RE: USPS Spam

2013-09-03 Thread Andrew Talbot
Just wanted to throw in my two cents here - I have spoken to USPS about this and they said that they never send out these messages unless the client requests them, and that it should be safe to completely block messages like this. The same cannot be said about UPS and FexEx, by the way.

SUBJ_ALL_CAPS

2013-08-20 Thread Andrew Talbot
Hey all - Does anybody know how long the string needs to be to trigger SUBJ_ALL_CAPS? I know it has to be multi-word and over a certain length. Was wondering the specific length. Thanks in advance J

Whitelisting subdomains?

2013-08-14 Thread Andrew Talbot
Hey, all - I'm trying to whitelist all our internal subdomains but I can't seem to get it to work. We have so many of them that it's impractical to do them individually. For instance, we have _...@logs.domain.com, @admin-sql.domani.com etc. etc. etc. I was thinking that whitelist_from

RE: PayPal spam filter?

2013-06-27 Thread Andrew Talbot
I just had to weigh in here to say that we have DCC_CHECK scored up to a 4, and all of these kinds of spam messages get caught by that because they always hit at least another 1 point worth of rules. Also, those two rules require plugins, I believe. -Original Message- From: Juerg

Chain rules?

2013-06-24 Thread Andrew Talbot
Hey all - Is there a way to chain rules together such that one rule will only fire if another is hit? Specifically, we have a client that is getting hit with a bunch of messages that are just links, but the links contain sex words. We want to do a body scan for a list of sex words if and

RE: Chain rules?

2013-06-24 Thread Andrew Talbot
@spamassassin.apache.org Subject: Re: Chain rules? On Mon, 24 Jun 2013, Andrew Talbot wrote: Is there a way to chain rules together such that one rule will only fire if another is hit? Specifically, we have a client that is getting hit with a bunch of messages that are just links

Rule to scan for .html attachments?

2013-05-31 Thread Andrew Talbot
Hey all - I'm trying to set up a custom rule that scores HTML attachments. The problem I'm running across is that using a rule like this one: mimeheader HTML_ATTACH Content-Type =~ /^text\/html/i Will flag all messages that come in as HTML (vs. plain text). I found this : header

Re: Rule to scan for .html attachments?

2013-05-31 Thread Andrew Talbot
That didn't work :( On Fri, May 31, 2013 at 12:40 PM, Martin Gregorie mar...@gregorie.orgwrote: On Fri, 2013-05-31 at 11:51 -0400, Andrew Talbot wrote: I'm trying to set up a custom rule that scores HTML attachments. ..snippage.. I found this : header HTML_ATTACH_RULE_2 Content

Re: Rule to scan for .html attachments?

2013-05-31 Thread Andrew Talbot
Didn't work with mime_header (or mimeheader) with either rule. On Fri, May 31, 2013 at 12:23 PM, Axb axb.li...@gmail.com wrote: On 05/31/2013 05:51 PM, Andrew Talbot wrote: Hey all - I'm trying to set up a custom rule that scores HTML attachments. The problem I'm running across

RE: Rule to scan for .html attachments?

2013-05-31 Thread Andrew Talbot
to scan for .html attachments? On Fri, 31 May 2013 14:10:36 -0400 Andrew Talbot andrew.talbot.ownweb...@gmail.com wrote: That didn't work :( What didn't work? Oh... you top-posted. Anyway... you might need a full rule, which can be expensive. Something like: full HTML_RULE /Content

RE: Rule to scan for .html attachments?

2013-05-31 Thread Andrew Talbot
attached. -Original Message- From: Martin Gregorie [mailto:mar...@gregorie.org] Sent: Friday, May 31, 2013 2:35 PM To: users@spamassassin.apache.org Subject: Re: Rule to scan for .html attachments? On Fri, 2013-05-31 at 14:10 -0400, Andrew Talbot wrote: That didn't work :( Can you

RE: Rule to scan for .html attachments?

2013-05-31 Thread Andrew Talbot
@spamassassin.apache.org Subject: Re: Rule to scan for .html attachments? On Fri, 2013-05-31 at 14:45 -0400, Andrew Talbot wrote: I need it to fire on any HTML attachment. The modules are enabled. I can get it to pick up text/html, remember, but the problem is that it detects messages sent

Re: Bayes + DCC / Bayes as a false-positive killer

2013-05-29 Thread Andrew Talbot
you for your response. On Tue, May 28, 2013 at 8:12 PM, Dave Warren da...@hireahit.com wrote: On 2013-05-28 13:43, Andrew Talbot wrote: As some of you may have known from talking with me over the past few weeks, I've been having a difficult time 'selling' my bosses on the idea of Bayes

Re: Bayes + DCC / Bayes as a false-positive killer

2013-05-29 Thread Andrew Talbot
Andrew Talbot wrote: Hey all - I've got two questions: 1- ... That said, I'm wondering if it's redundant to run DCC and Bayes at the same time? From what I understand, DCC is a subscription-based service, so it would be nice to be able to cut that cost out! It depends what you mean

Re: Bayes + DCC / Bayes as a false-positive killer

2013-05-29 Thread Andrew Talbot
AM, Matus UHLAR - fantomas uh...@fantomas.skwrote: On 28.05.13 16:43, Andrew Talbot wrote: That said, I'm wondering if it's redundant to run DCC and Bayes at the same time? From what I understand, DCC is a subscription-based service, so it would be nice to be able to cut that cost out

Bayes + DCC / Bayes as a false-positive killer

2013-05-28 Thread Andrew Talbot
Hey all - I've got two questions: 1- We're running Bayes and DCC on our server, and we've just been running Bayes locally to see how well it works. It's been about three weeks now so I finally really started poring over the results. One thing I noticed that I thought was a particularly

Bayes autolearning: logarithmic?

2013-05-22 Thread Andrew Talbot
Hey all - I set up Bayes with autolearning a few weeks ago. It took forever to get started, but now it seems like the learning speed has accelerated. Is the autolearning supposed to accelerate? I can't help but feel like it may just be feeding itself it's own data or something.

RE: Default Bayes Database

2013-05-10 Thread Andrew Talbot
. -Original Message- From: Karsten Bräckelmann [mailto:guent...@rudersport.de] Sent: Wednesday, May 08, 2013 8:18 PM To: users@spamassassin.apache.org Subject: Re: Default Bayes Database On Wed, 2013-05-08 at 14:09 -0400, Andrew Talbot wrote: Well, I certainly hope someone offers

Default Bayes Database

2013-05-08 Thread Andrew Talbot
Hey all - I remember seeing somewhere that there was a default Bayes database for Bayes to start using right away, but can't seem to find that information again on the Wiki or in my notes. Can someone please help?

RE: Default Bayes Database

2013-05-08 Thread Andrew Talbot
- From: Axb [mailto:axb.li...@gmail.com] Sent: Wednesday, May 08, 2013 1:32 PM To: users@spamassassin.apache.org Subject: Re: Default Bayes Database On 05/08/2013 07:26 PM, Andrew Talbot wrote: Hey all - I remember seeing somewhere that there was a default Bayes database for Bayes

Bayes Autolearning

2013-05-01 Thread Andrew Talbot
Hey All - I'm about to set up Bayes on one of our mail servers. A lot of the documentation says that I need to manually sift through a few hundred messages and classify them to 'teach' the filter, and it sounds like I may need to do that on an ongoing basis. That is not a very plausible

RE: Bayes Autolearning

2013-05-01 Thread Andrew Talbot
Subject: Re: Bayes Autolearning On 05/01/2013 08:01 PM, Andrew Talbot wrote: Any suggestions any of you have for a Bayes newbie - about what I just asked or otherwise - would be very much appreciated. I advocate autolearning as it has always worked fine for me. Can take a bit longer to see

RE: Bayes Autolearning

2013-05-01 Thread Andrew Talbot
Axb; the only thing I'd add to that is: bayes_auto_learn_on_error 1 Which prevents Bayes from over-training when the classifier already agrees with what the autolearn is trying to train on. Cheers, Steve. On 01/05/13 19:14, Axb wrote: On 05/01/2013 08:01 PM, Andrew Talbot wrote

RE: Bayes Autolearning

2013-05-01 Thread Andrew Talbot
, Andrew Talbot wrote: Hi, Seve - Thanks for your response. Is that just for performance reasons? Performance is one of the things that bayes_auto_learn_on_error 1 will give you. It means that if the message was already considered spam by Bayes, then the message won't be autolearnt

RE: More longer rules or fewer shorter ones?

2013-04-26 Thread Andrew Talbot
at 18:45 -0400, Andrew Talbot wrote: I like your point about the portmanteau rules (and I award you two Points for using one of my favorite words in a new - yet appropriate - manner!). :-) I never thought about scoring each rule as a 0.001 or something really low then tying them all

Re: More longer rules or fewer shorter ones?

2013-04-25 Thread Andrew Talbot
, 2013-04-24 at 12:32 -0400, Andrew Talbot wrote: I have my customized deployment split up into a bunch of separate CF files (by category) and I have those further split up into rules based on score. I also use very long rules, mainly due to spamiferous mailing lists, because all the headers

More longer rules or fewer shorter ones?

2013-04-24 Thread Andrew Talbot
Hey, all - I have my customized deployment split up into a bunch of separate CF files (by category) and I have those further split up into rules based on score. So, I have a bunch of stuff like: header RULE_1 Subject =~ /\b(this|that|theother|blah|blah)/i score RULE_1 1 describe

RE: More longer rules or fewer shorter ones?

2013-04-24 Thread Andrew Talbot
Subject: Re: More longer rules or fewer shorter ones? On Wed, 24 Apr 2013, Andrew Talbot wrote: Hey, all - I have my customized deployment split up into a bunch of separate CF files (by category) and I have those further split up into rules based on score. So, I have a bunch of stuff like

RE: More longer rules or fewer shorter ones?

2013-04-24 Thread Andrew Talbot
, April 24, 2013 1:53 PM To: users@spamassassin.apache.org Subject: RE: More longer rules or fewer shorter ones? On Wed, 24 Apr 2013, Andrew Talbot wrote: John, Thanks for your prompt response! A lot of the rules are big jumbles of rules we are generating in real time and adding