Re: false scoring for DNS_FROM_RFC_ABUSE

2006-05-26 Thread List Mail User
... On Thursday 25 May 2006 21:31, Kai Schaetzl took the opportunity to write: Jamie L. Penman-Smithson wrote on Thu, 25 May 2006 17:12:07 +0100: .de does not have a working WHOIS server, that's fundamentally broken: No, *your* whois client is outdated and broken. snip And this is not the

Re: Crosspost: [Mimedefang] Using per-list SA policies

2006-05-26 Thread jdow
From: Loren Wilton [EMAIL PROTECTED] Well, I didn't get any responses on the MDF mailing list, so I was wondering if SA was the better angle to be coming at this with. I think we can help you, but it will depend on exactly what you want to do. SA normally is used to filter to mail for

Re: Crosspost: [Mimedefang] Using per-list SA policies

2006-05-26 Thread Justin Mason
Philip Prindeville writes: Well, I didn't get any responses on the MDF mailing list, so I was wondering if SA was the better angle to be coming at this with. it's definitely something that has to be dealt with on the MDF end; SpamAssassin does allow it fine, but the caller has to implement

Re: ANNOUNCE: Apache SpamAssassin 3.1.2 available!

2006-05-26 Thread Justin Mason
jdow writes: From: Theo Van Dinter [EMAIL PROTECTED] Apache SpamAssassin 3.1.2 is now available! This is a maintainance release of the 3.1.x branch. Whine, you mean I have to put in the special print code that Loren needs for properly creating rules in yet ANOTHER release? bug #?

Re: ALL_TRUSTED score

2006-05-26 Thread Matt Kettler
Bowie Bailey wrote: I was just looking through the default scores and I noticed that ALL_TRUSTED is only scored at -1.8. I thought it had a much lower score than that. Am I completely off track, or did something change in one of the recent versions? It got hacked back because trust-path

Re: End-user (not administrator) question

2006-05-26 Thread NM Public
Sur 2006-05-25, Evan Platt skribis: Umm... Switch to a different mail provider? I just blogged about this yesterday. If your university uses IMAP, which is the case for almost all universities these days, they can set things up so that each user has the option to have his/her spammy

Re: false scoring for DNS_FROM_RFC_ABUSE

2006-05-26 Thread Kai Schaetzl
List Mail User wrote on Thu, 25 May 2006 23:02:21 -0700 (PDT): DeNIC does not follow this protocol; 1. there's nothing which backs your claim, *nothing*. 2. example is an example and nothing else. You should know that. There are also special words in RFCs which clearly define mandatory

Re: false scoring for DNS_FROM_RFC_ABUSE

2006-05-26 Thread Magnus Holmgren
On Friday 26 May 2006 15:53, List Mail User took the opportunity to write: Kai, There doesn't seem to be any language barrier, so either you refuse to read and follow the RFC trail yourself, or you require spoon-feeding. What about RFC1032, page 5 VERIFICATION OF DATA

Re: Penalizing mail with multiple Subject or From header fields?

2006-05-26 Thread Justin Mason
mark -- it's not too pretty. header TWO_SUBJSALL =~ /(?:^|\n)Subject:.*\nSubject:/s --j. Mark Martinec writes: Is it possible to add some score points to mail which has multiple Subject header fields and/or multiple From header fields? I guess not, but it is worth asking

Re: false scoring for DNS_FROM_RFC_ABUSE

2006-05-26 Thread Kai Schaetzl
List Mail User wrote on Fri, 26 May 2006 06:53:36 -0700 (PDT): What about RFC1032, page 5 RFC 1032 is not authoritative in any way. It never was a standard, it doesn't define anything about the whois protocol. If you think so it's wishful thinking. This RFC is not obsolete, and make quite

Re: 3.1.2-Windows, exit codes broken?

2006-05-26 Thread Kai Schaetzl
Craig Emmitt wrote on Fri, 26 May 2006 11:01:53 -0500: 3.1.2 is not setting a non-zero exit code when a message is classified as spam (spamassassin.bat -e mailfilein mailfileout) Known issue/bug? There is something about exit codes in the changelog. Kai -- Kai Schätzl, Berlin, Germany

Re: sa-learn script

2006-05-26 Thread Bill Taroli
Paul Matthews wrote: ... what I want it to do is once it is marked as spam to move the e-mail from /var/spool/mail/user to $HOME/mail/Junk and same as marking it ham, move it from $HOME/mail/Junk to /var/spool/mail/user Can anyone tell me how-to do that? Well, the desire to do this is

sa-learn

2006-05-26 Thread --[UxBoD]--
Hi, i use SpamAssassin with MailScanner and Postfix and was wondering how I get newly spam entered to the bayes database. I have created a little script that polls our accounts :- #!/bin/bash LOCK_FILE=/var/lock/subsys/spam_check.lock if [ -f ${LOCK_FILE} ]; then logger -p

Re: ALL_TRUSTED score

2006-05-26 Thread Matt Kettler
Bowie Bailey wrote: Matt Kettler wrote: Bowie Bailey wrote: I was just looking through the default scores and I noticed that ALL_TRUSTED is only scored at -1.8. I thought it had a much lower score than that. Am I completely off track, or did something change in one of the recent

RE: 3.1.2-Windows, exit codes broken?

2006-05-26 Thread Emmitt, Craig
3.1.2 is not setting a non-zero exit code when a message is classified as spam (spamassassin.bat -e mailfilein mailfileout) Known issue/bug? There is something about exit codes in the changelog. I had checked the changelog and didn't see anything obviously relevant. Craig

Re: Crosspost: [Mimedefang] Using per-list SA policies

2006-05-26 Thread Philip Prindeville
Loren Wilton wrote: Well, I didn't get any responses on the MDF mailing list, so I was wondering if SA was the better angle to be coming at this with. I think we can help you, but it will depend on exactly what you want to do. SA normally is used to filter to mail for recipients. You

Re: Penalizing mail with multiple Subject or From header fields?

2006-05-26 Thread Loren Wilton
Is it possible to add some score points to mail which has multiple Subject header fields and/or multiple From header fields? Sure. Ugly, but certainly possible. Something like header DOUBLE_SUBJECT ALL =~ /\nSubject: *\nSubject:.\s+\S/m Loren

Re: Penalizing mail with multiple Subject or From header fields?

2006-05-26 Thread Mark Martinec
header TWO_SUBJS ALL =~ /(?:^|\n)Subject:.*\nSubject:/s header DOUBLE_SUBJECT ALL =~ /\nSubject: *\nSubject:.\s+\S/m So this is what it boils down to, tested: header L_DOUBLE_SUBJECT ALL =~ /^Subject:.*^Subject:/smi score L_DOUBLE_SUBJECT 0.9 header L_DOUBLE_FROMALL =~

Re: Penalizing mail with multiple Subject or From header fields?

2006-05-26 Thread John Rudd
On May 26, 2006, at 10:37 AM, Loren Wilton wrote: Is it possible to add some score points to mail which has multiple Subject header fields and/or multiple From header fields? Sure. Ugly, but certainly possible. Something like header DOUBLE_SUBJECT ALL =~ /\nSubject: *\nSubject:.\s+\S/m

Re: Crosspost: [Mimedefang] Using per-list SA policies

2006-05-26 Thread Kai Schaetzl
Philip Prindeville wrote on Fri, 26 May 2006 11:26:33 -0600: No, it's to a list. At the list exploder, we want to be able to apply certain per-list policies. For instance, for most lists (but not all), the following would be applicable: I don't use MimeDefang, but I guess it should be

Re: 3.1.2-Windows, exit codes broken?

2006-05-26 Thread Kai Schaetzl
Craig Emmitt wrote on Fri, 26 May 2006 12:02:57 -0500: I had checked the changelog and didn't see anything obviously relevant. I mean this: - bug 3754: if there's a problem opening a file via sa-learn or spamassassin, return an error exit value. It indicates there might have been changes

Re: false scoring for DNS_FROM_RFC_ABUSE

2006-05-26 Thread Pablo Allietti
On Fri, May 26, 2006 at 02:31:16PM +0200, Kai Schaetzl wrote: Jamie L. Penman-Smithson wrote on Fri, 26 May 2006 00:52:39 +0100: After some research, I came to the conclusion that .de is, indeed, still broken: ftp://ftp.isi.edu/in-notes/rfc3912.txt And *where exactly* does this

RFC gurus...question

2006-05-26 Thread qqqq
Is this a valid Message ID? ?7[14

Re: Crosspost: [Mimedefang] Using per-list SA policies

2006-05-26 Thread Philip Prindeville
Kai Schaetzl wrote: Philip Prindeville wrote on Fri, 26 May 2006 11:26:33 -0600: No, it's to a list. At the list exploder, we want to be able to apply certain per-list policies. For instance, for most lists (but not all), the following would be applicable: I don't use MimeDefang,

IntegratedSpamdInPostfix; can't send spam header

2006-05-26 Thread Jana Nguyen
I'm not sure what's the problem why I can't send mail with spam header. Below are my master.cf and local.cf file, there maybe a misconfiguration? master.cf: # == # service type private unpriv chroot wakeup maxproc

Re: Crosspost: [Mimedefang] Using per-list SA policies

2006-05-26 Thread jdow
From: Philip Prindeville [EMAIL PROTECTED] are fired... And you might have a specific set of rules for a list like alsa-devel (the 'L' in ALSA is for Linux, so it might be reasonable to assume that no one will be posting with charset='windows-1252'... it's also an English language list, so

Re: false scoring for DNS_FROM_RFC_ABUSE

2006-05-26 Thread jdow
From: Kai Schaetzl [EMAIL PROTECTED] Jamie L. Penman-Smithson wrote on Fri, 26 May 2006 00:52:39 +0100: After some research, I came to the conclusion that .de is, indeed, still broken: ftp://ftp.isi.edu/in-notes/rfc3912.txt And *where exactly* does this RFC say that the whois input and

Re: Crosspost: [Mimedefang] Using per-list SA policies

2006-05-26 Thread Kai Schaetzl
Philip Prindeville wrote on Fri, 26 May 2006 13:32:10 -0600: Except that developers aren't vetted in any particular way. vetted? The spammer with time on his hands could subscribe himself... plus there's always the chance of a legitimate user's machine becoming infected with an email

Re: Crosspost: [Mimedefang] Using per-list SA policies

2006-05-26 Thread Philip Prindeville
jdow wrote: From: Philip Prindeville [EMAIL PROTECTED] are fired... And you might have a specific set of rules for a list like alsa-devel (the 'L' in ALSA is for Linux, so it might be reasonable to assume that no one will be posting with charset='windows-1252'... it's also an English

Re: Crosspost: [Mimedefang] Using per-list SA policies

2006-05-26 Thread Philip Prindeville
Kai Schaetzl wrote: Philip Prindeville wrote on Fri, 26 May 2006 13:32:10 -0600: Except that developers aren't vetted in any particular way. vetted? You can sign yourself up for most lists, if you have a valid address and a web browser. You have to try to get yourself

Re: Crosspost: [Mimedefang] Using per-list SA policies

2006-05-26 Thread jdow
From: Philip Prindeville [EMAIL PROTECTED] jdow wrote: From: Philip Prindeville [EMAIL PROTECTED] are fired... And you might have a specific set of rules for a list like alsa-devel (the 'L' in ALSA is for Linux, so it might be reasonable to assume that no one will be posting with

Re: Crosspost: [Mimedefang] Using per-list SA policies

2006-05-26 Thread Kelson
jdow wrote: (Otherwise - what in hell are the STD-XXX documents?) Good question... Medical test results for people who *ahem* perform in a certain film genre? -- Kelson Vibber SpeedGate Communications www.speed.net

Re: Crosspost: [Mimedefang] Using per-list SA policies

2006-05-26 Thread Jonas Eckerman
Kai Schaetzl wrote: I don't use MimeDefang, but I guess it should be possible to tell MD to use a specific configuration file when calling SA (depends on how it calls SA). Absolutely. Here's an example from our mimedefang-filter: ---8--- if ($is_result_query) { debug_log(2,spam:

Re: ANNOUNCE: Apache SpamAssassin 3.1.2 available!

2006-05-26 Thread Kai Schaetzl
Theo Van Dinter wrote on Thu, 25 May 2006 20:42:47 -0400: Apache SpamAssassin 3.1.2 is now available! rpm built, installed, linted, checked, running fine it seems. Kai -- Kai Schätzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.conactive.com

SA Version in CPAN

2006-05-26 Thread Chris
I notice that CPAN has the version listed as 3.001002, I take it this is actually 3.1.2? -- Chris Registered Linux User 283774 http://counter.li.org 17:29:03 up 12 days, 5:29, 1 user, load average: 0.29, 0.43, 0.24 Mandriva Linux 10.1 Official, kernel 2.6.8.1-12mdk pgpepAHrLMQnQ.pgp

Re: SA Version in CPAN

2006-05-26 Thread Kevin W. Gagel
- Original Message - I notice that CPAN has the version listed as 3.001002, I take it this is actually 3.1.2? -- Yes, I just finished upgrading it myself using CPAN and it is 3.1.2. = Kevin W. Gagel Network Administrator Information Technology Services

Re: SA Version in CPAN

2006-05-26 Thread Chris
On Friday 26 May 2006 5:35 pm, Kevin W. Gagel wrote: - Original Message - I notice that CPAN has the version listed as 3.001002, I take it this is actually 3.1.2? -- Yes, I just finished upgrading it myself using CPAN and it is 3.1.2. Thanks Kevin, appreciate it. -- Chris

Re: false scoring for DNS_FROM_RFC_ABUSE

2006-05-26 Thread List Mail User
... From: Kai Schaetzl [EMAIL PROTECTED] Jamie L. Penman-Smithson wrote on Fri, 26 May 2006 00:52:39 +0100: After some research, I came to the conclusion that .de is, indeed, still broken: ftp://ftp.isi.edu/in-notes/rfc3912.txt And *where exactly* does this RFC say that the whois

Re: RFC gurus...question

2006-05-26 Thread David B Funk
On Fri, 26 May 2006, wrote: Is this a valid Message ID? ?7[14 No, see RFC-2822 section 3.6.4 It clearly says that a Message ID must be: \s id-left @ id-right \s where you can more-or-less call the left right parts: [\w\.-\?]{1,} (using perl reg-ex syntax, this is a slight