RE: [SAtalk] OOPS! Razor2 Problem Still There!

2003-10-15 Thread Bill Polhemus








Well, a follow-up:



I figgered out that I probably had to remake
and remake install, etc.



Which I then proceeded to do, and then *BOOM!* I get a compile error
on Razor2.



Bear in mind that I had no problem
installing it before. Further bear in mind that I even erased the whole Razor2
source tree, re-downloaded and re-created the tree, put the Razor2.patch onto
the fresh code tree, and STILL got the compile error.



I give up. Im goin to bed.




 
  
  
  
  
  William L. Polhemus, Jr.
  P.E.
  Polhemus Engineering Company
  Katy, Texas USA
  
 









image001.jpg

RE: [SAtalk] Oops... running 2.60

2003-07-28 Thread Tony Hoyle
 -Original Message-
 From: Kai MacTane [mailto:[EMAIL PROTECTED] 
 Sent: 25 July 2003 17:34
 To: [EMAIL PROTECTED]
 Subject: RE: [SAtalk] Oops... running 2.60
 

 Actually, I doubt those BAYES_00 hits are doing you much 
 good, either. If 
 messages like these trigger BAYES_00, I have to wonder if 
 there's something 
 wrong with your Bayes tokens/db/etc.
 
I wipe the bayes db every couple of weeks to avoid this (over time
it starts giving more and more FNs).  I wiped it again just after 
sending the message, so it'll take a little while before the BAYES_00
creeps back again.

I went to 2.60 because there was more spam getting through than getting caught
with 2.55.  2.60 is still about 75% effective, so it's still useful.  Those HTML only 
spams
are a complete git though (I had 50 of them in my inbox this morning...  Ended up 
deleting the
entire inbox and emailing people to resend if they had something I needed to see, 
which is what I used to
have to do before SA existed).

Interestingly 2.60 seems to be missing the scoring of some spams altogether...
I think they're exceeding the spam size threshold - eg. the spam below got a zero 
(it's actually a viagra
advert...  I'd not expect SA to tell from the text, though).

I'm half tempted to go with a draconian solution like TMDA to get around this, since 
it seems the spammers
are starting to win :(

Tony

Microsoft Mail Internet Headers Version 2.0
Received: from mail.magenta-netlogic.com ([192.168.1.2]) by ireland.local.mnl with 
Microsoft SMTPSVC(5.0.2195.5329);
 Mon, 28 Jul 2003 03:37:52 +0100
Received: by mail.magenta-netlogic.com (Postfix)
id 6A4C9BFA0E; Mon, 28 Jul 2003 03:37:52 +0100 (BST)
Delivered-To: [EMAIL PROTECTED]
Received: from localhost (localhost [127.0.0.1])
by mail.magenta-netlogic.com (Postfix) with ESMTP
id A7AADBFA14; Mon, 28 Jul 2003 03:37:51 +0100 (BST)
Received: from mail.magenta-netlogic.com ([127.0.0.1])
 by localhost (betty.magenta-netlogic.com [127.0.0.1]) (amavisd-new, port 10024)
 with LMTP id 14922-01; Mon, 28 Jul 2003 03:37:51 +0100 (BST)
Received: from mail.nodomain.org (sisko.nodomain.org [213.208.99.114])
by mail.magenta-netlogic.com (Postfix) with ESMTP
id DA73BBFA0E; Mon, 28 Jul 2003 03:37:46 +0100 (BST)
Received: from localhost (localhost [127.0.0.1])
by mail.nodomain.org (Postfix) with ESMTP
id EE9A7E13C1; Mon, 28 Jul 2003 03:37:44 +0100 (BST)
Received: from mail.nodomain.org ([127.0.0.1])
 by localhost (sisko.local.nodomain.org [127.0.0.1]) (amavisd-new, port 10024)
 with LMTP id 19963-05-3; Mon, 28 Jul 2003 03:37:44 +0100 (BST)
Received: from 188.red-213-98-37.pooles.rima-tde.net 
(188.Red-213-98-37.pooles.rima-tde.net [213.98.37.188])
by mail.nodomain.org (Postfix) with SMTP
id A7E6CE124B; Mon, 28 Jul 2003 03:36:13 +0100 (BST)
Received: from dw.0a7e.org ([61.34.60.204]) by 188.red-213-98-37.pooles.rima-tde.net 
with ESMTP id 81594796; Mon, 28 Jul 2003 03:28:52 +
Message-ID: [EMAIL PROTECTED]
From: Angelita Knowles [EMAIL PROTECTED]
To: [EMAIL PROTECTED], [EMAIL PROTECTED],
[EMAIL PROTECTED], [EMAIL PROTECTED],
[EMAIL PROTECTED]
Subject: bohst fackplate ijg
Date: Mon, 28 Jul 03 03:28:52 GMT
X-Mailer: Internet Mail Service (5.5.2650.21)
MIME-Version: 1.0
Content-Type: multipart/related;
type=multipart/alternative;
boundary=8.C0D3A.2_B6AA._0.3A6F
X-Priority: 3
X-MSMail-Priority: Normal
X-Virus-Scanned: by amavisd-new-20030314-p2 (Debian)
X-Virus-Scanned: by amavisd-new-20030616-p3 (Debian)
X-Spam-Status: No, hits=0.0 tagged_above=-1.0 required=5.0 
X-Spam-Level: 
Return-Path: [EMAIL PROTECTED]
X-OriginalArrivalTime: 28 Jul 2003 02:37:52.0602 (UTC) FILETIME=[3E339BA0:01C354B1]

--8.C0D3A.2_B6AA._0.3A6F
Content-Type: multipart/alternative;
boundary=8.C0D3A.2CE6AA._0.3A6F

--8.C0D3A.2CE6AA._0.3A6F
Content-Type: text/html;
Content-Transfer-Encoding: quoted-printable


--8.C0D3A.2CE6AA._0.3A6F--
--8.C0D3A.2_B6AA._0.3A6F
Content-Type: image/jpeg;
name=phrtrt.jpg
Content-Transfer-Encoding: base64
Content-ID: phrtrt.jpg

--8.C0D3A.2_B6AA._0.3A6F
Content-Type: image/jpeg;
name=phdm.gif
Content-Transfer-Encoding: base64
Content-ID: phdm.gif

--8.C0D3A.2_B6AA._0.3A6F
Content-Type: image/jpeg;
name=pheww.jpg
Content-Transfer-Encoding: base64
Content-ID: pheww.jpg

--8.C0D3A.2_B6AA._0.3A6F
Content-Type: image/jpeg;
name=phover.jpg
Content-Transfer-Encoding: base64
Content-ID: phover.jpg

--8.C0D3A.2_B6AA._0.3A6F
Content-Type: image/jpeg;
name=phqweq.jpg
Content-Transfer-Encoding: base64
Content-ID: phqweq.jpg

--8.C0D3A.2_B6AA._0.3A6F
Content-Type: image/jpeg;
name=phvwer.jpg
Content-Transfer-Encoding: base64
Content-ID: phvwer.jpg

--8.C0D3A.2_B6AA._0.3A6F
Content-Type: image/jpeg;
name=phwrer.jpg
Content-Transfer-Encoding: base64
Content-ID: phwrer.jpg


--8.C0D3A.2_B6AA._0.3A6F

RE: [SAtalk] Oops... running 2.60

2003-07-28 Thread Kai MacTane
At 7/28/03 05:21 AM , Tony Hoyle wrote:
I wipe the bayes db every couple of weeks to avoid this (over time
it starts giving more and more FNs).  I wiped it again just after
sending the message, so it'll take a little while before the BAYES_00
creeps back again.
I had the same problem with Bayes... eventually, I just turned it off.

Interestingly 2.60 seems to be missing the scoring of some spams altogether...
I think they're exceeding the spam size threshold - eg. the spam below got 
a zero (it's actually a viagra advert...  I'd not expect SA to tell from 
the text, though).
Yeah, by default it skips messages over 256K. Judging by the number of JPGs 
referenced in the text, I'd guess the message was too big.

--Kai MacTane
--
And when I squinted/The world seemed rose-tinted;
 Angels appeared to descend...
--Depeche Mode,
 Waiting for the Night


---
This SF.Net email sponsored by: Free pre-built ASP.NET sites including
Data Reports, E-commerce, Portals, and Forums are available now.
Download today and enter to win an XBOX or Visual Studio .NET.
http://aspnet.click-url.com/go/psa0013ave/direct;at.aspnet_072303_01/01
___
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk


RE: [SAtalk] Oops... running 2.60

2003-07-28 Thread Simon Byrnand
At 13:21 28/07/2003 +0100, Tony Hoyle wrote:
 -Original Message-
 From: Kai MacTane [mailto:[EMAIL PROTECTED]
 Sent: 25 July 2003 17:34
 To: [EMAIL PROTECTED]
 Subject: RE: [SAtalk] Oops... running 2.60


 Actually, I doubt those BAYES_00 hits are doing you much
 good, either. If
 messages like these trigger BAYES_00, I have to wonder if
 there's something
 wrong with your Bayes tokens/db/etc.

I wipe the bayes db every couple of weeks to avoid this (over time
it starts giving more and more FNs).  I wiped it again just after
sending the message, so it'll take a little while before the BAYES_00
creeps back again.
I went to 2.60 because there was more spam getting through than getting caught
with 2.55.  2.60 is still about 75% effective, so it's still 
useful.  Those HTML only spams
are a complete git though (I had 50 of them in my inbox this 
morning...  Ended up deleting the
entire inbox and emailing people to resend if they had something I needed 
to see, which is what I used to
have to do before SA existed).
So you're saying that 2.55 was catching less than 50% of your spam ?

Honestly, you must have something wrong with your setup causing that, 
theres no way that SA's hit rate is that poor. Here we're getting at least 
95% detected, and thats with a threshold of 7.0 instead of the default 5.0

If you're wiping the bayes database every couple of weeks then that wont be 
helping either. You need to find out why it is giving you FN's perhaps you 
don't have suitable autolearn thresholds.

Try using check_bayes_db and browse through the token database to see if 
anything strange is being learnt, and/or run some troublesome spams through 
spamassassin in debug mode to see what tokens are being scored, and in 
which direction...

Another thing you could try is turn autolearning off and learn the biggest 
bunch of spam and ham you can and see how you go.

If you're wiping your bayes database all the time and then letting it learn 
again, then until it has autolearnt 200 hams and 200 spams you're not using 
bayes, and in my experience SA with bayes disabled is MUCH worse.

Also, are you using RBL checks and DCC, Razor, Pyzor ?

If you're not, that could easily explain your poor hit rate especially with 
HTML only spams - to catch those effectively you really need the RBL checks 
and DCC, Razor, and Pyzor all working...

Regards,
Simon


---
This SF.Net email sponsored by: Free pre-built ASP.NET sites including
Data Reports, E-commerce, Portals, and Forums are available now.
Download today and enter to win an XBOX or Visual Studio .NET.
http://aspnet.click-url.com/go/psa0013ave/direct;at.aspnet_072303_01/01
___
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk


Re: [SAtalk] Oops... running 2.60

2003-07-26 Thread Martin Radford
At Fri Jul 25 16:42:09 2003, Tony Hoyle wrote: [reformatted]

 I've found 2.60 is a generaly bit better than 2.55, but recently the
 spammers have worked around it... I now get about a couple of dozen
 spams a day coming in with ridiculously low scores (2, usually) -
 they're heavily exploiting the low scoring HTML_IMAGE_ONLY rules*
 
 I'd expect 2.55 will have been so thoroughly worked around now as to
 be nearly useless, if 2.60 is being beaten so quickly..

Correct me if I'm wrong, but:

(1) 2.60 is still a CVS version - it has not been released.
(2) Only one set of mass-checks has been done, so the scoring for 2.60
has not been done yet.  Once those have been done, there may well be
significant differences in the scores received by any given mail.

Martin
-- 
Martin Radford  |   Only wimps use tape backup: _real_ 
[EMAIL PROTECTED] | men just upload their important stuff  -o)
Registered Linux user #9257 |  on ftp and let the rest of the world  /\\
- see http://counter.li.org |   mirror it ;)  - Linus Torvalds _\_V


---
This SF.Net email sponsored by: Free pre-built ASP.NET sites including
Data Reports, E-commerce, Portals, and Forums are available now.
Download today and enter to win an XBOX or Visual Studio .NET.
http://aspnet.click-url.com/go/psa0013ave/direct;at.aspnet_072303_01/01
___
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk


RE: [SAtalk] Oops... running 2.60

2003-07-25 Thread Tony Hoyle
 -Original Message-
 From: Colin Henein [mailto:[EMAIL PROTECTED] 
 Sent: 24 July 2003 17:32
 To: [EMAIL PROTECTED]
 Subject: [SAtalk] Oops... running 2.60
 
 
 Greetings all,
 
 I've been running 2.60 for several months (must have picked 
 the wrong download back there somewhere). 
 
 I haven't been having any problems, but I wanted to know if 
 I'd be getting better filtering with 2.55. Not sure how the 
 rule tuning works, and whether I'm better off with the 2.60 
 ruleset (more modern) or the 2.55 ruleset (better tuned?).
 
 Should I step back to 2.55?
 
I've found 2.60 is a generaly bit better than 2.55, but recently the spammers have
worked around it... I now get about a couple of dozen spams a day coming in with
ridiculously low scores (2, usually) - they're heavily exploiting the low scoring 
HTML_IMAGE_ONLY rules*

I'd expect 2.55 will have been so thoroughly worked around now as to be nearly useless,
if 2.60 is being beaten so quickly..

Tony

* 3 examples I got in the last hour:

X-Spam-Status: No, hits=1.5 tagged_above=-1.0 required=5.0
 tests=FORGED_RCVD_HELO, HTML_50_60, HTML_IMAGE_ONLY_08, HTML_LINK_CLICK_HERE,
 HTML_MESSAGE, HTML_TITLE_EMPTY, MSGID_FROM_MTA_LATER

X-Spam-Status: No, hits=-2.7 tagged_above=-1.0 required=5.0
 tests=BAYES_00, EXCUSE_3, HTML_40_50, HTML_IMAGE_ONLY_12,
 HTML_IMAGE_RATIO_06, HTML_MESSAGE, HTML_WITH_BGCOLOR, NORMAL_HTTP_TO_IP,
 RAZOR2_CF_RANGE_11_50, RAZOR2_CHECK

X-Spam-Status: No, hits=0.6 tagged_above=-1.0 required=5.0 tests=BAYES_00,
 DATE_IN_FUTURE_12_24, HTML_50_60, HTML_IMAGE_ONLY_04, HTML_MESSAGE,
 HTML_WEB_BUGS, MAILTO_LINK, MIME_HTML_ONLY, PORN_4




---
This SF.Net email sponsored by: Free pre-built ASP.NET sites including
Data Reports, E-commerce, Portals, and Forums are available now.
Download today and enter to win an XBOX or Visual Studio .NET.
http://aspnet.click-url.com/go/psa0013ave/direct;at.aspnet_072303_01/01
___
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk


RE: [SAtalk] Oops... running 2.60

2003-07-25 Thread Kai MacTane
At 7/25/03 08:42 AM , Tony Hoyle wrote:
I've found 2.60 is a generaly bit better than 2.55, but recently the 
spammers have worked around it... I now get about a couple of dozen spams 
a day coming in with ridiculously low scores (2, usually) - they're 
heavily exploiting the low scoring HTML_IMAGE_ONLY rules*
[snip]

X-Spam-Status: No, hits=-2.7 tagged_above=-1.0 required=5.0
 tests=BAYES_00, EXCUSE_3, HTML_40_50, HTML_IMAGE_ONLY_12,
 HTML_IMAGE_RATIO_06, HTML_MESSAGE, HTML_WITH_BGCOLOR, NORMAL_HTTP_TO_IP,
 RAZOR2_CF_RANGE_11_50, RAZOR2_CHECK
X-Spam-Status: No, hits=0.6 tagged_above=-1.0 required=5.0 tests=BAYES_00,
 DATE_IN_FUTURE_12_24, HTML_50_60, HTML_IMAGE_ONLY_04, HTML_MESSAGE,
 HTML_WEB_BUGS, MAILTO_LINK, MIME_HTML_ONLY, PORN_4
Actually, I doubt those BAYES_00 hits are doing you much good, either. If 
messages like these trigger BAYES_00, I have to wonder if there's something 
wrong with your Bayes tokens/db/etc.

--Kai MacTane
--
In another life I see you/As an angel flying high,
 And the hands of time will free you/You will cast your chains aside,
 And the dawn will come and kiss away
 Every tear that's ever fallen from your eyes...
--Concrete Blonde,
 Caroline


---
This SF.Net email sponsored by: Free pre-built ASP.NET sites including
Data Reports, E-commerce, Portals, and Forums are available now.
Download today and enter to win an XBOX or Visual Studio .NET.
http://aspnet.click-url.com/go/psa0013ave/direct;at.aspnet_072303_01/01
___
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk


Re: [SAtalk] Oops

2003-06-16 Thread Jonathan Nichols

Sorry about that, folks.  I should learn to drink more caffinated beverages
by the afternoon... but what's the likelihood of that? :-)
With cool places like http://www.wholelattelove.com - it's very likely! 
Trust me, I did it! ;)





---
This SF.NET email is sponsored by: eBay
Great deals on office technology -- on eBay now! Click here:
http://adfarm.mediaplex.com/ad/ck/711-11697-6916-5
___
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk


Re: [SAtalk] Oops

2003-06-16 Thread Benjamin A. Shelton
 With cool places like http://www.wholelattelove.com - it's very likely! 
 Trust me, I did it! ;)

Haha!  There is hope!  *grins*



---
This SF.NET email is sponsored by: eBay
Great deals on office technology -- on eBay now! Click here:
http://adfarm.mediaplex.com/ad/ck/711-11697-6916-5
___
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk


Re: [SAtalk] Oops!

2002-06-02 Thread Craig R Hughes

If you look at a bug in bugzilla, in the header info at the top of the ticket,
there's a link that says Create an attachment.  Click that, then follow the
directions.

C

Olivier Nicole wrote:

ON Olivier, could you attach the new file to a bugzilla ticket?  It's hard to
ON extract from your original email.
ON
ON That's what I though, how to *attach* anything in bugzilla? I see
ON nowhere mention of such attachement.
ON
ON I understood that it was not supposed to be dumped in the
ON Description: textarea, so what?


___

Don't miss the 2002 Sprint PCS Application Developer's Conference
August 25-28 in Las Vegas -- http://devcon.sprintpcs.com/adp/index.cfm

___
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk



Re: [SAtalk] Oops!

2002-06-01 Thread Craig R Hughes

Olivier, could you attach the new file to a bugzilla ticket?  It's hard to
extract from your original email.

Thanks,

C

Olivier Nicole wrote:

ON
ON There was a typo in this one, I missed the 96
ON
ON lang fr describe DATE_IN_FUTURE_96_XX   L'entête Date: est plus de 96 heures 
après la date de l'entête Received:
ON
ON Olivier
ON
ON ___
ON
ON Don't miss the 2002 Sprint PCS Application Developer's Conference
ON August 25-28 in Las Vegas -- http://devcon.sprintpcs.com/adp/index.cfm
ON
ON ___
ON Spamassassin-talk mailing list
ON [EMAIL PROTECTED]
ON https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
ON
ON
ON


___

Don't miss the 2002 Sprint PCS Application Developer's Conference
August 25-28 in Las Vegas -- http://devcon.sprintpcs.com/adp/index.cfm

___
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk