Re: [SAtalk] More obfuscation

2004-01-21 Thread Charles Gregory
On Tue, 20 Jan 2004, Robert Menschel wrote: CS I'm not sure where the post is, but about 3 weeks ago I think Dallas CS put a semi-end to the spell-checker debate :) Perhaps I need to re-clarify. The idea is NOT to treat mis-spelled words as spam. The idea is to find specific 'close matches' to

[SAtalk] SA missed an 'invisible font'?

2004-01-21 Thread Charles Gregory
X-Spam-Level: ** X-Spam-Status: No, hits=2.7 required=3.5 autolearn=no tests=HTML_20_30=0.474, HTML_FONT_BIG=0.1,HTML_MESSAGE=0.001,LOC_LOWPRICE=0.9, LOC_WEIGHTPATCH=1,RCVD_IN_NJABL=0.1,RCVD_IN_SORBS=0.1 Example HTML below. SA seems to have not recognized the EE font as

[SAtalk] More obfuscation

2004-01-20 Thread Charles Gregory
I'm starting to see mail with TEXT obfuscation, such as: I heard you need viagrPa. Note the capital P thrown in to our favorite 'v' word. It is really beginning to look like we need a genuine spelling checker, or some sort of 'approximation' technology, if such exists. There is no 'pattern' I

Re: [WL] Re: [SAtalk] More obfuscation

2004-01-20 Thread Charles Gregory
On Tue, 20 Jan 2004, Marcus Frischherz wrote: But there is: there exists (at least in PHP) a function called levenshtein, which calculates the similarity between two words. Surely there must exist a perl equivalent to it. see: http://at.php.net/manual/en/function.levenshtein.php So I

Re: [WL] Re: [SAtalk] More obfuscation

2004-01-20 Thread Charles Gregory
On Wed, 21 Jan 2004, Sidney Markowitz wrote: Does anyone who is concerned about the obfuscation have any statistics to show that it really is a problem for the current rules plus network tests plus a well-trained Bayes? Right now, there would be no statistics, because the text obfu has just

Re: [WL] [SAtalk] Yikes.. rules_du_jour

2004-01-18 Thread Charles Gregory
On Sat, 17 Jan 2004, Jonathan Nichols wrote: rules_du_jour is kind of neat, but I hope it's not going to drive up Chris Jennifer's bandwidth bills or som 'em over a quota. :P A thought, and a suggestion: Thought: Some of the rules in 'rules du jour' look like they are fairly 'stable'. There

Re: [WL] Re: [SAtalk] unfakeable Habeas watermark?

2004-01-18 Thread Charles Gregory
At first glance, you would think that a habeas 'whitelist' would be good, but you have to realize that in many cases, an individual habeas customer may be using a 'major' ISP, which could either be abused, or actually carry a few spammers. Would we want to whitelist the AOL mail servers? |-P No,

Re: [WL] Re[2]: [WL] Re: [SAtalk] unfakeable Habeas watermark?

2004-01-18 Thread Charles Gregory
On Sun, 18 Jan 2004, Ian Southam wrote: CG carry a few spammers. Would we want to whitelist the AOL mail servers? |-P Pick on the right people, AOL for their size generate very little spam. I still wouldn't whitelist them. ;-) Now adelphia.net, level3 .. :-). Do I hear an earthlink? A

Re: [SAtalk] [OT and long] Port Blocking (was: Spamwriter).

2004-01-16 Thread Charles Gregory
On Fri, 16 Jan 2004, Pedro Sam wrote: Here's another analogy, I leave my legally owned and licensed firearm in plain view in the fore mentioned car. Robbers then proceed to steal my big ass gun and rob a bank ... well, you see where this is headed. I can see where you are trying to FORCE

[SAtalk] [OT] New Virus psychology?

2004-01-16 Thread Charles Gregory
Not strictly speaking 'spam', but one heck of a psychological trick for getting people to open attachments: I received an e-mail with an attachment NAMED: www.boards4all.com. Of course, '.com' files are similar to '.exe' files and so what *looks* like a web address actually ends up being an

Re: [SAtalk] HEh...

2004-01-15 Thread Charles Gregory
On Wed, 14 Jan 2004, Brian May wrote: Thought this was a little humorous... Habeas is Misusing their own mark? I certainly hope Habeas isn't using some form of automated update for that infringer list/lookup. Otherwise I can see spammers abusing them further by submitting as many legitimate

Re: [WL] Re: [SAtalk] [OT and long] Port Blocking (was: Spamwriter).

2004-01-15 Thread Charles Gregory
Computers are like cars. If you crash your car into someone else's car (or house, or business), you're gonna pay for the damage you caused. And if someone STEALS your car, the person who stole it is responsible, even if you are unaware of the theft. With insurane being compulsory, in some

Re: [SAtalk] Habeas Responds to Spammer Violation of Habeas Warrant Mark

2004-01-14 Thread Charles Gregory
On Tue, 13 Jan 2004, Matthew Cline wrote: It is interesting that this spam attack appears to be originating from a distributed set of zombie cable/DSL modems that someone likely took over in a past virus attack. If the spammers are using zombies, then couldn't both the spammers and the

Re: [WL] Re: [SAtalk] OT: forged habeus mark

2004-01-13 Thread Charles Gregory
On Mon, 12 Jan 2004, David A. Carter wrote: Habeas watermarking *may* fail if repeatedly attacked by the spammers, which would be a shame. It will *definitely* fail if enough of us as mail administrators freak out and pull habeas checking from our configurations at the first sign of danger,

Re: [WL] [SAtalk] How to count pattern matches?

2004-01-13 Thread Charles Gregory
On Tue, 13 Jan 2004, Christian Recktenwald wrote: is there a possibility to count the number of occurences of a given pattern? I've asked for this before. Never heard any replies. I was actually hoping for a test with a minimum threshold, such as If count is greater than 5 then score 'x'. -

Re: [SAtalk] How to count pattern matches?

2004-01-13 Thread Charles Gregory
On Tue, 13 Jan 2004, Chris Santerre wrote: On Tue, 13 Jan 2004, Christian Recktenwald wrote: is there a possibility to count the number of occurences of a given pattern? I've asked for this before. Never heard any replies. I was actually hoping for a test with a minimum threshold,

Re: [WL] Re: [SAtalk] Phony Habeas mark on spam...I knew it was just a matter of time

2004-01-12 Thread Charles Gregory
On Sun, 11 Jan 2004, Theo Van Dinter wrote: Send them to [EMAIL PROTECTED] I dug through my spam corpus and found 8 so far this month and just sent them off. We'll see what happens. I agree on reporting them. But it should be obvious in the short term, if these things become annoying, just

[SAtalk] HTML accented character spam

2004-01-12 Thread Charles Gregory
Hiyo! Just curious how to best handle HTML character spam. For example, the 'V' pill word was spelled: Viuml;agrave;graring; And it's 'X' counter-part as: Xaacute;naring;x I could use 'rawbody', but then I end up 'wheeling' through all the different possible substitutes for each letter. Is

Re: [WL] [SAtalk] Silly spam

2004-01-08 Thread Charles Gregory
On Wed, 7 Jan 2004, Kurt Buff wrote: Several instances of the attached message got through, and I'm wondering what might catch this - we're running v2.60, with popcorn, backhair, weeds, smallpox, nov2rules and bigevil, plus a couple of minor custom rules. I hate it when my mail client doesn't

[SAtalk] Re: Rule gripe....

2004-01-05 Thread Charles Gregory
On Sun, 4 Jan 2004, Bob Proulx wrote: Carl R. Friend wrote: May I make an appeal, on behalf of everyone using FreePort, to re- think the wisdom of the /\d\d\@/ rule? Thanks for putting up with the foregoing rant and your patience. May I suggest that you get some non-spam samples of the

Re: [WL] Re: [SAtalk] REQUEST TO SPAMASSASSIN AUTHORS

2004-01-02 Thread Charles Gregory
On Wed, 31 Dec 2003, Charles Tassell wrote: I wonder if a better way to do this would be to add an extra field to the rule (or maybe change BODY to BODY_STRIPPED or HEADER_STRIPPED) which removes everything that is *not* a letter before doing the regexp check. IE, does a s/[^a-zA-Z]//g) on

[SAtalk] REQUEST TO SPAMASSASSIN AUTHORS

2003-12-31 Thread Charles Gregory
Another idea that would work really well at the coding level: The latest flavor of spam seems to be 'letter doubling'. Ie. Lowwestt instead of lowest, etc, etc. This form of obfuscation essentially creates a spelling error variant on every rule we have out there. What would work really well,

Re: [SAtalk] REQUEST TO SPAMASSASSIN AUTHORS

2003-12-31 Thread Charles Gregory
On Wed, 31 Dec 2003, Rich Puhek wrote: Would something like excessive instances of /(\w)\1/ work? Yes, that sounds like a good idea. Which leads back to the request I made previously for a mechanism to COUNT the number of occurences of a match, for 'excessive' use of something that is

Re: [WL] Re: [SAtalk] Fwd: Rude Rape actions

2003-12-29 Thread Charles Gregory
On Sun, 28 Dec 2003, Evan Platt wrote: Yow, how am I supposed to stop spam like this? There isn't anything to filter on except the word 'adult'. I guess 'rape' works as well.. But I'm not really inclined to filter messages with the word rape in them, nor give them a 3+ score. When's the

Re: [SAtalk] False positives

2003-12-29 Thread Charles Gregory
Hello! If I may toss in my own two cents: 1) In general, responsible service providers make it a user OPTION (opt-IN) to use spamassassin, and allow users to set their own 'comfort level', to minimize what THEY consider to be false positives. 2) Spamassassin on its own does not block or delete

RE: [SAtalk] Holiday Contest - Highest Spam score message

2003-12-24 Thread Charles Gregory
Hello all! And a happy holiday to you all! I don't suppose the irony is lost on anyone that a bunch of anti-spam fanatics are celebrating the holidays by trying to make the world's worst spam?? (LOL) - charles On Wed, 24 Dec 2003, Kurt Buff wrote: Heck, even with bayes autolearn, popcorn,

Re: [SAtalk] YO DEVELOPER! SA Rule COUNTER?

2003-12-14 Thread Charles Gregory
On Sat, 13 Dec 2003, Gary Funck wrote: Alternatively, offer a max count and pattern. The actual count would be expressed as a percentage of the maximum, and this would be multiplied by the score.. Actually, this is what I said we did *not* want when I said a 'straight multiplier' would be

[SAtalk] YO DEVELOPER! SA Rule COUNTER?

2003-12-13 Thread Charles Gregory
Hi! I suggested this once before, and did not see any response. Many rules that I see suggested on this list all have the characteristic of being a good test against e-mail that contain a large number of occurences (a high 'count') of a particular 'trick' or 'obfuscation'. BUT these rules have to

Re: [WL] [SAtalk] Re: YO DEVELOPER! SA Rule COUNTER?

2003-12-13 Thread Charles Gregory
On Sat, 13 Dec 2003, Bryan Hoover wrote: But if we were able to check the COUNT of how many times a particular rule was matched, we could easily distinguish runaway use of obfuscation. It is an interesting idea. It is analysis of the analysis, or meta analysis. Not really. It is counting

Re: [SAtalk] Habeas test

2003-12-09 Thread Charles Gregory
On Tue, 9 Dec 2003, Jeremy Kister wrote: It seems that spamassassin 2.60 requires all 9 Habeas fields to be included, in order, in the header of an email, for it to recognize the Habeas mark. I'm just a little curious. There is nothing technically 'magical' about the Habeas headers. They could

Re: [SAtalk] SpamAssassin 2.61 released!

2003-12-09 Thread Charles Gregory
1) Will RPM's be out soon? OR 2) It sounds like this release is mostly just rule changes. Is there yet a mechanism (an easy way) to just update rules without going through an 'install' process? Thanks for all the hard work! - Charles On Mon, 8 Dec 2003, Justin Mason wrote:

[SAtalk] Re: spamd piling up - just killing me

2003-12-07 Thread Charles Gregory
On Sunday 07 December 2003 22:56 CET Erick Calder wrote: ok. I'm now running 2.60 but with same results. curiously, as with Cheryl's problem, I mostly seem to have one user with the problem... and from what I can tell there is nothing remarkable about that user's account... My favorite

[SAtalk] ATTN DEVELOPERS: Rule out-of-date??

2003-12-06 Thread Charles Gregory
Greetings! One of our users today reported a mis-identification of legitimate mail primarily based upon two tests: 1.1 FORGED_OUTLOOK_HTMLOutlook can't send HTML message only 1.1 FORGED_OUTLOOK_TAGSOutlook can't send HTML in this format Here are the headers I believe to be

Re: [WL] Re: [SAtalk] ATTN DEVELOPERS: Rule out-of-date??

2003-12-06 Thread Charles Gregory
On Sat, 6 Dec 2003, Matt Kettler wrote: There are a lot of outlook 2003 related bugs that have recently been fixed in CVS and are slated for 2.61.. http://bugzilla.spamassassin.org/show_bug.cgi?id=2344 http://bugzilla.spamassassin.org/show_bug.cgi?id=2538 Theoreticaly, these may fix your

Re: [SAtalk] ATTN DEVELOPERS: Rule out-of-date??

2003-12-06 Thread Charles Gregory
On Sat, 6 Dec 2003, Bill Landry wrote: Perhaps it would be a nice idea to somehow post an interim 'patch' that would do nothing more than adjust the scores on rules that seem to have problems? So adjust your scores for these tests in /etc/mail/spamassassin/local.cf file. I've already

Re: [WL] [SAtalk] configure: error: C preprocessor /lib/cpp fails sanity check

2003-12-03 Thread Charles Gregory
On Wed, 3 Dec 2003, [ISO-8859-1] Jürgen R. Plasser wrote: I'd like to install SA 2.60 from source on a RH 9 box I used the binary rpms and as long as I uninstalled the old spamassassin manually, the new multiple rpms went in fine. - Charles

Re: [SAtalk] A special new website

2003-12-01 Thread Charles Gregory
And the point of the mail with the attached jpg would be.? - C --- This SF.net email is sponsored by: SF.net Giveback Program. Does SourceForge.net help you be more productive? Does it help you create better code? SHARE THE LOVE, and

Re: [WL] [SAtalk] Cache poisoning on relays.osirusoft.com??

2003-11-29 Thread Charles Gregory
Hello! On Sat, 29 Nov 2003, Mark wrote: The weirdest thing. To my great scare I found myself suddenly blacklisted at relays.osirusoft.com: As I understand it, 'osirusoft' went offline in August, and as a form of 'notice' to all their previous clients, set their blacklist DNS lookup to return

Re: [SAtalk] What level to delete at?

2003-11-25 Thread Charles Gregory
On Mon, 24 Nov 2003, Matt Kettler wrote: What are some of the setups out there? What score do you delete at? On our system (CommunityNet ISP) we allow our inidividual users to set their 'Hits Required' level, and choose between deleting or merely flagging the mail. We encounter some confusion

[SAtalk] 'Windows-1251' in subject line.

2003-11-24 Thread Charles Gregory
Hello! Okay, not to pick on Miroslav, but, here is a case where a legitimate English language e-mail has 'Windows-1251' embedded in the subject line. So I don't think it would be fair to filter on this alone. So I ask again, is there a way to identify when the contents are going to be a jumble

Re: [WL] Re: [SAtalk] Character Set Spam....

2003-11-22 Thread Charles Gregory
On Fri, 21 Nov 2003, Justin Mason wrote: Charles Gregory writes: I've been playing with the 'locales' settings, and they work quite well where a message has been properly formatted with 'charset' headers, but here's a message whose only visible clue is the use of 'windows-1251' in the SUBJECT

Re: [WL] Re[2]: [SAtalk] Character Set Spam....

2003-11-22 Thread Charles Gregory
On Fri, 21 Nov 2003, Robert Menschel wrote: I use the following rule with some success. You should be able to substitute your windows-1251. header RM_sx_iso8859 Subject:raw =~ /iso-8859-1/i Interesting. They do not list the 'raw' option in the SA documentation for header checks. This is

[SAtalk] What the....? Return receipt (fwd)

2003-11-22 Thread Charles Gregory
What the? I have received several of these today. I'm not sending any mail that would actually generate a legitimate delivery receipt, so what does this message mean? Side note: they are using an old domain that is disused, so definitely a a spam behind this somewhere. - Charles --

Re: [SAtalk] finally

2003-11-22 Thread Charles Gregory
On Thu, 20 Nov 2003 12:49:05 -0800, [EMAIL PROTECTED] (Justin Mason) wrote: [EMAIL PROTECTED] has been unsubscribed. (I eventually wrote an LWP crawler to download each of the 87 chunks of the address list from sf.net so I could grep them ;) I also wrote a note to 'pool.com' suggesting that

[SAtalk] Character Set Spam....

2003-11-21 Thread Charles Gregory
Hello! I've been playing with the 'locales' settings, and they work quite well where a message has been properly formatted with 'charset' headers, but here's a message whose only visible clue is the use of 'windows-1251' in the SUBJECT line. The text is obviously a non-English characterset, but I

Re: [SAtalk] SA LIST PROBLEM? Quoted Printable problem?

2003-11-19 Thread Charles Gregory
On Tue, 18 Nov 2003, David B Funk wrote: Based upon the headers of your message, it looks like you're using pine v4.05. My apologies. I keep forgetting that my Pine is on an *ancient* Solaris system, and not the reasonbly up-to-date mail server. Unfortunately, the (expletive) thing is so

Re: [SAtalk] SA LIST PROBLEM? Quoted Printable problem?

2003-11-19 Thread Charles Gregory
On Wed, 19 Nov 2003, Nancy McGough wrote: As an alternative, you could try reading the spamassassin mailing list via the gmane.org NNTP server and see if the messages show up correctly there. Actually, they show up correctly as soon as I start a reply, so there is no real problem reading them.

Re: [SAtalk] ATT PATENTS ANTI-ANTISPAM TECHNOLOGY

2003-11-19 Thread Charles Gregory
On Wed, 19 Nov 2003, Martin McWhorter wrote: filters. ATT says it is re-evaluating the patent and has not decided how it will use the technology. SOURCE: News.com; AUTHOR: Paul Festa, CNET http://news.com.com/2100-1032_3-5108918.html Here is a suggestion: Sue spammers that use technology to

Re: [SAtalk] Tracking down thewizard.net forwarder

2003-11-19 Thread Charles Gregory
I ask again, particularly of the list maintainers, has anyone written mail to 'pool.com' and/or 'thewizard.net' to solve the problem at the source? - Charles On Wed, 19 Nov 2003, Ken Bass wrote: For every submission I keep getting the below bounce / along with advertisement. This is quite

[SAtalk] SA LIST PROBLEM? Quoted Printable problem?

2003-11-18 Thread Charles Gregory
Hello, Lately on several e-mails from the list, I've been seeing an error message in my Pine mail program that says: [Error: Formatting error: Non-hexadecimal character in QP encoding] More importantly, the message is *truncated* in the display. Oddly enough, when I quote the message to

[SAtalk] pool.com

2003-11-15 Thread Charles Gregory
Just curious: Has anyone actually written to either 'pool.com' or to 'thewizard.net' and complained about this bounce? - C On Fri, 14 Nov 2003, Marcio Merlone wrote: FYI. Begin forwarded message: Date: Fri, 14 Nov 2003 16:45:05 + From: [EMAIL PROTECTED] To: Marcio Merlone [EMAIL

[SAtalk] LIST ADMIN - SUGGESTION: pool.com

2003-11-15 Thread Charles Gregory
On Fri, 14 Nov 2003, Matt Kettler wrote: Unfortunately the list admins can't track which address is generating these bounces. There's no subscribed addresses that seem to match the very little bit of information that's in the bounce itself.. If contacting the domains does no good, may I

[SAtalk] Re: Biz.Yahoo.com 'PRNews' abuse?

2003-11-15 Thread Charles Gregory
On Fri, 14 Nov 2003, Jeremy Zawodny wrote: I got a spam today that just missed being spam by a few fractions of a point. The Click here URL was: http://biz.yahoo.com/prnews/031112/lnw017_1.html I know the PRNewswire and BusinessWire are pretty good about the clients they take. If

Re: [SAtalk] Empty Return-Path?

2003-11-15 Thread Charles Gregory
On Fri, 14 Nov 2003, Robert Menschel wrote: See my stats below -- I developed a rule for this test, and running it against my corpus I found that it matched more ham than spam. I was actually thinking that it might be possible to build a rule that only triggers when the message is not

[SAtalk] Biz.Yahoo.com 'PRNews' abuse?

2003-11-14 Thread Charles Gregory
Hallo! I got a spam today that just missed being spam by a few fractions of a point. The Click here URL was: http://biz.yahoo.com/prnews/031112/lnw017_1.html It's not a redirect, but an actual 'press release' on Yahoo itself. But the content is pretty much the stuuf of 'stock alert'

[SAtalk] Empty Return-Path?

2003-11-14 Thread Charles Gregory
Hallo! Another spam today, with the infamous empty return path. (Return-Path: ) But I didn't see any test that was catching this. Is there something legitimate about an empty return path that makes it a bad test? - Charles --- This SF. Net

Re: [WL] [SAtalk] Bounce all but whitelist

2003-11-12 Thread Charles Gregory
On Tue, 11 Nov 2003, Tim Merkel wrote: I have a client who wishes to only allow mail into his inbox that is explicitly allowed via his white list. If you are using procmail, make a whitelist recipe in his .procmailrc file. Technically, his mail will still go through spamassassin, but the

[SAtalk] new to spamassassin

2003-11-11 Thread Charles Gregory
On Tue, 11 Nov 2003, Yackley, Matt wrote: Scott, This would probably be a little better cleaner looking: body LOCAL_SWEARWORD /\b(?:word1|word2|word3|word4)\b/i And in case anyone else unfamiliar with regex is wondering about that question mark followed by a colon - it is a special code

Re: [SAtalk] Razor2 Custom scores?

2003-11-06 Thread Charles Gregory
On Thu, 6 Nov 2003, Robert Leonard III wrote: My system has only two scoring options for the Razor2 matches.. 0-50, and 51-100.. I'd like to score those with a confidence of 90+ higher than those with at 51.. What is the syntax to add to my local.cf files to allow this to happen.. or can it

[SAtalk] [RD] excessive table tags

2003-11-04 Thread Charles Gregory
On Tue, 4 Nov 2003, Colin A. Bartlett wrote: I have a rule challenge for you all. How can we write a rule to catch messages like the one attached? body LOC_BRMASK /br(nbsp;?|.){1,5}br(nbsp;?|.){1,5}br(nbsp;?|.){1,5}br/i describe LOC_BRMASK Masking BR tags with 1-5 characters between

Re: [SAtalk] [RD] excessive table tags

2003-11-04 Thread Charles Gregory
On Tue, 4 Nov 2003, David B Funk wrote: body LOC_BRMASK /br(nbsp;?|.){1,5}br(nbsp;?|.){1,5}br(nbsp;?|.){1,5}br/i Um, does the 'body' class work or do you need to use 'rawbody' to see the unprocessed HTML? Heh. Heh. Oops. (grin) You're quite right. Should be 'rawbody'. I actually had

Re: [0.6] [SAtalk] Exessive HTML Code

2003-10-29 Thread Charles Gregory
On Wed, 29 Oct 2003, Mark Ritchie wrote: Now, as you can see the trick here to fool spamassassin is the i and b tags. Would it be possible to make a rule or adjust the rules so the i/i scores high? There is nothing inbetween and I'd have to say anyone sending messages like this is obviously

[SAtalk] Duplicate postings.

2003-10-29 Thread Charles Gregory
, 29 Oct 2003 12:28:22 -0500 Message-ID: [EMAIL PROTECTED] From: Chris Santerre [EMAIL PROTECTED] To: 'Charles Gregory' [EMAIL PROTECTED], Spamassassin-Talk (E-mail) [EMAIL PROTECTED] X-Mailer: Internet Mail Service (5.5.2653.19) X-Spam-Score: 0.2 (/) Sender: [EMAIL PROTECTED

Re: [-6.8] Re: [SAtalk] Call for suggestions: reducing side-effects of hijacked email address

2003-10-29 Thread Charles Gregory
On Wed, 29 Oct 2003, Justin Mason wrote: Look at any message that matches various patterns for a DSN (Subject =~ /undeliverable/, etc.). If it does not contain the IP address of his network or outgoing relay, drop it, it's a bounced forgery. Again, this works in *most* cases, but there are

Re: [2.2] [SAtalk] What on earth is this? FW: Undeliverable Mail: RE: [SAtalk] [RD] Open source is Naughty!!!

2003-10-29 Thread Charles Gregory
On Wed, 29 Oct 2003, Chris Santerre wrote: I'm not sure if this is a Spam or legit! Anyone ever got one of these from the list? I got one of these too. I think a list subscriber has a broken 'bounce' mechanism, or their domain just cavved, but the message did not provide any details on whose

[SAtalk] Duplicate postings. (clarification)

2003-10-29 Thread Charles Gregory
on or near [EMAIL PROTECTED] or 'force9.net' has something strange in their mail handling that is re-mailing articles? - Charles -- Forwarded message -- Date: Wed, 29 Oct 2003 15:11:10 -0500 (EST) From: Charles Gregory [EMAIL PROTECTED] Subject: Duplicate postings. Okay

RE: [SAtalk] Duplicate postings. (clarification)

2003-10-29 Thread Charles Gregory
On Wed, 29 Oct 2003, Colin A. Bartlett wrote: Charles Gregory Sent: Wednesday, October 29, 2003 4:33 PM Just at a rough guess, I would say that whoever resides on or near [EMAIL PROTECTED] or 'force9.net' has something strange in their mail handling that is re-mailing articles? Per my

Re: [2.6] RE: [SAtalk] 2.60 on RH9

2003-10-26 Thread Charles Gregory
On Sat, 25 Oct 2003, Marcos A. Pendas wrote: Warning: I could not locate your pod2man program. Please make sure, your pod2man program is in your PATH before you execute 'make' First off, pod2man is installed: /usr/bin/pod2man Any ideas on how to fix this? Weird as this sounds,

[SAtalk] Re: [OT] What is next step?

2003-10-24 Thread Charles Gregory
On 23 Oct 2003, AltGrendel wrote: I've seen no evidence of this. The only thing I've seen for certain is that the older an E-mail address is (once it has gotten on at least one spammer's list), the more spam it gets. Regardless of whether it's bounced or not. Spammers are still selling

Re: [0.1] RE: [SAtalk] How to update old version of SpamAssassin

2003-10-23 Thread Charles Gregory
On Wed, 22 Oct 2003, Michael Emdy wrote: spamassassin-2.44-11.8.x Anybody update SA on RedHat 9 with any success? Yup. The secret is to UNinstall the spamassassin 2.44 rpm before you install the 2.6 modules. rpm -e --repackage spamassassin The 'repackage' option will place a copy of the old

Re: [SAtalk] Looking for some interview subjects

2003-10-22 Thread Charles Gregory
On Tue, 21 Oct 2003, Chris Paul wrote: You should call me. I'm starting a company that will eliminate spam for good. Not just filter it. Filtration won't scale. We'll be eliminating spam for good. 1) I hope you have a robust server. The latest spammer tactic is to DOSA anyone with a good

[SAtalk] Re: How BIG are 'auto-whitlist' files supposed to get?

2003-10-22 Thread Charles Gregory
On Tue, 21 Oct 2003, Ian Douglas wrote: NOW I see auto-whitelist and 'bayes' files that are exceeding 1MB in size, each. Is this 'normal'? Any permission issues to take into account if you make the owner of the file something other than the user's login name? Minor issues. I am more

[SAtalk] How BIG are 'auto-whitlist' files supposed to get?

2003-10-21 Thread Charles Gregory
Hello! We've only just started using SA. For a while we were running 2.4, and just last week we upgraded to 2.6. When we first started using SA, I kept a casual eye on the personal files in .spamassassin, and did not see anything particularly problematic, but NOW I see auto-whitelist and 'bayes'

Re: [-3.6] [SAtalk] Using SPAMD ?

2003-10-18 Thread Charles Gregory
spamassassin calls a directly executed perl script - NO spamd involved. And this carries the resource loads of loading/compiling the code for every piece of mail. spamc (which you should use in place of 'spamassassin' in your procmailrc) needs to have spamd running as a daemon process. -

Re: [0.0] [SAtalk] adding SPAM hits score to headers

2003-10-17 Thread Charles Gregory
On Fri, 17 Oct 2003, Diego Puppin wrote: is it possible to add the spamassassin hits score to the spam mails, so that I can sort my spam box and find the spammest emails? I would like to have my spam emails tagged as: **SPAM** (score) Subject so I can sort and find which has 30 hits and which

[SAtalk] Deleting e-mail from a blacklisted site on a mail relay

2003-10-16 Thread Charles Gregory
Allyn Baskerville [EMAIL PROTECTED] wrote: Everything is working properly, but I would like to delete all e-mails from blacklisted sites, and just tag the other potential spam before forwarding to the internal server. If you are talking about sites that match the tests 'DNSBL' or similar,

[SAtalk] SA 2.60 occasionally does no markup on spam

2003-10-16 Thread Charles Gregory
On Thu, 16 Oct 2003, Rich Puhek wrote: Spamd does see the message (I verified by looking for the message ID in the debug output), and the message appears to run through spamd fine, but it lands in my mailbox with no markup. The other thing I've had cause this is if the buffer size in

Re: [SAtalk] CPAN or RPM's?

2003-10-16 Thread Charles Gregory
On Thu, 16 Oct 2003, Jeff Lasman wrote: They announced the phase out at least a year ago; perhaps longer. I just spoke to Red Hat, and none of their front line people could name a date, though they 'guessed' that it must have been later than July/03 when the Red Hat 10 Beta was released

RE: [SAtalk] Spamassassin updates

2003-10-16 Thread Charles Gregory
On Wed, 15 Oct 2003, Larry Gilson wrote: The sequence I use is : 1) perl-Mail-SpamAssassin-vers# 2) spamassassin-tools-vers# 3) spamassassin-vers# Next 'duh' question: What IS 'spamassassin-tools'? I didn't install it. Was it also included in the RH9 default spamassassin-2.44? Is it

Re: [0.5] RE: [SAtalk] SA 2.60 occasionally does no markup on spam

2003-10-15 Thread Charles Gregory
Hiyo! Are we talking about messages that have been processed through spamd but not marked, or ones that somehow bypassed spamd altogether? I find an occasional message gets missed by spamd when I *restart* it to pick up on new rules :-) - Charles On Wed, 15 Oct 2003, Martin, Jeffrey wrote:

[SAtalk] Spamassassin updates

2003-10-15 Thread Charles Gregory
Excuse me, but WHY do people post 'easy' instructions like the following and leave out whatever steps are needed to make them work? I just tried these: wget http://spamassassin.org/released/RPMs/spamassassin-2.60-1.src.rpm rpmbuild --rebuild spamassassin-2.60-1.src.rpm rpm -Uvh

Re: [SAtalk] Spamassassin updates

2003-10-15 Thread Charles Gregory
On Wed, 15 Oct 2003, Theo Van Dinter wrote: On Wed, Oct 15, 2003 at 02:59:58PM -0400, Charles Gregory wrote: And now that I look at it, that particular file is my local.cf that I didn't want over-written! So does this mean it aborts, is half way done, or WHAT? Have I just munched my

RE: [SAtalk] reporting the spam 'hosts

2003-10-14 Thread Charles Gregory
On Tue, 14 Oct 2003, Colin A. Bartlett wrote: If we start putting the squeeze on the image hosts, do you think that spammers will then just start to embed the images within their email? Certainly the bandwidth requirements become more costly then, but it doesn't seem like that would be a hard

Re: [1.2] [SAtalk] [RD] Emporium update!

2003-10-14 Thread Charles Gregory
On Tue, 14 Oct 2003, Chris Santerre wrote: I saved these in *gulp* MSDOS text in the hopes it wouldn't have any crazy characters. (Yeah I'm using a windows system!) Please let me know if you have any problems. This is nearly always a problem for people trying to save stuff on Unix flavors,

Re: [1.0] [SAtalk] What Does This Error Message Mean (Custom Rules)

2003-10-14 Thread Charles Gregory
On Tue, 14 Oct 2003, Bill Polhemus wrote: Failed to compile body SpamAssassin tests, skipping: (Bareword i not allowed while strict subs in use at Just a quick guess. I'd say that you put a space in front of the 'i' that goes at the end of the condition that does not belong there. You

[SAtalk] 'check_for_to_in_subject' not working?

2003-10-13 Thread Charles Gregory
running spamd 2.44 from /etc/procmailrc under RH Linux 9. Thanks! - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Charles Gregory Hamilton CommunityNet Member Services [EMAIL PROTECTED] Connecting the Community! www.hwcn.org

[SAtalk] Osirusoft problems

2003-10-13 Thread Charles Gregory
Hallo! While I think of it, can anyone tell me HOW to actually reach a warm body at 'Osirusoft' and get them to correct the 'blacklisting' of our mail server? It shows up as an open relay, which is something we've never been. I've run several open relay tests just to be sure we weren't hacked.

[SAtalk] Body rule not working SOME times...

2003-10-13 Thread Charles Gregory
Hi! I've got a rule (SA 2.44) that looks like this: body LOC_DOCTORB /our doctors will write.*prescription/i I've seen it work a few times, so the syntax is okay. But today it did not match on the following (excuse the full headers,but they might give a clue): Return-Path: [EMAIL

Re: [SAtalk] Re: Any Idea When RH RPMs are coming out?

2003-10-13 Thread Charles Gregory
On Mon, 13 Oct 2003, Bob Proulx wrote: http://spamassassin.org/released/RPMs/ Basically the following commands should do it. wget http://spamassassin.org/released/RPMs/spamassassin-2.60-1.src.rpm rpmbuild --rebuild spamassassin-2.60-1.src.rpm rpm -Uvh spamassassin-2.60-1.i386.rpm #

Re: [SAtalk] Osirusoft problems

2003-10-13 Thread Charles Gregory
On Tue, 14 Oct 2003, Matt Kettler wrote: OSIRUSOFT is and has been DEAD. They now match EVERY IP address in the world in an effort to force everyone to wake up and stop using OSIRUSOFT as a blacklist. Ah. Excellent. So I need not worry about this. Thanks! - Charles

Re: [0.3] Re: [SAtalk] Body rule not working SOME times...

2003-10-13 Thread Charles Gregory
On Tue, 14 Oct 2003, Matt Kettler wrote: Well, a copy-paste of some interpretation of the message by pine isn't really going to give us much useful information to go on. However, I'd venture to guess that the MIME construction is of a nature which confuses SA.. For example, a bug that was