Re: SURBL Usage Policy change

2008-11-12 Thread Dave Koontz
Jeff Chan wrote ... (11/11/2008 7:33 PM): Hi Micah, Thanks very much for the feedback. Does anyone know how many non-profits have more than 1,000 users (i.e., users with mailboxes)? The non-profit pricing is below ISPs and half that of regular end users. There are many non-profits out

Re: Question training the Bayse filter

2008-11-12 Thread Thomas Zastrow
Dear Karsten. Karsten Bräckelmann schrieb: On Tue, 2008-11-11 at 21:55 +0100, Thomas Zastrow wrote: I'm still not happy with my Spamassassin ... it don't recognizes a lot of Spam mails, even my Thunderbird with default properties recognizes more than SA. Every day, I train the Bayes filter

Re: SURBL Usage Policy change

2008-11-12 Thread Peter Nitschke
On 12/11/2008 at 1:15 PM Henrik K wrote: On Tue, Nov 11, 2008 at 04:33:50PM -0800, Jeff Chan wrote: Hi Micah, Thanks very much for the feedback. Does anyone know how many non-profits have more than 1,000 users (i.e., users with mailboxes)? The non-profit pricing is below ISPs and half

Re: Funds / Award release scams poor scoring

2008-11-12 Thread John Hardin
On Wed, 12 Nov 2008, Justin Mason wrote: John Hardin writes: Check out the sought-fraud ruleset. http://svn.apache.org/viewvc/spamassassin/rules/trunk/sandbox/jm/20_sought_fraud.cf (I don't know if it's in sa-update yet - Justin?) That's in sa-update since last night; it's now bundled in

Re: SURBL Usage Policy change

2008-11-12 Thread SM
At 16:58 11-11-2008, Dave Koontz wrote: Given this change in SURBL in policy and pricing, I would strongly suggest removing their rules from the SA rule base. Otherwise, you will likely get lots of complaints from users of systems that have embedded SA installs, or others who do not monitor

Major spam source, McColo, knocked offline

2008-11-12 Thread Bill Landry
Found this posted on another list, thought others here might find this of interest, as well. Major Source of Online Scams and Spams Knocked Offline: http://voices.washingtonpost.com/securityfix/2008/11/major_source_of_online_scams_a.html SpamCop.net - Total spam report volume:

Re: Spamassassin+amavis

2008-11-12 Thread Luis Croker
Hi this mail ius just to say thanks all the people kindly sent me a mail trying to figure out the low performance in my server. Right now the server is working well and filtering like I wish. The changes I did were decrease the number of amavisd processes to 5, turned off DCC, the

Re: Major spam source, McColo, knocked offline

2008-11-12 Thread Matthias Leisi
SpamCop.net - Total spam report volume: http://www.spamcop.net/spamgraph.shtml?spamweek I first thought my stats are broken, but it seems they are still working as they did before - note the share-price-like drop beginning sometime after 22:00 UTC yesterday. (These mrtg charts are not mail

Re: SURBL Usage Policy change

2008-11-12 Thread Peter Nitschke
On 11/11/2008 at 7:58 PM Dave Koontz wrote: There are many non-profits out there that will hit your limits... I don't think anyone knows how many there are. 1,000 users is fairly trivial, and most non profits won't even be able to fill in your forms second required field of how many messages on

Re: sa-update fails suddenly

2008-11-12 Thread Justin Mason
What about spamassassin -D --lint? btw I suspect this is from having 2 versions of SpamAssassin installed, and/or 2 versions of perl, colliding with each other. --j. Michael Monnerie writes: On Mittwoch, 12. November 2008 Justin Mason wrote: Are you using the sought ruleset?  I updated

Re: SURBL Usage Policy change

2008-11-12 Thread Matus UHLAR - fantomas
On 12.11.08 21:56, Peter Nitschke wrote: Read the entire sentence. Please note that free public DNS queries for organizations smaller than 1,000 users or processing fewer than 250,000 messages per day is unchanged. So you could have 1,000,000 users but less than 250,000 messages per

Re: Funds / Award release scams poor scoring

2008-11-12 Thread Micah Anderson
* Justin Mason [EMAIL PROTECTED] [2008-11-12 05:20-0500]: John Hardin writes: On Sun, 9 Nov 2008, Micah Anderson wrote: Does anyone have any rules to catch these, or suggestions of scores to tweak to make these hit better? I am running clamav-milter with the sanesecurity add-ons,

Re: SURBL Usage Policy change

2008-11-12 Thread Henrik K
On Tue, Nov 11, 2008 at 07:58:01PM -0500, Dave Koontz wrote: Given this change in SURBL in policy and pricing, I would strongly suggest removing their rules from the SA rule base. Otherwise, you will likely get lots of complaints from users of systems that have embedded SA installs, or

Re: Overriding user prefs in local.cf

2008-11-12 Thread Micah Anderson
Matt Kettler [EMAIL PROTECTED] writes: Micah Anderson wrote: I set some 'add_header' options in my global local.cf and could not figure out why they were not being applied. It turns out that because I am using SQL user_prefs, any add_header lines I put in local.cf are just ignored (even

Re: SURBL Usage Policy change

2008-11-12 Thread Matus UHLAR - fantomas
On 12.11.08 13:00, Matus UHLAR - fantomas wrote: In another mail to surbl list it was mentioned that any organization who has more than 1000 users or processes 25 messages per day, the feed must be set up and charge paid. That meant you need to have =1000 users AND process =25

Re: SURBL Usage Policy change

2008-11-12 Thread Jeff Chan
On Wednesday, November 12, 2008, 2:33:53 AM, Peter Nitschke wrote: On 11/11/2008 at 7:58 PM Dave Koontz wrote: There are many non-profits out there that will hit your limits... I don't think anyone knows how many there are. 1,000 users is fairly trivial, and most non profits won't even be able

sa-update fails suddenly

2008-11-12 Thread Michael Monnerie
Without changing anything my sa-update suddenly fails badly. Can someone give me a hint? Subroutine check_for_from_dns redefined at /usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/EvalTests.pm line 1429. plugin: failed to parse plugin (from @INC): Bareword

Re: Funds / Award release scams poor scoring

2008-11-12 Thread Justin Mason
Micah Anderson writes: * Justin Mason [EMAIL PROTECTED] [2008-11-12 05:20-0500]: John Hardin writes: On Sun, 9 Nov 2008, Micah Anderson wrote: Does anyone have any rules to catch these, or suggestions of scores to tweak to make these hit better? I am running clamav-milter

Re: Question training the Bayse filter

2008-11-12 Thread Karsten Bräckelmann
On Wed, 2008-11-12 at 12:24 +0100, Thomas Zastrow wrote: Karsten Bräckelmann schrieb: On Tue, 2008-11-11 at 21:55 +0100, Thomas Zastrow wrote: I'm still not happy with my Spamassassin ... it don't recognizes a lot of Spam mails, even my Thunderbird with default properties recognizes

Re: SURBL Usage Policy change

2008-11-12 Thread Joseph Brennan
Jeff Chan [EMAIL PROTECTED] wrote: Does anyone know how many non-profits have more than 1,000 users (i.e., users with mailboxes)? Most universities and colleges have many more than that. An undergrad-only school that admits only about 200 a year would pass that number, counting faculty

Re: SURBL Usage Policy change

2008-11-12 Thread Henrik K
On Tue, Nov 11, 2008 at 04:33:50PM -0800, Jeff Chan wrote: Hi Micah, Thanks very much for the feedback. Does anyone know how many non-profits have more than 1,000 users (i.e., users with mailboxes)? The non-profit pricing is below ISPs and half that of regular end users. Sometimes the

Re: SURBL Usage Policy change

2008-11-12 Thread Raymond Dijkxhoorn
Hi! Given this change in SURBL in policy and pricing, I would strongly suggest removing their rules from the SA rule base. Otherwise, you will likely get lots of complaints from users of systems that have embedded SA installs, or others who do not monitor this list. I can see many Barracuda

Re: sa-update fails suddenly

2008-11-12 Thread Michael Monnerie
On Mittwoch, 12. November 2008 Justin Mason wrote: Are you using the sought ruleset?  I updated that last night to bundle the new anti-fraud component.   However it all looks fine and I can't see a bug that would cause those errors... Oh, my first mail to the list arrived, so I seem to not get

Re: Barracuda RBL

2008-11-12 Thread mouss
Sujit Acharyya-Choudhury wrote: I would like to use the free barracuda RBL with SpamAssassin. Is there any rule for that yet? I've been usingthis: ifplugin Mail::SpamAssassin::Plugin::DNSEval header RCVD_IN_BRBL eval:check_rbl('brbl-lastexternal', 'bb.barracudacentral.org.')

Re: Funds / Award release scams poor scoring

2008-11-12 Thread Justin Mason
John Hardin writes: On Sun, 9 Nov 2008, Micah Anderson wrote: Does anyone have any rules to catch these, or suggestions of scores to tweak to make these hit better? I am running clamav-milter with the sanesecurity add-ons, but these are still making it through. Check out the

Re: SURBL Usage Policy change

2008-11-12 Thread Karsten Bräckelmann
On Wed, 2008-11-12 at 13:00 +0100, Matus UHLAR - fantomas wrote: On 12.11.08 21:56, Peter Nitschke wrote: Read the entire sentence. Please note that free public DNS queries for organizations smaller than 1,000 users or processing fewer than 250,000 messages per day is unchanged.

RE: SURBL Usage Policy change

2008-11-12 Thread Rosenbaum, Larry M.
Where is the price list? I haven't been able to find it. -Original Message- From: Joseph Brennan [mailto:[EMAIL PROTECTED] Sent: Wednesday, November 12, 2008 12:25 PM To: users@spamassassin.apache.org Subject: Re: SURBL Usage Policy change Jeff Chan [EMAIL PROTECTED] wrote:

Re: sa-update fails suddenly

2008-11-12 Thread Justin Mason
Michael Monnerie writes: Without changing anything my sa-update suddenly fails badly. Can someone give me a hint? Are you using the sought ruleset? I updated that last night to bundle the new anti-fraud component. However it all looks fine and I can't see a bug that would cause those

Re: sa-update fails suddenly

2008-11-12 Thread Matus UHLAR - fantomas
On 12.11.08 11:24, Michael Monnerie wrote: Without changing anything my sa-update suddenly fails badly. Can someone give me a hint? HAven't you changed or upgraded perl or any of its libraries? Subroutine check_for_from_dns redefined at

Re: SURBL Usage Policy change

2008-11-12 Thread Henrik K
On Wed, Nov 12, 2008 at 09:56:46PM +1030, Peter Nitschke wrote: Read the entire sentence. Please note that free public DNS queries for organizations smaller than 1,000 users or processing fewer than 250,000 messages per day is unchanged. So you could have 1,000,000 users but less than

Re: SURBL Usage Policy change

2008-11-12 Thread Jeff Chan
On Wednesday, November 12, 2008, 10:55:52 AM, Larry Rosenbaum wrote: Where is the price list? I haven't been able to find it. Hi Larry, The pricing calculator is the first step of the data feed form: http://www.surbl.org/datafeed/ Jeff C. -- Jeff Chan mailto:[EMAIL PROTECTED]

Re: SURBL Usage Policy change

2008-11-12 Thread Jeff Chan
On Wednesday, November 12, 2008, 3:15:26 AM, Henrik K wrote: On Tue, Nov 11, 2008 at 04:33:50PM -0800, Jeff Chan wrote: Hi Micah, Thanks very much for the feedback. Does anyone know how many non-profits have more than 1,000 users (i.e., users with mailboxes)? The non-profit pricing is

SA Score

2008-11-12 Thread Josie Walls
Hello All, Can anyone provide insight into what this means and how to rectify it?: 2.9 TVD_SPACE_RATIO BODY: TVD_SPACE_RATIO Thanks so much for your help. Kindest Regards, Josie Josie Walls Senior Email Deliverability Manager WhatCounts, Inc. Business Email, RSS, Mobile,

Re: SA Score

2008-11-12 Thread mouss
Josie Walls wrote: Hello All, Can anyone provide insight into what this means and how to rectify it?: 2.9 TVD_SPACE_RATIO BODY: TVD_SPACE_RATIO http://wiki.apache.org/spamassassin/Rules/TVD_SPACE_RATIO

Re: SURBL Usage Policy change

2008-11-12 Thread Kenneth Porter
On Wednesday, November 12, 2008 1:28 PM +0100 Matthias Leisi [EMAIL PROTECTED] wrote: Number of users or number of messages is a good approximation of the number of actual DNS queries, and sufficiently simple to determine. At dnswl.org, we consider any source (being losely defined as a /24

RE: Barracuda RBL

2008-11-12 Thread Sujit Acharyya-Choudhury
A bit confused after reading all the mail. Would the following rule score 2.0 points and reduce FP? ifplugin Mail::SpamAssassin::Plugin::DNSEval header __RCVD_IN_BRBL eval:check_rbl('brbl','bb.barracudacentral.org') tflags __RCVD_IN_BRBL net header RCVD_IN_BRBL

Re: SURBL Usage Policy change

2008-11-12 Thread Jeff Chan
On Tuesday, November 11, 2008, 4:58:01 PM, Dave Koontz wrote: Jeff Chan wrote ... (11/11/2008 7:33 PM): Hi Micah, Thanks very much for the feedback. Does anyone know how many non-profits have more than 1,000 users (i.e., users with mailboxes)? The non-profit pricing is below ISPs and half

Re: SURBL Usage Policy change

2008-11-12 Thread Matthias Leisi
Kenneth Porter schrieb: At dnswl.org, we consider any source (being losely defined as a /24 doing more than 100'000 queries / 24 hours as a large user, and ask them to switch to rsync access (however this is not strongly enforced at present, and does not involve money). Does it help to

USER_IN_WHITELIST triggered but whitelist_from* not in my config

2008-11-12 Thread robanna
Lately, we've been getting a bunch of spam with negative scores because it has triggered USER_IN_WHITELIST but we don't use whitelist_from*. About 2 weeks ago I removed whitelist_from_rcvd. Could it still be triggering it. Maybe the spam was sent a few weeks ago and just now being deliver to the

Re: sa-update fails suddenly

2008-11-12 Thread Michael Monnerie
On Mittwoch, 12. November 2008 Justin Mason wrote: Are you using the sought ruleset?  I updated that last night to bundle the new anti-fraud component.   However it all looks fine and I can't see a bug that would cause those errors... I've got confirmation that I have been re-subscribed now.

Re: SURBL Usage Policy change

2008-11-12 Thread Matthias Leisi
I don't understand what users have to do in this context. It's the queries that affect DNS servers. It's obviously true that the number of queries is the cause for introducing any limitation/pricing scheme. But it's pretty hard for a receiving site to actually know how many DNS queries they're

Re: USER_IN_WHITELIST triggered but whitelist_from* not in my config

2008-11-12 Thread robanna
Nevermind. Someone has whitelisted our url in user-prefs. robanna wrote: Lately, we've been getting a bunch of spam with negative scores because it has triggered USER_IN_WHITELIST but we don't use whitelist_from*. About 2 weeks ago I removed whitelist_from_rcvd. Could it still be

Spamassassin Restart and E-Mail being scanned at time of restart.

2008-11-12 Thread Michael Hutchinson
Hello Everyone, I am wondering, what happens to E-Mail that is being scanned when the root user on the mail system restarts Spamassassin? I see lots of Spamd children before it is restarted and they suddenly all drop off on a restart (as expected) - do the E-Mail's being scanned at that time

Re: Razor2 and Windoze

2008-11-12 Thread Bret Miller
No... I'd say if it's working for you, then no worries. I'll have to try installing it again when I have a chance. Perhaps it matters what kind of compiler you use for installing too... Bret On 11/10/2008 6:04 AM, Dan Barker wrote: I read it on the internet (so it has to be trueg) that

Re: Major spam source, McColo, knocked offline

2008-11-12 Thread fchan
I seen the similar statistics on my mail server. I saw a drop of spam since this morning which I normally see the daily spike of spam. I wish this lull in spam will last awhile since my mail server needs a break :-) Frank SpamCop.net - Total spam report volume:

Re: Major spam source, McColo, knocked offline

2008-11-12 Thread Arvid Ephraim Picciani
SpamCop.net - Total spam report volume: http://www.spamcop.net/spamgraph.shtml?spamweek I first thought my stats are broken, but it seems they are still working as they did before - note the share-price-like drop beginning sometime after 22:00 UTC yesterday. can't see any drop here. in

Re: Spamassassin+amavis

2008-11-12 Thread John Hardin
On Wed, 12 Nov 2008, Luis Croker wrote: turned off DCC, the network tests and install the DNS service locallly. Turning off the network tests will obscure any benefit from installing a local caching DNS server. Try turning the network tests on for a while and see whether your performance

Re: Major spam source, McColo, knocked offline

2008-11-12 Thread Martin Gregorie
On Thu, 2008-11-13 at 01:16 +0100, Arvid Ephraim Picciani wrote: why would all spam come from a single network anyway? Turning off that one network would stop spam from a bot net if the bot-herder's command server(s) are there. Martin

Re: Major spam source, McColo, knocked offline

2008-11-12 Thread Ned Slider
Martin Gregorie wrote: On Thu, 2008-11-13 at 01:16 +0100, Arvid Ephraim Picciani wrote: why would all spam come from a single network anyway? Turning off that one network would stop spam from a bot net if the bot-herder's command server(s) are there. Martin SpamCop's weekly graph

Re: Major spam source, McColo, knocked offline

2008-11-12 Thread Robert Schetterer
fchan schrieb: I seen the similar statistics on my mail server. I saw a drop of spam since this morning which I normally see the daily spike of spam. I wish this lull in spam will last awhile since my mail server needs a break :-) Frank SpamCop.net - Total spam report volume:

Re: sa-update fails suddenly

2008-11-12 Thread Michael Monnerie
On Donnerstag, 13. November 2008 Michael Monnerie wrote: Without changing anything Bah, found the bug, it was a PEBKAC. Some stupid installed SA 3.1.8 from the openSUSE DVD, while we were at 3.2.5. Reverted to 3.2.5, runs smooth as it should. Sorry for the fuzz. mfg zmi -- // Michael

Re: SURBL Usage Policy change

2008-11-12 Thread Peter Nitschke
On 12/11/2008 at 12:45 PM Jeff Chan wrote: On Wednesday, November 12, 2008, 3:15:26 AM, Henrik K wrote: On Tue, Nov 11, 2008 at 04:33:50PM -0800, Jeff Chan wrote: Hi Micah, Thanks very much for the feedback. Does anyone know how many non-profits have more than 1,000 users (i.e., users with

419 cheapskates

2008-11-12 Thread John Hardin
On Thu, 13 Nov 2008, cyrilla johnson wrote: Dearest One, I'm Ms Cyrilla Johnson, Pls I'm seeking for your attention to assist me in transfering sum of (US$10.5) to you. It's Deposited in a security company here in Cote d'ivoire by My late father but my uncle is a total trait to my life. More

Re: Spamassassin Restart and E-Mail being scanned at time of restart.

2008-11-12 Thread SM
Hi Michael, At 14:45 12-11-2008, Michael Hutchinson wrote: I am wondering, what happens to E-Mail that is being scanned when the root user on the mail system restarts Spamassassin? I see lots of Spamd children before it is restarted and they suddenly all drop off on a restart (as expected) –