Unicode right to left HTML override obsfucation

2005-11-18 Thread Sean Doherty
Is there any rules available for catching messages that use the unicode right to left override in HTML to reverse text (sample attached)? For instance 'H#8236;olle#8238; W#8236;dlro#8238;' would render as 'Hello World' I've seen a couple of these sneak thru recently. I don't want to create a

Re: SA 3.01 scoring very low

2004-11-04 Thread Sean Doherty
On Wed, 2004-11-03 at 21:40, Dave Goodrich wrote: Good afternoon, I just finished testing an upgrade of SA to 3.01 and my scores fell through the floor. Read the docs, tried to use the Wiki, followed everyone else's upgrade on the list. Not sure just what went wrong.

Re: {SPAM} SA 3.01 scoring very low

2004-11-04 Thread Sean Doherty
On Wed, 2004-11-03 at 21:52, Matt Kettler wrote: At 04:40 PM 11/3/2004, Dave Goodrich wrote: Good afternoon, I just finished testing an upgrade of SA to 3.01 and my scores fell through the floor. Read the docs, tried to use the Wiki, followed everyone else's upgrade on the list. Not sure

Re: SA 3.01 scoring very low

2004-11-04 Thread Sean Doherty
On Thu, 2004-11-04 at 14:14, Dave Goodrich wrote: Sean Doherty wrote: On Wed, 2004-11-03 at 21:40, Dave Goodrich wrote: Good afternoon, I just finished testing an upgrade of SA to 3.01 and my scores fell through the floor. Read the docs, tried to use the Wiki, followed everyone

Re: SA 3.01 scoring very low

2004-11-04 Thread Sean Doherty
On Thu, 2004-11-04 at 15:04, Dave Goodrich wrote: Check out trusted_network section of Mail::SpamAssassin::Conf i.e no RBL tests on trusted networks. If you're running with DNS checks enabled, SpamAssassin includes code to infer your trusted networks on the fly, so this may not be

Re: trusted_networks and ALL_TRUSTED

2004-11-02 Thread Sean Doherty
On Mon, 2004-11-01 at 18:24, Matt Kettler wrote: At 01:07 PM 11/1/2004, Sean Doherty wrote: so the *next* step must be the external MX. My 10.x server is inside a firewall which NATs port 25 so this conclusion is not correct. I imagine that my setup isn't all that different from a lot

Re: AWL and ABL Re: trusted_networks and ALL_TRUSTED

2004-11-02 Thread Sean Doherty
On Tue, 2004-11-02 at 12:50, George Georgalis wrote: Do you mean -0.001? Why would you want to penalise mail coming thru a trusted path? It really doesn't matter to me what the score is, I just want to disable the test. http://bugzilla.spamassassin.org/show_bug.cgi?id=3406 My

trusted_networks and ALL_TRUSTED

2004-11-01 Thread Sean Doherty
Hi, I'm looking for some clarification on trusted_networks, the ALL_TRUSTED rule, and in particular how trusted_networks are inferred if not specified in local.cf. Since upgrading to 3.0.1 I have seen an increase in false negatives, which would have otherwise been caught if not for the