I believe there was a post about this a while back. Using procmail to check
the level and then determine just what you are asking. I haven't played with
it yet. Try a quick search of the archives. I think it was less then 2
months ago.
The basic answer is what Theo said. SA doesn't do this,
I used CPAN for installing update preq's. But I used a tar for SA. It was
however the easiest way to update things. I haven't used up2date yet :)
-Original Message-
From: McClung, Darren W. [mailto:[EMAIL PROTECTED]]
Sent: Thursday, October 03, 2002 2:00 PM
To: 'rODbegbie'
Cc: [EMAIL
I've already upgrades from SA 2.31 to 2.40. I'm now going to 2.42 and
figured I'd ask a simple question. What is the easiest method of upgrading?
CPAN or straight .tar? I can't remember if CPAN will keep my config files
intact. I saw no upgrade info on the FAQ. Is this worth adding to it?
I'll
It's just another form of decimal notation scam. I have a program in my palm
to convert just such little beasties :) Users with a clue somtimes use the
same aproach to defeat web filters. THey want their porn that bad at work,
fine. I just get to show the boss that cool little palm ap and show
Of course, you probably need to use a userprefs database in that case,
rather than the userprefs in each user's home directory.
Aside from moving the process to another system, Are you saying that seting
up the users in a database is a faster process then putting configs in user
directories? I
I was excited, then I saw the script. :)
This will install many instances of SA on the system. While it will work, it
just doesn't seem right. It would be better to install sitewide and then
just customize the calling of SA in users local procmail file. This way you
just have to copy the
I've seen this same question asked many times here. And I'm an SATALK noob!
Can we add a section in the FAQ in big bright neon letters that says how to
do just this?
Or as Josh mentioned, place it in the example under big blinking monkeys :)
How to remove high scoring spam and mark up low
How would the term 'goldfish' score in the corpus? :)
There isn't much to key off of in the email itself. Very short. Heck, virus
writers could just make viruses with common, non spam realted words in them.
(Goldfish, spoon, eclipse, hoceky, monkeychow,) Then you would be adding
custom rules
Quick question. I'll admit I haven't looked into this at all. But I don't
recall seeing anything like this in the docs.
If local rules set an email over your spam limit, then can it be set to skip
Razor2 check? At that point it is already spam, no sense in checking any
further.
I only ask
WOW! That is slick and easy. Nice work.
-Original Message-
From: Jeremy Turner [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, October 29, 2002 4:35 PM
To: Rich Wellner; [EMAIL PROTECTED]
Cc: [EMAIL PROTECTED]
Subject: Re: [SAtalk] Generating Statistics (new graph enclosed)
On Thu,
I've been looking into this problem for a while now. I've searched the
archives and found many questions but little answers.
Problem: Use SA on Aliases and / or virtusers AND real users combined.
So far the only solution looks like using MySQL. (Which for reasons of my
own I don't want to do
Sorry gagel, I'm having trouble following you. How are you doing your
config? Are all your users local, aliased, virtual, database stored, or
combo?
-Original Message-
From: gagel [mailto:[EMAIL PROTECTED]]
Sent: Friday, November 01, 2002 3:18 PM
To: Chris Petersen; Chris Santerre
This is done easily in procmail, by checking for the spam status. Check the
procmail example that came with SA.
But this may NOT be a good idea. Suppose some worker's wife sends him an
email like,
When you get home I'm going to RAPE you like the little love monkey you
are! and ect
SHould
Very nice. You don't say if your doing simply local or RAZOR2, DCC, ect...
checks.
You have to be happy with that kind of improvement! (and price)
-Original Message-
From: Hugh Brown [mailto:[EMAIL PROTECTED]]
Sent: Thursday, November 07, 2002 5:08 PM
To: [EMAIL PROTECTED]
Subject:
When SA 2.50 goes live, will there be a way to get a pretrained generic
version or corpus to train with? I haven't gone live with my SA yet, still
trying different things in the little spare time I have, and I don't have a
corpus. I think I remember a thread saying there was a public download of
Great advice from everyone here. Interesting to see how admins take
different approaches to the same problem.
Due to many FPs, I'm not going to use RBLs for the company. Makes sense.
I sent out a message to the users to send me the email addresses of people
they deal with overseas. I'll check
My leaving the project is just a drop in the ocean.
That will send out ripples!
I think Your situation will be discussed more then you think. The idea of
this happening has a major impact on open source. What if NAI suddenly hired
Dan Quinlan, Justin and Theo? Then we go from major contributors
I'm fighting the same problem here. I've passed thru our weekly newsletter
thru SA and it scores low. We only send to current customers and people in
the industry. SO I'm not trying to sell an Eskimo Nigerian weight loss sex
enhancers. :)
Well written, good content, and industry specific. Also
: Jason Farrar [mailto:[EMAIL PROTECTED]]
Sent: Thursday, January 09, 2003 7:33 PM
To: 'Chris Santerre'
Subject: RE: Miltrassassin/Spamd/Sendmail relay server config?
Thanks Chris. Do you know where in the procmail config I would call
spamd
*snip*
It sounds like you should be using spamass-milter or
mime_defang. These
tie SA into the MTA before delivery. That way, if a return receipt is
requested, it can be generated with the original sender, since their
address will still be in the envelope from.
I keep hearing more and
I use NAV for exchange here. There really isn't a tool to pick and choose
which to respond to. :( I wish there was. Simply ignore it for the most
part. I can't believe that Klez is still around.
-Original Message-
From: Matt Kettler [mailto:[EMAIL PROTECTED]]
Sent: Friday, February
Obviously everyone on the
list has seen the spam that came thru that said PUSH THIS instead of click here.
Is that something relatively new? It actually made me laugh. Should the rule
that catches Click Here be adjusted to also catch PUSH THIS? Or is everyone now
relying on Bayes? :)
My
using procmail and mimedefang I believe you could. Anything above a 6 goes
to my spamtrap account for manual review. NOTHING EVER gets deleted without
me seeing it.
-Original Message-
From: Shayne Lebrun [mailto:[EMAIL PROTECTED]
Sent: Tuesday, April 01, 2003 3:02 PM
To: [EMAIL
I'm glad you followed up on it. But why then, do they NEVER reply to the
answers that people give them? That would be common sense.
As for conspiracy theories, I don't think you are the real jmason. Someone
stole your identity. The real jmason is trapped in the trunk of a car on the
way to
http://www.msnbc.com/news/921042.asp?0dm=C14PN
1 fraud down, 10,000 to go
:/
Mentions the [EMAIL PROTECTED] contact as well.
Chris SanterreSystem Admin"A little nonsense now and
then, is relished by the wisest men."- Willy Wonka
I won't go posting the
whole email , but the last Nigerian I just read in my spamtrap had me literally
LOL! They seem to be so desperate that they changed it around so much, it bearly
makes ANY sense anymore :)
Even knowing what they are
trying to say, it isn't right. Check these 2
-Original Message-
From: Kai Schaetzl [mailto:[EMAIL PROTECTED]
Sent: Tuesday, May 27, 2003 11:32 AM
To: [EMAIL PROTECTED]
Subject: Re: [SAtalk] kicking SPAM: AWL, custom rules
Guenther wrote on 26 May 2003 01:03:10 +0200:
header X_KNOWN_SPAMMER From =~
?
I don't really know how to setup my own rules, how would I do what you
described below?
Thanks
Ricardo
On Tue, 27 May 2003 10:09:24 -0400 Chris Santerre wrote:
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
Sent: Monday, May 26, 2003 8:15
$10 says it is a harvester!
Kyle: After all that? Shenanigans! Shenanigans SHENANIGANS!!
-Original Message-
From: Mike Anderson [mailto:[EMAIL PROTECTED]
Sent: Tuesday, May 27, 2003 1:54 PM
To: [EMAIL PROTECTED]
Subject: [SAtalk] I hate SpamAssassin
Because of you I
-Original Message-
From: Matt Kettler [mailto:[EMAIL PROTECTED]
Sent: Tuesday, May 27, 2003 4:28 PM
To: Chris Santerre; Spamassassin-Talk (E-mail)
Subject: Re: [SAtalk] Nigerians are getting funny! (or sad)
At 03:04 PM 5/27/2003 -0400, Chris Santerre wrote:
Opfuscate urgen
-Original Message-
From: Edward Brookhouse [mailto:[EMAIL PROTECTED]
Sent: Wednesday, May 28, 2003 8:03 AM
To: [EMAIL PROTECTED]
Subject: [SAtalk] Whitelisting Reply-To
I assume this is possible, looking for suggestions on howto.
Any pointers to different docs appreciated.
tir, 27.05.2003 kl. 23.49 skrev Ben M. VanWagner:
What amazes me is that everytime some idiot does this..
...and gets answered, they never reply back! This guy was most likely a
spammer trying to get our goat or harvest more addresses. Look at all the
time wasted talking about this. Has
. Sadly no time for that. :(
HTH,
Chris Santerre
System Admin
A little nonsense now and then, is relished by the wisest men. - Willy
Wonka
---
This SF.net email is sponsored by: ObjectStore.
If flattening out C++ or Java code to make your
corpus soon ;)
here are two quick rules:
rawbody TEST1 /spacer\.gif/i
and
rawbody TEST2 /alt\=/i
Just curious on the rates. Thanks!
Chris Santerre
System Admin
A little nonsense now and then, is relished by the wisest men. - Willy
Wonka
I don't know what's funnier. The fact that we keep getting these posts, or
the sig quote you responded with to Diane! :)
-Original Message-
From: William Stearns [mailto:[EMAIL PROTECTED]
Sent: Wednesday, May 28, 2003 2:29 PM
To: Dianne Moore; [EMAIL PROTECTED]
Cc:
I completely agree that SA is incredible I'm not even using bayes! Here are
my stats:
90% of marked spam is scored over 7 and goes into spamtrap! Not even
delivered. I've had 4 FPs since Febuary!
Stats per log. Totals to a month worth.
-rw--- 1 root root 4.6M May 30 12:00
Has anyone gotten a reply from these kinds of posts after you answer them. I
think the score is like 1-6. 1 reply after we all answered, and we've had
about 6 of these kinds of posts.
Didn't anyone call the person? I am s tempted :)
-Original Message-
From: Brian K. West
-Original Message-
From: Theo Van Dinter [mailto:[EMAIL PROTECTED]
On Mon, Jun 02, 2003 at 10:42:24AM -0700, Cassandra Lynette
Brockett wrote:
Personally not really liking rhat very much, I'd suggest
another OS, but for
stability, so far 6.2 is the most stable of the rhat
UNtil you figure out how to send it to the correct address. No human handles
the list. Welcome to the internet!
-hint- check the header of EVERY email you got from SATALK list.
-Original Message-
From: Frank Chibesakunda [mailto:[EMAIL PROTECTED]
Sent: Wednesday, June 04, 2003 3:19
LOL, I wonder if I can get that written off as an expense! They have
important tech articles now!
Good to see someone talking about SA!
Chris Santerre
System Admin
A little nonsense now and then, is relished by the wisest men. - Willy
Wonka
-Original Message-
From: Jeremy Kister
Received: from marge (ppp025.pfa.centurytel.net [207.230.201.227])
by r2d2.centurytel.net (8.12.9/8.12.9) with SMTP id h541GkPB015914
for [EMAIL PROTECTED]; Tue, 3 Jun 2003
from marge Hm.. ppp025 Hmmm.
Me thinks if we contacted centurytel.net they would have
Like the subject says, they
have a new section devoted to spam filters. As you may have guessed, no mention
of SAProxy.
http://download.com.com/3150-2382-0.html?tag=dir
I can see why no mention of
Spamassassin, as the site is geared towards end lusers. But SAProxy should have
been
try this
ps -ef | grep spamd
note process id#
then kill -TERM id#
then start spamd again (/usr/bin/spamd -d -c -a) or something like that.
-Original Message-
From: Marius Kirschner [mailto:[EMAIL PROTECTED]
Sent: Wednesday, June 04, 2003 2:29 PM
To: 'Duncan Findlay'; [EMAIL
Anyone seeing the @ symbol
used a lot in URIs?
href=""http://[EMAIL PROTECTED]/mp/gh/index.html">http://[EMAIL PROTECTED]/mp/gh/index.html
I've seen quite a few.
Might be worth a looksee as the latest spammer trend.
Chris SanterreSystem Admin"A little nonsense now and
then, is relished by
Wow This is OT. But while we are at it, I had a win NT 3.1 PDC YES 3.1
server running at my last job for about 2-3 years. Service pack 1 only :) To
my knowledge it is still running! About 7 years+
Mangmnt decided if it ain't broke...
NT, behind a firewall, without worrying about inside
IF you truly want to BL them and save overhead, and you have permission to
change the file, add them to your access file as reject. That way the email
won't even get in to be processed.
HTH
Chris
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
Sent: Wednesday,
-Original Message-
From: Dan Baker [mailto:[EMAIL PROTECTED]
Sent: Friday, June 13, 2003 8:30 AM
To: [EMAIL PROTECTED]
Subject: [SAtalk] a few suggestions
I'm having great luck with spamassassin... a few things slip thru of
course, and I wanted to post in case it gives
This isn't a request, more
an open discussion.
Would it be good to program
a default counter function in SA so that users may custom write rules using it.
IE a simple function call in SA called 'counter' instead of header. Then you
simply feed it a regex and give it a minimum.
counter
I just got this subject
placed directly into my spamtrap folder:
*SPAM* Email ads
are the most effective
:) SO funny I had to
share. Keep up the great work guys! I'll upgrade one day, I swear! 2.4x
and still rocking!
Chris SanterreSystem Admin"A little nonsense now and
then,
I received a Nigerian spam
today. It was caught, but they have definitely mutated it beyond logic. Here is
the kicker part:
"I must use
thisopportunity to implore you to exercise the utmostindulgence to keep
this matter extraordinaryconfidential, whatever your decision, while
Iawait your
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
Sent: Monday, June 16, 2003 3:21 PM
To: Christopher Eykamp
Cc: Chris Santerre; Spamassassin-Talk (E-mail); [EMAIL PROTECTED]
Subject: Re: [SAtalk] New type of generic rule.
Christopher Eykamp said
-Original Message-
From: Jonathan Vanasco [mailto:[EMAIL PROTECTED]
Sent: Wednesday, June 18, 2003 12:38 PM
To: Jim Ford
Cc: [EMAIL PROTECTED]
Subject: Re: [SAtalk] We TEACH you how to SPAM and make a Fortune!!
I've been looking at Sugarplum spam poison and
teergrube/tar
-Original Message-
From: Theo Van Dinter [mailto:[EMAIL PROTECTED]
Sent: Thursday, June 19, 2003 1:23 PM
To: Chris Santerre
Cc: Spamassassin-Talk (E-mail)
Subject: Re: [SAtalk] Question on XSPAM report in header.
On Thu, Jun 19, 2003 at 01:04:17PM -0400, Chris Santerre wrote
but reduce it to maybe 3. Just to see what kinds of hits I get.
What does the 's', in /is do anyway? I never used it.
Oh and Tony, I'm using 2.43 :p
Chris Santerre
System Admin
You should never, never doubt what nobody is sure about.- Willy Wonka
OK, I've had some problems
tagging this repetitive spam. I'm using SA 2.43 (quiet you!) :)
I'm getting excellent
results! But this one has got me goofy. It simply skips some of my rules!! I'm
not sure why. In the header you can see it hits MY_DSL which is a header rule.
But I have a
-Original Message-
From: satalk [mailto:[EMAIL PROTECTED]
Sent: Monday, June 23, 2003 11:31 AM
To: Chris Santerre
Cc: Spamassassin-Talk (E-mail)
Subject: Re: [SAtalk] BASE64_ENC_TEXT skipping rules???
On Mon, 2003-06-23 at 16:07, Chris Santerre wrote:
OK, I've had some
-Original Message-
From: Matt Kettler [mailto:[EMAIL PROTECTED]
Sent: Monday, June 23, 2003 12:04 PM
To: Chris Santerre; Spamassassin-Talk (E-mail)
Subject: Re: [SAtalk] BASE64_ENC_TEXT skipping rules???
At 11:07 AM 6/23/2003 -0400, Chris Santerre wrote:
OK, I've had some
-Original Message-
From: Link, Pete [mailto:[EMAIL PROTECTED]
Sent: Tuesday, June 24, 2003 12:58 PM
To: [EMAIL PROTECTED]
Subject: [SAtalk] Spamassassin
I am looking for help with Spamassassin...
My spamassassin still allows quite a few SPAMs to the owner of the
company...
-Original Message-
From: Alan Leghart [mailto:[EMAIL PROTECTED]
Sent: Tuesday, June 24, 2003 7:27 PM
To: [EMAIL PROTECTED]
Subject: RE: [SPAM] [SAtalk] spamassassin-talk get you hacker
toolz here
cwgh
--On Tuesday, June 24, 2003 7:12 PM -0400 Bill
[EMAIL PROTECTED]
-Original Message-
From: Tony Earnshaw [mailto:[EMAIL PROTECTED]
Sent: Wednesday, June 25, 2003 11:06 AM
To: [EMAIL PROTECTED]
Subject: [SAtalk] I'm fed up with Viagra spam ...
... time for new spam types.
What's more, I'm in a vile mood today.
Many spammers follow this
\w is a word
correct?
Is this
right:?
/(build(ing)?|increase|more) \w?wealth/i
should hit "building real
weatlh" ?
Or is it just easier to
write:
/(build(ing)?|increase|more).{1,10}wealth/i
Chris SanterreSystem Admin"A little nonsense now and
then, is relished by the wisest men."-
-Original Message-
From: Theo Van Dinter [mailto:[EMAIL PROTECTED]
Sent: Wednesday, June 25, 2003 11:31 AM
To: Chris Santerre
Cc: Spamassassin-Talk (E-mail)
Subject: Re: [SAtalk] quick regex question for rules
On Wed, Jun 25, 2003 at 11:17:33AM -0400, Chris Santerre wrote
-Original Message-
From: Charles Mount [mailto:[EMAIL PROTECTED]
Sent: Wednesday, June 25, 2003 1:48 PM
To: [EMAIL PROTECTED]
Cc: [EMAIL PROTECTED]
Subject: Re: [SAtalk] URI rule -- how big?
PLEASE DO NOT REPLY UNLESS YOU CAN ANSWER THE QUESTION.
I have a working
/pcre
LOL, I sometimes think I'm TOO MUCH of a security nut! No FTP in or out to
this box. :)
I'll get it today. THanks! Doesn't everyone lockdown their email servers
tight as a frog's bum? :)
Best,
Tony
Thanks again Tony. This should reduce my number of quick question posts ;)
Chris
I checked sarc.com but
nothing on it. I heard this on a car board I am on. Any
truth?
"Just a note of
warning... For the last couple of weeks, I have been getting "connection
refused" errors on my Win XP computer at home any time I tried to access web
pages. I got the message on 3Si, SBN,
a few more I can't remember. But each has its own rule, with just
about every possibilty of OBFU I could come up with. Chances are if they
have other words OBFU'd, they have these already. So I hit most with just
these famous few.
HTH
Chris Santerre
System Admin
You should never, never doubt what
-Original Message-
From: Iago [mailto:[EMAIL PROTECTED]
Sent: Tuesday, July 01, 2003 10:16 AM
To: [EMAIL PROTECTED]
Subject: [SAtalk] spamd simply replaces spamassassin? don't think so
I'm running perl 5.8, spamassassin 2.55, solaris 2.7,
postfix 2.something (latest
How does 2.60 deal with the
embeddedbase 64 encoded text trick? I up'd the score overnight to see what
would happen and hit a ton of FPs. I'm still using 2.43, but you all knew that
already :)
Does it look for the double
embedded entry? I'm tagging everything but these pains, because the
I got a very interesting FP
this morning. Korean emails usually give me a tough time with FPs, but this one
had something different. The email came from a domain hosted on
kpost.com.
No biggy. web2.kpost.com is
a webmail interface. Now I have a rule that looks for Width and Height to be
the time.
Chris Santerre
System Admin
You should never, never doubt what nobody is sure about.- Willy Wonka
---
This SF.Net email sponsored by: Free pre-built ASP.NET sites including
Data Reports, E-commerce, Portals, and Forums are available
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
Sent: Tuesday, July 08, 2003 12:09 AM
To: Alain Fauconnet
Cc: [EMAIL PROTECTED]; [EMAIL PROTECTED];
[EMAIL PROTECTED]
Subject: Re: [SAtalk] How to do? Linux/Spam Assasin running
as a gateway
spam filter f or
things between the two. This should also
reduce FPs.
YMMV, HTH
Chris Santerre
System Admin
A little nonsense now and then, is relished by the wisest men. - Willy
Wonka
---
This SF.Net email sponsored by: Free pre-built ASP.NET sites
-Original Message-
From: Theo Van Dinter [mailto:[EMAIL PROTECTED]
Sent: Tuesday, July 08, 2003 10:47 AM
To: Rhett Gibson
Cc: [EMAIL PROTECTED]
Subject: Re: [SAtalk] No Hits higher than Required Hits but Not marked
as SPAM
On Tue, Jul 08, 2003 at 09:24:42AM -0500, Rhett
Did my list
give you the rule writing sickness Bill? ;)
I'min
for a rule forum for sure! I just keep writing more rules every week. But to
make it separate will not work. The SA developers should be part of the
discussion, as they may have better insight as to what the next SA ruleset will
-Original Message-
From: David Watson [mailto:[EMAIL PROTECTED]
Sent: Wednesday, July 09, 2003 10:36 AM
To: [EMAIL PROTECTED]
Subject: [SAtalk] Missed Spam samples
My site has been receiving some odd spam with little to no content,
increasing amounts over the last fortnight
Cnet has this
article:
http://news.com.com/2100-1028-1023740.html?part=dhttag=ntop
Lawmakers are debating and
opt-in vs.opt-out. Why is opt-out retarded?
Hi I'm abc spam inc! Buy my
junk.don't want, well then opt-out here.
*opts-out* spammer gets
confirmation of email and someone
of the rules. Like
looking for multiple instances of the rule.
It is easy to write a rule for some of the better knowns ones like
/(f|ph)(o|0)t(o|0)/i
but with all the ways of doing OBFU it would be kind of big.
Your spam was a nice example.
HTH
Chris Santerre
System Admin
You should never
-Original Message-
From: VonEssen, John [mailto:[EMAIL PROTECTED]
Sent: Thursday, July 10, 2003 12:58 PM
To: [EMAIL PROTECTED]
Subject: [SAtalk] spam with no body...
I have been seeing this sort of spam come up on several different mail
servers I work on.
The email is
-Original Message-
From: Raul Dias [mailto:[EMAIL PROTECTED]
Sent: Thursday, July 10, 2003 4:03 PM
To: [EMAIL PROTECTED]
Subject: [SAtalk] How to balance new rules for hams that
looks like spam
Hi,
Now I am facing a problem with hams.
Some advertising mails are
-Original Message-
From: David B Funk [mailto:[EMAIL PROTECTED]
Sent: Thursday, July 10, 2003 6:15 PM
To: Chris Santerre
Cc: 'German Staltari'; [EMAIL PROTECTED]
Subject: RE: [SAtalk] tricky spam
On Thu, 10 Jul 2003, Chris Santerre wrote:
I had a rule note on this from
-Original Message-
From: David B Funk [mailto:[EMAIL PROTECTED]
Sent: Friday, July 11, 2003 12:38 PM
To: Chris Santerre
Cc: Spamassassin-Talk (E-mail)
Subject: RE: [SAtalk] tricky spam
On Fri, 11 Jul 2003, Chris Santerre wrote:
Usually write it like, /(f|ph)ot0|(f|ph)0to/i
Message-
From: Rick Macdougall [mailto:[EMAIL PROTECTED]
Sent: Tuesday, July 15, 2003 11:37 AM
To: Chris Santerre
Cc: Spamassassin-Talk (E-mail)
Subject: Re: [SAtalk] (OT) DSL/DIALUP manual BL Catch 22
Hi,
My list does exactly that... but... I am very selective about what
ISP's get
-Original Message-
From: Alan Leghart [mailto:[EMAIL PROTECTED]
Sent: Thursday, July 17, 2003 9:03 PM
To: Chris Santerre
Cc: Spamassassin-Talk (E-mail)
Subject: RE: [SAtalk] (OT) DSL/DIALUP manual BL Catch 22
--On Wednesday, July 16, 2003 9:56 AM -0400 Chris Santerre
[EMAIL
I have been contemplating putting together a few web pages of collected
custom rules. Lots of times looking at other rules will help people learn
how to write them. I just have been real busy now. Any interest in seeing a
quick and dirty site?
I was going to break down rules into pages of header,
-Original Message-
From: Michael W. Cocke [mailto:[EMAIL PROTECTED]
Sent: Wednesday, July 23, 2003 7:43 AM
To: [EMAIL PROTECTED]
Subject: [SAtalk] Rule problem
Everytime I think I'm starting to understand this thing... GR.
Could come kind person tell me what I'm doing
Ok, I did it real quick.
Web site with a bunch of rules is up. Please send me your rules! I have rules
from people but I don't have permission to post to web. So If you send them to
me I will add them and give you credit.
The more the better! I'm
already working on the next version
You are denying a message I sent to the spamassassin list and you! You are
denying it because it looks like spam! Please don't do this for posts to the
SA list or direct replies to you from a post you made on the SA list, or 90%
of the reply/posts will be denied!
CC'd to the list so that others
continue to use SAtalk? I think we should. Maybe
just put [RD] in the subject for rule discussion?
I did the wiki thing, That
is kinda cool ;)
Chris Santerre System
Admin and SA Custom Rules Emporium Keeper http://www.merchantsoverseas.com/wwwroot/gorilla/sa_rules.htm
"A little nonsens
Something like this:
header MY_PLAYING_CARDS Subject =~ /pl(a|\@)ying.?c(a|\@)rds?/i
describe MY_PLAYING_CARDS Talks about playing cards in Subject
score MY_PLAYING_CARDS 1.0
Chris Santerre
System Admin and SA Custom Rules Emporium Keeper
http://www.merchantsoverseas.com/wwwroot/gorilla
-Original Message-
From: Kai MacTane [mailto:[EMAIL PROTECTED]
Sent: Friday, July 25, 2003 11:56 AM
To: [EMAIL PROTECTED]
Subject: Re: [SAtalk] [RD] rule discussion
At 7/25/03 07:09 AM , Chris Santerre wrote:
Well I've done another update on the rules site. Some great rules
there are about 5 different ways of
looking at this messege and figuring out how to catch it. I just don't want
start it here until I get a word from the list admin we can start doing
that.
Chris Santerre
System Admin and SA Custom Rules Emporium keeper
http://www.merchantsoverseas.com/wwwroot
/gorilla/tips.htm
Lots more to come, thanks to this great community. Thanks for the word on
the rule discussion JM. [RD] will do great!
Chris Santerre
System Admin and SA Custom Rules Emporium keeper
http://www.merchantsoverseas.com/wwwroot/gorilla/sa_rules.htm
A little nonsense now
describe MY_NO_QU Q without a U
score MY_NO_QU .5
Chris Santerre
System Admin and SA Custom Rules Emporium keeper
http://www.merchantsoverseas.com/wwwroot/gorilla/sa_rules.htm
A little nonsense now and then, is relished by the wisest men. - Willy
Wonka
-Original Message-
From
to be from spammers! So
I'm watching it closely.
Chris Santerre
System Admin and SA Custom Rules Emporium keeper
http://www.merchantsoverseas.com/wwwroot/gorilla/sa_rules.htm
A little nonsense now and then, is relished by the wisest men. - Willy
Wonka
-Original Message-
From: Robert
in it.
That might be what you're looking for.
Chris Santerre
System Admin and SA Custom Rules Emporium keeper
http://www.merchantsoverseas.com/wwwroot/gorilla/sa_rules.htm
A little nonsense now and then, is relished by the wisest men. - Willy
Wonka
be an rootes machine. No biggy, just
interesting they started the other day.
Anyone else ever get this after contributing? Devs?
Chris Santerre
System Admin and SA Custom Rules Emporium keeper
http://www.merchantsoverseas.com/wwwroot/gorilla/sa_rules.htm
A little nonsense now and then, is relished
[mailto:[EMAIL PROTECTED]
Sent: Tuesday, July 29, 2003 4:59 PM
To: Chris Santerre
Cc: Spamassassin-Talk (E-mail); William Stearns
Subject: Re: [SAtalk] [OT] Interesting results from emporium :)
Good afternoon, Chris,
On Tue, 29 Jul 2003, Chris Santerre wrote:
It seems that since
chars together
score MY_OBFU_MISC .33
Chris Santerre
System Admin and SA Custom Rules Emporium keeper
http://www.merchantsoverseas.com/wwwroot/gorilla/sa_rules.htm
A little nonsense now and then, is relished by the wisest men. - Willy
Wonka
tweak to their own lanquage.
-Original Message-
From: Tom Meunier [mailto:[EMAIL PROTECTED]
Sent: Wednesday, July 30, 2003 10:14 AM
To: Chris Santerre
Subject: RE: [SAtalk] [RD] Random characters in SPAM
Compaq. Ipaq. Iraq. Qatar. I think all of these would be more
common
-Original Message-
From: Gary Lopez [mailto:[EMAIL PROTECTED]
Sent: Tuesday, July 29, 2003 3:42 PM
To: [EMAIL PROTECTED]
Subject: [SAtalk] newbie: SA not catching contents in HTML
Good afternoon,
I'm sure I'm not unique to this, but I have search the
archives and
web
1 - 100 of 528 matches
Mail list logo
