Re: complete false hits for BASE64 and LW_STOCK_SPAM4

2007-02-23 Thread Jo Rhett
On Feb 22, 2007, at 6:23 AM, Rob Anderson wrote: Jo...you catch more flies (fixes to your problems) with sugar (being nice, even if you don't want to) than with a machete (the way you are). I wasn't trying to be nice or mean. I'm working on real problems, and I reported them as problems

Re: complete false hits for BASE64 and LW_STOCK_SPAM4

2007-02-22 Thread Nigel Frankcom
Could the next person passing the record player give it a jolt? It seems to be stuck on the same track... and I wasn't too keen on this track the 1st few times I heard it either ;-D

Re: complete false hits for BASE64 and LW_STOCK_SPAM4

2007-02-22 Thread Rob Anderson
Jo Rhett [EMAIL PROTECTED] 02/22/07 01:20AM Loren Wilton wrote: 4.He then COMPLAINS that rules are causing him FPs and demands that the rules be changed. Your rule is matching against messages which it shouldn't. 5.He THEN claims I am lying and making false assertions when I

Re: complete false hits for BASE64 and LW_STOCK_SPAM4

2007-02-21 Thread Jo Rhett
Jo Rhett wrote: Can you explain how this isn't an FP in the standard config? There's absolutely nothing custom about my config, so what standard are you applying here? Again, I have a 100% stock SA configuration. Why do I need a custom rule to work around an FP in the ruleset? On Feb

Re: complete false hits for BASE64 and LW_STOCK_SPAM4

2007-02-21 Thread Jo Rhett
On Feb 9, 2007, at 2:53 AM, Matt Kettler wrote: I just assumed the __RATWARE_0_TZ_DATE half was picking up on the lack of a valid timezone. It's looking for the timezone to literally be +, which it is not. I over-looked that entirely. Jo, can you check your copy of this rule? The relevant

Re: complete false hits for BASE64 and LW_STOCK_SPAM4

2007-02-21 Thread Jo Rhett
On Feb 9, 2007, at 7:45 AM, SM wrote: Blackberry messages will hit the LW_STOCK_SPAM4 rule. There is nothing wrong with the LW_STOCK_SPAM4 rule as such. The overall score in a standard configuration with that rule added averages around two points. It shouldn't cause any false positives

Re: complete false hits for BASE64 and LW_STOCK_SPAM4

2007-02-21 Thread Jo Rhett
On Feb 9, 2007, at 9:34 AM, Adam Lanier wrote: On Fri, 2007-02-09 at 09:01 -0800, Jo Rhett wrote: It's really hard not to be really annoyed with this answer. What kind of nonsense did you think my question was? If LW_STOCK_SPAM is a SARE RULE, then I am requesting a revision to the SARE rule.

RE: complete false hits for BASE64 and LW_STOCK_SPAM4

2007-02-21 Thread Coffey, Neal
Jo Rhett wrote: You're making all sorts of claims that I can positively tell you are wrong. I have *NO* local customizations to SpamAssassin other than the use of SA-update to retrieve the recommended SARE rules. That would be the very definition of a local customization. Just sayin'.

Re: complete false hits for BASE64 and LW_STOCK_SPAM4

2007-02-21 Thread Doc Schneider
Jo Rhett wrote: If you want a change to a SARE rule, go talk to the SARE people. I am. They answer questions about the rules on this list, and nowhere else. I guess then the [EMAIL PROTECTED] list isn't where SARE helps with rules... news to me. Since I happen to run that list. --

Re: complete false hits for BASE64 and LW_STOCK_SPAM4

2007-02-21 Thread Kris Deugau
Jo Rhett wrote: And frankly I disagree with the logic that rules that hit wrongly shouldn't be fixed unless it raises the score about 5.0. I simply couldn't function with *ANY* of my mailboxes at 5.0 -- I'd be deleting 1-2 pieces of spam per minute. I run my public mailboxes at 3.8 and I'm

Re: complete false hits for BASE64 and LW_STOCK_SPAM4

2007-02-21 Thread SM
Hi Jo, At 12:36 21-02-2007, Jo Rhett wrote: However, all blackberry messages also hit base64 text and excess base64 which puts them right on the edge. Anything that hits any other rule will cause a problem. The alternatives are: 1. Fix the rule 2. Lower the score for the rule 3. Remove the

Re: complete false hits for BASE64 and LW_STOCK_SPAM4

2007-02-21 Thread Jo Rhett
On Feb 21, 2007, at 3:02 PM, Kris Deugau wrote: - (at least, once Bayes was part of SA g) feed missed spam back into Bayes manually to complement the autolearning (which worked pretty well for me, and without which I'd have very VERY little ham learned at all). I spent about a year

Re: complete false hits for BASE64 and LW_STOCK_SPAM4

2007-02-21 Thread Jo Rhett
On Feb 21, 2007, at 3:19 PM, SM wrote: At 12:36 21-02-2007, Jo Rhett wrote: However, all blackberry messages also hit base64 text and excess base64 which puts them right on the edge. Anything that hits any other rule will cause a problem. The alternatives are: 1. Fix the rule 2. Lower the

Re: complete false hits for BASE64 and LW_STOCK_SPAM4

2007-02-21 Thread Jo Rhett
On Feb 21, 2007, at 12:54 PM, Coffey, Neal wrote: Jo Rhett wrote: You're making all sorts of claims that I can positively tell you are wrong. I have *NO* local customizations to SpamAssassin other than the use of SA-update to retrieve the recommended SARE rules. That would be the very

Re: complete false hits for BASE64 and LW_STOCK_SPAM4

2007-02-21 Thread SM
Hi Jo, At 16:17 21-02-2007, Jo Rhett wrote: The point of sending a note about this to the mailing list is that this problem will effect *EVERYONE* who gets crackberry messages, and thus it could probably use a real fix instead of forcing everyone to fix it locally. The problem affects people

RE: complete false hits for BASE64 and LW_STOCK_SPAM4

2007-02-21 Thread R Lists06
However, all blackberry messages also hit base64 text and excess base64 which puts them right on the edge. Anything that hits any other rule will cause a problem. And frankly I disagree with the logic that rules that hit wrongly shouldn't be fixed unless it raises the score about 5.0.

Re: complete false hits for BASE64 and LW_STOCK_SPAM4

2007-02-21 Thread Jo Rhett
At 16:17 21-02-2007, Jo Rhett wrote: The point of sending a note about this to the mailing list is that this problem will effect *EVERYONE* who gets crackberry messages, and thus it could probably use a real fix instead of forcing everyone to fix it locally. SM wrote: The problem affects

Re: complete false hits for BASE64 and LW_STOCK_SPAM4

2007-02-21 Thread Loren Wilton
Jo Rhett wrote: And frankly I disagree with the logic that rules that hit wrongly shouldn't be fixed unless it raises the score about 5.0. I simply couldn't function with *ANY* of my mailboxes at 5.0 -- I'd be deleting 1-2 pieces of spam per minute. I run my public mailboxes at 3.8 and I'm

Re: complete false hits for BASE64 and LW_STOCK_SPAM4

2007-02-21 Thread Jo Rhett
Loren Wilton wrote: 4.He then COMPLAINS that rules are causing him FPs and demands that the rules be changed. Your rule is matching against messages which it shouldn't. 5.He THEN claims I am lying and making false assertions when I state that the rule in question (that I wrote) would

Re: complete false hits for BASE64 and LW_STOCK_SPAM4

2007-02-21 Thread JP Kelly
poof!

Re: complete false hits for BASE64 and LW_STOCK_SPAM4

2007-02-09 Thread Loren Wilton
Jo Rhett wrote: As for LW_STOCK_SPAM4, it's being triggered by the fact that the message In the standard config? No.. It's not a FP in the standard config, so there's no reason to modify it. Can you explain how this isn't an FP in the standard config? There's absolutely nothing custom

Re: complete false hits for BASE64 and LW_STOCK_SPAM4

2007-02-09 Thread Nick Leverton
On Friday 09 February 2007 09:00, Loren Wilton wrote: Jo Rhett wrote: As for LW_STOCK_SPAM4, it's being triggered by the fact that the message No you don't. I wrote that rule. That's why it starts with my initials. I didn't submit it to SA, and while it I think exists in SARE rules,

Re: complete false hits for BASE64 and LW_STOCK_SPAM4

2007-02-09 Thread Matt Kettler
Jo Rhett wrote: Again, I have a 100% stock SA configuration. No you don't have a 100% stock config. There are at least two differences relevant to them message you posted: 1) you have the SARE STOCKS ruleset. LW_STOCK_SPAM4 is NOT a stock spamassasssin rule. It's part of an add-on ruleset, not

Re: complete false hits for BASE64 and LW_STOCK_SPAM4

2007-02-09 Thread Matt Kettler
Loren Wilton wrote: Now, that said, the forwarded Blackberry message you posted would not have hit the rule in the first place, unless someone took my original rule and modified it. So you not only don't have a standard config, you have apparently locally-modified versions of rules you have

Re: complete false hits for BASE64 and LW_STOCK_SPAM4

2007-02-09 Thread Chris Lear
* Loren Wilton wrote (08/02/07 19:46): As for LW_STOCK_SPAM4, it's being triggered by the fact that the message is base-64 encoded text AND has a Date: header that's missing a proper timezone. Apparently a batch of stock spam went out at some point with both of these abnormal features. I have

Re: complete false hits for BASE64 and LW_STOCK_SPAM4

2007-02-09 Thread SM
At 01:00 09-02-2007, Loren Wilton wrote: Now, that said, the forwarded Blackberry message you posted would not have hit the rule in the first place, unless someone took my original rule and modified it. So you not only don't have a standard config, you have apparently locally-modified

Re: complete false hits for BASE64 and LW_STOCK_SPAM4

2007-02-09 Thread Jo Rhett
On Feb 9, 2007, at 2:41 AM, Matt Kettler wrote: Jo Rhett wrote: Again, I have a 100% stock SA configuration. No you don't have a 100% stock config. There are at least two differences relevant to them message you posted: 1) you have the SARE STOCKS ruleset. LW_STOCK_SPAM4 is NOT a stock

Re: complete false hits for BASE64 and LW_STOCK_SPAM4

2007-02-09 Thread Adam Lanier
On Fri, 2007-02-09 at 09:01 -0800, Jo Rhett wrote: On Feb 9, 2007, at 2:41 AM, Matt Kettler wrote: Jo Rhett wrote: Again, I have a 100% stock SA configuration. No you don't have a 100% stock config. There are at least two differences relevant to them message you posted: 1) you have

Re: complete false hits for BASE64 and LW_STOCK_SPAM4

2007-02-09 Thread Matt Kettler
Jo Rhett wrote: Why do I need a custom rule to work around an FP in the ruleset? See above. It's really hard not to be really annoyed with this answer. If you don't like my answers, you're free to not accept my help. But please keep in mind two things: 1) I often come across as more rude

Re: complete false hits for BASE64 and LW_STOCK_SPAM4

2007-02-08 Thread Adam Lanier
On Wed, 2007-02-07 at 23:31 -0500, Matt Kettler wrote: No, the charset isn't triggering the base64 rules. The fact that the Content-Transfer-Encoding declares the message is base-64 encoded is causing it. Content-Transfer-Encoding: base64 As for LW_STOCK_SPAM4, it's being triggered by the

Re: complete false hits for BASE64 and LW_STOCK_SPAM4

2007-02-08 Thread Jo Rhett
On Feb 7, 2007, at 8:31 PM, Matt Kettler wrote: As for LW_STOCK_SPAM4, it's being triggered by the fact that the message is base-64 encoded text AND has a Date: header that's missing a proper timezone. Apparently a batch of stock spam went out at some point with both of these abnormal

Re: complete false hits for BASE64 and LW_STOCK_SPAM4

2007-02-08 Thread Loren Wilton
As for LW_STOCK_SPAM4, it's being triggered by the fact that the message is base-64 encoded text AND has a Date: header that's missing a proper timezone. Apparently a batch of stock spam went out at some point with both of these abnormal features. I have to admit, it's a pretty rare combination.

Re: complete false hits for BASE64 and LW_STOCK_SPAM4

2007-02-08 Thread Matt Kettler
Jo Rhett wrote: On Feb 7, 2007, at 8:31 PM, Matt Kettler wrote: As for LW_STOCK_SPAM4, it's being triggered by the fact that the message is base-64 encoded text AND has a Date: header that's missing a proper timezone. Apparently a batch of stock spam went out at some point with both of these

Re: complete false hits for BASE64 and LW_STOCK_SPAM4

2007-02-08 Thread Jo Rhett
Matt Kettler wrote: Jo Rhett wrote: On Feb 7, 2007, at 8:31 PM, Matt Kettler wrote: As for LW_STOCK_SPAM4, it's being triggered by the fact that the message is base-64 encoded text AND has a Date: header that's missing a proper timezone. Apparently a batch of stock spam went out at some point

Re: complete false hits for BASE64 and LW_STOCK_SPAM4

2007-02-07 Thread John D. Hardin
On Wed, 7 Feb 2007, Jo Rhett wrote: So this user's e-mail keeps getting tagged with rules that aren't right. There's no base64 here, at all (looked at the raw text) and there's certainly no stock spam. What's going on here? Have you run spamassassin --lint to see if there are any

Re: complete false hits for BASE64 and LW_STOCK_SPAM4

2007-02-07 Thread Jo Rhett
On Feb 7, 2007, at 1:47 PM, John D. Hardin wrote: On Wed, 7 Feb 2007, Jo Rhett wrote: So this user's e-mail keeps getting tagged with rules that aren't right. There's no base64 here, at all (looked at the raw text) and there's certainly no stock spam. What's going on here? Have you run

Re: complete false hits for BASE64 and LW_STOCK_SPAM4

2007-02-07 Thread Matt Kettler
Jo Rhett wrote: So this user's e-mail keeps getting tagged with rules that aren't right. There's no base64 here, at all (looked at the raw text) and there's certainly no stock spam. What's going on here? Is the charset triggering the base64 rules? They are false hits... No, the charset