Re: DNSBL Comparison 20091114

2009-11-16 Thread rich...@buzzhost.co.uk
On Mon, 2009-11-16 at 17:21 +1000, Res wrote: On Mon, 16 Nov 2009, rich...@buzzhost.co.uk wrote: safe. BRBL has a high hit rate as well, with a moderate safety rating. Wondered why i wasn't getting anything from mysql.com for over a week, BRBL has them listed :) You neglected to trim

Re: Cluster/Clone spamassassin node

2009-11-16 Thread ewreg
You may want to let us in on the details and we may be of better help. Okay, so: I'm preparing ~10 machine of Debian Lenny with spamassassin on the board. Configuration (hardwaresoftware) of each of those nodes will be almost the same (excluding ip address, hostname etc.). What kind of

Re: Cluster/Clone spamassassin node

2009-11-16 Thread Frank Heydlauf
Hi ewreg, list, On Mon, Nov 16, 2009 at 01:01:30AM -0800, ewreg wrote: ... I have done some research and I find that systemimager should be the one. But nowadays it isn't supported by Debian and the last modification comes from 2007. It looks like someone abandoned the ship. ever thought

Re: Good reasons to dont use RBLs

2009-11-16 Thread Bernd Petrovitsch
Hi! On Thu, 2009-11-12 at 21:41 -0600, Luis Daniel Lucio Quiroz wrote: [...] Again me, Well, in the security scope i use a principle that states that you souldnt use a lower layer solution to fix a higher one. So SPAM is a Layer 7 problem that is used to fixed with a Layer 3 solution

Re: DNSBL Comparison 20091114

2009-11-16 Thread Res
On Mon, 16 Nov 2009, rich...@buzzhost.co.uk wrote: You neglected to trim my name from your post making it look like the hrmm... that is not how alpine showed it... That said {don't you just lurvvee net policemen} I do have to laugh that the BRBL has mysql.com listed, given it sits at the

Re: Cluster/Clone spamassassin node

2009-11-16 Thread Matus UHLAR - fantomas
On Mon, Nov 16, 2009 at 01:01:30AM -0800, ewreg wrote: ... I have done some research and I find that systemimager should be the one. But nowadays it isn't supported by Debian and the last modification comes from 2007. It looks like someone abandoned the ship. On 16.11.09 11:36, Frank

Re: balancechecker.zip balancechecker.exe

2009-11-16 Thread Ralph Bornefeld-Ettmann
rich...@buzzhost.co.uk schrieb: On Mon, 2009-11-16 at 00:07 +0100, Ralph Bornefeld-Ettmann wrote: rich...@buzzhost.co.uk schrieb: Is anyone else seeing an influx of spam with a zip attachment balancechecker.zip? This contains a windows executable, balancechecker.exe, which appears to be

Re: DNSBL Comparison 20091114

2009-11-16 Thread Justin Mason
First -- my name is not Jim. Secondly -- I don't care what Spamhaus does, I'm asking what you suggest SpamAssassin do to measure FPs. --j. On Mon, Nov 16, 2009 at 06:00, rich...@buzzhost.co.uk rich...@buzzhost.co.uk wrote: On Sun, 2009-11-15 at 20:34 +, Justin Mason wrote: On Sun, Nov 15,

Re: DNSBL Comparison 20091114

2009-11-16 Thread rich...@buzzhost.co.uk
On Mon, 2009-11-16 at 14:00 +, Justin Mason wrote: First -- my name is not Jim. Secondly -- I don't care what Spamhaus does, I'm asking what you suggest SpamAssassin do to measure FPs. Is that a core feature of spamassassin Just in? Is it necessary to have that data? Will 'Hey, I noticed

Re: balancechecker.zip balancechecker.exe

2009-11-16 Thread rich...@buzzhost.co.uk
On Mon, 2009-11-16 at 14:08 +0100, Ralph Bornefeld-Ettmann wrote: rich...@buzzhost.co.uk schrieb: On Mon, 2009-11-16 at 00:07 +0100, Ralph Bornefeld-Ettmann wrote: rich...@buzzhost.co.uk schrieb: Is anyone else seeing an influx of spam with a zip attachment balancechecker.zip? This

Re: balancechecker.zip balancechecker.exe

2009-11-16 Thread Ned Slider
rich...@buzzhost.co.uk wrote: Ralph, I entirely agree as a logical human, but end users are *not* logical users. Many probably think 'Hey, this file must be OK to run as it's passed our gateway virus scanner and Norton is not picking it up - let's see what it does.' Rhetorical question:

Re: DNSBL Comparison 20091114

2009-11-16 Thread LuKreme
On 16-Nov-2009, at 07:00, Justin Mason wrote: First -- my name is not Jim. Secondly -- I don't care what Spamhaus does, I'm asking what you suggest SpamAssassin do to measure FPs. Thirdly, don't TOFU post (at least twice as bad as Top-posting). -- May the forces of evil become confused on

Re: balancechecker.zip balancechecker.exe

2009-11-16 Thread LuKreme
On 16-Nov-2009, at 08:29, Ned Slider wrote: rich...@buzzhost.co.uk wrote: Ralph, I entirely agree as a logical human, but end users are *not* logical users. Many probably think 'Hey, this file must be OK to run as it's passed our gateway virus scanner and Norton is not picking it up - let's

Re: Cluster/Clone spamassassin node

2009-11-16 Thread jp
I use dd to duplicate hard drives when needed. dd if=/dev/sdb of=/dev/sdc bs=1M for example. It's probably in every distribution. I use rsync to sync up system wide files such as authentication, etc... and on a per user basis it copies users' .procmailrc and .spamassassin/* files from a

Re: balancechecker.zip balancechecker.exe

2009-11-16 Thread John Hardin
On Mon, 16 Nov 2009, LuKreme wrote: On 16-Nov-2009, at 08:29, Ned Slider wrote: rich...@buzzhost.co.uk wrote: Ralph, I entirely agree as a logical human, but end users are *not* logical users. Many probably think 'Hey, this file must be OK to run as it's passed our gateway virus scanner and

Re: Cluster/Clone spamassassin node

2009-11-16 Thread Per Jessen
ewreg wrote: Good morning, I am preparing env with more then 10 node of spamassassin machine. I am wonder what kind of software do you use to clone OS and Spamassassin application to the other machine. tar. I've found that to quite manageable for a low number of nodes. /Per Jessen,

Google feedproxy redirector abuse

2009-11-16 Thread Kenneth Porter
I've been seeing pill spam with lots of identical URIs pointing at feedproxy.google.com over the last week or two. All the URI's seem to be this (leading http slash slash removed): feedproxy.google.com/~r/CraigslistHoustonAllForSale/WantedSearchquothealthquot/~3/3yX2enlGlyE/ I've no idea

Re: Google feedproxy redirector abuse

2009-11-16 Thread John Hardin
On Mon, 16 Nov 2009, Kenneth Porter wrote: I've been seeing pill spam with lots of identical URIs pointing at feedproxy.google.com over the last week or two. All the URI's seem to be this (leading http slash slash removed):

ebay date field is wrong

2009-11-16 Thread Per Jessen
I was just wondering if anyone had mentioned this to ebay: Date: Sun, 15 Nov 09 16:42:23 GMT-0700 will hit INVALID_DATE. /Per Jessen, Zürich

Re: ebay date field is wrong

2009-11-16 Thread Warren Togami
On 11/16/2009 03:04 PM, Per Jessen wrote: I was just wondering if anyone had mentioned this to ebay: Date: Sun, 15 Nov 09 16:42:23 GMT-0700 will hit INVALID_DATE. /Per Jessen, Zürich Date: Sat, 14 Nov 2009 19:10:44 -0700 (GMT) This ebay mail to me didn't hit INVALID_DATE. Warren

Re: ebay date field is wrong

2009-11-16 Thread Ned Slider
Warren Togami wrote: On 11/16/2009 03:04 PM, Per Jessen wrote: I was just wondering if anyone had mentioned this to ebay: Date: Sun, 15 Nov 09 16:42:23 GMT-0700 will hit INVALID_DATE. /Per Jessen, Zürich Date: Sat, 14 Nov 2009 19:10:44 -0700 (GMT) This ebay mail to me didn't hit

Re: balancechecker.zip balancechecker.exe

2009-11-16 Thread David B Funk
On Sun, 15 Nov 2009, rich...@buzzhost.co.uk wrote: Is anyone else seeing an influx of spam with a zip attachment balancechecker.zip? This contains a windows executable, balancechecker.exe, which appears to be testing clean with clam and others. I'm inclined to think it's *not* clean and is

Back on DNSBL overlap

2009-11-16 Thread Adam Katz
Warren reported: SPAM%HAM%RANK RULE 12.8342% 0.0021% 0.94 RCVD_IN_PSBL * 12.3053% 0.0026% 0.94 RCVD_IN_XBL 31.2499% 0.0827% 0.87 RCVD_IN_ANBREP_BL *2 80.2578% 0.1485% 0.86 RCVD_IN_PBL 27.1836% 0.1985% 0.79 RCVD_IN_SORBS_DUL 19.8213% 0.1785% 0.79 RCVD_IN_SEMBLACK * 90.9360% 0.3854%

Re: Back on DNSBL overlap

2009-11-16 Thread Warren Togami
On 11/16/2009 07:26 PM, Adam Katz wrote: My hypothesis, which I've anecdotally proven on my own deployment, is that the flaws are repeated as well. Spammers that trigger spamtraps on multiple DNSBLs (and URIBLs) may be sending from (or linking to) servers that also deal with legitimate

Re: ebay date field is wrong

2009-11-16 Thread Royce Williams
On Mon, Nov 16, 2009 at 11:04 AM, Per Jessen p...@computer.org wrote: I was just wondering if anyone had mentioned this to ebay: Date: Sun, 15 Nov 09 16:42:23 GMT-0700 will hit INVALID_DATE. I've reported this multiple times, with no response. Royce