Re: Possible pattern here?

2014-09-10 Thread Joolee
Sounds like a case of http://www.gossamer-threads.com/lists/spamassassin/users/187586 You might be able to find the rule mentioned here: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/jhardin/ On 10 September 2014 07:38, Bob Proulx b...@proulx.com wrote: I am helping a friend

Re: Possible pattern here?

2014-09-10 Thread Axb
On 09/10/2014 08:48 AM, Joolee wrote: Sounds like a case of http://www.gossamer-threads.com/lists/spamassassin/users/187586 You might be able to find the rule mentioned here: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/jhardin/ RAND_HEADER_MANY On 10 September 2014

RCVD_IN_MSPIKE_* strange scoring

2014-09-10 Thread Reindl Harald
something is here terrible wrong why does average is preferred over excellent why do H3 and H4 get a very less WL score? recently a clear spam message slipped by the -1.7 through describe RCVD_IN_MSPIKE_H2 Average reputation (+2) describe RCVD_IN_MSPIKE_H3 Good reputation (+3) describe

Re: RCVD_IN_MSPIKE_* strange scoring

2014-09-10 Thread Matus UHLAR - fantomas
On 10.09.14 13:22, Reindl Harald wrote: something is here terrible wrong why does average is preferred over excellent why do H3 and H4 get a very less WL score? I'd say, it's because of number of spams/hams received from hosts there. seems like only mail from hosts with average reputation

Re: RCVD_IN_MSPIKE_* strange scoring

2014-09-10 Thread Reindl Harald
Am 10.09.2014 um 13:33 schrieb Matus UHLAR - fantomas: On 10.09.14 13:22, Reindl Harald wrote: something is here terrible wrong why does average is preferred over excellent why do H3 and H4 get a very less WL score? I'd say, it's because of number of spams/hams received from hosts there.

Whitelist one mail with multiple destinations

2014-09-10 Thread M. Rodrigo Monteiro
Hi. Here is my scenario: Internet - MX (Postfix) - Relay (Postfix + Amavis with SpamAssassin) - Zimbra In SpamAssassin, I have a whitelist/blacklist. All the e-mail passes through, but Spams are taged (header and subject). My problem is that when an e-mail comes to multiple destinations and one

Re: Whitelist one mail with multiple destinations

2014-09-10 Thread Antony Stone
On Wednesday 10 September 2014 at 14:56:06 (EU time), M. Rodrigo Monteiro wrote: Hi. Here is my scenario: Internet - MX (Postfix) - Relay (Postfix + Amavis with SpamAssassin) - Zimbra My problem is that when an e-mail comes to multiple destinations and one of them is whitelisted, all

Re: Whitelist one mail with multiple destinations

2014-09-10 Thread Kevin A. McGrail
On 9/10/2014 8:56 AM, M. Rodrigo Monteiro wrote: Hi. Here is my scenario: Internet - MX (Postfix) - Relay (Postfix + Amavis with SpamAssassin) - Zimbra In SpamAssassin, I have a whitelist/blacklist. All the e-mail passes through, but Spams are taged (header and subject). My problem is that

Re: Whitelist one mail with multiple destinations

2014-09-10 Thread Antony Stone
On Wednesday 10 September 2014 at 15:17:29 (EU time), Kevin A. McGrail wrote: On 9/10/2014 8:56 AM, M. Rodrigo Monteiro wrote: Hi. Here is my scenario: Internet - MX (Postfix) - Relay (Postfix + Amavis with SpamAssassin) - Zimbra In SpamAssassin, I have a whitelist/blacklist. All

Re: Whitelist one mail with multiple destinations

2014-09-10 Thread David F. Skoll
On Wed, 10 Sep 2014 09:56:06 -0300 M. Rodrigo Monteiro fale...@rodrigomonteiro.net wrote: My problem is that when an e-mail comes to multiple destinations and one of them is whitelisted, all these destinations becomes whitelisted too. There are really only two ways to get around this, and

bayes_auto_learn_threshold_nonspam

2014-09-10 Thread Axb
for quite a while I've been playing with autolearn settings SA's default is: bayes_auto_learn_threshold_nonspam0.1 this *can* cause low scored spam to be learnt as ham. For several months I've been using bayes_auto_learn_threshold_nonspam -1.0 and so far no more false negatives have been

Re: Possible pattern here?

2014-09-10 Thread John Hardin
On Tue, 9 Sep 2014, Bob Proulx wrote: I am helping a friend who is getting hit with a lot of spam. He is running SpamAssassin. While looking at the spam that he is receiving I am seeing a pattern in the headers. Along with the normal headers the messages also contain a random set of random

Re: RCVD_IN_MSPIKE_* strange scoring

2014-09-10 Thread John Hardin
On Wed, 10 Sep 2014, Matus UHLAR - fantomas wrote: On 10.09.14 13:22, Reindl Harald wrote: something is here terrible wrong why does average is preferred over excellent why do H3 and H4 get a very less WL score? I'd say, it's because of number of spams/hams received from hosts there. seems

Re: Whitelist one mail with multiple destinations

2014-09-10 Thread M. Rodrigo Monteiro
2014-09-10 10:23 GMT-03:00 David F. Skoll d...@roaringpenguin.com: Option 2 is to accept the message unfiltered, split it into multiple copies, and remail each copy so it can be scanned per-recipient. This avoids the delay, but it also means you cannot reject spam with a 5xx SMTP failure code

Re: Whitelist one mail with multiple destinations

2014-09-10 Thread M. Rodrigo Monteiro
2014-09-10 10:17 GMT-03:00 Antony Stone antony.st...@spamassassin.open.source.it: On Wednesday 10 September 2014 at 14:56:06 (EU time), M. Rodrigo Monteiro wrote: Hi. Here is my scenario: Internet - MX (Postfix) - Relay (Postfix + Amavis with SpamAssassin) - Zimbra My problem is that when

Re: bayes_auto_learn_threshold_nonspam

2014-09-10 Thread Kevin A. McGrail
On 9/10/2014 9:47 AM, Axb wrote: for quite a while I've been playing with autolearn settings SA's default is: bayes_auto_learn_threshold_nonspam0.1 this *can* cause low scored spam to be learnt as ham. For several months I've been using bayes_auto_learn_threshold_nonspam -1.0 and so far

Re: Whitelist one mail with multiple destinations

2014-09-10 Thread David F. Skoll
On Wed, 10 Sep 2014 10:59:16 -0300 M. Rodrigo Monteiro fale...@rodrigomonteiro.net wrote: Option 2 is to accept the message unfiltered, split it into multiple copies, and remail each copy so it can be scanned per-recipient. How can I do it? It depends on the MTA you're using. If you use

Re: bayes_auto_learn_threshold_nonspam

2014-09-10 Thread Axb
On 09/10/2014 04:05 PM, Kevin A. McGrail wrote: On 9/10/2014 9:47 AM, Axb wrote: for quite a while I've been playing with autolearn settings SA's default is: bayes_auto_learn_threshold_nonspam0.1 this *can* cause low scored spam to be learnt as ham. For several months I've been using

Re: bayes_auto_learn_threshold_nonspam

2014-09-10 Thread Alex Regan
Hi, For several months I've been using bayes_auto_learn_threshold_nonspam -1.0 and so far no more false negatives have been learnt as ham which is was hoping for. If you're using autolearn, you may want to play with that threshold.. Based on your expertise with Bayes, should we change the

Re: RCVD_IN_MSPIKE_* strange scoring

2014-09-10 Thread Jose Borges Ferreira
On Wed, Sep 10, 2014 at 12:22 PM, Reindl Harald h.rei...@thelounge.net wrote: something is here terrible wrong why does average is preferred over excellent why do H3 and H4 get a very less WL score? recently a clear spam message slipped by the -1.7 through describe RCVD_IN_MSPIKE_H2

Re: bayes_auto_learn_threshold_nonspam

2014-09-10 Thread Axb
On 09/10/2014 04:29 PM, Alex Regan wrote: Hi, For several months I've been using bayes_auto_learn_threshold_nonspam -1.0 and so far no more false negatives have been learnt as ham which is was hoping for. If you're using autolearn, you may want to play with that threshold.. Based on your

Re: RCVD_IN_MSPIKE_* strange scoring

2014-09-10 Thread Reindl Harald
Am 10.09.2014 um 16:50 schrieb Jose Borges Ferreira: On Wed, Sep 10, 2014 at 12:22 PM, Reindl Harald h.rei...@thelounge.net wrote: something is here terrible wrong why does average is preferred over excellent why do H3 and H4 get a very less WL score? recently a clear spam message

Re: RCVD_IN_MSPIKE_* strange scoring

2014-09-10 Thread John Hardin
On Wed, 10 Sep 2014, Reindl Harald wrote: Am 10.09.2014 um 16:50 schrieb Jose Borges Ferreira: On Wed, Sep 10, 2014 at 12:22 PM, Reindl Harald h.rei...@thelounge.net wrote: something is here terrible wrong why does average is preferred over excellent why do H3 and H4 get a very less WL

Re: RP_MATCHES_RCVD

2014-09-10 Thread Thomas Harold
On 9/5/2014 2:37 AM, Reindl Harald wrote: Hi i got recently a clear spam message which would have a score of 6.9 but RP_MATCHES_RCVD removed 1.7 points is that not a little too much? This has been a problem for about 6 months now. I complained about it back in April 2014, and there was

MSPIKE in older SA ?

2014-09-10 Thread Jesse Norell
Is there any reason you should not use MSPIKE in versions older than 3.4.0? Eg. on debian box with 3.3.2, I have 20_mailspike.cf; I commented the version check out, tested that spamassassin --lint was happy, recompiled rules and I now have MSPIKE rules hitting. Am I missing something? Or is

Rule priority

2014-09-10 Thread Philip Prindeville
Is there a good discussion on how rule priority works, and short-circuited evaluation, etc? I must be looking in the wrong places because I can’t find much. I found register_method_priority() in ::Plugin but I wasn’t sure if that’s all there is… It only seems to be called in

Re: MSPIKE in older SA ?

2014-09-10 Thread Kevin A. McGrail
On 9/10/2014 12:59 PM, Jesse Norell wrote: Is there any reason you should not use MSPIKE in versions older than 3.4.0? Eg. on debian box with 3.3.2, I have 20_mailspike.cf; I commented the version check out, tested that spamassassin --lint was happy, recompiled rules and I now have MSPIKE rules

Re: bayes_auto_learn_threshold_nonspam

2014-09-10 Thread Amir Caspi
On Sep 10, 2014, at 7:47 AM, Axb axb.li...@gmail.com wrote: For several months I've been using bayes_auto_learn_threshold_nonspam -1.0 Any reason you chose -1.0 rather than something a bit closer to 0, like -0.5 or -0.2? Most of my low-scoring spam is pretty close to 0, so I'm just

Re: Rule priority

2014-09-10 Thread John Hardin
On Wed, 10 Sep 2014, Philip Prindeville wrote: I ask because I’m trying to address this comment: https://issues.apache.org/SpamAssassin/show_bug.cgi?id=7060#c10 This might be better on the dev list. -- John Hardin KA7OHZhttp://www.impsec.org/~jhardin/

Re: MSPIKE in older SA ?

2014-09-10 Thread Jesse Norell
On Wed, 2014-09-10 at 13:10 -0400, Kevin A. McGrail wrote: On 9/10/2014 12:59 PM, Jesse Norell wrote: Is there any reason you should not use MSPIKE in versions older than 3.4.0? Eg. on debian box with 3.3.2, I have 20_mailspike.cf; I commented the version check out, tested that

Re: MSPIKE in older SA ?

2014-09-10 Thread Kevin A. McGrail
On 9/10/2014 1:36 PM, Jesse Norell wrote: Would you consider changing the version check in official 20_mailspike.cf to allow 3.3.2 to use those by default? Jesse, For me, I am neutral on the matter as my energies are focused on 3.4.1 to release on 9/30. But this will need 3 explicit +1's

Re: bayes_auto_learn_threshold_nonspam

2014-09-10 Thread RW
On Wed, 10 Sep 2014 15:47:48 +0200 Axb wrote: for quite a while I've been playing with autolearn settings SA's default is: bayes_auto_learn_threshold_nonspam0.1 this *can* cause low scored spam to be learnt as ham. For several months I've been using

Re: bayes_auto_learn_threshold_nonspam

2014-09-10 Thread Alex Regan
Hi, For several months I've been using bayes_auto_learn_threshold_nonspam -1.0 Any reason you chose -1.0 rather than something a bit closer to 0, like -0.5 or -0.2? Most of my low-scoring spam is pretty close to 0, so I'm just wondering. I know I made the decision years ago to lower it to

Re: Possible pattern here?

2014-09-10 Thread Bob Proulx
John Hardin wrote: Bob Proulx wrote: Is there a way to use this to create a SpamAssassin rule to try to catch this type of spam? Grab the RAND_HEADER rules (there are several related, get them all) from my sandbox and score as you see fit. Ah... Already discussed earlier. Sorry for not

Re: bayes_auto_learn_threshold_nonspam

2014-09-10 Thread Alex Regan
Hi, SA's default is: bayes_auto_learn_threshold_nonspam0.1 this *can* cause low scored spam to be learnt as ham. For several months I've been using bayes_auto_learn_threshold_nonspam -1.0 and so far no more false negatives have been learnt as ham which is was hoping for. If you're using

Where spam comes from

2014-09-10 Thread Joe Quinn
http://qz.com/263013/for-390-you-can-buy-a-harvard-email-account-on-chinas-biggest-online-marketplace/ Most of the article is off topic, but I liked the mention of being able to buy *.edu email addresses. We see them from time to time, especially Harvard, and it always makes me wonder how much

Re: bayes_auto_learn_threshold_nonspam

2014-09-10 Thread Axb
On 09/10/2014 08:23 PM, RW wrote: On Wed, 10 Sep 2014 15:47:48 +0200 Axb wrote: for quite a while I've been playing with autolearn settings SA's default is: bayes_auto_learn_threshold_nonspam0.1 this *can* cause low scored spam to be learnt as ham. For several months I've been using

Re: MSPIKE in older SA ?

2014-09-10 Thread Benny Pedersen
On 10. sep. 2014 19.58.18 Kevin A. McGrail kmcgr...@pccc.com wrote: I will say, I don't know how long sa-update will work for 3.3.2. Eventually, we have to move on and not support old releases though right now the status quo of trying our best is ok. 3.3.2 is still latest stable in gentoo, i

Re: bayes_auto_learn_threshold_nonspam

2014-09-10 Thread RW
On Wed, 10 Sep 2014 20:57:35 +0200 Axb wrote: In practice this means that, without custom rules, ham can only be autolearned if it hits a DNS whitelist rule or RP_MATCHES_RCVD. from what I'm seeing is that it takes lower scored ham to autolearn ham. I don't use DNS whitelists and

Program failure (69) of spamc

2014-09-10 Thread Geoff Soper
Hi, I'm calling spamc (3.3.2) from procmail as suggested at https://wiki.apache.org/spamassassin/UsedViaProcmail Having made a change to not use the lockfile (as suggsted in another thread) I'm now getting the following error in my procmail log: procmail: Program failure (69) of spamc

Re: Program failure (69) of spamc

2014-09-10 Thread Mark Martinec
2014-09-10 23:25 Geoff Soper wrote: Hi, I'm calling spamc (3.3.2) from procmail as suggested at https://wiki.apache.org/spamassassin/UsedViaProcmail Having made a change to not use the lockfile (as suggsted in another thread) I'm now getting the following error in my procmail log: procmail: