Bayes DB version issue 3.1.3 = 3.1.4

2006-08-08 Thread Gary W. Smith
Title: Bayes DB version issue 3.1.3 = 3.1.4 Hello, I cant remember smoking crack when copying the config files over but anythings possible. I built out a new machine today and installed SA. We have a list of CPAN modules that were installed (same list as from the 3.1.3 servers). I copied

Re: Bayes DB version issue 3.1.3 = 3.1.4

2006-08-08 Thread Daryl C. W. O'Shea
On 8/8/2006 3:29 AM, Gary W. Smith wrote: Hello, I can’t remember smoking crack when copying the config files over but anything’s possible. I built out a new machine today and installed SA. We have a list of CPAN modules that were installed (same list as from the 3.1.3 servers). I copied

Word Doc spam

2006-08-08 Thread Patrick Sneyers
Received in my .mac (basically a spam bin) account.http://www.triksys.be/docspam.jpg = screenshot of word doc attached.Neer seen this beforeIs this new, or old news?211.16.219.135 is in all kinds of blacklists though.Patrick SneyersBelgiumVan: Robert Nicholson [EMAIL PROTECTED]Datum: 8

Re: Improved OCR Plugin with approximate matching

2006-08-08 Thread decoder
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hello again, I only wanted to add a small note: I recently saw gifs that cannot be converted using imagemagick because they are either sloppy generated or with intention partly corrupted. Please think about using giftopnm and jpegtopnm instead. If

Broken images in mails

2006-08-08 Thread decoder
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hello there, as I recently mentioned in the FuzzyOcr Thread, I found quite a lot mails that contain broken or corrupted gifs. I found one type that lets convert calculate extremely long and then fails, but with giftopnm it works after it spits out

Re: 0451.com

2006-08-08 Thread Tony Finch
On Mon, 7 Aug 2006, Hamish wrote: Yeah, Right... And Verisign never wildcarded domains either did they? Duh! right back at you. RFC 1123 section 2.1: The syntax of a legal Internet host name was specified in RFC-952 Hostname vs DomainName The domain name system itself doesn't have

Re: ImageInfo path

2006-08-08 Thread Matthias Keller
[EMAIL PROTECTED] wrote: Hello all. Mostly a lurker here. I am trying to install the imageinfo plugin. So, i followed the instructions, place *.pm file in Plugins dir and *.cf file in Spamassassin dir. Do a spamassassin --lint and get [6870] warn: plugin: failed to parse plugin (from @INC):

Bayes errors...

2006-08-08 Thread Hamish Marson
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 I keep getting the following from spamassasin (Running under amavisd debug-sa). Any ideas what I've done wrong this time? The database is mysql. SpamAssassin is 3.1.4 (It also did the same with 3.1.3). [12172] dbg: bayes: database connection

Re: Improved OCR Plugin with approximate matching

2006-08-08 Thread Matthias Keller
decoder wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hello there, I have improved the original OcrPlugin (found at http://wiki.apache.org/spamassassin/OcrPlugin), so it contains fuzzy matching. Like that, mistakes made by the OCR recognition or intentional obfuscations in the text

Re: Bayes errors...

2006-08-08 Thread Nigel Frankcom
I'm not sure what you've done there, I didn't realise it was possible to mix collation types in the same table. Have you checked that all tables are the same type? MyISAM or Inno? If they are all the same, I'd be inclined to pull it down, rebuild from the SA supplied SQL and retrain. Did you

Re: Bayes errors...

2006-08-08 Thread Hamish Marson
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Nigel Frankcom wrote: I'm not sure what you've done there, I didn't realise it was possible to mix collation types in the same table. Have you checked that all tables are the same type? MyISAM or Inno? If they are all the same, I'd be inclined to

Re: Improved OCR Plugin with approximate matching

2006-08-08 Thread decoder
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Matthias Keller wrote: decoder wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hello there, I have improved the original OcrPlugin (found at http://wiki.apache.org/spamassassin/OcrPlugin), so it contains fuzzy matching. Like that,

Re: Bayes errors...

2006-08-08 Thread Nigel Frankcom
On Tue, 08 Aug 2006 12:02:04 +0100, Hamish Marson [EMAIL PROTECTED] wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Nigel Frankcom wrote: I'm not sure what you've done there, I didn't realise it was possible to mix collation types in the same table. Have you checked that all tables are

Re: Bayes errors...

2006-08-08 Thread Hamish Marson
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Nigel Frankcom wrote: I'm not sure what you've done there, I didn't realise it was possible to mix collation types in the same table. Have you checked that all tables are the same type? MyISAM or Inno? If they are all the same, I'd be inclined to

Re: Re: Bayes errors...

2006-08-08 Thread Nigel Frankcom
On Tue, 08 Aug 2006 12:08:52 +0100, Hamish Marson [EMAIL PROTECTED] wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Nigel Frankcom wrote: I'm not sure what you've done there, I didn't realise it was possible to mix collation types in the same table. Have you checked that all tables are

Re: Word Doc spam

2006-08-08 Thread Kenneth Porter
--On Tuesday, August 08, 2006 10:27 AM +0200 Patrick Sneyers [EMAIL PROTECTED] wrote: Received in my .mac (basically a spam bin) account. http://www.triksys.be/docspam.jpg = screenshot of word doc attached. Neer seen this before Is this new, or old news? 211.16.219.135 is in all kinds of

Re: Word Doc spam

2006-08-08 Thread Ralf Hildebrandt
* Kenneth Porter [EMAIL PROTECTED]: I was surprised to see one of these as well. I'd always thought that it would be nice for the Open Office people to create a simple command-line utility to convert Word files to plain text for spam checking. man antiword -- Ralf Hildebrandt (i.A. des

Re: Broken images in mails

2006-08-08 Thread Kenneth Porter
--On Tuesday, August 08, 2006 11:51 AM +0200 decoder [EMAIL PROTECTED] wrote: as I recently mentioned in the FuzzyOcr Thread, I found quite a lot mails that contain broken or corrupted gifs. Until we have a better answer, I'd reject anything with an unrecognizable format. It might be an

Re: Improved OCR Plugin with approximate matching

2006-08-08 Thread Marc Perkel
Perhaps corrupted gifs should be treated as spam? decoder wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hello again, I only wanted to add a small note: I recently saw gifs that cannot be converted using imagemagick because they are either sloppy generated or with intention partly

Re: Improved OCR Plugin with approximate matching

2006-08-08 Thread John D. Hardin
On Tue, 8 Aug 2006, decoder wrote: I only wanted to add a small note: I recently saw gifs that cannot be converted using imagemagick because they are either sloppy generated or with intention partly corrupted. Please think about using giftopnm and jpegtopnm instead. If you have a better idea,

Re: ImageInfo path

2006-08-08 Thread Theo Van Dinter
On Tue, Aug 08, 2006 at 12:33:38PM +0200, Matthias Keller wrote: Then comment-out the loadplugin line in the .cf file and you're fine. Generally speaking, don't put loadplugin lines in your cf files. (if people are looking at the sandbox cf and saying but you do that, yes, for development. ;) )

Re: ImageInfo path

2006-08-08 Thread Benny Pedersen
On Tue, August 8, 2006 12:33, Matthias Keller wrote: # ImageInfo - performs some checks over the attached images # loadplugin Mail::SpamAssassin::Plugin::ImageInfo /etc/mail/spamassassin/plugins/ImageInfo.pm Then comment-out the loadplugin line in the .cf file and you're fine. make it into

Re: URIBL and SURBL no lnger hitting

2006-08-08 Thread Jeff Chan
On Monday, August 7, 2006, 1:56:41 PM, DAve DAve wrote: In frustration I edited /etc/resolv.conf and removed 127.0.0.1, URI lookups are completing and MailScanner is blasting through the queues on both machines exceedingly fast now. No idea what could have possibly changed, dnscache is

Re: URIBL and SURBL no lnger hitting

2006-08-08 Thread Rick Macdougall
Jeff Chan wrote: On Monday, August 7, 2006, 1:56:41 PM, DAve DAve wrote: In frustration I edited /etc/resolv.conf and removed 127.0.0.1, URI lookups are completing and MailScanner is blasting through the queues on both machines exceedingly fast now. No idea what could have possibly changed,

Re: ImageInfo path

2006-08-08 Thread Matthias Keller
Benny Pedersen wrote: On Tue, August 8, 2006 12:33, Matthias Keller wrote: # ImageInfo - performs some checks over the attached images # loadplugin Mail::SpamAssassin::Plugin::ImageInfo /etc/mail/spamassassin/plugins/ImageInfo.pm Then comment-out the loadplugin line in the .cf file and

RE: Bayes errors...

2006-08-08 Thread Gary W. Smith
This is because your database is in UTF8 format. As a result SA cannot read it (though it can write it). Drop the database and recreate it and the tables in latin and it will work just fine. You will have to retrain after that though. -Original Message- From: Hamish Marson

Re: Am I wasting my time with SpamCop?

2006-08-08 Thread Jeff Chan
On Saturday, August 5, 2006, 12:46:20 PM, Benny Pedersen wrote: spamcop.com is the windows client for spamcop.net ? No, IIRC it's something totally different that's squatting a similar domain name, probably on purpose. Jeff C. -- Jeff Chan mailto:[EMAIL PROTECTED] http://www.surbl.org/

Re: Am I wasting my time with SpamCop?

2006-08-08 Thread Jeff Chan
On Thursday, August 3, 2006, 7:40:57 AM, Andrzej Filip wrote: Make *clear* distiction between thre basic ways of using spmacop.net Correct: spamcop.net has multiple functions. 1) email blocking at MTA level [may be controversial cause of zero+ tolerance] Not recommended. Too many FPs to

Re: URIBL and SURBL no lnger hitting

2006-08-08 Thread DAve
Jeff Chan wrote: On Monday, August 7, 2006, 1:56:41 PM, DAve DAve wrote: In frustration I edited /etc/resolv.conf and removed 127.0.0.1, URI lookups are completing and MailScanner is blasting through the queues on both machines exceedingly fast now. No idea what could have possibly changed,

RE: Bayes DB version issue 3.1.3 = 3.1.4

2006-08-08 Thread Gary W. Smith
Daryl, Thanks for the info. I will update the .8. As for the database, which is the primary concern, the user account is correct. I have logged into the database from that server using the same credentials from the local.cf file. I had thought that we might have restricted by subnet so I did

Re: Am I wasting my time with SpamCop?

2006-08-08 Thread Jeff Chan
On Wednesday, August 2, 2006, 2:01:44 PM, Michele Blacknight.ie wrote: Steven W. Orr wrote: Hold on there Bullwinkle! I have been religiously using spamcop in the hopes that the reports that are sent out get used by at least some of the ISPs. Am I wrong about this? We're an ISP and we

Re: URIBL and SURBL no lnger hitting

2006-08-08 Thread Jeff Chan
On Tuesday, August 8, 2006, 7:53:45 AM, Rick Macdougall wrote: Jeff Chan wrote: On Monday, August 7, 2006, 1:56:41 PM, DAve DAve wrote: In frustration I edited /etc/resolv.conf and removed 127.0.0.1, URI lookups are completing and MailScanner is blasting through the queues on both machines

Multiple image spams: best practices?

2006-08-08 Thread Jeff Chan
Aside from the experimental OCR some folks are trying, what SA techniques are folks having good luck with for stopping those stock spams that are multiple, vertical images? Jeff C. -- Jeff Chan mailto:[EMAIL PROTECTED] http://www.surbl.org/

Re: URIBL and SURBL no lnger hitting

2006-08-08 Thread Jeff Chan
On Tuesday, August 8, 2006, 8:05:04 AM, DAve DAve wrote: I had no logging running on dnscache before so I don't *know* what was happening. I re-enabled logging and the issue went away. To be specific I changed my run file from exec setuidgid Gdnslog multilog -* to exec setuidgid Gdnslog

Re: URIBL and SURBL no lnger hitting

2006-08-08 Thread Rick Macdougall
Jeff Chan wrote: On Tuesday, August 8, 2006, 7:53:45 AM, Rick Macdougall wrote: Unlikely to be a dnscache issue. I run over 10 SA servers, all with local djb dnscaches. Aha, but do you use Linux or FreeBSD? I can't remember the details but I remember a FreeBSD/SA issue recently. Hi,

Looking for a good Ebay whitelist

2006-08-08 Thread qqqq
All, I have been having FPs from Ebay in AU and DE, as well as [EMAIL PROTECTED] Does anybody have a good whitelist for these?

Re: Multiple image spams: best practices?

2006-08-08 Thread Jeff Chan
On Tuesday, August 8, 2006, 8:08:04 AM, Jeff Chan wrote: Aside from the experimental OCR some folks are trying, what SA techniques are folks having good luck with for stopping those stock spams that are multiple, vertical images? Any technique for single image stock spams would be welcomed

Re: URIBL and SURBL no lnger hitting

2006-08-08 Thread DAve
Jeff Chan wrote: On Tuesday, August 8, 2006, 8:05:04 AM, DAve DAve wrote: I had no logging running on dnscache before so I don't *know* what was happening. I re-enabled logging and the issue went away. To be specific I changed my run file from exec setuidgid Gdnslog multilog -* to exec

Re: Multiple image spams: best practices?

2006-08-08 Thread decoder
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Jeff Chan wrote: On Tuesday, August 8, 2006, 8:08:04 AM, Jeff Chan wrote: Aside from the experimental OCR some folks are trying, what SA techniques are folks having good luck with for stopping those stock spams that are multiple, vertical images?

Re: Multiple image spams: best practices?

2006-08-08 Thread Bill Randle
On Tue, 2006-08-08 at 08:22 -0700, Jeff Chan wrote: On Tuesday, August 8, 2006, 8:08:04 AM, Jeff Chan wrote: Aside from the experimental OCR some folks are trying, what SA techniques are folks having good luck with for stopping those stock spams that are multiple, vertical images? Any

Re: Multiple image spams: best practices?

2006-08-08 Thread Jeff Chan
On Tuesday, August 8, 2006, 8:26:18 AM, decoder decoder wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Jeff Chan wrote: On Tuesday, August 8, 2006, 8:08:04 AM, Jeff Chan wrote: Aside from the experimental OCR some folks are trying, what SA techniques are folks having good luck with

Re: Multiple image spams: best practices?

2006-08-08 Thread Matthias Keller
Jeff Chan wrote: On Tuesday, August 8, 2006, 8:08:04 AM, Jeff Chan wrote: Aside from the experimental OCR some folks are trying, what SA techniques are folks having good luck with for stopping those stock spams that are multiple, vertical images? Any technique for single image stock

Re: Multiple image spams: best practices?

2006-08-08 Thread decoder
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Jeff Chan wrote: On Tuesday, August 8, 2006, 8:26:18 AM, decoder decoder wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Jeff Chan wrote: On Tuesday, August 8, 2006, 8:08:04 AM, Jeff Chan wrote: Aside from the experimental OCR some folks

Re: Looking for a good Ebay whitelist

2006-08-08 Thread Logan Shaw
On Tue, 8 Aug 2006, wrote: I have been having FPs from Ebay in AU and DE, as well as [EMAIL PROTECTED] Does anybody have a good whitelist for these? Because so many people try to forge messages from eBay but what comes from their own servers is almost definitely not spam, eBay seems like

Re: URIBL and SURBL no lnger hitting

2006-08-08 Thread Dhawal Doshy
DAve wrote: [snip] If it happens again I'll have some logs, provided I catch it in time, dnscache makes logs like bunnies make more bunnies. Until then I'm inclined to think it was a resource issue or anomaly on my system rather than an issue with SA or dnscache. I run dnscache on all my

RE: Looking for a good Ebay whitelist

2006-08-08 Thread Rob McEwen
RE: Looking for a good Ebay whitelist The following are what I have deemed as frequently used official e-bay smtp servers. This list might be used for whitelisting or/and negative scoring: 66.135.195.180-181 66.135.195.254 66.135.197.7-29 66.135.197.164 66.135.207.155 66.135.209.198-221

Re: URIBL and SURBL no lnger hitting

2006-08-08 Thread DAve
Dhawal Doshy wrote: DAve wrote: [snip] If it happens again I'll have some logs, provided I catch it in time, dnscache makes logs like bunnies make more bunnies. Until then I'm inclined to think it was a resource issue or anomaly on my system rather than an issue with SA or dnscache. I run

Re: ImageInfo path

2006-08-08 Thread Richard
-BEGIN PGP SIGNED MESSAGE- Hash: RIPEMD160 hi, Theo Van Dinter wrote, On 8/8/06 7:04 AM: On Tue, Aug 08, 2006 at 12:33:38PM +0200, Matthias Keller wrote: Then comment-out the loadplugin line in the .cf file and you're fine. Generally speaking, don't put loadplugin lines in your cf

RE: Looking for a good Ebay whitelist

2006-08-08 Thread Logan Shaw
On Tue, 8 Aug 2006, Rob McEwen wrote: The following are what I have deemed as frequently used official e-bay smtp servers. This list might be used for whitelisting or/and negative scoring: 66.135.195.180-181 66.135.195.254 66.135.197.7-29 66.135.197.164 66.135.207.155 66.135.209.198-221

Re: URIBL and SURBL no lnger hitting

2006-08-08 Thread Logan Shaw
On Tue, 8 Aug 2006, DAve wrote: Dhawal Doshy wrote: Dave, you might need to update the 'root/servers/@' file. IIRC, a couple of root servers have changed in the past few years. We replace the @ file with one of our own on every server. I contains just our dns servers and our own caches.

Re: URIBL and SURBL no lnger hitting

2006-08-08 Thread DAve
Logan Shaw wrote: On Tue, 8 Aug 2006, DAve wrote: Dhawal Doshy wrote: Dave, you might need to update the 'root/servers/@' file. IIRC, a couple of root servers have changed in the past few years. We replace the @ file with one of our own on every server. I contains just our dns servers and

Re: Looking for a good Ebay whitelist

2006-08-08 Thread Mark Martinec
On Tue, 8 Aug 2006, Rob McEwen wrote: The following are what I have deemed as frequently used official e-bay smtp servers. This list might be used for whitelisting or/and negative scoring: Seems like ebay is signing messages with DomainKeys, I'm getting DK_VERIFIED in my log for mail from

Re: Broken images in mails

2006-08-08 Thread John Andersen
On Tuesday 08 August 2006 01:51, decoder wrote: But I can view it perfectly. Does anyone know what this could be caused by and a tool which can reliably convert these to pnm? Another question that I would have in mind is, if that was intended to happen... Best regards Chris Are you

Re: Looking for a good Ebay whitelist

2006-08-08 Thread Jim Knuth
Heute (08.08.2006/18:52 Uhr) schrieb Mark Martinec, On Tue, 8 Aug 2006, Rob McEwen wrote: The following are what I have deemed as frequently used official e-bay smtp servers. This list might be used for whitelisting or/and negative scoring: Seems like ebay is signing messages with

updates.spamassassin.org.cf overrides local.cf?

2006-08-08 Thread DAve
I noticed that if I have updates_spamassassin_org.cf in place in my rules dir, my local.cf rule changes are set back to default. I tried to post, but that soesn't seem to be an option today. If anyone is interested it's here. http://pixelhammer.com/local-cf.txt DAve -- Three years now I've

RE: updates.spamassassin.org.cf overrides local.cf?

2006-08-08 Thread Bret Miller
I noticed that if I have updates_spamassassin_org.cf in place in my rules dir, my local.cf rule changes are set back to default. I tried to post, but that soesn't seem to be an option today. If anyone is interested it's here. http://pixelhammer.com/local-cf.txt Actually, I can understand

RE: updates.spamassassin.org.cf overrides local.cf?

2006-08-08 Thread Bowie Bailey
DAve wrote: I noticed that if I have updates_spamassassin_org.cf in place in my rules dir, my local.cf rule changes are set back to default. I tried to post, but that soesn't seem to be an option today. If anyone is interested it's here. http://pixelhammer.com/local-cf.txt

Blocking based on ALL IPs in the header

2006-08-08 Thread Rob McEwen (PowerView Systems)
Just thought ya'll would be interested to know that I just spent about 45 minutes trying to convince an I.T. guy at one of the largest regional banks in my area that a spam filter should ONLY check the IP address of the sending mail server against RBLs, NOT every single IP contained within the

Re: Looking for a good Ebay whitelist

2006-08-08 Thread SM
At 09:52 08-08-2006, Mark Martinec wrote: Seems like ebay is signing messages with DomainKeys, I'm getting DK_VERIFIED in my log for mail from [EMAIL PROTECTED] and [EMAIL PROTECTED] and similar. Ebay.com and a few other high profile domains have been signing their mail with DK. Note that

Re: updates.spamassassin.org.cf overrides local.cf?

2006-08-08 Thread DAve
Bowie Bailey wrote: DAve wrote: I noticed that if I have updates_spamassassin_org.cf in place in my rules dir, my local.cf rule changes are set back to default. I tried to post, but that soesn't seem to be an option today. If anyone is interested it's here. http://pixelhammer.com/local-cf.txt

Re: updates.spamassassin.org.cf overrides local.cf?

2006-08-08 Thread Theo Van Dinter
On Tue, Aug 08, 2006 at 03:48:49PM -0400, DAve wrote: Yep, I suspected as much. Now I have SA in three places, four if you count plugins. More if you count the modules and the commandline tools. I just had the crazy idea that I could keep rules in one place. Is this beginning to look

RE: updates.spamassassin.org.cf overrides local.cf?

2006-08-08 Thread Bret Miller
Yep, I suspected as much. Now I have SA in three places, four if you count plugins. More if you count the modules and the commandline tools. I just had the crazy idea that I could keep rules in one place. Is this beginning to look unwieldy to anyone else? (rhetorical, don't answer).

problems, problems

2006-08-08 Thread Wolfgang Jeltsch
Hello, I was kind of shocked when I discovered that there is no SpamAssassin manual or tutorial. For me, it's unimaginable that the world's leading open source spam detection software is missing such an important piece of documentation. The wiki pages are more bits and pieces than a coherent

modifications done by Courier MTA confusing SpamAssassin?

2006-08-08 Thread Wolfgang Jeltsch
Hello, I use Courier MTA. Courier MTA replaces certain mailformed mails with mails which contain some explaination and the original mail as an attachment. The attachment of the mail you're just reading contains such a mail produced by Courier MTA. Do those modifications done by Courier MTA

Re: modifications done by Courier MTA confusing SpamAssassin?

2006-08-08 Thread Michael Scheidell
Wolfgang Jeltsch wrote: Hello, I use Courier MTA. Courier MTA replaces certain mailformed mails with mails which contain some explaination and the original mail as an attachment. The attachment of the mail you're just reading contains such a mail produced by Courier MTA. Do those

Re: Improved OCR Plugin with approximate matching

2006-08-08 Thread decoder
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 decoder wrote: Hello there, I have improved the original OcrPlugin (found at http://wiki.apache.org/spamassassin/OcrPlugin), so it contains fuzzy matching. Like that, mistakes made by the OCR recognition or intentional obfuscations in the text

Re: modifications done by Courier MTA confusing SpamAssassin?

2006-08-08 Thread Wolfgang Jeltsch
Am Dienstag, 8. August 2006 22:51 schrieb Michael Scheidell: Wolfgang Jeltsch wrote: Hello, I use Courier MTA. Courier MTA replaces certain mailformed mails with mails which contain some explaination and the original mail as an attachment. The attachment of the mail you're just

RE: modifications done by Courier MTA confusing SpamAssassin?

2006-08-08 Thread Bowie Bailey
Wolfgang Jeltsch wrote: Hello, I use Courier MTA. Courier MTA replaces certain mailformed mails with mails which contain some explaination and the original mail as an attachment. The attachment of the mail you're just reading contains such a mail produced by Courier MTA. Do those

subject was meant to be new version, please test ;) -nt-

2006-08-08 Thread decoder
decoder wrote: decoder wrote: Hello there, I have improved the original OcrPlugin (found at http://wiki.apache.org/spamassassin/OcrPlugin), so it contains fuzzy matching. Like that, mistakes made by the OCR recognition or intentional obfuscations in the text don't make the recognition

Re: Looking for a good Ebay whitelist

2006-08-08 Thread Loren Wilton
SARE maintains a whitelist. I don't know if those particular sites are on it or not. If you can provide the appropriate info for a whitelist_from_recvd line they could probably be added. Loren

RE: Bayes DB version issue 3.1.3 = 3.1.4

2006-08-08 Thread Gary W. Smith
Okay, I have a little more information now. I run the same command that sql.pm would run. It appears to be a collation issue. Can we force the collation with 3.1.4 to a specific type? In my case the database is in latin because 3.1.3 choked on UTF8. This was on RHEL4 (which defaults to UTF8).

Re: modifications done by Courier MTA confusing SpamAssassin?

2006-08-08 Thread Wolfgang Jeltsch
Am Dienstag, 8. August 2006 23:04 schrieb Bowie Bailey: Wolfgang Jeltsch wrote: Hello, I use Courier MTA. Courier MTA replaces certain mailformed mails with mails which contain some explaination and the original mail as an attachment. The attachment of the mail you're just reading

RE: updates.spamassassin.org.cf overrides local.cf?

2006-08-08 Thread Logan Shaw
On Tue, 8 Aug 2006, Bret Miller wrote: I'm not exactly sure what the thinking was in moving the updates to /var/lib instead of keeping them with /usr/share with the original rules. I wonder why sa-update doesn't just create a version folder under /share/spamassassin and use that... Because

Re: problems, problems

2006-08-08 Thread Logan Shaw
On Tue, 8 Aug 2006, Wolfgang Jeltsch wrote: I was kind of shocked when I discovered that there is no SpamAssassin manual or tutorial. For me, it's unimaginable that the world's leading open source spam detection software is missing such an important piece of documentation. Well, it's not

Re: Looking for a good Ebay whitelist

2006-08-08 Thread jdow
From: Logan Shaw [EMAIL PROTECTED] On Tue, 8 Aug 2006, wrote: I have been having FPs from Ebay in AU and DE, as well as [EMAIL PROTECTED] Does anybody have a good whitelist for these? Because so many people try to forge messages from eBay but what comes from their own servers is almost

Re: problems, problems

2006-08-08 Thread jdow
man spamassassin is the key to the whole thing beyond the INSTALL files. Then you have things like man Mail::SpamAssassin and its kith and kin like man Mail::SpamAssassin::Conf. These will generally be more up to date than any documentation file that exists. And of course the original man

Re: Broken images in mails

2006-08-08 Thread John D. Hardin
On Tue, 8 Aug 2006, John Andersen wrote: Are you sure its perfect? I've seem many of these where they are intentionally corrupting the last portion (bottom edge) of the image so as to avoid simple size or hashing techniques. The ones I saw were the same image visually, but the bottom

Re: Word Doc spam

2006-08-08 Thread jdow
From: Ralf Hildebrandt [EMAIL PROTECTED] * Kenneth Porter [EMAIL PROTECTED]: I was surprised to see one of these as well. I'd always thought that it would be nice for the Open Office people to create a simple command-line utility to convert Word files to plain text for spam checking. man

RE: Word Doc spam

2006-08-08 Thread Bret Miller
From: Ralf Hildebrandt [EMAIL PROTECTED] * Kenneth Porter [EMAIL PROTECTED]: I was surprised to see one of these as well. I'd always thought that it would be nice for the Open Office people to create a simple command-line utility to convert Word files to plain text for spam

Re: Broken images in mails

2006-08-08 Thread decoder
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 John D. Hardin wrote: On Tue, 8 Aug 2006, John Andersen wrote: Are you sure its perfect? I've seem many of these where they are intentionally corrupting the last portion (bottom edge) of the image so as to avoid simple size or hashing

Some Ebay stats

2006-08-08 Thread qqqq
This is interesting. This is a list of relays with the From field matching '@ebay.' 202.64.65.129.in-addr.arpa domain name pointer gabriel.its.calpoly.edu. 204.64.65.129.in-addr.arpa domain name pointer email-gateway-michael.its.calpoly.edu. 10.193.98.140.in-addr.arpa domain name pointer

Re: Looking for a good Ebay whitelist

2006-08-08 Thread Logan Shaw
On Tue, 8 Aug 2006, jdow wrote: From: Logan Shaw [EMAIL PROTECTED] On Tue, 8 Aug 2006, wrote: I have been having FPs from Ebay in AU and DE, as well as [EMAIL PROTECTED] Does anybody have a good whitelist for these? So it seems like SPF is probably something good to rely on in this

RE: problems, problems

2006-08-08 Thread Gary V
Hello, I was kind of shocked when I discovered that there is no SpamAssassin manual or tutorial. For me, it's unimaginable that the world's leading open source spam detection software is missing such an important piece of documentation. http://spamassassin.apache.org/doc.html There are a

Re: updates.spamassassin.org.cf overrides local.cf?

2006-08-08 Thread DAve
Bret Miller wrote: Yep, I suspected as much. Now I have SA in three places, four if you count plugins. More if you count the modules and the commandline tools. I just had the crazy idea that I could keep rules in one place. Is this beginning to look unwieldy to anyone else? (rhetorical,

RE: HTML-tests good or bad?

2006-08-08 Thread Kurt Buff
| From: jdow [mailto:[EMAIL PROTECTED] | From: Chris Santerre [EMAIL PROTECTED] | | ... | | --Chris | | (If I spelt everything correct.I'm sorry.) | ^What's this spelt stuff? It sounds nasty. It's what's left over from making beer - I've seen it used to make bread.

Re: updates.spamassassin.org.cf overrides local.cf?

2006-08-08 Thread Daryl C. W. O'Shea
Bret Miller wrote: Yep, I suspected as much. Now I have SA in three places, four if you count plugins. More if you count the modules and the commandline tools. I just had the crazy idea that I could keep rules in one place. Is this beginning to look unwieldy to anyone else? (rhetorical,

Re: Word Doc spam

2006-08-08 Thread Mark Martinec
From: Ralf Hildebrandt [EMAIL PROTECTED] man antiword No manual entry for antiword Looks really useful and straightforward, thanks Ralf! In the FreeBSD ports collection it comes under: textproc/antiword or fetch it from its home site: http://www.winfield.demon.nl/ Mark

RE: Bayes DB version issue 3.1.3 = 3.1.4

2006-08-08 Thread Gary W. Smith
I've created a new database in UTF8 format. I will see how this works out. I might try to copy the data from the Latin database to the UTF8 database but in past experience this hasn't worked that great. I might also make a backup as well and try that. -Original Message- From: Gary W.

Re: Broken images in mails

2006-08-08 Thread John D. Hardin
On Wed, 9 Aug 2006, decoder wrote: John D. Hardin wrote: Adding a point for corrupted images is sounding better and better. Definetly a good idea... I will try to add this feature in the next release of FuzzyOcr (v.2.1) then. I'd suggest a better place would be the imageinfo plugin -

Re: Looking for a good Ebay whitelist

2006-08-08 Thread jdow
From: Logan Shaw [EMAIL PROTECTED] On Tue, 8 Aug 2006, jdow wrote: From: Logan Shaw [EMAIL PROTECTED] On Tue, 8 Aug 2006, wrote: I have been having FPs from Ebay in AU and DE, as well as [EMAIL PROTECTED] Does anybody have a good whitelist for these? So it seems like SPF is

Re: Word Doc spam

2006-08-08 Thread Kenneth Porter
--On Wednesday, August 09, 2006 1:01 AM +0200 Mark Martinec [EMAIL PROTECTED] wrote: In the FreeBSD ports collection it comes under: textproc/antiword or fetch it from its home site: http://www.winfield.demon.nl/ Cool. What's involved in integrating this into SA? Can the image plugin

Re: Broken images in mails

2006-08-08 Thread Kenneth Porter
--On Wednesday, August 09, 2006 12:18 AM +0200 decoder [EMAIL PROTECTED] wrote: I am also thinking about scanning all attachments, no matter if the content type specifies image or not (in the current version 2.0, only attachments that have image in their content type are scanned with format

Re: Looking for a good Ebay whitelist

2006-08-08 Thread Daryl C. W. O'Shea
jdow wrote: If SPF is good and says from ebay subtract some points in a meta rule. That gets you going while any whitelist that uses spf gets built. (Either that or do it yourself. {^_-}) You might as well do it yourself, since a single whitelist_from_spf seems a lot simpler (and faster in

Re: problems, problems

2006-08-08 Thread Wolfgang Jeltsch
Am Dienstag, 8. August 2006 23:54 schrieb Logan Shaw: On Tue, 8 Aug 2006, Wolfgang Jeltsch wrote: [...] Second, I often have a message of the following form in my mail log: courierlocal: [...] Cannot open bayes databases /home/wolfgang/.spamassassin/bayes_* R/W: lock failed:

RE: RE: Bayes DB version issue 3.1.3 = 3.1.4

2006-08-08 Thread Gary W. Smith
Nigel, I ended up taking the approach you listed a little earlier. The problem is that I now have two separate bayes databases; one for RH/3.1.3 and one for rPath/3.1.4. This isn't that much of a resource problem rather a redundancy problem (as I replicate the databases to our DR location,

Re: updates.spamassassin.org.cf overrides local.cf?

2006-08-08 Thread DAve
Daryl C. W. O'Shea wrote: Bret Miller wrote: Yep, I suspected as much. Now I have SA in three places, four if you count plugins. More if you count the modules and the commandline tools. I just had the crazy idea that I could keep rules in one place. Is this beginning to look unwieldy to

Re: Memory requirements

2006-08-08 Thread James Lay
On Mon, 7 Aug 2006 20:35:56 -0700 (PDT) John D. Hardin [EMAIL PROTECTED] wrote: On Mon, 7 Aug 2006, James Lay wrote: Anyone happen to know the memory requirements of SpamAssassin? I have 3.0.4 running on 128 Megs okwill upgrading to 3.1.4 plus the SARE rules tank it? Or am I safe?

Re: Memory requirements

2006-08-08 Thread James Lay
On Mon, 7 Aug 2006 20:46:05 -0700 jdow [EMAIL PROTECTED] wrote: From: James Lay [EMAIL PROTECTED] Hey all! Anyone happen to know the memory requirements of SpamAssassin? I have 3.0.4 running on 128 Megs okwill upgrading to 3.1.4 plus the SARE rules tank it? Or am I safe?

Re: Memory requirements

2006-08-08 Thread Marc Perkel
James Lay wrote: On Mon, 7 Aug 2006 20:35:56 -0700 (PDT) "John D. Hardin" [EMAIL PROTECTED] wrote: On Mon, 7 Aug 2006, James Lay wrote: Anyone happen to know the memory requirements of SpamAssassin? I have 3.0.4 running on 128 Megs okwill upgrading to

RE: Blocking based on ALL IPs in the header

2006-08-08 Thread Rob McEwen
FOLLOW-UP: This bank is using GFI for spam filtering: http://www.gfi.com/ And looking at GFI's manual, it seems that GFI treats ALL IPs in the header the same and any one blacklisted is treated just the same as if the sending mail server's IP were blacklisted... with NO option to **only** check

  1   2   >