Re: Another SARE channel with the most used rules available

2006-09-10 Thread [EMAIL PROTECTED]
Hi, Any chance of adding support for 3.1.5? (Currently fails with "dns: query failed: 5.1.3.saupdates.openprotect.com = NXDOMAIN".) We've already added txt record for the 3.1.5 release and it should work now. cheers, skar. -- OpenProtect - The email virus/spam filter

Re: Another SARE channel with the most used rules available

2006-09-10 Thread [EMAIL PROTECTED]
Hi, gpg --armor --export KEYID the man page is amazingly helpful ;-) Thanks, that was helpful. The instructions have been updated to use this technique instead of copying the entire public key ring of root. cheers, skar. -- OpenProtect - The email virus/spam filter

Stopping Domain Spam

2006-09-10 Thread gordonnz
I am new to modifying SpamAssassin but recently I have been daily getting several hundred spam e-mails addressed to anything@mydomain. Can I create a sort of white list of my proper addresses so that only my properly addressed messages get through or is there a better way? -- View this message

Re: Stopping Domain Spam

2006-09-10 Thread jdow
From: gordonnz [EMAIL PROTECTED] I am new to modifying SpamAssassin but recently I have been daily getting several hundred spam e-mails addressed to anything@mydomain. Can I create a sort of white list of my proper addresses so that only my properly addressed messages get through or is there a

Re: Stopping Domain Spam

2006-09-10 Thread mouss
gordonnz wrote: I am new to modifying SpamAssassin but recently I have been daily getting several hundred spam e-mails addressed to anything@mydomain. Can I create a sort of white list of my proper addresses so that only my properly addressed messages get through or is there a better way?

Re: A Note Regarding DHCP Zone

2006-09-10 Thread mouss
David Cary Hart wrote: Based upon removal requests, we are seeing a considerable increase in SA usage. I added some notes to our website recently that I wanted to share on this list: What's the purpose of duplicating sorbs and other lists? This will only make unlisting more complicated.

Re: SPF Scores

2006-09-10 Thread Michael Scheidell
Daryl C. W. O'Shea wrote: (yes, I looked up the ip address and pulled a txt record from aol, and yes, the ips are in the range, and yes, I have gotten SPF_SOFTFAIL from domains without any spf records) Bug 5077 includes a one line patch to fix this. It'll be included in 3.1.6 but is

Re: A Note Regarding DHCP Zone

2006-09-10 Thread David Cary Hart
On Sun, 10 Sep 2006 13:38:37 +0200, mouss [EMAIL PROTECTED] opined: David Cary Hart wrote: Based upon removal requests, we are seeing a considerable increase in SA usage. I added some notes to our website recently that I wanted to share on this list: What's the purpose of

Re: TQMcube Geo Zone config files

2006-09-10 Thread mouss
Andreas Pettersson wrote: In case anybody is interrested, I've compiled a config file for the geo zone at TQM http://tqmcube.com/worldzone.php It might not be of great use, but it is interresting to gather some statistics of where the mails come from. Files found here

Re: Juste a little question

2006-09-10 Thread mouss
jdow wrote: Are you sure that the path from the sender to you involves exactly one SpamAssassin run, yours? The LAST SpamAssassin run is the one that gets scored. And many initial setups seem to somehow get SpamAssassin into the loop twice, which is not good. Another caveat is to run

Odd error (or is it an error)

2006-09-10 Thread Steven Stern
The following appears periodically in my maillog. I think it has to do with an attempt to do a cpan upgrade or SpamAssassin that I had to back out and replace with the Fedora RPM. In any case, is this anything to worry about? Sep 10 11:12:30 mooch spamd[26250]: (?:(?=[\s,]))* matches null

Fwd: Drink it, forget it !

2006-09-10 Thread Robert Nicholson
Why didn't DATE_IN_FUTURE file on this message?Begin forwarded message:From: "Frederick Harris" [EMAIL PROTECTED]Date: January 14, 2007 12:07:22 AM CSTTo: [EMAIL PROTECTED]Subject: Drink it, forget it !X-Spam-Dcc: : grub.camros.com 1113; Body=1 Fuz1=1X-Spam-Flag: YESX-Spam-Checker-Version:

Re: Which DB is actually used?

2006-09-10 Thread mouss
Bo Mellberg wrote: jdow skrev: From: Bo Mellberg [EMAIL PROTECTED] I have SA 3.1.4 configured and running on Debian Sarge using apt-get. I'm finding it hard to know what directory is actually used for the bayes-database: max:~# ls /root/.spamassassin/ -al total 2344 drwx-- 2 root

Re: site-wide config?

2006-09-10 Thread mouss
Russell Jones wrote: Sorry if this is covered somewhere in the documentation, and if so can someone be nice enough to point it to me :) I can't seem to locate it. I would like to set spamassassin to use a site-wide configuration, so that when I tell it to sa-learn, it will apply what it

Re: TQMcube Geo Zone config files

2006-09-10 Thread Andreas Pettersson
mouss wrote: How does/would this compare to using RELAY_COUNTRY? are they similar (so one should only use one of them) or complementary? I don't know. I haven't used RELAY_COUNTRY, but now that I'm aware of its existense I'll have a look at it :) Regards, Andreas

Re: TQMcube Geo Zone config files

2006-09-10 Thread Andreas Pettersson
Andreas Pettersson wrote: I don't know. I haven't used RELAY_COUNTRY, but now that I'm aware of its existense I'll have a look at it :) Ok, I've had a quick look now. RelayCountry presents the country code of the last relay either as a separate header, or as the _RELAYCOUNTRY_ header

Re: Drink it, forget it !

2006-09-10 Thread Robert Nicholson
It seems to have decided that date_diff is 0 for some reason in check_for_shifted_dateOn Sep 10, 2006, at 11:42 AM, Robert Nicholson wrote:Why didn't DATE_IN_FUTURE file on this message?Begin forwarded message:From: "Frederick Harris" [EMAIL PROTECTED]Date: January 14, 2007 12:07:22 AM CSTTo:

Re: Drink it, forget it ! .... bug in _check_date_diff

2006-09-10 Thread Robert Nicholson
i'm guessing what happened here was that it took the first Received header... which is the same as the Date: header.What i'd rather it take though is the header closest to me.so instead of usingReceived: from [61.15.158.107] (helo=[71353437]) by caching4-true.asianet.co.th with smtp (Exim 4.60

Re: Odd error (or is it an error)

2006-09-10 Thread Theo Van Dinter
On Sun, Sep 10, 2006 at 11:14:13AM -0500, Steven Stern wrote: The following appears periodically in my maillog. I think it has to do with an attempt to do a cpan upgrade or SpamAssassin that I had to back out and replace with the Fedora RPM. In any case, is this anything to worry about? It's

Re: Drink it, forget it ! .... bug in _check_date_diff

2006-09-10 Thread Robert Nicholson
So if I use the following instead it then fires the rule  # use the date with the smallest absolute difference  # (experimentally, this results in the fewest false positives)  @diffs = sort { abs($a) = abs($b) } @diffs;  # pick the first one that isn't 0  foreach my $diff (@diffs)  {     next if

Re: A Note Regarding DHCP Zone

2006-09-10 Thread mouss
David Cary Hart wrote: We are listing a large number of ranges that SORBS does not. There are numerous operational differences that make both lists useful. It's ok if the lists contain different entries. my concern is if a list includes another one. you can setup aggregate lists if you

Re: Fwd: Drink it, forget it !

2006-09-10 Thread Matt Kettler
At a casual guess, I'd say that the UNPARSABLE_RELAY might be related. Run it through with -D on and see which Received: headers are unparseable. Robert Nicholson wrote: Why didn't DATE_IN_FUTURE file on this message? Begin forwarded message: *From: *Frederick Harris [EMAIL PROTECTED]

Re: Drink it, forget it !

2006-09-10 Thread Robert Nicholson
The last two received headers in the message looked forged? [12657] dbg: received-header: parsed as [ ip=61.15.158.107 rdns=cm61-15-158-107.hkcable.com.hk helo=!71353437! by=caching4- true.asianet.co.th ident= [EMAIL PROTECTED] intl=0 id=WDL- C580H-YQ auth= ] [12657] dbg: received-header:

Re: Drink it, forget it ! .... bug in _check_date_diff

2006-09-10 Thread Daryl C. W. O'Shea
Robert Nicholson wrote: This looks to be something Spammers are deliberately working around as how could you possibly get two received headers with the same date, time to the second? That's like saying how could you possibly get two received headers with the same date, time to the minute or

Re: Drink it, forget it ! .... bug in _check_date_diff

2006-09-10 Thread Robert Nicholson
Well either way. Assuming that the lowest numbered date diff represents the real receive time is niave at best. On Sep 10, 2006, at 2:03 PM, Daryl C. W. O'Shea wrote: Robert Nicholson wrote: This looks to be something Spammers are deliberately working around as how could you possibly get

Re: Drink it, forget it ! .... bug in _check_date_diff

2006-09-10 Thread Daryl C. W. O'Shea
I haven't read any of the rest of this thread, but I'll respond to the latest... Robert Nicholson wrote: Well either way. Assuming that the lowest numbered date diff represents the real receive time is niave at best. As is assuming that the rule assumes that the times are real. Comparing

Fwd: פריצת דרך מאתגרת

2006-09-10 Thread Robert Nicholson
Why didn't foreign charset rules catch this?Begin forwarded message:From: [EMAIL PROTECTED]Date: September 10, 2006 2:17:51 PM CDTTo: [EMAIL PROTECTED]Subject: פריצת דרך מאתגרתX-Spam-Dcc: : grub.camros.com 1113; Body=5 Fuz1=5 Fuz2=3X-Spam-Flag: YESX-Spam-Checker-Version: SpamAssassin 3.1.1

Re: פריצת דרך מאתגרת

2006-09-10 Thread Robert Nicholson
Windows-1255and apparently with locales DB6 x @locales0  'en'1  'th'2  'it'3  'en_US'Mail::SpamAssassin::Locales::is_charset_ok_for_locales($1, @locales)returns trueMail::SpamAssassin::Locales::is_charset_ok_for_locales(/home/robert/lib/perl5/site_perl/5.8.0/Mail/SpamAssassin/Locales.pm:91):91:   

Re: LOG: Re: Drink it, forget it ! .... bug in _check_date_diff

2006-09-10 Thread Daryl C. W. O'Shea
Robert Nicholson wrote: If you converted all times to GMT and compared them against now and if they were now how often would that be FPing? I suppose that the spam hit rate would go up a little for the DATE_IN_FUTURE_* rules, while the ham hit rate (caused by the thousands of people who

Re: LOG: Re: Drink it, forget it ! .... bug in _check_date_diff

2006-09-10 Thread Robert Nicholson
I personally am probably not interested in mail from people who don't know how to set their system's time but you could implement it using a threshold. To me that's a lot better than assuming an n hour difference b/w Received and Date: etc which the sender can easily forge. Unless the

Re: SPF Scores

2006-09-10 Thread BG Mahesh
On 9/9/06, Daryl C. W. O'Shea [EMAIL PROTECTED] wrote: Michael Scheidell wrote:Bug 5077 includes a one line patch to fix this.It'll be included in3.1.6 but is trivial to apply by hand now. http://issues.apache.org/SpamAssassin/show_bug.cgi?id=5077I seem to have multiple versions of SPF.pm on my