correct AWL on training

hurt. Likewise, FN should adjust AWL upwards on manual training, no? -- Jesse Norell Kentec Communications, Inc. 970-522-8107 - www.kci.net

save resolved IP in bayes

a plugin? Thanks, Jesse -- Jesse Norell Kentec Communications, Inc. 970-522-8107 - www.kci.net

Re: save resolved IP in bayes

On Wed, 2014-09-03 at 23:36 +0200, Axb wrote: On 09/03/2014 11:17 PM, Jesse Norell wrote: Hello, Looking at recent botnet spam, comparing messages from one day to the next, I see new URL's being advertised that resolve to the same IP address as ones in the past. Eg. some at http

Re: correct AWL on training

On Thu, 2014-09-04 at 13:04 +0200, Matus UHLAR - fantomas wrote: On 03.09.14 15:13, Jesse Norell wrote: Both today and in the past I've looked at some FP's that scored very high on AWL. At least today I dug up the old messages that caused AWL to get out of line, and trained them as ham

MSPIKE in older SA ?

? Or is that just there to try to persuade people towards upgrading versions? Thanks, -- Jesse Norell Kentec Communications, Inc. 970-522-8107 - www.kci.net

Re: MSPIKE in older SA ?

On Wed, 2014-09-10 at 13:10 -0400, Kevin A. McGrail wrote: On 9/10/2014 12:59 PM, Jesse Norell wrote: Is there any reason you should not use MSPIKE in versions older than 3.4.0? Eg. on debian box with 3.3.2, I have 20_mailspike.cf; I commented the version check out, tested

Re: more_spam_from like more_spam_to

on sender * implement several WL score levels based on RCPT -- Jesse Norell Kentec Communications, Inc. 970-522-8107 - www.kci.net

Re: more_spam_from like more_spam_to

On Wed, 2014-09-17 at 16:47 +0200, Axb wrote: On 09/17/2014 04:27 PM, Jesse Norell wrote: snip Just a thought - maybe a config setting to not do automatic bayes training for a give from/to addr would be more appropriate? Say a meta rule (more a flag but I don't know enough SA rules

Re: Recent spate of Malicious VB attachments II

product meets your expectations. If you don't want to spend on AV the you'll have to look into free ClamAV signatures : http://sanesecurity.com/ and others. -- Jesse Norell Kentec Communications, Inc. 970-522-8107 - www.kci.net

Re: Retraining Spamassassin and the Dovecot antispam plugin

this working i'd appreciate knowing about it. Thanks. Dave. -- Jesse Norell Kentec Communications, Inc. 970-522-8107 - www.kci.net

Re: problem integrating spamassasin into postfix

tus=deferred (te mporary > failure. Command output: pipe: fatal: pipe_command: > execvp /home/spamd/spamfilter.sh: No such file or directory ) > > > Has anyone seen this and can help me out with an idea ? > > > Thank you very much ! /home/spamd/spamfilter.sh: No such file or directory sounds like you simply have the filename misspelled or in the wrong directory? -- Jesse Norell Kentec Communications, Inc. 970-522-8107 - www.kci.net

Re: problem integrating spamassasin into postfix

On Mon, 2016-01-11 at 13:32 -0700, Jesse Norell wrote: > On Mon, 2016-01-11 at 22:12 +0200, D CATALIN BADIRCA wrote: > > Hi, > > > > > > I am using with Postfix 10.2-RELEASE-p7 with Postfix 3.0.3 and I am > > trying to configure Spamassassin into my system. >

Re: Tuning recommendations?

yes with is the same user that the scanner runs as. -- Jesse Norell Kentec Communications, Inc. 970-522-8107 - www.kci.net

Re: R: regular expression needed

n't confident (nearly 100% ham or spam); it utilizes Redis Sets for set logic/operations. If you are creating a plugin for these phishing emails, it may be an avenue to pursue; it sounds like it works quite well (when trained with a large ham/spam corpus). -- Jesse Norell Kentec Communications, Inc. 970-522-8107 - www.kci.net

Re: txrep training performance

time issued 19 queries - relearning the same message as the same time issued 41 queries.) My guess is the current state of things is: could be improved, maybe file an rfe ? Thanks... On Wed, 2017-07-12 at 17:40 -0600, Jesse Norell wrote: > One thing pointing to maybe a need for rework

Re: message/rfc822 to mbox script for use with sa-learn workflow

ogether. If that's an option you'll pursue and you can use dovecot as your imap server, check out https://github.com/jnorell/train-spam-scanner as a training script. It's designed for exactly the goals you have in mind, ie. users supplying training messages which can be moderated and built into a corpus. -- Jesse Norell Kentec Communications, Inc. 970-522-8107 - www.kci.net

Re: message/rfc822 to mbox script for use with sa-learn workflow

ents > in windows, then auto-feed them myself (as attachment again). > b) let them send as attachment to a imap account, where I can > "unattach" inspect, and put in ham/spam imap folders then train from > those. > -- Jesse Norell Kentec Communications, Inc. 970-522-8107 - www.kci.net

Re: "bout u" campaign

rc - maybe worth looking into implementing in spamassassin? Does masscheck automate meta rule creation? (ie. not just generate scores) Not the full "evolution filter" idea which would have to run on the endpoint, but that would benefit everyone via rule updates. -- Jesse Norell Kentec Communications, Inc. 970-522-8107 - www.kci.net

Re: txrep training performance

ble. On Wed, 2017-07-12 at 09:59 -0600, Jesse Norell wrote: > Hello, > > I have txrep data in a mysql database, and am working on a training > script to run sa-learn; with bayes also in MySQL and a corpus size of > 5279 nspam and 849 nham, sa-learn takes a full 2 hours to run wi

txrep training performance

? Thanks, -- Jesse Norell Kentec Communications, Inc. 970-522-8107 - www.kci.net

Re: bayes sql: bayes_seen needs UPDATE

esolve this issue? > > On 6/22/2017 2:49 PM, Jesse Norell wrote: > > Hello, > > > > I'm working on converting a spam training script/setup which works with > > bayes dbm files to support sql bayes, and came across an error in the > > grants in the README.bayes file a

bayes sql: bayes_seen needs UPDATE

dded this to the bug tracker.) -- Jesse Norell Kentec Communications, Inc. 970-522-8107 - www.kci.net

Re: Can't locate Mail/SpamAssassin/Plugin/SpamCop.pm: lib/Mail/SpamAssassin/Plugin/SpamCop.pm: Permission denied

524003783.H176971P29357.netcup.bokomoko.de\:2\,S > > > > > [...] > > > > > Apr 18 18:49:52.980 [5164] dbg: config: using > > > > > "/home/rd/.spamassassin/ > > > > > user_prefs" for user prefs file > > > > > Apr 18 18:49:52.980 [5164] dbg: config: read file > > > > > /home/rd/.spamassassin/ > > > > > user_prefs > > > > > Apr 18 18:49:52.981 [5164] dbg: plugin: loading > > > > > Mail::SpamAssassin::Plugin::URIDNSBL from @INC > > > > > Apr 18 18:49:52.986 [5164] dbg: plugin: loading > > > > > Mail::SpamAssassin::Plugin::Hashcash from @INC > > > > > Apr 18 18:49:52.995 [5164] dbg: plugin: loading > > > > > Mail::SpamAssassin::Plugin::SPF from @INC > > > > > [...] > > > > > Apr 18 18:50:11.222 [5164] info: reporter: spam reported to > > > > > SpamCop > > > > > 1 message(s) examined. > > > > > Apr 18 18:50:11.301 [5164] dbg: plugin: > > > > > Mail::SpamAssassin::Plugin::MIMEHeader=HASH(0x372cf68) > > > > > implements > > > > > 'finish_tests', priority 0 > > > > > Apr 18 18:50:11.301 [5164] dbg: plugin: > > > > > Mail::SpamAssassin::Plugin::Check=HASH(0x372d220) implements > > > > > 'finish_tests', > > > > > priority 0 > > > > > > > > > > It almost seems that a prefix is missing when running through > > > > > inotifywait. > > > > > > > > > > Any hint is welcome :-) > > > > > > > > > > Many thanks > > > > > Rainer > > > > > > > > > > -- > > > > > Rainer Dorsch > > > > > http://bokomoko.de/ > -- Jesse Norell Kentec Communications, Inc. 970-522-8107  -  www.kci.net

Re: more spam is getting through :-(

ight handle things better. -- Jesse Norell Kentec Communications, Inc. 970-522-8107 - www.kci.net

Re: handling spam from gmail.

wish to communicate with your users. - by raising the "cost" of sending legitimate mail to your users, you will of course receive less legitimate mail along with less spam. - for business transactions this costs business/money; eg. if faced with such a system upon initial contact, I myself would choose to not "click the link" and merely go to a competitor if there are other reasonably equivalent businesses. not an absolute deal breaker, but definitely a strong turn-off. -- Jesse Norell Kentec Communications, Inc. 970-522-8107 - www.kci.net