RE: [SAtalk] OOPS! Razor2 Problem Still There!
Well, a follow-up: I figgered out that I probably had to “remake” and “remake install”, etc. Which I then proceeded to do, and then *BOOM!* I get a “compile error” on Razor2. Bear in mind that I had no problem installing it before. Further bear in mind that I even erased the whole Razor2 source tree, re-downloaded and re-created the tree, put the Razor2.patch onto the fresh code tree, and STILL got the compile error. I give up. I’m goin’ to bed. William L. Polhemus, Jr. P.E. Polhemus Engineering Company Katy, Texas USA <>
RE: [SAtalk] Oops... running 2.60
At 13:21 28/07/2003 +0100, Tony Hoyle wrote: > -Original Message- > From: Kai MacTane [mailto:[EMAIL PROTECTED] > Sent: 25 July 2003 17:34 > To: [EMAIL PROTECTED] > Subject: RE: [SAtalk] Oops... running 2.60 > > > Actually, I doubt those BAYES_00 hits are doing you much > good, either. If > messages like these trigger BAYES_00, I have to wonder if > there's something > wrong with your Bayes tokens/db/etc. > I wipe the bayes db every couple of weeks to avoid this (over time it starts giving more and more FNs). I wiped it again just after sending the message, so it'll take a little while before the BAYES_00 creeps back again. I went to 2.60 because there was more spam getting through than getting caught with 2.55. 2.60 is still about 75% effective, so it's still useful. Those HTML only spams are a complete git though (I had >50 of them in my inbox this morning... Ended up deleting the entire inbox and emailing people to resend if they had something I needed to see, which is what I used to have to do before SA existed). So you're saying that 2.55 was catching less than 50% of your spam ? Honestly, you must have something wrong with your setup causing that, theres no way that SA's hit rate is that poor. Here we're getting at least 95% detected, and thats with a threshold of 7.0 instead of the default 5.0 If you're wiping the bayes database every couple of weeks then that wont be helping either. You need to find out why it is giving you FN's perhaps you don't have suitable autolearn thresholds. Try using check_bayes_db and browse through the token database to see if anything strange is being learnt, and/or run some troublesome spams through spamassassin in debug mode to see what tokens are being scored, and in which direction... Another thing you could try is turn autolearning off and learn the biggest bunch of spam and ham you can and see how you go. If you're wiping your bayes database all the time and then letting it learn again, then until it has autolearnt 200 hams and 200 spams you're not using bayes, and in my experience SA with bayes disabled is MUCH worse. Also, are you using RBL checks and DCC, Razor, Pyzor ? If you're not, that could easily explain your poor hit rate especially with HTML only spams - to catch those effectively you really need the RBL checks and DCC, Razor, and Pyzor all working... Regards, Simon --- This SF.Net email sponsored by: Free pre-built ASP.NET sites including Data Reports, E-commerce, Portals, and Forums are available now. Download today and enter to win an XBOX or Visual Studio .NET. http://aspnet.click-url.com/go/psa0013ave/direct;at.aspnet_072303_01/01 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
RE: [SAtalk] Oops... running 2.60
At 7/28/03 05:21 AM , Tony Hoyle wrote: I wipe the bayes db every couple of weeks to avoid this (over time it starts giving more and more FNs). I wiped it again just after sending the message, so it'll take a little while before the BAYES_00 creeps back again. I had the same problem with Bayes... eventually, I just turned it off. Interestingly 2.60 seems to be missing the scoring of some spams altogether... I think they're exceeding the spam size threshold - eg. the spam below got a zero (it's actually a viagra advert... I'd not expect SA to tell from the text, though). Yeah, by default it skips messages over 256K. Judging by the number of JPGs referenced in the text, I'd guess the message was too big. --Kai MacTane -- "And when I squinted/The world seemed rose-tinted; Angels appeared to descend..." --Depeche Mode, "Waiting for the Night" --- This SF.Net email sponsored by: Free pre-built ASP.NET sites including Data Reports, E-commerce, Portals, and Forums are available now. Download today and enter to win an XBOX or Visual Studio .NET. http://aspnet.click-url.com/go/psa0013ave/direct;at.aspnet_072303_01/01 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
RE: [SAtalk] Oops... running 2.60
> -Original Message- > From: Kai MacTane [mailto:[EMAIL PROTECTED] > Sent: 25 July 2003 17:34 > To: [EMAIL PROTECTED] > Subject: RE: [SAtalk] Oops... running 2.60 > > > Actually, I doubt those BAYES_00 hits are doing you much > good, either. If > messages like these trigger BAYES_00, I have to wonder if > there's something > wrong with your Bayes tokens/db/etc. > I wipe the bayes db every couple of weeks to avoid this (over time it starts giving more and more FNs). I wiped it again just after sending the message, so it'll take a little while before the BAYES_00 creeps back again. I went to 2.60 because there was more spam getting through than getting caught with 2.55. 2.60 is still about 75% effective, so it's still useful. Those HTML only spams are a complete git though (I had >50 of them in my inbox this morning... Ended up deleting the entire inbox and emailing people to resend if they had something I needed to see, which is what I used to have to do before SA existed). Interestingly 2.60 seems to be missing the scoring of some spams altogether... I think they're exceeding the spam size threshold - eg. the spam below got a zero (it's actually a viagra advert... I'd not expect SA to tell from the text, though). I'm half tempted to go with a draconian solution like TMDA to get around this, since it seems the spammers are starting to win :( Tony Microsoft Mail Internet Headers Version 2.0 Received: from mail.magenta-netlogic.com ([192.168.1.2]) by ireland.local.mnl with Microsoft SMTPSVC(5.0.2195.5329); Mon, 28 Jul 2003 03:37:52 +0100 Received: by mail.magenta-netlogic.com (Postfix) id 6A4C9BFA0E; Mon, 28 Jul 2003 03:37:52 +0100 (BST) Delivered-To: [EMAIL PROTECTED] Received: from localhost (localhost [127.0.0.1]) by mail.magenta-netlogic.com (Postfix) with ESMTP id A7AADBFA14; Mon, 28 Jul 2003 03:37:51 +0100 (BST) Received: from mail.magenta-netlogic.com ([127.0.0.1]) by localhost (betty.magenta-netlogic.com [127.0.0.1]) (amavisd-new, port 10024) with LMTP id 14922-01; Mon, 28 Jul 2003 03:37:51 +0100 (BST) Received: from mail.nodomain.org (sisko.nodomain.org [213.208.99.114]) by mail.magenta-netlogic.com (Postfix) with ESMTP id DA73BBFA0E; Mon, 28 Jul 2003 03:37:46 +0100 (BST) Received: from localhost (localhost [127.0.0.1]) by mail.nodomain.org (Postfix) with ESMTP id EE9A7E13C1; Mon, 28 Jul 2003 03:37:44 +0100 (BST) Received: from mail.nodomain.org ([127.0.0.1]) by localhost (sisko.local.nodomain.org [127.0.0.1]) (amavisd-new, port 10024) with LMTP id 19963-05-3; Mon, 28 Jul 2003 03:37:44 +0100 (BST) Received: from 188.red-213-98-37.pooles.rima-tde.net (188.Red-213-98-37.pooles.rima-tde.net [213.98.37.188]) by mail.nodomain.org (Postfix) with SMTP id A7E6CE124B; Mon, 28 Jul 2003 03:36:13 +0100 (BST) Received: from dw.0a7e.org ([61.34.60.204]) by 188.red-213-98-37.pooles.rima-tde.net with ESMTP id 81594796; Mon, 28 Jul 2003 03:28:52 + Message-ID: <[EMAIL PROTECTED]> From: "Angelita Knowles" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]>, <[EMAIL PROTECTED]>, <[EMAIL PROTECTED]>, <[EMAIL PROTECTED]>, <[EMAIL PROTECTED]> Subject: bohst fackplate ijg Date: Mon, 28 Jul 03 03:28:52 GMT X-Mailer: Internet Mail Service (5.5.2650.21) MIME-Version: 1.0 Content-Type: multipart/related; type="multipart/alternative"; boundary="8.C0D3A.2_B6AA._0.3A6F" X-Priority: 3 X-MSMail-Priority: Normal X-Virus-Scanned: by amavisd-new-20030314-p2 (Debian) X-Virus-Scanned: by amavisd-new-20030616-p3 (Debian) X-Spam-Status: No, hits=0.0 tagged_above=-1.0 required=5.0 X-Spam-Level: Return-Path: [EMAIL PROTECTED] X-OriginalArrivalTime: 28 Jul 2003 02:37:52.0602 (UTC) FILETIME=[3E339BA0:01C354B1] --8.C0D3A.2_B6AA._0.3A6F Content-Type: multipart/alternative; boundary="8.C0D3A.2CE6AA._0.3A6F" --8.C0D3A.2CE6AA._0.3A6F Content-Type: text/html; Content-Transfer-Encoding: quoted-printable --8.C0D3A.2CE6AA._0.3A6F-- --8.C0D3A.2_B6AA._0.3A6F Content-Type: image/jpeg; name="phrtrt.jpg" Content-Transfer-Encoding: base64 Content-ID: --8.C0D3A.2_B6AA._0.3A6F Content-Type: image/jpeg; name="phdm.gif" Content-Transfer-Encoding: base64 Content-ID: --8.C0D3A.2_B6AA._0.3A6F Content-Type: image/jpeg; name="pheww.jpg" Content-Transfer-Encoding: base64 Content-ID: --8.C0D3A.2_B6AA._0.3A6F Content-Type: image/jpeg; name="phover.jpg" Content-Transfer-Encoding: base64 Content-ID: --8.C0D3A.2_B6AA._0.3A6F Content-Type: image/jpeg; name="phqweq.jpg" Content-Transfer-Encoding: base64 Content-ID: --8.C0D3A.2_B6AA._0.3A6F Content-Type: image/jpeg; name="phvwer.jpg" Content-Transfer-Encoding: base64 Content-ID: --8.C0D3A
Re: [SAtalk] Oops... running 2.60
At Fri Jul 25 16:42:09 2003, Tony Hoyle wrote: [reformatted] > I've found 2.60 is a generaly bit better than 2.55, but recently the > spammers have worked around it... I now get about a couple of dozen > spams a day coming in with ridiculously low scores (<2, usually) - > they're heavily exploiting the low scoring HTML_IMAGE_ONLY rules* > > I'd expect 2.55 will have been so thoroughly worked around now as to > be nearly useless, if 2.60 is being beaten so quickly.. Correct me if I'm wrong, but: (1) 2.60 is still a CVS version - it has not been released. (2) Only one set of mass-checks has been done, so the scoring for 2.60 has not been done yet. Once those have been done, there may well be significant differences in the scores received by any given mail. Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTED] | men just upload their important stuff -o) Registered Linux user #9257 | on ftp and let the rest of the world /\\ - see http://counter.li.org | mirror it ;)" - Linus Torvalds _\_V --- This SF.Net email sponsored by: Free pre-built ASP.NET sites including Data Reports, E-commerce, Portals, and Forums are available now. Download today and enter to win an XBOX or Visual Studio .NET. http://aspnet.click-url.com/go/psa0013ave/direct;at.aspnet_072303_01/01 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
RE: [SAtalk] Oops... running 2.60
At 7/25/03 08:42 AM , Tony Hoyle wrote: I've found 2.60 is a generaly bit better than 2.55, but recently the spammers have worked around it... I now get about a couple of dozen spams a day coming in with ridiculously low scores (<2, usually) - they're heavily exploiting the low scoring HTML_IMAGE_ONLY rules* [snip] X-Spam-Status: No, hits=-2.7 tagged_above=-1.0 required=5.0 tests=BAYES_00, EXCUSE_3, HTML_40_50, HTML_IMAGE_ONLY_12, HTML_IMAGE_RATIO_06, HTML_MESSAGE, HTML_WITH_BGCOLOR, NORMAL_HTTP_TO_IP, RAZOR2_CF_RANGE_11_50, RAZOR2_CHECK X-Spam-Status: No, hits=0.6 tagged_above=-1.0 required=5.0 tests=BAYES_00, DATE_IN_FUTURE_12_24, HTML_50_60, HTML_IMAGE_ONLY_04, HTML_MESSAGE, HTML_WEB_BUGS, MAILTO_LINK, MIME_HTML_ONLY, PORN_4 Actually, I doubt those BAYES_00 hits are doing you much good, either. If messages like these trigger BAYES_00, I have to wonder if there's something wrong with your Bayes tokens/db/etc. --Kai MacTane -- "In another life I see you/As an angel flying high, And the hands of time will free you/You will cast your chains aside, And the dawn will come and kiss away Every tear that's ever fallen from your eyes... --Concrete Blonde, "Caroline" --- This SF.Net email sponsored by: Free pre-built ASP.NET sites including Data Reports, E-commerce, Portals, and Forums are available now. Download today and enter to win an XBOX or Visual Studio .NET. http://aspnet.click-url.com/go/psa0013ave/direct;at.aspnet_072303_01/01 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
RE: [SAtalk] Oops... running 2.60
> -Original Message- > From: Colin Henein [mailto:[EMAIL PROTECTED] > Sent: 24 July 2003 17:32 > To: [EMAIL PROTECTED] > Subject: [SAtalk] Oops... running 2.60 > > > Greetings all, > > I've been running 2.60 for several months (must have picked > the wrong download back there somewhere). > > I haven't been having any problems, but I wanted to know if > I'd be getting better filtering with 2.55. Not sure how the > rule tuning works, and whether I'm better off with the 2.60 > ruleset (more modern) or the 2.55 ruleset (better tuned?). > > Should I step back to 2.55? > I've found 2.60 is a generaly bit better than 2.55, but recently the spammers have worked around it... I now get about a couple of dozen spams a day coming in with ridiculously low scores (<2, usually) - they're heavily exploiting the low scoring HTML_IMAGE_ONLY rules* I'd expect 2.55 will have been so thoroughly worked around now as to be nearly useless, if 2.60 is being beaten so quickly.. Tony * 3 examples I got in the last hour: X-Spam-Status: No, hits=1.5 tagged_above=-1.0 required=5.0 tests=FORGED_RCVD_HELO, HTML_50_60, HTML_IMAGE_ONLY_08, HTML_LINK_CLICK_HERE, HTML_MESSAGE, HTML_TITLE_EMPTY, MSGID_FROM_MTA_LATER X-Spam-Status: No, hits=-2.7 tagged_above=-1.0 required=5.0 tests=BAYES_00, EXCUSE_3, HTML_40_50, HTML_IMAGE_ONLY_12, HTML_IMAGE_RATIO_06, HTML_MESSAGE, HTML_WITH_BGCOLOR, NORMAL_HTTP_TO_IP, RAZOR2_CF_RANGE_11_50, RAZOR2_CHECK X-Spam-Status: No, hits=0.6 tagged_above=-1.0 required=5.0 tests=BAYES_00, DATE_IN_FUTURE_12_24, HTML_50_60, HTML_IMAGE_ONLY_04, HTML_MESSAGE, HTML_WEB_BUGS, MAILTO_LINK, MIME_HTML_ONLY, PORN_4 --- This SF.Net email sponsored by: Free pre-built ASP.NET sites including Data Reports, E-commerce, Portals, and Forums are available now. Download today and enter to win an XBOX or Visual Studio .NET. http://aspnet.click-url.com/go/psa0013ave/direct;at.aspnet_072303_01/01 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] Oops
> With cool places like http://www.wholelattelove.com - it's very likely! > Trust me, I did it! ;) Haha! There is hope! *grins* --- This SF.NET email is sponsored by: eBay Great deals on office technology -- on eBay now! Click here: http://adfarm.mediaplex.com/ad/ck/711-11697-6916-5 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] Oops
Sorry about that, folks. I should learn to drink more caffinated beverages by the afternoon... but what's the likelihood of that? :-) With cool places like http://www.wholelattelove.com - it's very likely! Trust me, I did it! ;) --- This SF.NET email is sponsored by: eBay Great deals on office technology -- on eBay now! Click here: http://adfarm.mediaplex.com/ad/ck/711-11697-6916-5 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] Oops!
If you look at a bug in bugzilla, in the header info at the top of the ticket, there's a link that says "Create an attachment". Click that, then follow the directions. C Olivier Nicole wrote: ON> >Olivier, could you attach the new file to a bugzilla ticket? It's hard to ON> >extract from your original email. ON> ON> That's what I though, how to *attach* anything in bugzilla? I see ON> nowhere mention of such attachement. ON> ON> I understood that it was not supposed to be dumped in the ON> "Description:" textarea, so what? ___ Don't miss the 2002 Sprint PCS Application Developer's Conference August 25-28 in Las Vegas -- http://devcon.sprintpcs.com/adp/index.cfm ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] Oops!
>Olivier, could you attach the new file to a bugzilla ticket? It's hard to >extract from your original email. That's what I though, how to *attach* anything in bugzilla? I see nowhere mention of such attachement. I understood that it was not supposed to be dumped in the "Description:" textarea, so what? Olivier ___ Don't miss the 2002 Sprint PCS Application Developer's Conference August 25-28 in Las Vegas -- http://devcon.sprintpcs.com/adp/index.cfm ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] Oops!
Olivier, could you attach the new file to a bugzilla ticket? It's hard to extract from your original email. Thanks, C Olivier Nicole wrote: ON> ON> There was a typo in this one, I missed the 96 ON> ON> lang fr describe DATE_IN_FUTURE_96_XX L'entête Date: est plus de 96 heures après la date de l'entête Received: ON> ON> Olivier ON> ON> ___ ON> ON> Don't miss the 2002 Sprint PCS Application Developer's Conference ON> August 25-28 in Las Vegas -- http://devcon.sprintpcs.com/adp/index.cfm ON> ON> ___ ON> Spamassassin-talk mailing list ON> [EMAIL PROTECTED] ON> https://lists.sourceforge.net/lists/listinfo/spamassassin-talk ON> ON> ON> ___ Don't miss the 2002 Sprint PCS Application Developer's Conference August 25-28 in Las Vegas -- http://devcon.sprintpcs.com/adp/index.cfm ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
