How to write my own plugin

2007-08-12 Thread Paul Lenz
Actually I write Perl programs since many years, but I am not so familiar with the object oriented programming and I can not discover the secrets of Spamassassin. Contretely: I was not able to access the body of a mail. I included Plugin\Test.pm into my configuration and gave it a score of 0.1.

How can I write my own plugins?

2007-08-12 Thread Paul Lenz
Actually I write Perl programs since many years, but I am not so familiar with the object oriented programming and I can not discover the secrets of Spamassassin. Contretely: I was not able to access the body of a mail. I included Plugin\Test.pm into my configuration: loadplugin

How can I write my own plugin?

2007-08-12 Thread Paul Lenz
Actually I write Perl programs since many years, but I am not so familiar with the object oriented programming and I can not discover the secrets of Spamassassin. Contretely: I was not able to access the body of a mail. I included Plugin\Test.pm into my configuration: loadplugin

Re: Detecting short-TTL domains?

2007-08-12 Thread Kai Schaetzl
John D. Hardin wrote on Sat, 11 Aug 2007 18:21:35 -0700 (PPT): I think there was some consensus about using that in concert with an excessive number of A records as a spam sign. Check the thread history. I don't think anyone is suggesting by itself it's a useful indicator. This is what I had

Re: rule for empty text + GIF or PDF ?

2007-08-12 Thread Kai Schaetzl
Gene Heskett wrote on Sat, 11 Aug 2007 23:43:38 -0400: 1: sa-update is NOT pulling new PDFInfo.pm or pdfinfo.cf files even when they are available. of course not! 2: spamassassin --lint -D ignores these rules when we install them by hand. which means you probably haven't installed PDFInfo

Re: How can I write my own plugins?

2007-08-12 Thread jdow
From: Paul Lenz [EMAIL PROTECTED] PS. Sorry for multiple postings, I only saved my message during editing, but it seems to be sent every time :( Control-S save draft. Alt-S send. Easy way to make the mistake. Control-Enter is an instant send, which is annoying when you fat finger and hit the

Re: How can I write my own plugin?

2007-08-12 Thread jdow
From: Paul Lenz [EMAIL PROTECTED] Actually I write Perl programs since many years, but I am not so familiar with the object oriented programming and I can not discover the secrets of Spamassassin. Contretely: I was not able to access the body of a mail. I included Plugin\Test.pm into my

RE: Detecting short-TTL domains?

2007-08-12 Thread Thomas Raef
I agree. To catch the fast-flux servers you have to check not only low ttl values but ALSO how frequently the IP addresses assigned to that domain change. I think everyone is looking for a fast fast-flux fix. I believe, and this is just my opinion, that a dnsbl is the way to go. That way if the

Re: How can I write my own plugins?

2007-08-12 Thread Alex Woick
Paul Lenz wrote on 12.08.2007 11:23: Actually I write Perl programs since many years, but I am not so familiar with the object oriented programming and I can not discover the secrets of Spamassassin. Contretely: I was not able to access the body of a mail. You should consult man perltoot

SOLVED: How can I write my own plugins?

2007-08-12 Thread Paul Lenz
Alex Woick [EMAIL PROTECTED] wrote: This is already very good. You have it. That text is the text of the internal test message that is processed on every SpamAssassin startup or --lint. Ah! It does not come from an email, only from the startup! Now I got it. I stored the log file into

Re: How can I write my own plugins?

2007-08-12 Thread Kai Schaetzl
Paul Lenz wrote on Sun, 12 Aug 2007 12:23:52 +0300: PS. Sorry for multiple postings, I only saved my message during editing, but it seems to be sent every time BTW, it looks like you are using an outdated version of your mail client, upgrade! Kai -- Kai Schätzl, Berlin, Germany Get your

Re: Detecting short-TTL domains?

2007-08-12 Thread Kai Schaetzl
Thomas Raef wrote on Sun, 12 Aug 2007 06:19:43 -0500: a dnsbl is the way to go. On first look I disagree. We already have SURBL and URIBL. I don't see how this would add any benefit on top of that. We are talking about URI's in mail, not about hostnames of mailservers or email adresses. The

Re: some of you have bad meta rules...

2007-08-12 Thread Justin Mason
Loren Wilton writes: Ok. Sounds like they removed some base rules we were depending on. Maybe time to remove those rules based on them, or recreate the base rules as our own. Feel free to recreate them; 3.2.x will efficiently merge duplicates anyway so it won't have any runtime effect.

I send 5 million spams a day

2007-08-12 Thread Marc Perkel
But I send them to people who are building public blocklists. I've expanded my delivery system so I can keep up with the load. If anyone out there is running a public black lists and wants a free feed contact me privately and I'll set it up. I have 2 main feeds. One is mostly messages

Re: Detecting short-TTL domains?

2007-08-12 Thread Kai Schaetzl
Kai Schaetzl wrote on Sun, 12 Aug 2007 14:31:15 +0200: SA is all about storing SA is all about *scoring* Kai -- Kai Schätzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.conactive.com

RE: Detecting short-TTL domains?

2007-08-12 Thread Thomas Raef
Yes you are correct. I got so focused on the improper identification of fast-flux that I lost sight of the details. I stand, maybe not corrected, but at least with a broader understanding of the real issue. There must be some way of better identifying these domains in a URI. Thank you for

Re: Detecting short-TTL domains?

2007-08-12 Thread Jeff Chan
Quoting Kai Schaetzl [EMAIL PROTECTED]: Thomas Raef wrote on Sun, 12 Aug 2007 06:19:43 -0500: a dnsbl is the way to go. On first look I disagree. We already have SURBL and URIBL. I don't see how this would add any benefit on top of that. We are talking about URI's in mail, not about

Re: SOLVED: How can I write my own plugins?

2007-08-12 Thread John D. Hardin
On Sun, 12 Aug 2007, Paul Lenz wrote: After chmod 777 the logfile, Bad practice. Bad practice. Please don't develop the habit of reflexively chmod 777ing things. I dealt with that from my firm's support department for five years and I still have the twitch. (1) It completely turns off

Re: SOLVED: How can I write my own plugins?

2007-08-12 Thread Paul Lenz
John D. Hardin [EMAIL PROTECTED] wrote: After chmod 777 the logfile, Bad practice. I know. I did this only to make the logfile working for a short time. Since I know that my plugin works, I deleted the logfile. Paul Lenz

Re: Detecting short-TTL domains?

2007-08-12 Thread Steve Freegard
[ repost: obfusicating domains to avoid the apache.org SMTP filter... ] Hi John, John Rudd wrote: I'm a prophet now!? :-) Hm. So, I'm sure I can figure this out eventually, but does anyone know the right Net::DNS way to extract the TTL? I could probably set it up as a value in

Re: Dns Resolver problem

2007-08-12 Thread Pawel Sasin
I want to be able to make SA rotate DNS servers. Apparently that is a limitation of Net::DNS. There was some discussion of it on-list a few weeks back; I don't clearly remember the details. You might want check the current status of Net::DNS w/r/t fallback, rotation, etc., and work

Re: Dns Resolver problem

2007-08-12 Thread Pawel Sasin
I want to be able to make SA rotate DNS servers. Apparently that is a limitation of Net::DNS. There was some discussion of it on-list a few weeks back; I don't clearly remember the details. You might want check the current status of Net::DNS w/r/t fallback, rotation, etc., and work with

RE: SA rule for userid in subject?

2007-08-12 Thread jeffsal
I was wondering how to modify Lorens rule for the follwing type of emails which I have been getting a lot of: In the subject I get: some word[s]-userid or some word[s]-some word[s]-userid Loren answered that a month ago. Is in the archives. You may use: header RULE_NAME ALL =~ /\nTo:

userid in subject

2007-08-12 Thread jeffsal
I was wondering how to modify Lorens rule for the follwing type of emails which I have been getting a lot of: In the subject I get: some word[s]-userid or some word[s]-some word[s]-userid Loren answered that a month ago. Is in the archives. You may use: header RULE_NAME ALL =~

Re: SA rule for userid in subject?

2007-08-12 Thread Loren Wilton
I was wondering how to modify Lorens rule for the follwing type of emails which I have been getting a lot of: In the subject I get: some word[s]-userid or some word[s]-some word[s]-userid You aren't too specific about the subject form, and you aren't specific about the To: form. That leaves

So lets change it to sa-update doesn't

2007-08-12 Thread Gene Heskett
On Sunday 12 August 2007, Kai Schaetzl wrote: Gene Heskett wrote on Sat, 11 Aug 2007 23:43:38 -0400: 1: sa-update is NOT pulling new PDFInfo.pm or pdfinfo.cf files even when they are available. of course not! And why not? They've been announced as available, so one would assume a simple run

rewrite_header To not work for collect spam mail to one account

2007-08-12 Thread tangaish.en
hi,everyone! I want use rewrite_header To rewrite the spam mail rcpt to: address to one accont named [EMAIL PROTECTED], I know there's private problem, but the mail box is for business use only, the user ask administrator(me) to pick up normal mail from spam mark mails, I really hate this work

Re: MS outlook can't read parsed email... HELP!!

2007-08-12 Thread Evan Platt
At 08:19 PM 8/12/2007, lynk wrote: I'm totally confused re this spamassassin thingy... i can't seem to get MS outlook to read the email i received (spam/ham) after spamassassin(3.1.9) scanned the message. You posted this 2 days ago. If no one answers again, I have two suggestions: First

Re: MS outlook can't read parsed email... HELP!!

2007-08-12 Thread Nigel Frankcom
On Sun, 12 Aug 2007 21:52:28 -0700, Evan Platt [EMAIL PROTECTED] wrote: At 08:19 PM 8/12/2007, lynk wrote: I'm totally confused re this spamassassin thingy... i can't seem to get MS outlook to read the email i received (spam/ham) after spamassassin(3.1.9) scanned the message. You posted this 2