Ah, I see now. It's probably the link to exclaimer.co.uk which is a
product that puts boilerplate disclaimers at the end of Exchange 200x
emails. Lawyers love those things. Idunno why it's in there.
-tom
> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] On
>
Upgrade to 1.14.
> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] On
> Behalf Of Arpi
> Sent: Saturday, January 24, 2004 7:29 AM
> To: [EMAIL PROTECTED]
> Subject: [SAtalk] new chicnpox --lint failed
>
> Hi,
>
> After upgrading chichekpox to Version 1.11, spa
You're asking why would "exotic playthings" or "excellentoffers" be a
spam indicator? If it gives you FPs, just lower the score in your
local.cf. Or view the source of the email in question and look at
what's tripping it. 3.0 isn't enough to FP all on its own, after all -
there's some other spa
I'll never complain about my old PII-400 taking 8.5 seconds to process a
message through spamd again.
-tom
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of
Thomas Kinghorn
Sent: Friday, January 23, 2004 4:32 AM
To: Spamassassin-Talk (E-mail)
Subject: [SAt
Since they rarely declare the TRUE country they're sending from, I'd
probably use the blackholes.us rbls. And probably host them locally to
reduce DNS lookup time.
http://www.blackholes.us/docs/usage.html
It only has zones for argentina, brazil, china, hong kong, japan, korea,
malaysia, mexico,
You forgot the part about the free Blaupunkt car stereos and Sony WEGA
televisions.
-tom
> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] On
> Behalf Of [EMAIL PROTECTED]
> Sent: Wednesday, January 07, 2004 9:05 AM
> To: [EMAIL PROTECTED]
> Subject: [SAtalk]
Pyzor and BigEvil nailed both of them. The second one hit a whole ton of
RBLs also.
> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] On
> Behalf Of Geoff Soper
> Sent: Wednesday, January 07, 2004 4:18 PM
> To: Chris Santerre
> Cc: [EMAIL PROTECTED]
> Subject: *
Interesting to me mostly because spamc/spamd by default won't even look
at a 1.2mb email. I'm interested in how/where that happened.
-tom
> -Original Message-
>
> After we upgraded to SA 2.61 as was suggested by this list we
> had a mail-machine crash again when spamd expanded beyond
Start spamd with -D debug options and then tail -f /var/log/maillog
|grep -i bigevil
> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] On
> Behalf Of SAtalk Mail User
> Sent: Monday, January 05, 2004 11:04 AM
> To: [EMAIL PROTECTED]
> Subject: [SAtalk] BigEvil.c
Hi Gordon,
>
> Firstly, I can bring up the list of tests, but is there any
> way that I can find out more explanation of the tests?
http://www.spamassassin.org/tests.html
There
> are really two aspects to this question - the brief
> descriptions of the tests often refer to technical details
Before you play with the settings, consider updating to the current
version of SpamAssassin. You're probably using 2.44; the current
version is 2.61. At this point, that much spam getting through would be
expected behavior.
-tom
> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:
> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] On
> Behalf Of AltGrendel
>
> We're running Exchange 2k that was upgraded from 5.5, which
> was upgraded from ...(you get the idea). Anyway, I'm still
> seeing the old header style and I'm wondering if it's n
> -Original Message-
> From: Tony Hoyle [mailto:[EMAIL PROTECTED]
> Sent: Thursday, December 18, 2003 8:41 AM
> To: Tom Meunier; AltGrendel; SA-Talk
> Subject: RE: [SAtalk] importing spam from exchange users for sa-learn?
> >
> Interesting... what did you set o
> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] On
> Behalf Of AltGrendel
> Sent: Thursday, December 18, 2003 7:54 AM
> To: SA-Talk
> Subject: RE: [SAtalk] importing spam from exchange users for sa-learn?
>
> Wasn't there a big issue with public folders stripp
http://www.wot.no-ip.com/cgi-bin/detoken.pl
Most of the gibberish I see is encoded tracking information. I plugged
in my domain name to the little script thingy, saved the .cf file, and
it catches 'em like crazy.
-tom
> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROT
What would differentiate the proposed public corpus from the public
corpus at http://www.spamassassin.org/publiccorpus/?
-tom
> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] On
> Behalf Of Adam Denenberg
> Sent: Thursday, December 11, 2003 8:10 AM
> To: [EMAI
You'll want to look at http://www.exit0.us/index.php/MaskedWordList
Take a gander at the link to Chris' Mediocre ObfuScript, which is soon
(I hear) to be upgraded to Chris' Somewhat Adequate ObfuScript.
-tom
> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] On
> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] On
> Behalf Of Kenneth Porter
> > http://www.securitysage.com/guides/postfix_uce.html
>
> I just got some mail bounced by an ISP using this setup and
> after reviewing the details, it looks like the system is se
> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] On Behalf Of
> Guentert Matthias
>
> I have successfully installed spamassassin on my linux server which
> runs postfix as mta. Our Exchange 2000 server pops the emails from the
> linux server which stands in th
You've just described how spamassassin works.
So I'm pretty certain the you don't want to sit at a command line,
saving your mails to text files, and checking them one-by-one. What is
it that you would LIKE to do, really? Chances are someone's already
doing it. Do you have a non-*n?x enterprise
> -Original Message-
> > IIRC, bl.spamcop.net isn't supposed to resolve. Try running an RBL
> > query against it instead of trying to resolve it.
> >
> >
> Surely it has to resolve to *something* - the NS records have
> gone as well.
>
> Tony
>
No, it doesn't have to. When you que
No. How would this be a bug? By definition it would have to be a
custom rule, since you've specified that it be user-specific and custom
header specific. Such a rule would work for nobody in the universe but
Wolfgang Rohdewald.
-tom
> -Original Message-
> From: [EMAIL PROTECTED]
> [m
The CASHCASHCASH rule tests for the string '$$$' not for the phrase
CASH! CASH! CASH!
The ADDRESSES_ON_CD rule caught almost as much ham when tested against a
half-million message corpus as it did spam.
The BLANK_LINES_90_100 caught MORE ham than it did spam.
http://search.cpan.org/src/JMASON/Mail
VSNL is, I believe, the largest ISP in India or at least in the top 2.
I'd tread lightly on blocking them if you do business with India at all.
-tom
> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] On
> Behalf Of Chris Santerre
> Sent: Thursday, November 06, 20
Since I'm stupid, you'll want to test this thoroughly.
In 20_body_checks.cf you'll find:
bodyRAZOR2_CF_RANGE_11_50 eval:check_razor2_range('11','50')
bodyRAZOR2_CF_RANGE_51_100 eval:check_razor2_range('51','100')
tflags RAZOR2_CF_RANGE_11_50 net
tflags RAZOR2_CF_RANGE_51_100 net
Example 1. Use spamc/spamd, it defaults to only scanning messages under
250k and you can change that limit with spamc's -s switch.
Example 2. What version of Spamassassin are you running? There's a
whole ton of tests based upon the ratio of image to text.
-tom
___
If it's already 100% sure that it's spam, how is it helpful to train it
that it's spam? It's not like it's going to be 110% sure that it's
spam. It's already trained!
Not trying to be a wise-ass, I've just seen this question come up fairly
often, and can't wrap my head around it.
-tom
> -O
No, but you can enable it if you like. Their web site tells you how.
Just save this text as /etc/mail/spamassassin/something.cf
http://www.ahbl.org/using/spamassassin.txt
> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] On
> Behalf Of Nigel Featherston
> Sen
Matt, thanks for this. It's a great resource. However, I'm wondering
why the following were scored as zero and thus don't have numbers to
support their efficacy or lack thereof:
0.000 0. 0.0.500 0.110.00 RCVD_IN_SORBS_BLOCK
0.000 0. 0.0.500 0.110.
-m 15 will limit it to 15 spamd instances. Give that a shot.
I'm kinda surprised by how quickly this happens, though.
> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] On
> Behalf Of Dennis Duval
> Sent: Monday, November 03, 2003 5:05 PM
> To: [EMAIL PROTECTED]
John, if you run the email through
Spamassassin -tD -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] On
> Behalf Of Stewart, John
> Sent: Monday, November 03, 2003 1:13 PM
> To: '[EMAIL PROTECTED]'
> Subject: [SAtalk] Problems with bayes "forgetting" in 2.60
>
>
Sweet. 27 hours for that to show up. (And looking at headers it's the
ISP anyway, heh)
> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] On
> Behalf Of Tom Meunier
> Sent: Friday, October 24, 2003 8:47 AM
> To: [EMAIL PROTECTED]
>
Okay, this is the sixth copy of this email that I've gotten. Is it me,
is it sourceforge, or is it maybelline?
(Yeah, I know it's sourceforge, but I wanted to kvetch)
-tom
> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] On
> Behalf Of Chris Trudeau
> Sent:
Even on good mail? Or only on Spam? Because when I see spam, I'm 99%
sure it's spam, and a well-trained Bayes engine would be 99% sure also.
If it's on good mail that you're seeing 99%, every time, then your
database is screwed up and you should start over.
> -Original Message-
> From:
Sorry, I should've left a note. I had brought it to the printers to get
a banner made, and thought I'd take it out for a nice ice cream sundae
too. It's back now, though.
I put it at http://www.spamassassin.org/tests.html
> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL
> I have a pretty
> comprehensive (and paranoid) list of blacklisted from
> addresses that I *know* will only send spam.
>
> Is there any way I configure SA such that these will be used
> to train the bayes?
Make a custom header rule for the domain, and score it with a crazy
amount of points.
That's right. It seems weird, doesn't it? But basically, that setting
tells SA that the filenames are /usr/local/share/bayes_*
To achieve what you think it should be, you'd want to do bayes_path
/usr/local/share/bayes/bayes - funny as that sounds.
> -Original Message-
> From: [EMAIL P
Train Bayes with sa-learn --ham using a sizable representative sample of the shipping
company's "known good" email.
> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] On
> Behalf Of Håkon Nilsen (Exinet AS)
> Sent: Friday, October 17, 2003 6:21 AM
> To: [EMAIL P
> -Original Message-
>
> I'm Linux SysAdmin at the company I work for, I always
> install everything from source.
> A colleague, a Windows SysAdmin, installs everything on his
> Linux boxes from RPMs.
>
> What does that tell you? :)
>
Tells me we need a larger sample size. I'm a Wind
It's arguable whether that will unsubscribe them, or confirm to the
spammer that they've scored a direct hit, and make your users a more
valuable spam target. Think about it: Is someone who just hijacked a
Taiwanese elementary school's mail server to send out necrophilia
pornography with forged he
-H should list a directory other than the default home directory of the
user that's calling spamc. Else, don't use it at all.
-m5 should be -m 5 I believe.
Other than that, Idunno. Feel free to ignore me.
-tom
> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED
tom
> -Original Message-
> From: Robert Leonard III [mailto:[EMAIL PROTECTED]
> Sent: Monday, October 13, 2003 1:00 PM
> To: Tom Meunier; [EMAIL PROTECTED]
> Subject: Re: [SAtalk] Bayes not working.. On System Wide SA
>
> Thanks for the tip.. I guess it was an address
> -Original Message-
> From: Roger Merchberger [mailto:[EMAIL PROTECTED]
[ ]
>
> 2) Is there any way of setting up logging to know which rules
> are being hit & which ones aren't without grabbing all of the
> message headers? I'd like to be able to profile which rules
> are being hi
Call it with spamd and limit the number of spamd processes with the -m
switch.
For comparison sake, I have a light-volume postfix/spamd gateway server
that handles about 1000 messages per hour during business hours. It's a
PII-400 with 512mb RAM.
I can't give you spamstats time statistics outpu
So I'm loving the rules http://spamhammers.nxtek.net/ that Jennifer
Wheeler wrote , but I'm up against a few (philosophical?) questions, and
would like to invite discussion.
I've noticed that about 95% of the time when these rules are hit,
they're listed as BAYES_99. In this case, should I even b
Okay, are you running spamassassin as root? If not, you'll probably
want to specify bayes_path in your local.cf - so that when you do a
spamassassin -D it reflects the ACTUAL location of the Bayes databases.
Then run it again, and see if you actually have zero spams in the
database. It will tell
How do you call SpamAssassin? Please be specific with your answer. :)
If you use spamc/spamd it defaults to only scanning up to 250kb,
configurable with the -s switch. No config file necessary, you set it
as a switch on the line that you call spamc with.
http://www.spamassassin.org/doc/spamc.ht
> -Original Message-
> From: O-Zone [mailto:[EMAIL PROTECTED]
> On Wednesday 08 October 2003 13:40, Tom Meunier wrote:
> > (I must be annoying SOMEBODY) Hi Oz, Which
> > machine(s) have spamassassin? I know domini does, but does
> siena also
> > have
(I must be annoying SOMEBODY)
Hi Oz,
Which machine(s) have spamassassin? I know domini does, but does siena
also have spamassassin? That would cause this behavior.
-tom
- headers -
On Wednesday 08 October 2003 13:25, you wrote:
> It's difficult to see because you're not incl
Hi Doug,
The answer to your question varies depending on what version of
SpamAssassin you're using, and what RBL's you're seeing scores on. This
is crucial information to answering your question.
Since this is a well-documented issue with versions before 2.60, I'm
going to assume that, and that y
Okay, so SpamAssassin is working fine. The mail is properly marked up
when it leaves SpamAssassin at the original place SpamAssassin is
called. Then the next process is what's marking it as 0.0. It almost
looks as if it's running spamassassin twice, once on the original mail
and once on the alr
Sounds like Postini. Or Messagelabs. postini dot com or messagelabs
dot com.
Messagelabs is using a modified SpamAssassin, iirc.
> -Original Message-
> From: Jonathan Vanasco [mailto:[EMAIL PROTECTED]
> Sent: Tuesday, October 07, 2003 5:23 PM
> To: [EMAIL PROTECTED]
> Subject: [SAtalk
6 asterisks indicates it's not quite 7.0. Probably 6.9something. You
could add up the scores to verify if you really like, but that's what's
happening.
X-Spam-Level: **
X-Spam-Status: No, hits=7.0 required=7.0
tests=BAYES_10,DATE_IN_PAST_03_06,
HTML_FONTCOLOR_BLUE,HTML_FONTCOLOR_RED
So you're saying that when you cut and paste the body of a spam into an
email, removing the spammer's headers, SpamAssassin doesn't rate your
headers as spammy as the spammer's headers? And you include only the
spammy body, and it trips off all the spammy body checks? That's to be
expected, isn't
You need to either upgrade to 2.60 or remove your Osirusoft and orbs
tests tests as specified in the article at http://news.spamassassin.org.
Those blocklists are dead and are waiting until your timeout.
-tom
> -Original Message-
> From: Jim Ford [mailto:[EMAIL PROTECTED]
> Sent: Monday,
What version of SpamAssassin? You can implement Razor, DCC, RBLs, and
train your Bayes up to 200 each of spam/ham to augment the tools at SA's
disposal.
-tom
> -Original Message-
> From: David M. Carney [mailto:[EMAIL PROTECTED]
> Sent: Monday, October 06, 2003 1:09 PM
> To: [EMAIL PRO
It's the first option on the list if you type spamd --help
> -Original Message-
> From: Rob Mangiafico [mailto:[EMAIL PROTECTED]
> Sent: Monday, October 06, 2003 1:10 PM
> To: [EMAIL PROTECTED]
> Subject: [SAtalk] spamd and -a option in 2.60?
>
> In the 2.60 docs, the -a "auto whitelis
I've been able to re-discover pyzor servers (and it always winds up with the same
server) and get pyzor working for a couple hours before the "couldn't grok response
'...TimeoutErrors'" begins again. I've disabled Pyzor and just written it off to my
own ignorance. Basically once it starts not
Look, there's a poll for this at
http://news.spamassassin.org/modules.php?op=modload&name=NS-Polls&file=index
Is it inappropriate to suggest that we see who's got the biggest thingy over there?
-tom
---
This sf.net email is sponsored by:Think
What to do with a spam that includes this garbage at the bottom, in a hidden font?
Bayes freaked, I'm kinda glad it didn't auto-learn it. I'd rather have the false
negative than that. (Only snipped the Bayes poison from the mail, I think maybe
Mozilla TBird put all the = in there.)
-tom
---
1. It's okay to train with the spam with Spamassassin markup. sa-learn
ignores the markup.
2. It's not okay to train with "this month's sent-mail" - you need to
be training it with mail that reflects the type of mail you GET, not
send. The headers are as crucial as the body.
-tom
> -Origi
> -Original Message-
> From: Malte S. Stretz [mailto:[EMAIL PROTECTED]
> and 3 ways to
> > attach a complete message (as sent by the POP3 server) to a new
> > message.
>
> Could you tell me the way to do it with Outlook 2000? I
> searched for that
> option on a customers box today,
AFAICT you'd do
auto_whitelist_factor 0
use_bayes 0 will disable bayes, not the (unfortunately named - it's as much an auto
blacklist as an auto whitelist, innit?) auto whitelisting feature.
I hope if I'm mistaken somebody will jump in and correct me. I remember this being
asked a few months a
Why not just go get 80 spams from the public corpus? It'll be not optimal, but it'll
be better than forcing it with 120.
http://spamassassin.org/publiccorpus/
> -Original Message-
> From: Bill [mailto:[EMAIL PROTECTED]
> Sent: Friday, September 26, 2003 10:45 AM
> To: [EMAIL PROTECTED]
You could probably make some of that happen yourself by implementing some of the
blacklists at http://www.blackholes.us
See http://www.blackholes.us/docs/usage.html#spamassassin for usage info.
-tom
-Original Message-
From: Andrew Thomas [mailto:[EMAIL PROTECTED]
Sent: Friday, September
I think the main thrust of his answer was that Google Is Your Friend.
http://www.gryzor.com/tools/
-tom
> -Original Message-
> From: Jim Knuth [mailto:[EMAIL PROTECTED]
> > First hit after googling for spamstats and perl:
> > http://freshmeat.net/projects/spamstats/?topic_id=245
>
> tha
Go check your filesystem rights on those file & directories. That's happened to me
before, and I was waiting for it to happen this time too, and mysteriously, it didn't.
My gateway boxen must be contagious. :)
-tom
> -Original Message-
> From: Steve Heggood [mailto:[EMAIL PROTECTED]
>
SpamAssassin doesn't block mail. All it does is mark it up for content.
That mail seems to have been marked up for spam content correctly.
Therefore, your problem is not with SpamAssassin but rather with the
product that you've configured to quarantine mail.
> -Original Message-
> From:
Hi Darren,
> 256 Ham, 1040 Probably Spam (>5 points), 256 Almost Certainly
> Spam (>15 points), and 269 false negatives, 0 false
> positives. Bayes was trained with 16680 Spam, 4092 Ham,
> 125776 tokens. I have auto-learning enabled, and feed all
> the false negatives back into sa-learn th
> -Original Message-
> From: Mike Klein [mailto:[EMAIL PROTECTED]
> Sent: Monday, September 22, 2003 3:48 PM
> To: [EMAIL PROTECTED]
> Subject: RE: [SAtalk] SpamAssassin filters seem too weak out of the
> box...
[]
>
> As far as I could tell, my spam email was pfs (that's pretty f%$%$king
It's not abysmal. You just don't understand it. Most people get in
excess of 99% of spam with SpamAssassin. Isn't it great to know that
SpamAssassin is so well geared against false positives that you're
TRYING to send a spammy email and can't do it?
http://www.spamassassin.org/tests.html
Break
Spamstats does that.
http://www.gryzor.com/tools/
> -Original Message-
> From: Markus Gaugusch [mailto:[EMAIL PROTECTED]
> Sent: Monday, September 22, 2003 5:31 AM
> To: [EMAIL PROTECTED]
> Subject: [SAtalk] Better logging?
>
> Hi,
> I'm using spamassassin on our relay server (with pos
Oh pooh. Ignore me. Of course Patrick is right; it doesn't support qmail.
> -Original Message-
> From: Tom Meunier
> Sent: Sunday, September 21, 2003 9:51 AM
> To: 'Tomáš Macek'; [EMAIL PROTECTED]
> Subject: RE: [SAtalk] Autodeleting spam based on scor
Why, Google of course!
http://savannah.nongnu.org/projects/spamass-milt/
Yes, it works with qmail.
-tom
> -Original Message-
> From: Tomáš Macek [mailto:[EMAIL PROTECTED]
> Sent: Sunday, September 21, 2003 8:40 AM
> To: [EMAIL PROTECTED]
> Subject: Re: [SAtalk] Autodeleting spam based o
Bayes, RBL checks, Razor, DCC, Pyzor.
-tom
> -Original Message-
> From: Ed Greenberg [mailto:[EMAIL PROTECTED]
> Sent: Sunday, September 21, 2003 8:58 AM
> To: spamassassin talk
> Subject: [SAtalk] Really really simple spams - not enough to
> accumulate 4 points
>
> I've been getting
Hi Ed,
You can either wait until the auto-learning catches up and learns 200
messages, or if you're impatient (like me) and just want to get it
going:
Train it with as much recent good mail as you can get, then make up for
it with older mail. Don't get all wrapped up in the timestamp issue.
Train
SpamAssassin doesn't bounce mail, period. If you want it to bounce mail, please do
so. If you don't, don't. Further documentation in your MTA's man pages.
-tom
> -Original Message-
> From: Regis Wilson [mailto:[EMAIL PROTECTED]
> Sent: Thursday, September 18, 2003 4:56 PM
> To: [EMAIL
> -Original Message-
> From: Gary Funck [mailto:[EMAIL PROTECTED]
> Sent: Friday, September 19, 2003 10:38 AM
> To: Spamassassin List
> Subject: RE: [SAtalk] Scan Message Max Size
> > Define "safe" - I stick with the default of 250kb and have
> never had
> > an issue with it. I can't se
Absolutely.
www.exit0.us/index.php/VirusBounceRules
among other things.
-tom
> -Original Message-
> From: Ivar Magne Auestad [mailto:[EMAIL PROTECTED]
> Sent: Thursday, September 18, 2003 1:01 PM
> To: [EMAIL PROTECTED]
> Cc: [EMAIL PROTECTED]
> Subject: [SAtalk] Question for the FAQ
>
Define "safe" - I stick with the default of 250kb and have never had an issue with it.
I can't see receiving a spam anywhere near that size, that wouldn't also trigger an
attachment blocking rule on my gateway MTA.
-tom
> -Original Message-
> From: Jeff Funk [mailto:[EMAIL PROTECTED]
>
skip_rbl_checks 1
#even though they're default if installed anyway...
use_razor2 1
use_pyzor 1
use_dcc 1
You've disabled the Osirusoft tests, I hope. Those hit everything on the Internet.
-tom
> -Original Message-
> From: Covington, Chris [mailto:[EMAIL PROTECTED]
> Sent: Thursday, Sept
http://blackholes.us/
> -Original Message-
> From: Peter Kiem [mailto:[EMAIL PROTECTED]
> Sent: Wednesday, September 17, 2003 7:41 PM
> To: [EMAIL PROTECTED]
> Subject: [SAtalk] Recognising dynamic rr.com IPs
>
> I'm getting sick of all the spam that comes from rr.com and
> have been b
Message-
> From: Tom Meunier [mailto:[EMAIL PROTECTED]
> Sent: Tuesday, September 16, 2003 2:02 PM
> To: [EMAIL PROTECTED]
> Subject: RE: [SAtalk] The Verisign folly
>
>
> "Date: Sat, 25 Jan 2003 10:19:37 +1100"
>
> -tom
>
> > -Original Me
"Date: Sat, 25 Jan 2003 10:19:37 +1100"
-tom
> -Original Message-
> http://www.iab.org/Documents/icann-vgrs-response.html
---
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_
I'm mulling over whether to make some SA rules for some of the more common urban
legends and virus hoaxes. Has anyone played with this, that is willing to share
experiences?
-tom
---
This sf.net email is sponsored by:ThinkGeek
Welcome to gee
If there's no BAYES_ test whatsoever, it isn't thinking it's ham. It's not saying
anything whatsoever. Probably based upon the fact that it didn't have sufficient
tokens or something.
Please note that Bayes doesn't use keywords. It uses tokens, which may or may not
resemble words. Also note
How can you tell it only ran one test? I'd say it ran all of the tests
but only hit on one of them.
What rule do you feel your example spams broke, that SpamAssassin missed
tagging? The only answer to spams like your example is Bayes, RBLs, and
distributed checksums such as Razor/Pyzor/DCC, if
Yes, you're not running spamd as root, but you ran spamassassin -D --lint as root.
Note the different paths to the bayes databases in your output.
> -Original Message-
> From: James Herschel [mailto:[EMAIL PROTECTED]
> Sent: Tuesday, September 09, 2003 3:07 PM
> To: To
if you run spamassassin -D --lint it will show you a dbug line:
debug: bayes corpus size: nspam = [number], nham = [number]
> -Original Message-
> From: James Herschel [mailto:[EMAIL PROTECTED]
> Plus I'd just like to know how much further I
> have to go before the Bayes kicks in
You are correct. It needs 68 more spams.
> -Original Message-
> From: James Herschel [mailto:[EMAIL PROTECTED]
> Sent: Tuesday, September 09, 2003 9:58 AM
> To: [EMAIL PROTECTED]
> Subject: [SAtalk] Not sure if my Bayesian filter is adding to
> the score
> ...
>
>
[snip]
> Sep 9 10:
>
> currently I am looking for options on how to speed up
> spamassassin 2.54.
>
Hi Jochen,
I've been considering the idea proferred at
http://www.advosys.ca/papers/printable/postfix-filtering.html
under "A Word About Performance"
The method shown here is an easy and reliable way to filter m
Feed it 1400 more?
-tom
> -Original Message-
> From: Peter Kiem [mailto:[EMAIL PROTECTED]
>
> Yes I don't expect it to activate in SA until then but how can you get
> it to over 200 when I feed it 134 emails but the db says it
> only learned
> 19?
--
1. It *is* the case indeed. Look at your email. Since Osirusoft has
blacklisted the entire internet, every one would have that test flagged,
wouldn't it? Yes. It doesn't, does it? No. Setting it to 0 disables
the test.
2. Even if it *did* run the test, if a test were to score zero points,
There are already tests for SpamCop and NJABL:
RCVD_IN_BL_SPAMCOP_NET
RCVD_IN_NJABL
X_NJABL_OPEN_PROXY
X_NJABL_DIALUP
You can see what blacklists are tested by default, and their assigned scores, at
http://www.spamassassin.org/tests.html
For examples of rules for alternative blacklists, see
http://useast.spamassassin.org/tests.html
You've got negative scores all over that thing. Add them up.
> -Original Message-
> From: landy [mailto:[EMAIL PROTECTED]
> Sent: Thursday, September 04, 2003 5:31 AM
> To: SA
> Cc: [EMAIL PROTECTED]
> Subject: [SAtalk] why so low
>
> i have
Hi Dave, hope I can help here beyond parroting what I've read & played with...
> > On this one, it's because autolearn learns the message pre-Bayes
> > test. Without your Bayes_90, that message scored under 1.9 points,
> > and so it was autolearned. The other reason that applies here is
> > expl
Hi Dave,
You've got two different things happening here.
> -Original Message-
> From: Dave Kliczbor [mailto:[EMAIL PROTECTED]
> Sent: Wednesday, September 03, 2003 12:52 PM
> To: [EMAIL PROTECTED]
> Subject: [SAtalk] Bayes filter and autolearning
>
>
> | X-Spam-Status: No, hits=4.1 requ
> -Original Message-
> From: Ron Gilbert [mailto:[EMAIL PROTECTED]
>
> >>Because without a few hundred messages, it would be
> completely and utterly
> useless?
>
> Yes, i do understand that. I guess my complaint is that I
> would have rather
> it started working and been somewhat us
Because without a few hundred messages, it would be completely and utterly useless?
It would be like meeting an airline pilot who was 5'7" tall and had a scar on his left
cheek and wore his hat backwards. Bayes would think that scars on left cheeks were as
reliable an indicator of airline-pilo
You'll likely find that those words wouldn't be considered "interesting
tokens" - and if they do, they will also be considered interesting
tokens for all the ham you receive discussing these topics. The
bayesian engine doesn't simply grab words; it grabs tokens, and it grabs
them in some really (t
1 - 100 of 134 matches
Mail list logo
