Re: Skipping RBL checks for internal servers

2015-03-22 Thread Matus UHLAR - fantomas
On Sat, 21 Mar 2015 20:51:49 + RW rwmailli...@googlemail.com wrote: The two calculations produce the same result when Ns2/Nh2 = (Ns2-Ns1)/(Nh2-Nh1) i.e. if spam and ham is being added in the same ratio that it occurs in the database. On 21.03.15 22:54, David F. Skoll wrote: Yup,

Re: Skipping RBL checks for internal servers

2015-03-22 Thread Alex Regan
Hi, I think it seldom pays to be too clever with Bayes. If (and this is a big if) you have a large enough sample of mail, in our experience it's better just to shovel it all into Bayes than to be selective about what you present to Bayes. The Bayes algorithms are usually pretty good at

Re: Skipping RBL checks for internal servers

2015-03-22 Thread Reindl Harald
Am 22.03.2015 um 17:44 schrieb Alex Regan: Would it be helpful to have something that graphs the data to monitor the effect of learning changes? Does something already exist? i am doing something similar recently by one per night iterate through all ham/spam smaples to get a overview how

Re: Skipping RBL checks for internal servers

2015-03-22 Thread David F. Skoll
On Sun, 22 Mar 2015 12:44:26 -0400 Alex Regan mysqlstud...@gmail.com wrote: [...] So instead of trying to figure out the proper expiry period, you just start over completely every two weeks? No, we use a two-week sliding window to construct our Bayes DB. We don't learn for two weeks and

Re: Skipping RBL checks for internal servers

2015-03-21 Thread RW
On Fri, 20 Mar 2015 22:08:23 -0400 David F. Skoll wrote: Bayes expiry is a tricky thing. To do expiry in a way that can be justified mathematically, you really should expire messages, not individual tokens. Otherwise, you're skewing the probabilities. The only token probabilities that can

Re: Skipping RBL checks for internal servers

2015-03-21 Thread David F. Skoll
On Sat, 21 Mar 2015 15:10:19 + RW rwmailli...@googlemail.com wrote: The only token probabilities that can be skewed by token expiry are those than get expired and are then subsequently relearned. Yup. But they might turn out to be important. Even then when those tokens are relearned the

Re: Skipping RBL checks for internal servers

2015-03-21 Thread RW
On Sat, 21 Mar 2015 13:13:13 -0400 David F. Skoll wrote: On Sat, 21 Mar 2015 15:10:19 + RW rwmailli...@googlemail.com wrote: The only token probabilities that can be skewed by token expiry are those than get expired and are then subsequently relearned. Yup. But they might turn out

Re: Skipping RBL checks for internal servers

2015-03-21 Thread David F. Skoll
On Sat, 21 Mar 2015 20:51:49 + RW rwmailli...@googlemail.com wrote: The two calculations produce the same result when Ns2/Nh2 = (Ns2-Ns1)/(Nh2-Nh1) i.e. if spam and ham is being added in the same ratio that it occurs in the database. Yup, that's correct; I got it wrong by extrapolating

Re: Skipping RBL checks for internal servers

2015-03-20 Thread Matus UHLAR - fantomas
On 20.03.15 09:30, Reindl Harald wrote: why would you want poems or cooking recipes trained as spam? and why not? they still may contain stuff that helps differ spam from ham, you never know... once I have trained spam report as ham, extracted the original spam and trained that one as spam.

Re: Skipping RBL checks for internal servers

2015-03-20 Thread Reindl Harald
Am 20.03.2015 um 11:40 schrieb Matus UHLAR - fantomas: On 20.03.15 09:30, Reindl Harald wrote: why would you want poems or cooking recipes trained as spam? and why not? i think i have explained it often enough now they still may contain stuff that helps differ spam from ham, you never

Re: Skipping RBL checks for internal servers

2015-03-20 Thread Reindl Harald
Am 19.03.2015 um 23:52 schrieb RW: On Thu, 19 Mar 2015 20:46:10 +0100 Reindl Harald wrote: Am 19.03.2015 um 20:35 schrieb RW: On Thu, 19 Mar 2015 01:12:15 +0100 Reindl Harald wrote: the last point is easy to prove by having the old, unmodified corpus and run spamc against the cleaned

Re: Skipping RBL checks for internal servers

2015-03-20 Thread David F. Skoll
On Fri, 20 Mar 2015 17:09:29 -0400 Kevin A. McGrail kmcgr...@pccc.com wrote: And I've heard arguments for and against removing the poisoning information. YMMV. I think it seldom pays to be too clever with Bayes. If (and this is a big if) you have a large enough sample of mail, in our

Re: Skipping RBL checks for internal servers

2015-03-20 Thread Alex Regan
Hi, On 03/20/2015 06:50 AM, Reindl Harald wrote: Am 20.03.2015 um 11:40 schrieb Matus UHLAR - fantomas: On 20.03.15 09:30, Reindl Harald wrote: why would you want poems or cooking recipes trained as spam? and why not? i think i have explained it often enough now I've heard arguments in

Re: Skipping RBL checks for internal servers

2015-03-20 Thread Kevin A. McGrail
On 3/20/2015 4:58 PM, Alex Regan wrote: Can someone with some authority (ie, those that wrote it or understand the code) add some input? Bayesian token systems are probably the basis for quite a number of master and doctoral level thesiseseses (whatever the plural of thesis). Understanding

Re: Skipping RBL checks for internal servers

2015-03-19 Thread RW
On Thu, 19 Mar 2015 20:46:10 +0100 Reindl Harald wrote: Am 19.03.2015 um 20:35 schrieb RW: On Thu, 19 Mar 2015 01:12:15 +0100 Reindl Harald wrote: the last point is easy to prove by having the old, unmodified corpus and run spamc against the cleaned bayes database and the final

Re: Skipping RBL checks for internal servers

2015-03-19 Thread Reindl Harald
Am 19.03.2015 um 09:22 schrieb Matus UHLAR - fantomas: Am 18.03.2015 um 22:29 schrieb David B Funk: Just have an internal mail-submission port that isn't routed thru SA On 18.03.15 22:46, Reindl Harald wrote: may not be possible if you have hundrets of domains without setup a internal DNS

Re: Skipping RBL checks for internal servers

2015-03-19 Thread Matus UHLAR - fantomas
Am 18.03.2015 um 22:29 schrieb David B Funk: Just have an internal mail-submission port that isn't routed thru SA On 18.03.15 22:46, Reindl Harald wrote: may not be possible if you have hundrets of domains without setup a internal DNS view just for a different MX You apparently mean

Re: Skipping RBL checks for internal servers

2015-03-19 Thread Nick Edwards
On 3/19/15, Reindl Harald h.rei...@thelounge.net wrote: Am 19.03.2015 um 12:57 schrieb Nick Edwards: On 3/19/15, Steve Freegard s...@fsl.com wrote: On 18/03/15 21:46, Reindl Harald wrote: Wow - you must be fun at parties... HAHAHA reindl doesnt go to parties because , he has no friends

Re: Skipping RBL checks for internal servers

2015-03-19 Thread Kevin A. McGrail
I am getting tired of all of the personal attacks. End it, everyone. Stick to facts or take it offlist. I don't care which. Regards, KAM

Re: Skipping RBL checks for internal servers

2015-03-19 Thread Reindl Harald
Am 19.03.2015 um 12:57 schrieb Nick Edwards: On 3/19/15, Steve Freegard s...@fsl.com wrote: On 18/03/15 21:46, Reindl Harald wrote: Wow - you must be fun at parties... HAHAHA reindl doesnt go to parties because , he has no friends and no one would have him, he can start a fight when he's

Re: Skipping RBL checks for internal servers

2015-03-19 Thread Steve Freegard
On 18/03/15 21:46, Reindl Harald wrote: Am 18.03.2015 um 22:29 schrieb David B Funk: Just have an internal mail-submission port that isn't routed thru SA may not be possible if you have hundrets of domains without setup a internal DNS view just for a different MX In general you don't want

Re: Skipping RBL checks for internal servers

2015-03-19 Thread Nick Edwards
On 3/19/15, Steve Freegard s...@fsl.com wrote: On 18/03/15 21:46, Reindl Harald wrote: Wow - you must be fun at parties... HAHAHA reindl doesnt go to parties because , he has no friends and no one would have him, he can start a fight when he's the only tosser in the room.

Re: Skipping RBL checks for internal servers

2015-03-19 Thread Nick Edwards
hahahaha come on reindl, do you think people here will bother to click your links when all they only need do is google reindl harald to get an unbiased view of who you really are and the sort of offensive abusive creep you really are. fedora users BANNED roundcube MODERATED postifx BANNED

Re: Skipping RBL checks for internal servers

2015-03-19 Thread Reindl Harald
Am 19.03.2015 um 12:30 schrieb Steve Freegard: On 18/03/15 21:46, Reindl Harald wrote: Am 18.03.2015 um 22:29 schrieb David B Funk: Just have an internal mail-submission port that isn't routed thru SA may not be possible if you have hundrets of domains without setup a internal DNS view

Re: Skipping RBL checks for internal servers

2015-03-19 Thread Reindl Harald
Am 19.03.2015 um 13:09 schrieb Nick Edwards: On 3/19/15, Reindl Harald h.rei...@thelounge.net wrote: Am 19.03.2015 um 12:57 schrieb Nick Edwards: On 3/19/15, Steve Freegard s...@fsl.com wrote: On 18/03/15 21:46, Reindl Harald wrote: Wow - you must be fun at parties... HAHAHA reindl

Re: Skipping RBL checks for internal servers

2015-03-19 Thread Reindl Harald
well, i never pretended to be the nicest person on the world but the difference between both of us is that i *never ever* go out and seek postings from a specific person and call him/her names without any context to the thread and technical background just because it's he/her and in fact i

Re: Skipping RBL checks for internal servers

2015-03-19 Thread Kevin A. McGrail
Last warning. Offlist with these emails or next step is list removal. Regards, KAM

Re: Skipping RBL checks for internal servers

2015-03-19 Thread Nick Edwards
On 3/19/15, Reindl Harald h.rei...@thelounge.net wrote: and in fact i was *never ever* that abusive as you are all the time beause there is a difference in get heatet in a technical discussion or like you do absue for the sake of abuse hahahaha thankfulyl google shows otherwise so you

Re: Skipping RBL checks for internal servers

2015-03-19 Thread Matus UHLAR - fantomas
Am 18.03.2015 um 22:29 schrieb David B Funk: Just have an internal mail-submission port that isn't routed thru SA On 18.03.15 22:46, Reindl Harald wrote: may not be possible if you have hundrets of domains without setup a internal DNS view just for a different MX Am 19.03.2015 um 09:22

Re: Skipping RBL checks for internal servers

2015-03-19 Thread RW
On Thu, 19 Mar 2015 01:12:15 +0100 Reindl Harald wrote: Am 19.03.2015 um 00:54 schrieb RW: This is nothing to do with auto-learning. There is a difference between miss-training and training with spam that contains so-called Bayes poison. Bayes is best trained on what is in real-world

Re: Skipping RBL checks for internal servers

2015-03-19 Thread Reindl Harald
Am 19.03.2015 um 20:35 schrieb RW: On Thu, 19 Mar 2015 01:12:15 +0100 Reindl Harald wrote: Am 19.03.2015 um 00:54 schrieb RW: This is nothing to do with auto-learning. There is a difference between miss-training and training with spam that contains so-called Bayes poison. Bayes is best

Re: Skipping RBL checks for internal servers

2015-03-19 Thread Reindl Harald
Am 19.03.2015 um 13:53 schrieb Matus UHLAR - fantomas: Am 18.03.2015 um 22:29 schrieb David B Funk: Just have an internal mail-submission port that isn't routed thru SA On 18.03.15 22:46, Reindl Harald wrote: may not be possible if you have hundrets of domains without setup a internal DNS

Re: Skipping RBL checks for internal servers

2015-03-19 Thread Bill Cole
On 18 Mar 2015, at 17:24, Axb wrote: Why is Internal or local mail sent thru SA? If the MTA handles outbound mail from Windows users, passing their mail through SA is prudent. There are spamming trojans that figure out how to use the victim's legitimate submission config including

Re: Skipping RBL checks for internal servers

2015-03-19 Thread Reindl Harald
Am 19.03.2015 um 19:48 schrieb Bill Cole: On 18 Mar 2015, at 17:24, Axb wrote: Why is Internal or local mail sent thru SA? If the MTA handles outbound mail from Windows users, passing their mail through SA is prudent. There are spamming trojans that figure out how to use the victim's

Skipping RBL checks for internal servers

2015-03-18 Thread Quanah Gibson-Mount
I noticed that some of the Zimbra auto-generated emails (reports on various bits) are getting hit with RBL scoring for some customers. This appears to be because they are (quite reasonably) using private IPs on some of thier internal Zimbra servers. However, when it goes through the MTA, it

Re: Skipping RBL checks for internal servers

2015-03-18 Thread Reindl Harald
Am 19.03.2015 um 00:54 schrieb RW: On Wed, 18 Mar 2015 23:57:13 +0100 Reindl Harald wrote: Am 18.03.2015 um 23:34 schrieb RW: On Wed, 18 Mar 2015 22:46:14 +0100 Reindl Harald wrote: frankly i trained over months with *hand chosen* mail smaples and spent nearly two weeks day and night to

Re: Skipping RBL checks for internal servers

2015-03-18 Thread RW
On Wed, 18 Mar 2015 22:46:14 +0100 Reindl Harald wrote: frankly i trained over months with *hand chosen* mail smaples and spent nearly two weeks day and night to remove bayes-posioning from the samples and rebuild bayes from scratch leading in reduce the ntokens from 170 to 150

Re: Skipping RBL checks for internal servers

2015-03-18 Thread Reindl Harald
Am 18.03.2015 um 23:34 schrieb RW: On Wed, 18 Mar 2015 22:46:14 +0100 Reindl Harald wrote: frankly i trained over months with *hand chosen* mail smaples and spent nearly two weeks day and night to remove bayes-posioning from the samples and rebuild bayes from scratch leading in reduce the

Re: Skipping RBL checks for internal servers

2015-03-18 Thread RW
On Wed, 18 Mar 2015 23:57:13 +0100 Reindl Harald wrote: Am 18.03.2015 um 23:34 schrieb RW: On Wed, 18 Mar 2015 22:46:14 +0100 Reindl Harald wrote: frankly i trained over months with *hand chosen* mail smaples and spent nearly two weeks day and night to remove bayes-posioning from

Re: Skipping RBL checks for internal servers

2015-03-18 Thread Axb
On 03/18/2015 10:39 PM, Reindl Harald wrote: Am 18.03.2015 um 22:24 schrieb Axb: On 03/18/2015 09:48 PM, Quanah Gibson-Mount wrote: I noticed that some of the Zimbra auto-generated emails (reports on various bits) are getting hit with RBL scoring for some customers. This appears to be

Re: Skipping RBL checks for internal servers

2015-03-18 Thread Axb
On 03/18/2015 10:46 PM, Reindl Harald wrote: Am 18.03.2015 um 22:29 schrieb David B Funk: Just have an internal mail-submission port that isn't routed thru SA may not be possible if you have hundrets of domains without setup a internal DNS view just for a different MX In general you don't

Re: Skipping RBL checks for internal servers

2015-03-18 Thread Reindl Harald
Am 18.03.2015 um 22:58 schrieb Axb: On 03/18/2015 10:46 PM, Reindl Harald wrote: Am 18.03.2015 um 22:29 schrieb David B Funk: Just have an internal mail-submission port that isn't routed thru SA may not be possible if you have hundrets of domains without setup a internal DNS view just for

Re: Skipping RBL checks for internal servers

2015-03-18 Thread Reindl Harald
Am 18.03.2015 um 21:48 schrieb Quanah Gibson-Mount: I noticed that some of the Zimbra auto-generated emails (reports on various bits) are getting hit with RBL scoring for some customers. This appears to be because they are (quite reasonably) using private IPs on some of thier internal Zimbra

Re: Skipping RBL checks for internal servers

2015-03-18 Thread Reindl Harald
Am 18.03.2015 um 22:11 schrieb Reindl Harald: Am 18.03.2015 um 21:48 schrieb Quanah Gibson-Mount: I noticed that some of the Zimbra auto-generated emails (reports on various bits) are getting hit with RBL scoring for some customers. This appears to be because they are (quite reasonably) using

Re: Skipping RBL checks for internal servers

2015-03-18 Thread Axb
On 03/18/2015 09:48 PM, Quanah Gibson-Mount wrote: I noticed that some of the Zimbra auto-generated emails (reports on various bits) are getting hit with RBL scoring for some customers. This appears to be because they are (quite reasonably) using private IPs on some of thier internal Zimbra

Re: Skipping RBL checks for internal servers

2015-03-18 Thread Reindl Harald
Am 18.03.2015 um 22:24 schrieb Axb: On 03/18/2015 09:48 PM, Quanah Gibson-Mount wrote: I noticed that some of the Zimbra auto-generated emails (reports on various bits) are getting hit with RBL scoring for some customers. This appears to be because they are (quite reasonably) using private

RE: Skipping RBL checks for internal servers

2015-03-18 Thread Marieke Janssen
Hi Quanah, X-Spam-Status: Yes, score=10.297 tagged_above=-10 required=10 tests=[ALL_TRUSTED=-1, BAYES_00=-0.5, T_RP_MATCHES_RCVD=-0.01, URIBL_BLACK=3.25, URIBL_DBL_SPAM=2.5, URIBL_JP_SURBL=1.25, URIBL_RHS_DOB=1.514, URIBL_SBL_A=0.1, URIBL_WS_SURBL=1.608,

Re: Skipping RBL checks for internal servers

2015-03-18 Thread Quanah Gibson-Mount
--On Wednesday, March 18, 2015 11:11 PM +0100 Reindl Harald h.rei...@thelounge.net wrote: The IP is clearly listed in trusted_networks your problem are not RBL's your problem are URIBL's and so mail content ask yourself why autogenerated mails contains crap URLs listed on URIBL_BLACK,

Re: Skipping RBL checks for internal servers

2015-03-18 Thread David B Funk
On Wed, 18 Mar 2015, Reindl Harald wrote: Am 18.03.2015 um 21:48 schrieb Quanah Gibson-Mount: I noticed that some of the Zimbra auto-generated emails (reports on various bits) are getting hit with RBL scoring for some customers. This appears to be because they are (quite reasonably) using

Re: Skipping RBL checks for internal servers

2015-03-18 Thread Reindl Harald
Am 18.03.2015 um 22:29 schrieb David B Funk: Just have an internal mail-submission port that isn't routed thru SA may not be possible if you have hundrets of domains without setup a internal DNS view just for a different MX In general you don't want auto-mail running thru SA for this