproducible. Something between me and those people whose keys are determined by my copy of gpg to be Bad signature, is mangling mail.

Re: Attempts to poison bayesian systems

2003-12-23 Thread Jason Lim
One technique that's being used a lot is to get books in electronic form and put a coupld of sentences in every spam (sentences from a book will pass gramatical checking etc, unlike the example you posted above). Also text from a book will have the right ratio of words, you will almost never

Re: Attempts to poison bayesian systems

2003-12-23 Thread Noah L. Meyerhans
On Tue, Dec 23, 2003 at 01:36:20PM +, Dale Amon wrote: I have yet to see a false positive caused by this even though I get quite a lot of this stuff and routinely mark it as spam. I can't think of any other reason for someone to do it though. There has to be a point. Someone is going

suspicious smbd connections

2003-12-23 Thread outsider
Hi, Last time I frequently get messages like smbd[949]: refused connect from in my /var/log/syslog. Every time with new IP-address. What are these connections? Is somebody trying to scan me or what is the reason for these messages? Thank you in advance!

Re: suspicious smbd connections

2003-12-23 Thread Noah L. Meyerhans
On Tue, Dec 23, 2003 at 07:01:01PM +0100, outsider wrote: Last time I frequently get messages like smbd[949]: refused connect from in my /var/log/syslog. Every time with new IP-address. What are these connections? Is somebody trying to scan me or what is the reason for these messages? You

Re: Attempts to poison bayesian systems

2003-12-23 Thread Marcel Weber
Noah L. Meyerhans wrote: This method is especially effective in the case where the bayesian classifier only looks at the first MIME attachment, because the second is then free to contain whatever spam tokens they want to put in it. IIRC, this is how most bayesian filters behave. noah I got

Re: suspicious smbd connections

2003-12-23 Thread Phillip Hofmeister
You may wish to enable an iptables filter to block all ports except those you explicitly allow. On Tue, 23 Dec 2003 at 01:01:01PM -0500, outsider wrote: Hi, Last time I frequently get messages like smbd[949]: refused connect from in my /var/log/syslog. Every time with new IP-address. What

Re: Attempts to poison bayesian systems

2003-12-23 Thread Matt Zimmerman
On Tue, Dec 23, 2003 at 01:25:30PM +, Dale Amon wrote: I've been noticing loads of mails like this lately: Date: Sun, 21 Dec 2003 16:25:34 +0500 From: Joseph Jenkins [EMAIL PROTECTED] Subject: Re: MIT, rest in peace! To: [EMAIL PROTECTED] X-Mailer: mPOP Web-Mail 2.19

IPSec WinXP interop

2003-12-23 Thread Antony Gelberg
Hi all, My first post here - long time d-u subscriber. I'm trying to set up a VPN where WinXP roadwarriors can access a LAN that sits behind a Linux router. I want to use X.509 certificates rather than PSKs. So I've installed freeswan and l2tpd on the router. There is quite a bit of

Re: Attempts to poison bayesian systems

2003-12-23 Thread Nick Boyce
On Tue, 23 Dec 2003 13:25:30 +, Dale Amon wrote: I've been noticing loads of mails like this lately: Date: Sun, 21 Dec 2003 16:25:34 +0500 From: Joseph Jenkins [EMAIL PROTECTED] Subject: Re: MIT, rest in peace! To: [EMAIL PROTECTED] X-Mailer: mPOP Web-Mail 2.19 emery atrocious