Re: Filtering zip spam

2010-04-29 Thread ram
On Tue, 2010-04-27 at 11:08 -0400, Alex wrote: Hi, Might as well just block all of \.fr at smtp time for that matter :-) Poor France :( I mostly do... au revoir Le France Somewhat off-topic, but in the interest of increasing awareness, India reportedly ranks first:

Bayes spam and ham out of proportion

2010-04-29 Thread Frank Bures
I've been running spamassassin for years. I am using auto-learn with very conservative thresholds. However, after several years of usage my spam database is about three time larger than my ham database and I am starting to see false positives. Is there a way how to shrink the spam database?

Re: Bayes spam and ham out of proportion

2010-04-29 Thread Matus UHLAR - fantomas
On 29.04.10 08:25, Frank Bures wrote: I've been running spamassassin for years. I am using auto-learn with very conservative thresholds. However, after several years of usage my spam database is about three time larger than my ham database and I am starting to see false positives. Is

[Copfilter] Copy of quarantined email - *** SPAM *** [8.9/7.0] Re: Filtering zip spam

2010-04-29 Thread babedh-d...@biggdog.biz
Hi, Alex, does Bayes understand/check INSIDE zips, at least for file properties?  If not, then it is inherently limited (just in this I'm not sure if you're asking me rhetorically here. I really don't know. Is it enough that bayes finds the encoded string as the attachment, and matches that

Re: checking and processing scores different

2010-04-29 Thread Raphael Bauduin
Hi, sorry for taking so long to come back with the headers, but here they are finally: http://pastebin.org/192054 Does this help? Thanks for your help Raphaël On Wed, Apr 21, 2010 at 3:28 PM, Bowie Bailey bowie_bai...@buc.com wrote: Raphael Bauduin wrote: Hi, I'm trying to help someone

Re: ING Direct mail FPing on TVD_ rules - also TO_EQ_FROM root subrules

2010-04-29 Thread John Hardin
On Wed, 28 Apr 2010, Kris Deugau wrote: Michael Scheidell wrote: On 4/28/10 3:13 PM, Kris Deugau wrote: 0.0 TO_EQ_FM_HTML_ONLY To == From and HTML only 0.0 TO_EQ_FM_DIRECT_MX To == From and direct-to-MX 1.7 TO_EQ_FM_HTML_DIRECT To == From and HTML only, direct-to-MX so.

Re: Bayes spam and ham out of proportion

2010-04-29 Thread Jason Bertoch
On 2010/04/29 8:25 AM, Frank Bures wrote: I've been running spamassassin for years. I am using auto-learn with very conservative thresholds. However, after several years of usage my spam database is about three time larger than my ham database and I am starting to see false positives. Is

Re: ING Direct mail FPing on TVD_ rules - also TO_EQ_FROM root subrules

2010-04-29 Thread Kris Deugau
John Hardin wrote: On 4/28/10 3:13 PM, Kris Deugau wrote: 0.0 TO_EQ_FM_HTML_ONLY To == From and HTML only 0.0 TO_EQ_FM_DIRECT_MX To == From and direct-to-MX 1.7 TO_EQ_FM_HTML_DIRECT To == From and HTML only, direct-to-MX There was a bug in handling bare addresses in the

Re: Bayes spam and ham out of proportion

2010-04-29 Thread RW
On Thu, 29 Apr 2010 08:25:29 -0400 Frank Bures lisfr...@chem.toronto.edu wrote: I've been running spamassassin for years. I am using auto-learn with very conservative thresholds. However, after several years of usage my spam database is about three time larger than my ham database and I am

Re: checking and processing scores different

2010-04-29 Thread Jonas Eckerman
On 2010-04-29 14:58, Raphael Bauduin wrote: The difference is: * BAYES_95 in place of BAYES_05 * score is 6.9 in place of 3.9 http://pastebin.org/192054 As you say the mail has been processed twice, with different configurations or databases, or with the same databases but different

RE: Bayes spam and ham out of proportion

2010-04-29 Thread Giampaolo Tomassoni
On Thu, 29 Apr 2010 08:25:29 -0400 Frank Bures lisfr...@chem.toronto.edu wrote: what you need to do write a script that divides the metadata num_spam value and all the token Nspam counts by 3. The updated database can then be loaded back in with --restore. I don't know if this is going to be

Re: Spamassassin rewriting headers of messages that are not marked Spam

2010-04-29 Thread Alex
Hi, This is the entire content of my local.cf: required_hits 5 report_safe 0 rewrite_header Subject [SPAM] I don't think that's the best configuration either. You should start with a default local.cf, then. You might also try enabling some debugging to trace the loading of plugin-ins and

Re: Bayes spam and ham out of proportion

2010-04-29 Thread Alex
Hi, I would instead, in order of effectiveness:        a) expire old tokens;        b) eliminate tokens with very few ham/spam occurrences.        c) eliminate tokens with very close nham to nspam values; Can you explain how to do this, or point to documentation that would explain? My

Re: ING Direct mail FPing on TVD_ rules - also TO_EQ_FROM root subrules

2010-04-29 Thread John Hardin
On Thu, 29 Apr 2010, Kris Deugau wrote: John Hardin wrote: On 4/28/10 3:13 PM, Kris Deugau wrote: 0.0 TO_EQ_FM_HTML_ONLY To == From and HTML only 0.0 TO_EQ_FM_DIRECT_MX To == From and direct-to-MX 1.7 TO_EQ_FM_HTML_DIRECT To == From and HTML only, direct-to-MX

RE: Bayes spam and ham out of proportion

2010-04-29 Thread Giampaolo Tomassoni
Hi, I would instead, in order of effectiveness:        a) expire old tokens;        b) eliminate tokens with very few ham/spam occurrences.        c) eliminate tokens with very close nham to nspam values; Can you explain how to do this, or point to documentation that would

Re: ING Direct mail FPing on TVD_ rules - also TO_EQ_FROM root subrules

2010-04-29 Thread Kris Deugau
John Hardin wrote: On Thu, 29 Apr 2010, Kris Deugau wrote: I don't see anything obviously wrong with the root From == To meta subrules: header __TO_EQ_FROM_1 ALL =~ /\nFrom:[^\n]{0,80}?([^\n\s]+)?\n(?:[^\n]{1,100}\n)*To:[^\n]+\1/ism header __TO_EQ_FROM_2

RE: new PDF Launch malware exploit (with sample)

2010-04-29 Thread Rosenbaum, Larry M.
From: d.h...@yournetplus.com [mailto:d.h...@yournetplus.com] Sent: Wednesday, April 28, 2010 2:29 PM To: users@spamassassin.apache.org Subject: RE: new PDF Launch malware exploit (with sample) Quoting Rosenbaum, Larry M. rosenbau...@ornl.gov: Please don't send live malware samples to

Re: Bayes spam and ham out of proportion

2010-04-29 Thread RW
On Thu, 29 Apr 2010 18:32:04 +0200 Giampaolo Tomassoni g.tomass...@libero.it wrote: what you need to do write a script that divides the metadata num_spam value and all the token Nspam counts by 3. The updated database can then be loaded back in with --restore. I don't know if this is

Re: Bayes spam and ham out of proportion

2010-04-29 Thread Matt Kettler
On 4/29/2010 8:25 AM, Frank Bures wrote: I've been running spamassassin for years. I am using auto-learn with very conservative thresholds. However, after several years of usage my spam database is about three time larger than my ham database and I am starting to see false positives. Is

GPL rules

2010-04-29 Thread Luis Daniel Lucio Quiroz
Hi all, I wonder if someone knows about GPL rules for SA, i know the SARE what others? TIA LD

Re: spamd[18549]: config: failed to parse line, skipping, in /etc/mail/spamassassin/local.cf: use_auto_whitelist 1

2010-04-29 Thread ram
On Wed, Apr 28, 2010 at 10:11 PM, Benny Pedersen m...@junc.org wrote: On ons 28 apr 2010 10:55:10 CEST, ram wrote /usr/bin/spamd -V SpamAssassin Server version 3.3.1 running on Perl 5.8.8 with SSL support (IO::Socket::SSL 1.01) with zlib support (Compress::Zlib 1.42) spamassassin

Re: spamd[18549]: config: failed to parse line, skipping, in /etc/mail/spamassassin/local.cf: use_auto_whitelist 1

2010-04-29 Thread Benny Pedersen
On fre 30 apr 2010 06:21:18 CEST, ram wrote warn: lint: 1 issues detected, please rerun with debug enabled for more information what is it ? you already see the problem in that line press s in less to save the whole output if unsure what to do, and then pastebin it on a webpage and then

Re: spamd[18549]: config: failed to parse line, skipping, in /etc/mail/spamassassin/local.cf: use_auto_whitelist 1

2010-04-29 Thread Benny Pedersen
On fre 30 apr 2010 06:21:18 CEST, ram wrote warn: lint: 1 issues detected, please rerun with debug enabled for more information what is it ? you already see the problem in that line press s in less to save the whole output if unsure what to do, and then pastebin it on a webpage and then