Re: Image spam with inline jpeg image

2006-08-11 Thread Justin Mason
jdow writes: From: Jim Maul [EMAIL PROTECTED] Bowie Bailey wrote: It doesn't really matter to me who supports which pieces as long as they all work. Someone may be able to fix sa-update so that it can take over from RDJ, but as of now, that is not possible without configuring

Re: Image spam with inline jpeg image

2006-08-11 Thread Logan Shaw
On Fri, 11 Aug 2006, Justin Mason wrote: jdow writes: Nor does it make sense to use a tool, even if supplied with SpamAssassin, that is broken for performing updates. what's the broken part? Well, this may not qualify as broken, but I would say it's an undesirable behavior that, upon

RE: Image spam with inline jpeg image

2006-08-11 Thread Bret Miller
On Fri, 11 Aug 2006, Justin Mason wrote: jdow writes: Nor does it make sense to use a tool, even if supplied with SpamAssassin, that is broken for performing updates. what's the broken part? Well, this may not qualify as broken, but I would say it's an undesirable behavior that,

Re: Image spam with inline jpeg image

2006-08-11 Thread Justin Mason
Bret Miller writes: On Fri, 11 Aug 2006, Justin Mason wrote: jdow writes: Nor does it make sense to use a tool, even if supplied with SpamAssassin, that is broken for performing updates. what's the broken part? Well, this may not qualify as broken, but I would say it's an

RE: Image spam with inline jpeg image

2006-08-11 Thread Bret Miller
Bret Miller writes: On Fri, 11 Aug 2006, Justin Mason wrote: jdow writes: Nor does it make sense to use a tool, even if supplied with SpamAssassin, that is broken for performing updates. what's the broken part? Well, this may not qualify as broken, but I would

Re: Image spam with inline jpeg image

2006-08-11 Thread Theo Van Dinter
On Fri, Aug 11, 2006 at 10:14:46AM -0500, Logan Shaw wrote: What happens if the new set is broken? There's no easy way to revert to the last known good state. sa-update lint checks the new files in a separate temp area before installing them into the real directory. Only if lint succeeds

RE: sa-update broken? (was Image spam with inline jpeg image)

2006-08-11 Thread Bret Miller
On Fri, Aug 11, 2006 at 10:14:46AM -0500, Logan Shaw wrote: What happens if the new set is broken? There's no easy way to revert to the last known good state. sa-update lint checks the new files in a separate temp area before installing them into the real directory. Only if lint succeeds

Re: sa-update broken? (was Image spam with inline jpeg image)

2006-08-11 Thread Theo Van Dinter
I received/responded to this privately before it was also sent to the list, so paraphrasing below... On Fri, Aug 11, 2006 at 08:45:43AM -0700, Bret Miller wrote: But adding the option to archive will make at least some people more comfortable with running sa-update. So I added the bz ticket.

Re: Image spam with inline jpeg image

2006-08-11 Thread DAve
Bret Miller wrote: Bret Miller writes: On Fri, 11 Aug 2006, Justin Mason wrote: jdow writes: Nor does it make sense to use a tool, even if supplied with SpamAssassin, that is broken for performing updates. what's the broken part? Well, this may not qualify as broken, but I would say it's

Re: Image spam with inline jpeg image

2006-08-11 Thread Theo Van Dinter
On Fri, Aug 11, 2006 at 11:56:00AM -0400, DAve wrote: I think a status report would be a good option as well. SA already asks you for your admins email address at install time. Sending a report of what happened during the sa-update process would be very, very valuable. Hrm. I'd say feel

Re: Image spam with inline jpeg image

2006-08-11 Thread DAve
Theo Van Dinter wrote: On Fri, Aug 11, 2006 at 11:56:00AM -0400, DAve wrote: I think a status report would be a good option as well. SA already asks you for your admins email address at install time. Sending a report of what happened during the sa-update process would be very, very valuable.

Re: Image spam with inline jpeg image

2006-08-11 Thread jdow
From: Logan Shaw [EMAIL PROTECTED] On Fri, 11 Aug 2006, Justin Mason wrote: jdow writes: Nor does it make sense to use a tool, even if supplied with SpamAssassin, that is broken for performing updates. what's the broken part? Well, this may not qualify as broken, but I would say it's

Re: Image spam with inline jpeg image

2006-08-11 Thread jdow
From: Justin Mason [EMAIL PROTECTED] jdow writes: From: Jim Maul [EMAIL PROTECTED] Bowie Bailey wrote: It doesn't really matter to me who supports which pieces as long as they all work. Someone may be able to fix sa-update so that it can take over from RDJ, but as of now, that is

RE: Image spam with inline jpeg image

2006-08-11 Thread Kenneth Porter
--On Wednesday, August 09, 2006 3:54 PM -0500 Logan Shaw [EMAIL PROTECTED] wrote: This is purely a philosophical argument, but something seems wrong about the idea of using a package manager to manage volatile data files in /var. The problem is not the use of the package manager but the

Re: Image spam with inline jpeg image

2006-08-11 Thread Kenneth Porter
--On Wednesday, August 09, 2006 7:33 PM -0700 jdow [EMAIL PROTECTED] wrote: For about a femto-second, perhaps. There is too much YMMV involved with the SARE rule sets to make it practical as an rpm solution. True, this is the real problem with packaging SARE: There's no clear separation of

Re: Image spam with inline jpeg image

2006-08-11 Thread John D. Hardin
On Fri, 11 Aug 2006, Kenneth Porter wrote: --On Wednesday, August 09, 2006 7:33 PM -0700 jdow [EMAIL PROTECTED] wrote: For about a femto-second, perhaps. There is too much YMMV involved with the SARE rule sets to make it practical as an rpm solution. True, this is the real problem

RE: Image spam with inline jpeg image

2006-08-11 Thread Bret Miller
Nor does it make sense to use a tool, even if supplied with SpamAssassin, that is broken for performing updates. what's the broken part? Well, this may not qualify as broken, but I would say it's an undesirable behavior that, upon successful download of the new set of rules, it

Re: Image spam with inline jpeg image

2006-08-11 Thread jdow
From: Bret Miller [EMAIL PROTECTED] Nor does it make sense to use a tool, even if supplied with SpamAssassin, that is broken for performing updates. what's the broken part? Well, this may not qualify as broken, but I would say it's an undesirable behavior that, upon successful

RE: Image spam with inline jpeg image

2006-08-11 Thread Gary Funck
-Original Message- From: jdow [mailto:[EMAIL PROTECTED] Sent: Wednesday, August 09, 2006 7:33 PM Gary Funck wrote: Has anyone considered also supplying new rules in the form of rpm's available via a yum-compatible repository? It'd be nice to have the usual versioning and logging

RE: Image spam with inline jpeg image

2006-08-10 Thread Benny Pedersen
On Wed, August 9, 2006 22:01, Gary Funck wrote: could be done as a gateway to sa-update, perhaps providing the updates in other package formats as well. rpm packages does not install sa-update ? i know yum, but dont make it the better sa-update :-) it was worse enogh with rulesdujour --

RE: Image spam with inline jpeg image

2006-08-10 Thread Bret Miller
On Wed, 9 Aug 2006, Gary Funck wrote: Has anyone considered also supplying new rules in the form of rpm's available via a yum-compatible repository? It'd be nice to have the usual versioning and logging support as well as a central update facility. This could be done as a gateway

Re: Image spam with inline jpeg image

2006-08-10 Thread Jim Maul
Bowie Bailey wrote: Bret Miller wrote: On Wed, 9 Aug 2006, Gary Funck wrote: Has anyone considered also supplying new rules in the form of rpm's available via a yum-compatible repository? It'd be nice to have the usual versioning and logging support as well as a central update facility. This

Re: Image spam with inline jpeg image

2006-08-10 Thread Jim Maul
Bowie Bailey wrote: It doesn't really matter to me who supports which pieces as long as they all work. Someone may be able to fix sa-update so that it can take over from RDJ, but as of now, that is not possible without configuring about 62 sa-update channels (one for each ruleset RDJ manages).

RE: Image spam with inline jpeg image

2006-08-10 Thread Bowie Bailey
Jim Maul wrote: Bowie Bailey wrote: It doesn't really matter to me who supports which pieces as long as they all work. Someone may be able to fix sa-update so that it can take over from RDJ, but as of now, that is not possible without configuring about 62 sa-update channels (one

RE: Image spam with inline jpeg image

2006-08-10 Thread Michael Scheidell
-Original Message- From: Bowie Bailey [mailto:[EMAIL PROTECTED] Sent: Thursday, August 10, 2006 2:45 PM To: users@spamassassin.apache.org Subject: RE: Image spam with inline jpeg image Possibly. It depends on the overhead involved in setting up the channels. Plus, not all

RE: Image spam with inline jpeg image

2006-08-10 Thread Bowie Bailey
Michael Scheidell wrote: From: Bowie Bailey [mailto:[EMAIL PROTECTED] Possibly. It depends on the overhead involved in setting up the channels. Plus, not all of us want ALL 62 files! Some of the *[0-3] files say to use 70_abcd0.cf , or _1, or_2, or_3. Would need tome cf file for

Re: Image spam with inline jpeg image

2006-08-10 Thread Stuart Johnston
Bowie Bailey wrote: Michael Scheidell wrote: From: Bowie Bailey [mailto:[EMAIL PROTECTED] Possibly. It depends on the overhead involved in setting up the channels. Plus, not all of us want ALL 62 files! Some of the *[0-3] files say to use 70_abcd0.cf , or _1, or_2, or_3. Would need tome

RE: Image spam with inline jpeg image

2006-08-10 Thread Dave Koontz
Perhaps it could be as simple as only updating existing rules for your installation? In other words, you would have to download the CF file and install it first (but you would do this anyways to test!!!). Then sa-update could simply parse your rules directory and update rules found there

Re: Image spam with inline jpeg image

2006-08-10 Thread jdow
From: Jim Maul [EMAIL PROTECTED] Bowie Bailey wrote: It doesn't really matter to me who supports which pieces as long as they all work. Someone may be able to fix sa-update so that it can take over from RDJ, but as of now, that is not possible without configuring about 62 sa-update channels

Re: Image spam with inline jpeg image

2006-08-10 Thread Daryl C. W. O'Shea
On 8/11/2006 12:02 AM, jdow wrote: From: Jim Maul [EMAIL PROTECTED] Bowie Bailey wrote: It doesn't really matter to me who supports which pieces as long as they all work. Someone may be able to fix sa-update so that it can take over from RDJ, but as of now, that is not possible without

Image spam with inline jpeg image

2006-08-09 Thread Ramprasad
All my rulesets and the LARGO rules are for catching inline png and inline gif. Now I am getting stock spams with images like --=_NextPart_001_000C_01C6BBE8.11C02650-- --=_NextPart_000_000B_01C6BBE8.11BB4450 Content-Type: image/jpeg; name=militarism.jpg Content-Transfer-Encoding:

Re: Image spam with inline jpeg image

2006-08-09 Thread Dhawal Doshy
Ramprasad wrote: All my rulesets and the LARGO rules are for catching inline png and inline gif. Now I am getting stock spams with images like --=_NextPart_001_000C_01C6BBE8.11C02650-- --=_NextPart_000_000B_01C6BBE8.11BB4450 Content-Type: image/jpeg; name=militarism.jpg

Re: Image spam with inline jpeg image

2006-08-09 Thread Richard
-BEGIN PGP SIGNED MESSAGE- Hash: RIPEMD160 Are you using the updated version OR the one originally posted? http://www.rulesemporium.com/plugins.htm#imageinfo can the rules_du_jour script be config'd to pickup plugin updates as well? i'd guess more than just an add to

Re: Image spam with inline jpeg image

2006-08-09 Thread Ramprasad
http://www.rulesemporium.com/plugins.htm#imageinfo Updates: - added optimization changes by Theo Van Dinter - added jpeg support - added function image_named() - added function image_size_exact() - added function image_size_range() - added function image_to_text_ratio() - dhawal

Re: Image spam with inline jpeg image

2006-08-09 Thread MennovB
image-spam that got a LARGO score since the install last week, I don't get many of those spams.. Regards Menno -- View this message in context: http://www.nabble.com/Image-spam-with-inline-jpeg-image-tf2079118.html#a5728450 Sent from the SpamAssassin - Users forum at Nabble.com.

RE: Image spam with inline jpeg image

2006-08-09 Thread Gary Funck
Menno wrote: Ramprasad wrote: But still this mail is getting thru http://ecm.netcore.co.in/tmp/imagespam.txt I tested your mail here with the latest imageinfo.pm and it comes through indeed. The exact same one in .gif (same text, same background) was detected though. It was even my

Re: Image spam with inline jpeg image

2006-08-09 Thread Benny Pedersen
On Wed, August 9, 2006 16:39, Richard wrote: can the rules_du_jour script be config'd to pickup plugin updates as well? i'd guess more than just an add to TRUSTED_RULESETS everyone likes to have sa-update ruledujour now :-) rules_du_jour was done when sa-update did not exists -- Benny

Re: Image spam with inline jpeg image

2006-08-09 Thread Richard
-BEGIN PGP SIGNED MESSAGE- Hash: RIPEMD160 hi, can the rules_du_jour script be config'd to pickup plugin updates as well? i'd guess more than just an add to TRUSTED_RULESETS everyone likes to have sa-update ruledujour now :-) i'm sorry, i don't understand that sentence.

Re: Image spam with inline jpeg image

2006-08-09 Thread DAve
Richard wrote: -BEGIN PGP SIGNED MESSAGE- Hash: RIPEMD160 hi, can the rules_du_jour script be config'd to pickup plugin updates as well? i'd guess more than just an add to TRUSTED_RULESETS everyone likes to have sa-update ruledujour now :-) i'm sorry, i don't understand that

Re: Image spam with inline jpeg image

2006-08-09 Thread Theo Van Dinter
On Wed, Aug 09, 2006 at 09:58:19AM -0700, Richard wrote: rules_du_jour was done when sa-update did not exists are you implying that sa-update replaces rules-du-jour? That depends on what you mean by replaces. i though sa-update updates the SA distro's bundled rules, but NOT any additional

Re: Image spam with inline jpeg image

2006-08-09 Thread Spamassassin List
- Original Message - From: Gary Funck [EMAIL PROTECTED] To: users@spamassassin.apache.org Sent: Thursday, August 10, 2006 12:04 AM Subject: RE: Image spam with inline jpeg image Menno wrote: Ramprasad wrote: But still this mail is getting thru http://ecm.netcore.co.in/tmp

RE: Image spam with inline jpeg image

2006-08-09 Thread Gary Funck
Theo wrote (in part): sa-update is a generic tool that lets users download channels (ie: bundles of rules/plugins) from anywhere that decides to publish them (requires a certain setup, etc.) At the moment, the only published channel that I know of is updates.spamassassin.org. (all

RE: Image spam with inline jpeg image

2006-08-09 Thread Logan Shaw
On Wed, 9 Aug 2006, Gary Funck wrote: Has anyone considered also supplying new rules in the form of rpm's available via a yum-compatible repository? It'd be nice to have the usual versioning and logging support as well as a central update facility. This could be done as a gateway to sa-update,

RE: Image spam with inline jpeg image

2006-08-09 Thread Bowie Bailey
Logan Shaw wrote: On Wed, 9 Aug 2006, Gary Funck wrote: Has anyone considered also supplying new rules in the form of rpm's available via a yum-compatible repository? It'd be nice to have the usual versioning and logging support as well as a central update facility. This could be done

Re: Image spam with inline jpeg image

2006-08-09 Thread jdow
From: Theo Van Dinter [EMAIL PROTECTED] There's nothing stoping the SARE folks from publishing a single or a bunch of channels and getting rid of RDJ in favor of sa-update if they wanted to... There are some benefits either way I suppose, and I'm biased towards sa-update of course. :| Um,

Re: Image spam with inline jpeg image

2006-08-09 Thread jdow
From: Gary Funck [EMAIL PROTECTED] Theo wrote (in part): sa-update is a generic tool that lets users download channels (ie: bundles of rules/plugins) from anywhere that decides to publish them (requires a certain setup, etc.) At the moment, the only published channel that I know of is