Re: bayes learning '0 messages found'

2010-02-13 Thread Charles Gregory
On Sat, 13 Feb 2010, smfabac wrote: $ sa-learn --showdots --ham --mbox notspam Learned tokens from 0 message(s) (0 message(s) examined) Still no luck. Are we sure the notspam file is clean? Try trimming it down to just one or two messages, and see how it goes - C

Re: MTX plugin created (Re: Spam filtering similar to SPF, less breakage)

2010-02-11 Thread Charles Gregory
On Wed, 10 Feb 2010, dar...@chaosreigns.com wrote: http://www.chaosreigns.com/mtx/ You know, just for a moment I thought I would take a look, just for curiosity sake, and instead got this moronic jack-ass ATTITUDE page. You are welcome to your opinions on browsers, and are free to whine

Re: [sa] Re: MTX plugin created (Re: Spam filtering similar to SPF, less breakage)

2010-02-11 Thread Charles Gregory
On Thu, 11 Feb 2010, Bowie Bailey wrote: What page were you looking at? All I see at that URL is a fairly straightforward description of how to implement his MTX system. The page 'redirects' to this one: http://www.chaosreigns.com/fail It's a rant page telling the visitor that you cannot

Re: MTX plugin created (Re: Spam filtering similar to SPF, less breakage)

2010-02-11 Thread Charles Gregory
On Thu, 11 Feb 2010, LuKreme wrote: Erm.. The string microsoft doesn't even exist on that page. No Microsoft browser supports this 9 year old standard. Obviously you are't using IE and so you weren't subjected to the arrogant refusal of his server to deliver the requested page. (shrug) - C

Re: [sa] Re: MTX plugin created (Re: Spam filtering similar to SPF, less breakage)

2010-02-11 Thread Charles Gregory
On Thu, 11 Feb 2010, LuKreme wrote: It's a rant page telling the visitor that you cannot read the site using Internet Explorer, Good. Get a real browser. Like I said, he (and you) can rant all you want about the evils of Microsoft, and frankly I wouldn't be inclined to argue with you. (grin)

Re: MTX plugin created (Re: Spam filtering similar to SPF, less breakage)

2010-02-11 Thread Charles Gregory
On Thu, 11 Feb 2010, Bowie Bailey wrote: I would blame whoever set up the website. The page in question does not even attempt to use the features that the fail page refers to. (nod) I guess that really says it all Thanks for mentioning this. Now my 'vague feeling' is confirmed. - C

Re: OT::Making a PC explode (was Re: Newest spammer trick - non-blank subject lines?)

2010-02-10 Thread Charles Gregory
On Wed, 10 Feb 2010, Bowie Bailey wrote: Electronics generating sparks when overloaded? Yes. Generating smoke? Yes. Flames? Yes. A dynamic explosion? No. (Never did figure out why all the electronics consoles in movies seem to contain explosives...) Self-destruct mechanism, obviously! :)

Re: Spam filtering similar to SPF, less breakage

2010-02-09 Thread Charles Gregory
On Mon, 2010-02-08 at 22:08 -0500, dar...@chaosreigns.com wrote: You get an email delivered from 64.71.152.40 (last untrusted relay). You look up the DNS A record for that IP, and get mail.chaosreigns.com. That's a PTR lookup, but let's press on Then you look up the DNS PTR record of

Re: Spam filtering similar to SPF, less breakage

2010-02-09 Thread Charles Gregory
On Tue, 9 Feb 2010, dar...@chaosreigns.com wrote: My home dynamic cablemodem address passes full-circle DNS. But not this. So this is far more useful for checking if an IP is a legitimate sending mail server. So rather than mimicing SPF, you want to mimic the effect of various IP-based

Re: Spam filtering similar to SPF, less breakage

2010-02-09 Thread Charles Gregory
On Tue, 9 Feb 2010, dar...@chaosreigns.com wrote: When I implement this, senders will get an error asking them to ask their administrator to create the necessary record. Those administrators will say that they do not have control over DNS, because that's done at a higher organizational level,

Re: Spam filtering similar to SPF, less breakage

2010-02-09 Thread Charles Gregory
On Tue, 9 Feb 2010, dar...@chaosreigns.com wrote: So rather than mimicing SPF, you want to mimic the effect of various IP-based blacklists to which an ISP can report all of its 'unauthorized' IP's (typicalyl dynamic IP blocks)? Basically, except of course that the default, when not

Re: [sa] Re: Spam filtering similar to SPF, less breakage

2010-02-09 Thread Charles Gregory
On Tue, 9 Feb 2010, dar...@chaosreigns.com wrote: Charles: Thanks, I clearly need to lay out implementation sequence. Sorry to be wasting your time, but I am smart enough to have grasped it from your previous e-mails. You just WANT your solution to be magically adopted by everyone and you

Re: [sa] RE: Sought rules not doing so good

2010-02-03 Thread Charles Gregory
On Wed, 3 Feb 2010, Jonas wrote: But for us as well as bowie, the sought rules are hitting significantly less mails than they used to. Makes me wonder if the spammers have put some work into identifying the spamtraps used to feed the sought rules generator? Have the sought maintainers

Re: painting everybody in Taiwan with the same brush

2010-01-29 Thread Charles Gregory
* Strictly for fun. Cuz I'm a geek and can't resist.. The code you post could not produce the output shown. There is no 'reject' in the line 'Relay access denied'. (big wide grin) No argument about the intended *point* of the output. :) - C On Thu, 28 Jan 2010, LuKreme wrote: $

Re: [sa] Re: painting everybody in Taiwan with the same brush

2010-01-29 Thread Charles Gregory
On Fri, 29 Jan 2010, Bowie Bailey wrote: Take another look. The original line must contain 'reject', but the output is not the entire line. Awk. (as an exclamation) :) - C

Re: Web Form Spam

2010-01-29 Thread Charles Gregory
On Fri, 29 Jan 2010, te...@cnysupport.com wrote: little uncomfortable making the form submit any more complicated than necessary, since the people who use it are generally already stressed, and I'd prefer to not make them decipher swirly letters. I find that most form-fillers are robots and

Re: [OT?] Web Form Spam

2010-01-29 Thread Charles Gregory
On Fri, 29 Jan 2010, James Butler wrote: . Gibberish in the form is just a probe. My experience has been that the gibberish gets around simplistic tests for 'empty' fields. That's why I advocate the use of a field that *should* be empty. :) - C

Re: painting everybody in Taiwan with the same brush

2010-01-28 Thread Charles Gregory
On Thu, 28 Jan 2010, jida...@jidanni.org wrote: You guys are doing something wrong. Firstly, let's all acknowledge that the OP cross-posted to/from the SARE mailing list, and continues to do so. Yes, there is no one on the main SA list that is responsible for the rule, but that being said,

Re: blog article on 3.3.0

2010-01-28 Thread Charles Gregory
On Thu, 28 Jan 2010, Alex wrote: The font is very small (CTRL-+ helped here), but it's so light I couldn't read it. Stupid pet trick: Highlight the text with your mouse, and you will get ugly, but readable white-on-blue. :) - C

Re: [Sare-users] painting everybody in Taiwan with the same brush

2010-01-27 Thread Charles Gregory
On Wed, 27 Jan 2010, Kai Schaetzl wrote: So what should a Taiwan user (Taiwan~=Hinet) user do. Buy a SMTP account with a US Company? I told you what you can do. Apart from that, again: SARE is not part of SA. SARE is deprecated. So, why bother? Why bother posting just to tell him that his

Re: spamassassin-3.3.0 for Fedora/RHEL

2010-01-26 Thread Charles Gregory
On Tue, 26 Jan 2010, Warren Togami wrote: http://wtogami.livejournal.com/33674.html If you use spamassassin on Fedora or RHEL5, please see my blog post for RPM packages and distro-specific notes. Anyone know where to find a RHEL(CentOS) 4 rpm? Or will it appear in the CentOS 4 official update

Re: spamassassin-3.3.0 for Fedora/RHEL

2010-01-26 Thread Charles Gregory
On Tue, 26 Jan 2010, Kai Schaetzl wrote: Charles Gregory wrote on Tue, 26 Jan 2010 14:10:51 -0500 (EST): Anyone know where to find a RHEL(CentOS) 4 rpm? Or will it appear in the CentOS 4 official update channels in due time? Just do yourself. Follow the instructions on the download page, it's

Re: [sa] Re: administra...@willspc.net bounces

2010-01-24 Thread Charles Gregory
On Sun, 24 Jan 2010, Benny Pedersen wrote: why did the bounce not go to apache.org ?, or did it, but apache.org did not see the problem in maillist ? Because we have a caching server accepting the mail, and then when it *finally* decides the client is not going to retrieve the mail, it

Re: [sa] Re: Whitelist on List-ID

2010-01-22 Thread Charles Gregory
On Thu, 21 Jan 2010, LuKreme wrote: : You shouldn't be sending ANY mailinglists through SpamAssassin. Say what? And how exactly do you propose to do that for hundreds of users, any of whom could be subscribed to many different lists? Far too much for any manual system (presuming you could even

Re: Whitelist on List-ID

2010-01-22 Thread Charles Gregory
On Fri, 22 Jan 2010, Matus UHLAR - fantomas wrote: On Thu, 21 Jan 2010, LuKreme wrote: : You shouldn't be sending ANY mailinglists through SpamAssassin. On 22.01.10 09:49, Charles Gregory wrote: Say what? And how exactly do you propose to do that for hundreds of users, any of whom could

Re: Wrong functionality of SUBJ_ALL_CAPS in mixed English and Greek subject

2010-01-19 Thread Charles Gregory
On Tue, 19 Jan 2010, Mike Cardwell wrote: : Then I don't know the Greek alphabet. The relevant subroutine from : SpamAssassin::Plugin::HeaderEval is below: :$subject =~ s/[^a-zA-Z]//g; # only look at letters I think the 'issue' is that spamassassin *should* have some 'higher level'

lint unresolved dependencies (was: is bayes enabled by default?)

2010-01-18 Thread Charles Gregory
On Sun, 17 Jan 2010, Benny Pedersen wrote: : spamassassin 21 -D --lint | less : is this line not a FAQ by now ? I just tried this, for curiosity's sake, and was surprised to discover that a couple of my meta rules had simple typos that showed up like this in the 'debug' output (3.2.5): [28424]

Re: [sa] Re: Faked _From_ field using our domain - how to filter/score?

2010-01-13 Thread Charles Gregory
On Wed, 13 Jan 2010, Mike Wallace wrote: : I do this but it only works for rejecting a forged envelope. It doesn't : work if it's only a forged From header which the example shows. : : Does anyone know of a way to handle this type of scenario, where the : envelope From is valid and the From

Re: newbie: configure SA to reject spam

2010-01-13 Thread Charles Gregory
On Wed, 13 Jan 2010, tonjg wrote: : thanks for your response Ned. : your last line describes exactly what I want to do - reject mail, do it at : the smtp stage in sendmail - but I don't know how to achieve this. Welcome! Permit me to state what may be considered 'obvious' to many, but which may

Re: [sa] Faked _From_ field using our domain - how to filter/score?

2010-01-12 Thread Charles Gregory
On Tue, 12 Jan 2010, Callum Millard wrote: : The problem is spam with a faked 'From:' field. Spammers are sending : e-mails to our domain with the 'From:' field set to a valid e-mail : address from our domain. Key question: Can your users send mail 'From' their internal addresses via ANY

Re: pill image spam learns to walk

2010-01-11 Thread Charles Gregory
On Mon, 11 Jan 2010, Mike Cardwell wrote: : I just copied and pasted that out of pastebin into a little project I've : been working on. Here's the result: : http://spamalyser.com/v/6xnb26gp/mime Question: What does spamalyzer do with an HTML message part? It is of concern (naturally) that

Re: Fake mailing list spam

2010-01-11 Thread Charles Gregory
On Mon, 11 Jan 2010, LuKreme wrote: : I never subscribed to the list in question. I am, in fact, not : subscribed to any googlelists on this account. I'm not an expert on googlegroups headers, but these 'look right'. So I'm inclined to agree that this is just an abused group and not spam that

Re: [sa] segmentation fault on startup

2010-01-10 Thread Charles Gregory
I don't know that it applies to specifically spamassassin, but I used to run into considerable nuisance with seg faults on Solaris when the parameters of scripts were a specific number of bytes - I think around multiples of 32. So you might achieve joy by adjusting the length of a filename

Re: Broken mass mailings - Delivered-To: issue

2010-01-08 Thread Charles Gregory
Please reply to list. This reply is to list... On Fri, 8 Jan 2010, Richard B. Emerson wrote: : Actually, the example note has To: bab...@yahoogroups.com not To: : ch...@pinefields.com... The To header is irrelevant. Mail to this list is addressed To: the list. But the *envelope* (which is

Re: Broken mass mailings - Delivered-To: issue

2010-01-08 Thread Charles Gregory
Ooops. Sorry. A poster replied offlist, and when I attempted to put it back on-list, I lamely inserted the SA users list address instead of the procmail list address. (smack forehead) Disregard. -C On Fri, 8 Jan 2010, Charles Gregory wrote: : Please reply to list. This reply is to list

Re: semi-legit senders in DNSWL and habeas - a hard problem

2010-01-06 Thread Charles Gregory
On Tue, 5 Jan 2010, Michael Scheidell wrote: : My suggestion: Setup a link/page that provides for rapid reporting by : pasting an offending e-mail without a bunch of form-filling. Just use a : captcha to avoid poisoning :) : - C : or an industry standard, RFC REQUIRED abuse@ address.

Re: semi-legit senders in DNSWL and habeas - a hard problem

2010-01-06 Thread Charles Gregory
On Tue, 5 Jan 2010, Gene Heskett wrote: : The bottom line is that they are still spammers. Filter 'em. About that. A principle needs to be discussed here: Prohibition does not work. The way to gain cooperation from 'big business' that *does* want to 'spam' is to find ways to keep them

Re: semi-legit senders in DNSWL and habeas - a hard problem

2010-01-06 Thread Charles Gregory
On Tue, 5 Jan 2010, Greg Troxel wrote: : Thanks. A link like report spam in the top bar, alongside marketers : and senders would help. That should link to a page that gives an email : address where one can forward the full offending message, and a way to : lookup IP addresses to see if they are

Re: [sa] Comparing the envelope-from/sender to the body from to prevent fake local users spams?

2010-01-06 Thread Charles Gregory
On Wed, 6 Jan 2010, lstep wrote: : Is there something implemented in Spamassassin to test and prevent mails : that come from 'outside' that have the header 'From' set to an internal : user? And here are YOUR headers on your email, which you would have received on your server from an 'outside

Re: semi-legit senders in DNSWL and habeas - a hard problem

2010-01-06 Thread Charles Gregory
On Wed, 6 Jan 2010, Kai Schaetzl wrote: : just wanted to inform you that is the only official quote marker. Deep sigh. Do you know why I changed it? Because I was getting several M$ Outhouse correspondents complaining that my messages (using the 'standard' '') were 'difficult to read'. I

Re: [sa] Re: semi-legit senders in DNSWL and habeas - a hard problem

2010-01-05 Thread Charles Gregory
On Tue, 5 Jan 2010, J.D. Falk wrote: : On Jan 5, 2010, at 10:10 AM, Greg Troxel wrote: : Once again I went to returnpath and senderscorecertified's web pages, : and found no link to an email address to report being spammed by one of : their customers. : Is the font size for Contact Us and

Re: [sa] Re: PH_DATE_PAST_20XX

2010-01-04 Thread Charles Gregory
date), figuring I would update the code long before I got here. Now I'm looking at my system and wondering, DID I update all those programs? LOL - C Charles Gregory wrote: Holy !!! I am SO glad that I read my e-mail first thing this morning! THANKS for spotting

Re: Apache SpamAssassin Y2K10 Rule Bug - Update Your Rules Now!

2010-01-04 Thread Charles Gregory
You know, I really can't complain about the 'responsiveness' in this situation. Under 24 hours. That's d**n good for anyone, but especially for volunteers on a holiday! I'm seriously impressed! Big thanks to the team! - Charles On Sat, 2 Jan 2010, Daryl C. W. O'Shea wrote: I've posted the

Re: PH_DATE_PAST_20XX

2010-01-01 Thread Charles Gregory
Holy !!! I am SO glad that I read my e-mail first thing this morning! THANKS for spotting this! - Charles On Fri, 1 Jan 2010, Mike Cardwell wrote: I just received some HAM with a surprisingly high score. The following rule triggered: * 3.2 FH_DATE_PAST_20XX The date

Re: [sa] Re: FH_DATE_PAST_20XX

2010-01-01 Thread Charles Gregory
On Fri, 1 Jan 2010, Mike Cardwell wrote: On 01/01/2010 10:15, Per Jessen wrote: I just received some HAM with a surprisingly high score. The following rule triggered: * 3.2 FH_DATE_PAST_20XX The date is grossly in the future. Agree, that should probably be [2-9][0-9]. Please open a bug for

Re: Latest 419 variant?

2009-12-23 Thread Charles Gregory
Not the first time I've seen 'threat mail' 419 though the other one was a much slicker job, and actually had my user a bit worried Just the same, thanks for posting this, I'll add a few rules to catch it. Don't want my more-senior clients worried by this crud - C On Tue, 22

Re: a.s.r (was Re: habeas - tainted white list)

2009-12-21 Thread Charles Gregory
On Mon, 21 Dec 2009, J.D. Falk wrote: That's IT! PORNOGRAPHIC DOCUMENTATION! Sorry. Already been tried. But no matter what we called it, the users still didn't appreciate their computers or network going down on them. :) - C PS. Let's not get started on how hard disks are smaller than

Re: Whitelists in SA

2009-12-20 Thread Charles Gregory
On Sat, 19 Dec 2009, Daryl C. W. O'Shea wrote: More unfortunately, privacy concerns prevent me from building a useful corpus of ham. Sigh But otherwise such a good idea Can you not trust yourself to use your own ham? You don't need to provide us with your mail. You can scan your own

Re: [sa] Re: Whitelists in SA

2009-12-20 Thread Charles Gregory
On Sun, 20 Dec 2009, jdow wrote: The downside is that this is not confirmed ham and confirmed spam. (nod) Exactly. And that is what is needed to do a masscheck... I wonder how much companies would pay for a part time SpamAssassin honcho who can be trusted (bonded?) and can write SARE-ish

Re: [sa] Re: Whitelists in SA

2009-12-19 Thread Charles Gregory
On Fri, 18 Dec 2009, Warren Togami wrote: Why wait, when you do relatively simple things to help make it happen? http://wiki.apache.org/spamassassin/NightlyMassCheck We can more frequently update rules if more people participate in the nightly masschecks. The current documentation is a bit of

Re: habeas - tainted white list

2009-12-19 Thread Charles Gregory
On Sat, 19 Dec 2009, Res wrote: the only person here at present trolling is you, so for F's sake STFU and stop generating massive noise ratio (nod) Done. - C

Re: habeas - tainted white list

2009-12-18 Thread Charles Gregory
On Thu, 17 Dec 2009, Christian Brel wrote: Would it be rude of me to ask how you make your money? Is it from the provision and delivery of bulk commercial email or am I confused? Wow. People are running down ReturnPath and they don't even have a clear idea of what RP *does*? How lame is that?

Re: Whitelists in SA

2009-12-18 Thread Charles Gregory
On Thu, 17 Dec 2009, jdow wrote: It is a good thing this issue was raised. It led to appropriate mass check runs. I expect that will lead to saner scoring within the SA framework. If not and it bites me, THEN I'll raise the issue again. Does that seem fair? 50_scores.cf:score

Re: habeas - tainted white list

2009-12-18 Thread Charles Gregory
On Fri, 18 Dec 2009, Christian Brel wrote: Why not default them to zero and include in the release notes/man that there are whitelists and they can *enable* them? Go read the archives, troll. - C

Re: habeas - tainted white list

2009-12-18 Thread Charles Gregory
On Fri, 18 Dec 2009, Christian Brel wrote: But they should not have to disable a whitelist that assists with the delivery of bulk commercial mail in an anti-spam application! If the sender is relying on such rules to keep the mailout under the radar then clearly there is something very wrong

Re: habeas - tainted white list

2009-12-18 Thread Charles Gregory
On Fri, 18 Dec 2009, Christian Brel wrote: On he subject of Spammy whitelists... * -1.0 RCVD_IN_DNSWL_LOW RBL: Sender listed at http://www.dnswl.org/, low * trust * [212.159.7.100 listed in list.dnswl.org] Yet the same IP is on and off SORBS and part of an ongoing spam problem. Perhaps

Re: habeas - tainted white list

2009-12-18 Thread Charles Gregory
On Fri, 18 Dec 2009, Christian Brel wrote: You need to resort to abuse for what particular reason? Repeatedly accusing the SA developers of fraudulent collusion is abusive. Don't be surprised if people are abusive in return. That is your choice of words - not mine. It is interesting that when

Re: [sa] Re: habeas - tainted white list

2009-12-18 Thread Charles Gregory
On Fri, 18 Dec 2009, Christian Brel wrote: On Thu, 17 Dec 2009, Christian Brel wrote: Would it be rude of me to ask how you make your money? Is it from the provision and delivery of bulk commercial email or am I confused? Wow. People are running down ReturnPath and they don't even have a clear

Re: [sa] Re: habeas - tainted white list

2009-12-18 Thread Charles Gregory
On Fri, 18 Dec 2009, Christian Brel wrote: Go read the archives, troll. All of them or do you have something specific, troll? Fine, fine, pedant. Go SEARCH the archives, troll. :) - C

Re: [sa] Re: habeas - tainted white list

2009-12-18 Thread Charles Gregory
On Fri, 18 Dec 2009, Jason Bertoch wrote: Or we could have the whitelist rules in a meta such that they only hit when a blacklist rule doesn't, if this is a common enough problem. It might also allow people to get past the high negative score for the whitelists. Hm. I *like* that

Re: [sa] Re: habeas - tainted white list

2009-12-18 Thread Charles Gregory
On Fri, 18 Dec 2009, Christian Brel wrote: Go SEARCH the archives, troll. :) Perhaps I can help you understand why the question was asked on list. It's obvious as to why. You failed to read previous postings that answered the question the first time(s) you (or someone else) asked it

Re: [sa] Re: habeas - tainted white list

2009-12-18 Thread Charles Gregory
On Fri, 18 Dec 2009, Christian Brel wrote: There comes a time when you need to deal with that and move on. We are all grown up now and not - like you say - '5 6 year old children'. Good. Then stop talking like them. Please feel free to act like an adult and end the personal attacks, or, act

Re: [sa] Re: habeas - tainted white list

2009-12-18 Thread Charles Gregory
On Fri, 18 Dec 2009, Christian Brel wrote: Charles, you *are* speaking for J D Falk with his Auspices? Hey, J D! Please post and give me your auspices. I'd love to see what this Troll posts if you say 'sure'. :) - C

Re: [sa] Re: Whitelists in SA

2009-12-18 Thread Charles Gregory
On Fri, 18 Dec 2009, LuKreme wrote: It's already been stayed no changes to 3.2.5 will be made until 3.3 is done, hasn't it? Well, at this point, I respectfully bow, and take a step back, so as not to sound too demanding of our great volunteers (smile), but I believe in another of my posts I

Re: [sa] Re: habeas - tainted white list

2009-12-18 Thread Charles Gregory
On Fri, 18 Dec 2009, jdow wrote: I suppose it's not a whole lot of bother to change the 3.2 scores. But, people who feel they have been bitten with a HABEAS score have probably already overridden them. Again, I make a note that my concern is for the thousands who install a 'pre-canned'

Re: [sa] Re: Whitelists in SA

2009-12-18 Thread Charles Gregory
On Fri, 18 Dec 2009, jdow wrote: On Thu, 17 Dec 2009, jdow wrote: Still no changes through the sa-update channel. Is there a time delay in the masscheck results being applied? Yes, there is, Mr. Gregory. It exists between your monitor and your keyboard. There is a one inch gap between

Re: [sa] Re: habeas - tainted white list

2009-12-18 Thread Charles Gregory
On Fri, 18 Dec 2009, John Hardin wrote: Or we could have the whitelist rules in a meta such that they only hit when a blacklist rule doesn't, if this is a common enough problem. It might also allow people to get past the high negative score for the whitelists. Is there a way

Re: [sa] Re: Whitelists in SA

2009-12-18 Thread Charles Gregory
On Fri, 18 Dec 2009, John Hardin wrote: We hope to get rule scoring and publication much more automated - i.e., if a rule in the sandbox works well based on the automated masschecks, it would be automatically scored and published via sa-update. Music to my ears. I will wait (semi-)patiently.

Re: Whitelists, not directly useful to spamassassin...

2009-12-17 Thread Charles Gregory
Thank you, Warren. That (finally) gives some real perspective to this mess, and gets some of the 'real' questions answered. - C On Wed, 16 Dec 2009, Warren Togami wrote: I made a discovery today that surprised even myself. Using the rescore masscheck and weekly masscheck logs while working

Re: [sa] Re: emailreg.org - tainted white list

2009-12-17 Thread Charles Gregory
On Thu, 17 Dec 2009, Yet Another Ninja wrote: On 12/16/2009 6:16 PM, Charles Gregory wrote: On Wed, 16 Dec 2009, Yet Another Ninja wrote: blabber... checkout SVN - follow dev list... HABEAS is history... I believe the *point* here is that HABEAS is NOT 'history' for ordinary systems

Re: emailreg.org - tainted white list

2009-12-17 Thread Charles Gregory
On Wed, 16 Dec 2009, LuKreme wrote: On 16-Dec-2009, at 16:11, Michael Hutchinson wrote: So far only 1 person on this list has claimed to have been hit by Spam that has been let through by the Habeas rules in SA. I'm the only one? Really? That doesn’t jibe with my memory, but I'm not scanning

Re: OT Re: Museum piece...

2009-12-17 Thread Charles Gregory
On Thu, 17 Dec 2009, hc...@mail.ewind.com wrote: I decided it was time to upgrade when a computer store clerk was trying to tell me that there was no such thing as an 8 floppy disk... I wonder if IBM finally phased them out? I still have a couple as souvenirs :) - C

RE: emailreg.org - tainted white list

2009-12-16 Thread Charles Gregory
On Tue, 15 Dec 2009, jdow wrote: Three points: 1) It is known this list is read by spammers to learn what we are doing. I've verified this with challenge/response tactics including taunting more than once. Sh! They'll hear you! :) 2) On several occasions now Richard has tried to torpedo

Re: icontact random tracking urls and scoring on unwanted TLDs

2009-12-16 Thread Charles Gregory
On Tue, 15 Dec 2009, Chris Santerre wrote: A few months back there was a wave of spam coming from abused Polish .pl TLD. It seems iContact uses random generated directories in thier tracking URLs that contain a period. Yup... you guessed it... incontact/a.pl/ means it hits the rule.

Re: HTML in Messages

2009-12-16 Thread Charles Gregory
On Tue, 15 Dec 2009, Marc Perkel wrote: I found the text only list and I originally had it set to just spamassassin.org rather that spamassassin.apache.org so this should help those on the list reading their email with a KSR33 teletype on a 110 baud acoustic modem use less paper when reading

OT: Museum piece...

2009-12-16 Thread Charles Gregory
On Tue, 15 Dec 2009, Chris Hoogendyk wrote: Marc Perkel wrote: http://www.vintage-computer.com/asr33.shtml There was actually a time when I had one of those in my house. For your amusement: I still have my old Commodore 64 and 1541 drive sitting in the basement. One year my daughter's

OT: Weird characters in Pine

2009-12-16 Thread Charles Gregory
On Tue, 15 Dec 2009, John Hardin wrote: I generally use PINE {researches a bit} Hmmm. It only appears to happen when non-ASCII characters are in the message I'm replying to. OT: Seeing how you seem to have some passing acquaintance with ASCII character set issues, I thought I would ask

Re: emailreg.org - tainted white list

2009-12-16 Thread Charles Gregory
On Tue, 15 Dec 2009, J.D. Falk wrote: Which finally brings us back to the core questions which seem to go unanswered: They've all been answered many times, in other threads. Perhaps I missed the messages, but it seems to me that the deep issues are *debated* a little, but never really

Re: emailreg.org - tainted white list

2009-12-16 Thread Charles Gregory
On Wed, 16 Dec 2009, Yet Another Ninja wrote: blabber... checkout SVN - follow dev list... HABEAS is history... I believe the *point* here is that HABEAS is NOT 'history' for ordinary systems running ordinary sa-update on 3.2.5. My rules (in /var/lib/spamassassin) still include the

Re: OT: Museum piece...

2009-12-16 Thread Charles Gregory
On Wed, 16 Dec 2009, Ted Mittelstaedt wrote: Those were the days. A few poke and peek commands, 15 minutes waiting for the cassette tape to load the pirated game... Biggest thrill for me was reverse-egineering the 'fast loader' code in one of the games so that I could create my own TSR that

Re: [sa] RE: emailreg.org - tainted white list

2009-12-15 Thread Charles Gregory
On Tue, 15 Dec 2009, Martin Gregorie wrote: Clarification: I, for one, was only proposing that the whitelisting plugins and rules that query external databases are removed from the standard ruleset and sa_update and placed in a separate library of optional rules. The 'issue' (as I see it) is

Re: [sa] Re: Spam from compromised web mails

2009-12-15 Thread Charles Gregory
On Tue, 15 Dec 2009, Jeff Koch wrote: I have to say that it is extremely annoying that this mailing list does not put a tag identifying itself in the subject line. Every other mailing list of a similar technical nature that I participate in has a tag. A tag of two characters would allow users

Re: Site-wide Bayes (was: Spam from compromised web mails)

2009-12-15 Thread Charles Gregory
On Tue, 15 Dec 2009, Matt Garretson wrote: Heartily agreed. Site-wide bayes here (single database for 2000+ users) catches 40% of the spam here. But what is the FP rate? Is it safe for an ISP with a widely varied user base to use site-wide Bayes? - Charles

Re: HTML in Messages

2009-12-15 Thread Charles Gregory
On Tue, 15 Dec 2009, Marc Perkel wrote: Get a modern email client. Are you using a KSR33 teletype on a 110 baud modem? To be fair, I must admit that there comes a point in the technology curve when we must let go of the oldest/plainest tech in favor of new ways of doing things. And even my

Re: [sa] Re: Spam from compromised web mails

2009-12-15 Thread Charles Gregory
On Tue, 15 Dec 2009, Toni Mueller wrote: As you may have noticed, I've got my procmail set to insert one (as seen above). But this has the unfortunate side-effect of messing with threading in some threaded mail clients and archives :( I don't know the abilities of Alpine, but if you use

Re: emailreg.org - tainted white list

2009-12-15 Thread Charles Gregory
On Tue, 15 Dec 2009, LuKreme wrote: On 15-Dec-2009, at 09:42, Charles Gregory wrote: The 'issue' (as I see it) is that a great many servers install a 'standard' SA 'package' So it is important to to make the best possible assessment of all rules... The trouble with that is exactly

Re: Spam from compromised web mails

2009-12-15 Thread Charles Gregory
On Tue, 15 Dec 2009, LuKreme wrote: As you may have noticed, I've got my procmail set to insert one (as seen above). But this has the unfortunate side-effect of messing with threading in some threaded mail clients and archives :( I just see Subject: Re: Re: Spam from… Changing the subject

Re: [sa] Re: emailreg.org - pretty good white list

2009-12-14 Thread Charles Gregory
On Mon, 14 Dec 2009, John Hardin wrote: On Mon, 14 Dec 2009, Per Jessen wrote: Why would anyone pay USD20 to register with emailreg.org instead of publishing an SPF record for free? To keep the pointy-haired managers happy. Meow! :) - C

Re: [sa] RE: emailreg.org - tainted white list

2009-12-14 Thread Charles Gregory
On Tue, 15 Dec 2009, Michael Hutchinson wrote: If everyone could ignore the taunting, and just carry on, there wouldn't be an issue. The taunting *is* the issue. The rest of the arguments, about design and defaults, are carried on by numerous individuals in a quite civilized manner. But when

Re: [sa] RE: emailreg.org - tainted white list

2009-12-14 Thread Charles Gregory
On Mon, 14 Dec 2009, Bob O'Brien wrote: I can mostly just offer opinion, and that would be that whitelisting is not (yet) in wide enough use to have become a sufficiently attractive target. Which brings us back to the 'rational version' of the discussion about SA weighing whitelists

Re: [sa] Re: Suggestion for use by ANY whitelist service....

2009-12-09 Thread Charles Gregory
On Tue, 8 Dec 2009, Yet Another Ninja wrote: Save your bullets. Habeas is history... it's been swallowed and the new mothership will be in SA 3.3.0 Cryptic, but raising hopes. Could you please explain this remark? - C

Re: [sa] Re: Suggestion for use by ANY whitelist service....

2009-12-09 Thread Charles Gregory
On Wed, 9 Dec 2009, John Hardin wrote: NOW you're getting somewhere. I saw that info on their site. The IP returned has the last octet set according to the tier. So maybe the issue here, which we should push into the SA developers hands is that the current Habeas rules only look for a binary

Re: [sa] RE: Suggestion for use by ANY whitelist service....

2009-12-08 Thread Charles Gregory
On Mon, 7 Dec 2009, R-Elists wrote: Nonsense. I had to score this list -2000 just to keep it from scoring so darn high that it was hitting the 'automatic' rejection at the SMTP gate before any of my whitelists could function. Charles, you would be better off properly whitelisting the SA mailing

Re: Suggestion for use by ANY whitelist service....

2009-12-08 Thread Charles Gregory
On Mon, 7 Dec 2009, Ted Mittelstaedt wrote: Yes, this is the grand new frontier of e-mail marketing. Technically, you *are* opting-in. It meets satisfactory criteria because you are using some other form of identification to substantiate that you are *really* you (you are buying stuff). But

Re: How to score jokes from non-spam sources

2009-12-08 Thread Charles Gregory
On Tue, 8 Dec 2009, Terry Carmen wrote: Some of my users have people they normally to corrospond with, but who also send large numbers of massivly CC'd jokes. Does anybody have an example of a rule that would score messages with large numbers of CCs higher, without hosing filtering for the

RE: Suggestion for use by ANY whitelist service....

2009-12-08 Thread Charles Gregory
On Tue, 8 Dec 2009, Mike Cardwell wrote: On 08/12/2009 16:35, Charles Gregory wrote: . My SMTP gateway (Mail Avenger) works best if mail is scanned for *all* recipients, and so it is not possible to use individual per-user Bayes. In cases were there is only a single recipient, I run

Re: Suggestion for use by ANY whitelist service....

2009-12-07 Thread Charles Gregory
On Fri, 4 Dec 2009, Ted Mittelstaedt wrote: What are you asking? Obviously 'unsolicited' is NOT 'wanted', so therefore by using the word 'wanted' I am by definition meaning *solicited*. That means somone ASKED for the mail. REQUESTED it via an opt-in mechanism, with confirmation. I will

Re: HABEAS_ACCREDITED WHY BY DEFAULT?

2009-12-07 Thread Charles Gregory
On Sat, 5 Dec 2009, Per Jessen wrote: Won't customers dealing with such a company will have whitelisted them long ago? For every 'mark' that is out there, stupidly entering their e-mail and then getting a bunch of ads for which they didn't realize they had given permission, there are people

Re: freemail vs dkim / spf

2009-12-07 Thread Charles Gregory
On Sun, 6 Dec 2009, Benny Pedersen wrote: i think it could be added to freemail.pm to test if sender domain have spf or dkim and if no spf and or no dkim consider it as a freemail domain ? Nope. I run an ISP and basically my SPF amounts to 'neutral' because my users can send mail from any

Re: Suggestion for use by ANY whitelist service....

2009-12-07 Thread Charles Gregory
On Sat, 5 Dec 2009, R-Elists wrote: Nyet, nyet, nyet... we would *not* all live with the occassional opt-in request from Return Path. frankly, nothing against them, yet if an organization really needs Return Path to get their email through to mailboxes without rejection, then doesn't the

<    1   2   3   4   >