Re: [SAtalk] surprising low score for this spam mail

2004-01-30 Thread Bill Landry
it at: http://www.emtinc.net/spamhammers.htm Bill --- The SF.Net email is sponsored by EclipseCon 2004 Premiere Conference on Open Tools Development and Integration See the breadth of Eclipse activity. February 3-5 in Anaheim, CA. http

Re: [SAtalk] new chicnpox --lint failed

2004-01-26 Thread Bill Landry
very log lines that need to remain on a single line and not wrap. Bill --- The SF.Net email is sponsored by EclipseCon 2004 Premiere Conference on Open Tools Development and Integration See the breadth of Eclipse activity. February 3-5

RE: [SAtalk] [OT] - The current state spam.

2004-01-21 Thread Bill
The most appropriate response would be to demand Microsoft fix their software. That is about as effective as trying to catch your breath in a vacuum. :) --- The SF.Net email is sponsored by EclipseCon 2004 Premiere Conference on Open

Re: [SAtalk] SpamAssassin 2.63 is released!

2004-01-21 Thread Bill Randle
-1mdk.src.rpm -Bill Randle [EMAIL PROTECTED] --- The SF.Net email is sponsored by EclipseCon 2004 Premiere Conference on Open Tools Development and Integration See the breadth of Eclipse activity. February 3-5 in Anaheim, CA. http

Re: [SAtalk] bigevil location

2004-01-19 Thread Bill Randle
are identical. I know bigevil list is being used because I can see them in the reports. Can you tell me which one is the correct location? The one in /etc/mail/spamassassin will be used; the other one is ignored. (I made the same mistake awhile back.) -Bill

RE: [SAtalk] Spamwriter

2004-01-14 Thread Bill
No Hosting Servers No Email Servers No FTP Servers Just consuming. My mail and web server generates about 10-20MB of traffic per month and is a far far more secure connection than my neighbor's connection which generates 100+MB of outbound traffic per day playing online multiplayer games.

Re: [SAtalk] Exchange and autolearn

2004-01-13 Thread Bill Randle
of the exchange server, but this was recommended in something I read and so far has been working fine. -Bill --- This SF.net email is sponsored by: Perforce Software. Perforce is the Fast Software Configuration Management System offering

Re: [SAtalk] Newbie: delete only spam from server

2004-01-11 Thread Bill Landry
Check-out amavisd-new, it can invoke SA and, based on the result score, apply any of several different options, including quarantining or discarding the message. Bill - Original Message - From: Andrew Cranson [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Sunday, January 11, 2004 2:03 PM

Re: [SAtalk] Mass-Check

2004-01-11 Thread Bill Landry
Wow, very nice Bob! Thanks for sharing this with the list. I'll give it a try this next week and see how it goes. Bill - Original Message - From: Robert Menschel [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Sunday, January 11, 2004 3:31 PM Subject: [SAtalk] Mass-Check Some people

[SAtalk] Abused REDIRECTOR URL

2004-01-09 Thread Bill Larson
://www.lacerate.com You also have MSN joining in as a late comer perhaps intending to take over the spam url masking world. http://g.msn.com/1SUenus/CT?http://www.2026.com/F/index.html Maybe they hope to embrace and extend this technique also. We would appreciate a response. Bill Larson Network

Re: [SAtalk] Email Not Caught

2004-01-07 Thread Bill Landry
) then restart whatever app you use to call spamassassin. Bill --- This SF.net email is sponsored by: Perforce Software. Perforce is the Fast Software Configuration Management System offering advanced branching capabilities and atomic changes

[SAtalk] New unsecure redirector.

2004-01-02 Thread Bill Larson
Abused url http://g.msn.com/1SUenus/CT?http://www.Nicole.name-williams.com/E/4156.html my url http://g.msn.com/1SUenus/CT?http://www.compu.net Rule to catch. uri MY_URI_REDIRECT2/http:\/\/g.msn.com\/1SUenus\/CT\?*/i score MY_URI_REDIRECT2 4.0 describe M_URI_REDIRECT2 contains url

Re: [SAtalk] [RD] Chickenpox Update

2003-12-31 Thread Bill Landry
- Original Message - From: Martin Radford [EMAIL PROTECTED] At Thu Jan 1 00:53:48 2004, jennifer wrote: Bill Landry contacted me with some nice edits on Chickenpox. More punctuation included (in addition to .), and the set is now doubled to include the subject. Bear in mind

Re: [SAtalk] Bigevil 2.05m updated + question for devs

2003-12-29 Thread Bill Landry
Chris, check the uri BigEvilList_14 line, you have a couple of dots . in front of the escape character \ instead of behind it. That's what's causing the Illegal octal digit warning when you --lint the new BigEvil.cf file. Bill - Original Message - From: Chris Santerre [EMAIL PROTECTED

RE: [SAtalk] Holiday Contest - Highest Spam score message

2003-12-24 Thread Bill
Subject: [SPAM 50.63] Would You Like to Save Tons on Health Care? lilly Date: Tue, 28 Oct 2003 09:07:06 + (GMT) --- This SF.net email is sponsored by: IBM Linux Tutorials. Become an expert in LINUX or just sharpen your skills. Sign up

Re: [SAtalk] NJABL Dialup test

2003-12-23 Thread Bill Landry
considered it too aggressive (too likely to generate false positives), so rather than import it into dnsbl.njabl.org, it was added as a separate sub-zone so that those who wanted to use it could, and those who did not, would not have it forced upon them. Bill

RE: [SAtalk] ... SA 2.61 eats mails ...

2003-12-22 Thread Bill
You say you believe you changed noting important, but apparently _something_ important was changed. What can you remember about settings you changed since it last worked? One of the easily missed gotcha's is editing the file in windows notepad or another unix-unaware editor. This inserts a

[SAtalk] SPF Support in SA?

2003-12-20 Thread Bill Landry
. Although it will take wide support to make SPF a really viable spam test, by including native support for SPF in SA, this would certainly go a long way in helping to make SPF a more widely adopted standard. Thoughts? Bill --- This SF.net email

Re: [SAtalk] SPF Support in SA?

2003-12-20 Thread Bill Landry
- Original Message - From: Theo Van Dinter [EMAIL PROTECTED] On Sat, Dec 20, 2003 at 11:49:37AM -0800, Bill Landry wrote: I was wondering if the SA developers are considering adding support for Sender Permitted From (SPF) in SA, as defined at spf.pobox.com? I have We have test

[SAtalk] Possible rule for IE_Redirect exploit

2003-12-19 Thread Bill Larson
Comments and suggestions on this rule are appreciated. full LOCAL_IEREDIR /[EMAIL PROTECTED](\/|htm|html|php|shtml)?/ score LOCAL_IEREDIR 150 describe LOCAL_IEREDIR Possible phishing/URL Masking attempt detected. Bill Larson Network Administrator Compu-Net Enterprises (931) 920-0043 or (877

[SAtalk] IE redirect rule

2003-12-18 Thread Bill Larson
http://[EMAIL PROTECTED]/malicious.html http://[EMAIL PROTECTED]/malicious.html returns http://www.trusted_site.com/ in the browser address line this can be done with any website. It can also be done with a https site as well. Any suggested rulesets for this one. Bill Larson

[SAtalk] Score reduction test

2003-12-15 Thread Bill Landry
the overall score. Thoughts and feedback appreciated... Bill --- This SF.net email is sponsored by: IBM Linux Tutorials. Become an expert in LINUX or just sharpen your skills. Sign up for IBM's Free Linux Tutorials. Learn everything from the bash

Re: [SAtalk] DCC ? Vipul's Razor? skip_rbl_checks?

2003-12-15 Thread Bill Landry
. Bill - Original Message - From: Jeff Lasman [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Sunday, December 14, 2003 11:11 PM Subject: [SAtalk] DCC ? Vipul's Razor? skip_rbl_checks? I'm using spamassassin version 2.55 with Exim version 4.24, as supplied by the hosting control panel people

[SAtalk] chickenpox.cf

2003-12-13 Thread Bill Landry
, or because you had problems when adding other punctuation marks? Bill --- This SF.net email is sponsored by: IBM Linux Tutorials. Become an expert in LINUX or just sharpen your skills. Sign up for IBM's Free Linux Tutorials. Learn

Re: [SAtalk] Detecting strings of Gibberish

2003-12-11 Thread Bill Landry
set also. Bill - Original Message - From: Larry Starr [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Thursday, December 11, 2003 7:49 AM Subject: [SAtalk] Detecting strings of Gibberish I have noticed that many SPAM emails, end with seversl lines of gibberish, such as: lvwpdfobv

[SAtalk] Preparing a spam corpus?

2003-12-10 Thread Bill
server and would like to set up a spam corpus for the new server. I have several thousand spams saved in an outlook folder. Do I need to extract each of those spams from the report or can I submit the encapsulated report message? Will SA strip the added headers/encapsulation? TIA, Bill

Re: [SAtalk] Using dccifd instead of dccproc

2003-12-10 Thread Bill Landry
environment than dccproc, since it does not need to be instantiated for each message scanned. Bill - Original Message - From: Smart,Dan [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, December 10, 2003 7:57 AM Subject: [SAtalk] Using dccifd instead of dccproc The DCC

Re: [SAtalk] Using dccifd instead of dccproc

2003-12-10 Thread Bill Landry
It's pretty straight forward, just make sure that the config options point to the correct directory and file locations for your setup. If you have specific questions after you have done this, let me know. Bill - Original Message - From: Smart,Dan [EMAIL PROTECTED] To: [EMAIL PROTECTED

RE: [SAtalk] another SpamAssassin ???

2003-12-09 Thread Bill
Yep, it was trademarked by Deersoft, and now owned by McAfee following their acquisition of Deersoft. Crap! I hope McAfee does not get the idea to start licensing SA. That would suck! Now that the name SpamAssassin is getting to be known as the premier product on the market you can

RE: [SAtalk] Header problems

2003-12-09 Thread Bill
X-Spam-Status: No, hits=1.5 required=5.0 tests=BAYES_50,BIZ_TLD,CASHCASHCASH, DNS_FROM_RFCI_DSN,HTML_FONTCOLOR_BLUE,HTML_FONT_BIG, HTML_FONT_INVISIBLE,HTML_MESSAGE autolearn=no version=2.60 The message was not spammy enough to trigger SA. Your bayes gave it a neutral value

RE: [SAtalk] another SpamAssassin ???

2003-12-09 Thread Bill
If you don't then you can expect exactly this type of activity from Mcafee. Considering that Spamassassin is now the preferred spam tool for ISPs, and getting some great press, they would be stupid not to take this logical step soon. Exactly my point! I have had dealing with their legal

Re: [SAtalk] FW: Can I auto report spam to Razor DCC using spamassain?

2003-12-09 Thread Bill Landry
it? If so, how. I sure hope not, since auto-reporting invites lots of false reports. No matter how accurate you think your spam rules are, human interaction is still necessary to validate and confirm a message is actually spam before reporting it to a spam database. Bill

RE: [SAtalk] filtering spam tagged email before hitting exchange 2000

2003-12-08 Thread Bill
Title: Message It would be easy to set up a procmail rule to move all tagged spam into a folder on the SA machine however this is a very dangerous thing to do as falsely tagged mail (FP) will never be delivered and the recipient has no way to recover the mail. It is much better to just tag

RE: [SAtalk] Delete mail with a score above n

2003-12-08 Thread Bill
IMHO, the best way to handle html mail is bit-bucket the message and send a note to the sender that html messages are not accepted by the server and include a link on how to kill html in their mailer. --- This SF.net email is sponsored by: IBM

RE: [SAtalk] Delete mail with a score above n

2003-12-08 Thread Bill
Title: Message Please search the archives or RTFM, this subjesct has been covered dozens of times. -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Mike DSent: Monday, December 08, 2003 12:09 PMTo: [EMAIL PROTECTED]Subject: [SAtalk]

Re: [SAtalk] amavisd-new spamassassin = no headers. Ugh!

2003-12-07 Thread Bill Randle
. This should show both SPAM and SPAM-TAG in the mail log file. This will help verify spam is detected and tagged at the requested level. -Bill --- This SF.net email is sponsored by: IBM Linux Tutorials. Become an expert in LINUX

Re: [WL] Re: [SAtalk] ATTN DEVELOPERS: Rule out-of-date??

2003-12-06 Thread Bill Landry
1.101 1.001 1.001 will be ignored if you set different scores for these tests in your local.cf file. Bill --- This SF.net email is sponsored by: IBM Linux Tutorials. Become an expert in LINUX or just sharpen your skills. Sign up for IBM's Free

[SAtalk] (no subject)

2003-12-03 Thread Bill
I just got this virus message that appears to have come from sourceforge. Did anyone else get this or did my antivirus FP on me? ---snip- The virus checker has found potentially malicious code in a mail by [EMAIL PROTECTED] Delivery has been stopped. The recipient(s) for

Re: [SAtalk] SA 2.55 running sweet, upgrade to 2.60 and no workie =(

2003-11-24 Thread Bill Goudie
On Mon, Nov 24, 2003 at 06:17:54AM -0800, James Nonya wrote: I'm running Slackware 8.1 which comes with perl 5.6.1. I've been running spamd just fine since 2.55 was released. I compile and install SA 2.60 and all goes well. When I try to start spamd here's what I get: Insecure directory

RE: [SAtalk] Re[2]: http://www.infoworld.com/article/03/11/14/45FEspam_1.html?s=tc

2003-11-24 Thread Bill
I've read numerous antispam articles, and NONE have given SA justice. I think the main reason for the poor reporting of SA is mainly due to the fact that every one of the reviews has been done by a company that has an agenda. That agenda being, collecting advertising funding from commercial

RE: [SAtalk] Really bad Infoworld article

2003-11-23 Thread Bill
And now for the real world. only 50 or less users: Brightmail$ 2,998 for 2 years FrontBridge $ 2,700 for 2 years Postini $ 2,700 for 2 years ProofPoint$ 2,000 for 2 years SpamAssassin $ 3,100 for 2 years That assumes that the small company

RE: [SAtalk] LIST ADMIN - SUGGESTION: pool.com

2003-11-15 Thread Bill
I don't know whether this is possible at SourceForge, but if it is, it might make sense to turn on these settings once in a while. Would it be possible for SF to release the entire subscription list to someone, say the list admin, who could then generate the mailing run locally? That might be

RE: [SAtalk] bug with AWL in 2.60?

2003-11-15 Thread Bill
Sounds like you forgot to restart spamd after your change. --- This SF. Net email is sponsored by: GoToMyPC GoToMyPC is the fast, easy and secure way to access your computer from any Web browser or wireless device. Click here to Try it Free!

RE: [SAtalk] SA 2.60, Exim 4.24: Large messages aren't passed to spamd correctly

2003-11-14 Thread Bill
a spam message anywhere close to that large so its a safe thing to do. Hope this helps. Bill --- This SF.Net email sponsored by: ApacheCon 2003, 16-19 November in Las Vegas. Learn firsthand the latest developments in Apache, PHP, Perl, XML, Java

RE: [SAtalk] problem with mail

2003-11-13 Thread Bill
Hi folks. I have exim4, exiscan and spamassassin 2.60 It works great, but not always. Normaly SA does not report any errors, warings etc. I use debian version (testing). As I say it work ok, but when remote server send to me from mail-daemon (zmailer) (mail with HTML and

RE: [SAtalk] Comments on CBL DNSBL (cbl.abuseat.org)

2003-11-12 Thread Bill Polhemus
I added this to my Sendmail configuration a couple of weeks back, and I have been amazed at how much SPAM has been rejected as a result. I prefer to have Sendmail reject it at the get-go, rather than have it come all the way through to SA. William L. Polhemus, Jr. P.E. Polhemus Engineering

RE: [SAtalk] Okay, this one makes me mad.. anybody see or stop this one yet? How did this get through!!!!! ?????

2003-11-12 Thread Bill Polhemus
I'll say. I have mine set at 4, which I have found (for my setup) is pretty near perfect, even though it is lower than the default setting of 5. William L. Polhemus, Jr. P.E. Polhemus Engineering Company Katy, Texas USA -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]

RE: [SAtalk] sa-learn --rebuild --force-expire stuck using huge memory?

2003-11-11 Thread Bill Polhemus
This sounds like my earlier problem trying to sa-learn large mailboxes. Others here commented that it must be a hardware problem, but my box is fairly new with very decent components (built from scratch by me but with good MB and memory, etc.) and nothing else I do, including using X, gives it

RE: [SAtalk] What Dynamic IPs rbl list?

2003-11-11 Thread Bill
The intention is to disallow any adsl, dial-up or dynamic/static address on such lines to send any mail to this server. I will have a separated smtp server for my customers... ;) Bad, bad, bad idea!!! There are many many people running home networks in dynamic space who send their mail thru

RE: [SAtalk] What Dynamic IPs rbl list?

2003-11-11 Thread Bill
I want to block those selling [EMAIL PROTECTED]@, asian porn, and such un-wanted material, which represents about 50% of the traffic (pure guess). There will be some spam that will then be easaly downloaded by our customers and then filtered. Again, I feel deleting ANY mail addressed to

Re: [SAtalk] Is punctuation really needed? (fwd)

2003-11-10 Thread Bill Larson
Simple solution 1.Spamassassins reads in the message 2. It then stores the original message in two variables 3. In the second variable remove all punctuation, spaces, special encoded characters, foreign language characters, html including html comments, and other methods used for obscufaction. 4.

Re: [SAtalk] sa-learn doesn't work!

2003-11-07 Thread Bill Baker
On Thu, 2003-11-06 at 11:49, Evan Platt wrote: --On Wednesday, November 05, 2003 10:29 PM -0500 Bill Baker [EMAIL PROTECTED] wrote: I received 3 identical spams from the same e-mail address that did not get classified as spam. I tried to do a sa-learn --spam on the message, and it said

[SAtalk] white on white spam

2003-11-05 Thread Bill Anderson
I found a rule to check for white on white text to spot possible spam. However, I am finding that spammers are not including the body color as white since the email client background default color is white. Thanks. How could you write the following rule to give the email a score if , body was

[SAtalk] sa-learn doesn't work!

2003-11-05 Thread Bill Baker
I received 3 identical spams from the same e-mail address that did not get classified as spam. I tried to do a sa-learn --spam on the message, and it said it learned from 1 message, but when I tried to filter the message again, the Bayesian filter says that the spam probability is 0 to 1%. I

[SAtalk] Procmail rule to delete spam on a per user basis.

2003-11-04 Thread Bill Larson
filtering. SA_OPTOUT_FILENAME=$HOME/.optout.spamassassin :0 * ? test ! -f $SA_OPTOUT_FILENAME { :0fw * 256000 | spamc } Bill Larson Network Administrator Compu-Net Enterprises --- This SF.net email is sponsored by: SF.net

RE: [SAtalk] sendmail and spamassassin

2003-10-29 Thread Bill Polhemus
I use Sendmail with SA, but I do use procmail. Do you not have access to the ability to install packages on your server? Otherwise, youre going to have to use the Spamass milter, which means youve STILL got installation to do. Without the ability to install stuff on your server, I

RE: [SAtalk] How can I mark all mails with specific words in the subject as spam?

2003-10-29 Thread Bill Polhemus
It isn't SA you want, it's procmail. The formail tool in the procmail package will do anything like this that you want. William L. Polhemus, Jr. P.E. Polhemus Engineering Company Katy, Texas USA -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Gerhard

RE: [SAtalk] Exessive HTML Code

2003-10-29 Thread Bill
Do you really think it would be a problem if we found more than 3 instances of i/i in each email to mark it as spam? Maybe I could just score it lower per instance, say .2 There were 58 instances of i/i in this email and 63 instances of b/b. A test that counted .1 per instance in a

[SAtalk] SA-LEARN Actually Crashes System!

2003-10-29 Thread Bill Polhemus
I am running SA 2.60 installed from the RPMs on Red Hat 9, on an AMD 2100+ based system with a half-gig of RAM. This has now happened for the second time. Before when it happened, about two weeks ago, I figured it was just a coincidence. Now, Im positive that its SA-LEARN that is the

RE: [SAtalk] What on earth is this? FW: Undeliverable Mail: RE: [SAtalk] [RD] Open source is Naughty!!!

2003-10-29 Thread Bill Polhemus
Definitely SPAM, and of a particularly nasty sort. Somehow someone is snagging emails off the archive or some other way, and fabricating these replies. Bad business. William L. Polhemus, Jr. P.E. Polhemus Engineering Company Katy, Texas USA -Original Message- From: [EMAIL PROTECTED]

[SAtalk] Auto-Learn

2003-10-28 Thread Bill Polhemus
How can I know for sure if Auto-Learn is functioning correctly? It does seem to be working for SOME messages but the headers in many of them say: X-Spam-Status: autolearn=no William L. Polhemus, Jr. P.E. Polhemus Engineering Company Katy, Texas USA

RE: [SAtalk] Auto-Learn

2003-10-28 Thread Bill Polhemus
Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Martin Radford Sent: Tuesday, October 28, 2003 2:23 PM To: Bill Polhemus Cc: [EMAIL PROTECTED] Subject: Re: [SAtalk] Auto-Learn autolearn=no indicates that this particular message was not learned from, not that autolearning

RE: [SAtalk] Moving SPAM to a separate Mailbox

2003-10-27 Thread Bill Polhemus
Yes. In fact, I have a .procmailrc file that uses the ${HOME} variable among other generics, and can be put in the HOME directory of any user. That way the user can also add their own recipes if they like. Oh, and I also have a /etc/procmail file that has some site-wide recipes (it adds stuff

RE: [SAtalk] help with sa-learn

2003-10-25 Thread Bill Polhemus
IIRC, it should be Sa-learn --spam --mbox kill William L. Polhemus, Jr. P.E. Polhemus Engineering Company Katy, Texas USA -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Joseph P. Wetstein Sent: Thursday, October 23, 2003 7:56 AM To: [EMAIL

RE: [SAtalk] Mistake-based training

2003-10-24 Thread Bill
i use postfix with sa and procmail to delivier the mails local to the outlook 2000 clients. my problem now is: how can i report a false negative from an outlook client to sa? in the faq i've seen the the posibility to forward the message with (double-click to open the mail in its own

RE: [SAtalk] Looking for some interview subjects

2003-10-22 Thread Bill Polhemus
Let me guess: You're hiring hit men to track down and eliminate, not just the Spam, but the Spammers themselves! Then, you're going to invest in genetic research that will find the Spammer gene and provide an inoculation for all the children in the world, to eradicate any possibility that they

Re: [SAtalk] [OT] What is next step?

2003-10-22 Thread Bill Larson
District, Beijing, China (100027) country: CN phone:+86-10-6418-5885 fax-no: +86-10-64182174 e-mail: [EMAIL PROTECTED] nic-hdl: JM97-AP mnt-by: MAINT-CNNIC-AP changed: [EMAIL PROTECTED] 20020819 source: APNIC Bill Larson Network Administrator Compu-Net

RE: [SAtalk] custom rules local.cf

2003-10-21 Thread Bill Polhemus
Yes. William L. Polhemus, Jr. P.E. Polhemus Engineering Company Katy, Texas USA -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Thomas Kinghorn Sent: Tuesday, October 21, 2003 6:50 AM To: Spamassassin-Talk (E-mail) Subject: [SAtalk] custom rules

RE: [SAtalk] Scoring of 5.0 means spam. ist possible to drop mails with a scoring of i.e. 15?

2003-10-21 Thread Bill Polhemus
I do it using a procmail recipe, such as: =BEGIN PROCMAIL RECIPE== :0 * ^X-Spam-Status: Yes { # Mails with a score of 15 or higher are almost certainly spam (with 0.05% # false positives according to rules/STATISTICS.txt). Let's delete them # completely. :0: *

Re: [SAtalk] New dnsbl to use?

2003-10-19 Thread Bill Landry
it. :) You don't say what version of SA you are running, but if it's 2.60, sorbs is already defined as a SA DNSBL test. See: /usr/share/spamassassin/20_dnsbl_tests.cf Bill --- This SF.net email sponsored by: Enterprise Linux Forum Conference Expo

RE: [SAtalk] Easy way to join two Bayes databases?

2003-10-19 Thread Bill Polhemus
I cannot speak as an expert on this score, but my understanding is that a combination of such Bayesian databases would likely do more harm than good because the residual spam corpus that would get through the general SA filtering would be very specific to the recipient. That is, combining

[SAtalk] Insecure dependency in sysopen

2003-10-18 Thread Bill Polhemus
I realize this is a Perl problem, but can anyone help me diagnose this? I know next to NOTHING about Perl. The following is an error message I get when attempting to run SA from an email alias under Sendmail: - Transcript of session follows - Insecure dependency in

RE: [SAtalk] Insecure dependency in sysopen

2003-10-18 Thread Bill Polhemus
Sent: Saturday, October 18, 2003 3:18 PM To: Bill Polhemus Cc: [EMAIL PROTECTED] Subject: Re: [SAtalk] Insecure dependency in sysopen Bill Polhemus wrote: I realize this is a Perl problem, but can anyone help me diagnose this? I know next to NOTHING about Perl. Are you running Razor checks

RE: [SAtalk] FAKE_HELO_AOL

2003-10-17 Thread Bill Polhemus
This one got through. Can we figure out how and why? Notice purposeful misspellings as obfuscations. William L. Polhemus, Jr. P.E. Polhemus Engineering Company Katy, Texas USA -Begin Included Message- htmlcenter16121g11n4m06a8a53594548b10126vx 291uqs7rz3xo63jl8w5ie14f3q3c3770brfont

[SAtalk] HELP: Can't Invoke SA From Sendmail Alias

2003-10-17 Thread Bill Polhemus
I have wanted to set up a spam trap for some time. First, I created an account, called spamtest, on my system. Then, I went to Usenet and posted a ton of test messages to every newsgroup I could think of (mostly the pr0n ones) where the address would be harvested, and tried using the

RE: [SAtalk] HELP: Can't Invoke SA From Sendmail Alias

2003-10-17 Thread Bill Polhemus
. P.E. Polhemus Engineering Company Katy, Texas USA -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Bill Polhemus Sent: Friday, October 17, 2003 6:26 PM To: [EMAIL PROTECTED] Subject: [SAtalk] HELP: Can't Invoke SA From Sendmail Alias

RE: [SAtalk] Off Topic BUT packages vs source

2003-10-16 Thread Bill Polhemus
I always use the SRPMs when they are available. However, I have never attempted to build SRPMS myself. Is this difficult to do? William L. Polhemus, Jr. P.E. Polhemus Engineering Company Katy, Texas USA -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of

RE: [SAtalk] CPAN or RPM's?

2003-10-15 Thread Bill Polhemus
I think this thing about RH dropping their boxed sets is really, really overblown. They will continue to make updates available, and they will release new distributions. You just won't be buying them in stores. William L. Polhemus, Jr. P.E. Polhemus Engineering Company Katy, Texas USA

[SAtalk] SA-LEARN (SA 2.60) Segmentation Fault

2003-10-15 Thread Bill Polhemus
I noticed that if I try to feed SA-LEARN a mailbox full of SPAM, it now craps out claiming segmentation fault. Anyone have any ideas? William L. Polhemus, Jr. P.E. Polhemus Engineering Company Katy, Texas USA image001.jpg

[SAtalk] Razor2 Check Skipped - Anyone seen this?

2003-10-15 Thread Bill Polhemus
Running SA 2.60, I am seeing the following in my procmail logs: razor2 check skipped: No such file or directory Insecure dependency in open while running with -T switch at /usr/lib/perl5/site_perl/5.8.0/i386-linux-thread-multi/Razor2/Client/Config.pm line 414, GEN20 line 1. Can

RE: [SAtalk] SA-LEARN (SA 2.60) Segmentation Fault

2003-10-15 Thread Bill Polhemus
) Segmentation Fault -- Maybe you can make the spam corpus available on a web page so other people can test if it segfaults on their machine too? JS -Message d'origine- De: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] De la part de Bill Polhemus Envoyé: 15 octobre 2003 13:16 À: [EMAIL

[SAtalk] OOPS! Razor2 Problem Still There!

2003-10-15 Thread Bill Polhemus
Okay, so I applied the patch as shown at: http://spamassassin.taint.org/faq/index.cgi?req=showfile=faq02.006.htp But I get the following message, STILL: razor2 check skipped: No such file or directory Insecure dependency in open while running with -T switch at

RE: [SAtalk] OOPS! Razor2 Problem Still There!

2003-10-15 Thread Bill Polhemus
Well, a follow-up: I figgered out that I probably had to remake and remake install, etc. Which I then proceeded to do, and then *BOOM!* I get a compile error on Razor2. Bear in mind that I had no problem installing it before. Further bear in mind that I even erased the whole

[SAtalk] New rule for disguised html?

2003-10-14 Thread Bill Anderson
I am no rule coder, so I was wondering if anyone has a rule to catch spammers that hide their url in their email. Here is an example of what it getting through my spam filters: href=http://w#101;#119;#105;#108;l#110;#101;ed#46;#99;#111;m/c/#1 05;r#111;#110;#46;#104;t#109;l?farrow=elrlnm It

[SAtalk] What Does This Error Message Mean (Custom Rules)

2003-10-14 Thread Bill Polhemus
I implemented some of the rules others have posted on this list regarding obfuscating text. Now that I am running SA 2.60, I note that Im getting the following error message. Failed to compile body SpamAssassin tests, skipping: (Bareword i not allowed while strict subs in use at

RE: [SAtalk] bad day

2003-10-13 Thread Bill
Kinda makes you wonder where the world is heading when more email is junk than legitimate :/ I see the email world heading towards secure email. A world where you cannot send an email until/unless your mailer software has a key installed that validates all mail leaving your site. If you

[SAtalk] More HTML Obfuscation: This One Made It Through

2003-10-13 Thread Bill Polhemus
Here's another one from a batch of several that have gotten through SA 2.55 over the last several days. They use the spurious HTML tags to break up the text and get it through the Bayesian filter. I'm running these through every time I get one--and luckily, there've only been about one or two

[SAtalk] Any Idea When RH RPMs are coming out?

2003-10-13 Thread Bill Polhemus
I really would prefer to implement something as complex as SA through the RPMs on my Red Hat 9 system. So far, they are only up to SA 2.55. That has worked fine up until recently, when the HTML obfuscation has begun cropping up. Perhaps 2.60 can fix that. Any idea when those will be available?

RE: [SAtalk] More HTML Obfuscation: This One Made It Through

2003-10-13 Thread Bill Polhemus
] [mailto:[EMAIL PROTECTED] On Behalf Of Keith C. Ivey Sent: Monday, October 13, 2003 9:27 PM To: [EMAIL PROTECTED] Subject: Re: [SAtalk] More HTML Obfuscation: This One Made It Through Bill Polhemus [EMAIL PROTECTED] wrote: They use the spurious HTML tags to break up the text and get it through

Re: [SAtalk] Using only one RBL

2003-10-11 Thread Bill Shupp
On Friday, October 10, 2003, at 07:30 PM, Matt Kettler wrote: At 05:03 PM 10/10/03 -0700, Bill Shupp wrote: How do I setup SpamAssassin to query only bl.spamcop.net, and set a very high score for that? I'm using spamd with vpopmail support. Go to /usr/share/spamassassin. look through

[SAtalk] Another example of obfuscating text

2003-10-10 Thread Bill Polhemus
-- Message Text - Here's one that I got today, that slipped through (the first in over a week). Not sure why SA 2.55 didn't get it: -- Forwarded message -- Date: Fri, 10 Oct 2003 11:23:22 -0400 From: Thomas [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: )US

[SAtalk] Using only one RBL

2003-10-10 Thread Bill Shupp
Hello, How do I setup SpamAssassin to query only bl.spamcop.net, and set a very high score for that? I'm using spamd with vpopmail support. Thanks, Bill Shupp --- This SF.net email is sponsored by: SF.net Giveback Program. SourceForge.net

RE: [SAtalk] spamd grabbing LOOOOOOTs of memory

2003-10-06 Thread Bill Polhemus
Sheesh, how much for a Gig of RAM now, about 200 Euros or so? What's the problem? William L. Polhemus, Jr. P.E. Polhemus Engineering Company Katy, Texas USA -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kai Schaetzl Sent: Monday, October 06, 2003 9:12

[SAtalk] Need to restore bayes database... What do I need to restore?

2003-10-06 Thread Bill
the daemon. Is there anything else I have to do? Both installs are latest version 2.60 TIA, Bill --- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf

RE: [SAtalk] Spam: The Screwfly Solution

2003-10-06 Thread Bill Polhemus
The Screwfly Solution A really good short story by SF writer Raccoona Sheldon/James Tiptree Jr./ (the late) Alice B. Sheldon as well. Bet you didn't think anyone else would notice. William L. Polhemus, Jr. P.E. Polhemus Engineering Company Katy, Texas USA -Original Message- From:

RE: [SAtalk] Today a bad day for spam?

2003-10-06 Thread Bill Polhemus
I only have a couple of mailboxes here in my home office, but today was the first day in WEEKS--since I got SA optimized--that SPAM got through. We had three all from ostensibly the same source. Penis enlargement. Hey, if I buy some, will they leave me alone? William L. Polhemus, Jr. P.E.

RE: [SAtalk] possible to forward messages marked as spam to seperate account?

2003-10-02 Thread Bill Polhemus
Again, this is a job... FOR PROCMAIL! (Admitting surprise that most don't use PROCMAIL along with SA...) William L. Polhemus, Jr. P.E. Polhemus Engineering Company Katy, Texas USA -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Oliver Neubauer Sent:

RE: [SAtalk] Razor Patch

2003-10-02 Thread Bill Polhemus
Best to do this as root. Or try /usr/bin/patch. William L. Polhemus, Jr. P.E. Polhemus Engineering Company Katy, Texas USA -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Robert Krüger Sent: Thursday, October 02, 2003 4:58 PM To: [EMAIL PROTECTED]

RE: Re[2]: [SAtalk] Autodeleting spam based on score without deleting all spam

2003-10-01 Thread Bill
How do I set up Sendmail to reject email with a high score or forward email to a local mailbox if it is within a certain range of score? The way I would do it is with a procmail recipe. Configure spamassassin to use the stars header system and then set a recipe to redirect based on the

RE: [SAtalk] Silly question about whitelist to a certain mailbox

2003-10-01 Thread Bill Polhemus
Well, I use procmail to send mail to SA. So how about a recipe, checking to see if mail is to that certain mailbox, and putting that recipe before the recipe that sends everything else to SA? I find that procmail solves a whole host of my email problems, btw. William L. Polhemus, Jr. P.E.

  1   2   >