Re: Off Topic - SPF - What a Disaster

2010-02-25 Thread Lee Dilkie
Marc Perkel wrote: I'm not hearing from people in this forum who are saying it works. Even those who are SPF evangelists can't point to any significant results in either blocking spam or passing ham. Well it's no magic bullet, but nothing is. I use SPF to try and make my domain less a target

Re: Error with sa-update.

2010-02-28 Thread Lee Dilkie
Daryl C. W. O'Shea wrote: Are you still having this issue? yes indeed Wow. That's an incredibly bad idea. Allowing sa-update to install Perl, or other, code (--allowplugins) without verifying that the code is signed (--nogpg) is pretty risky. If a mirror gets hacked you'll run

Re: Error with sa-update.

2010-02-28 Thread Lee Dilkie
On getting pgp to work... Following HOWTO at http://daryl.dostech.ca/sa-update/sare/sare-sa-update-howto.txt wget http://daryl.dostech.ca/sa-update/sare/GPG.KEY; worked fine $ sa-update --import GPG.KEY gpg: keyblock resource `/usr/local/etc/mail/spamassassin/sa-update-keys/secring.gpg': No

Re: Error with sa-update.

2010-02-28 Thread Lee Dilkie
nevermind, it eventually created the directory and jeyring files... not quite sure how that happened.. Lee Dilkie wrote: On getting pgp to work... Following HOWTO at http://daryl.dostech.ca/sa-update/sare/sare-sa-update-howto.txt wget http://daryl.dostech.ca/sa-update/sare/GPG.KEY; worked

can I roll back to an earlier version of updates

2010-02-28 Thread Lee Dilkie
Folks, For what ever reason, my sa-update to 3.30 has buggered itself. In my efforts to debug it's now at the situation that SA has no rules to run and I'm getting swamped. How, if it's possible, can I tell SA and sa-update to use the 3.2 version of the ruleset? Simply deleting the tree and

Re: can I roll back to an earlier version of updates

2010-03-01 Thread Lee Dilkie
Karsten Bräckelmann wrote: On Sun, 2010-02-28 at 18:44 -0500, Lee Dilkie wrote: For what ever reason, my sa-update to 3.30 has buggered itself. In my efforts to debug it's now at the situation that SA has no rules to run and I'm getting swamped. The first sentence is seriously

Re: can I roll back to an earlier version of updates

2010-03-01 Thread Lee Dilkie
?? Is there an archive I can download? (I'm thinking of modifying sa-update to comment-out where it removes the tmp files) -lee Karsten Bräckelmann wrote: On Mon, 2010-03-01 at 06:45 -0500, Lee Dilkie wrote: Karsten Bräckelmann wrote: Anyway, what comes to mind: Did you run sa-update after

Re: can I roll back to an earlier version of updates

2010-03-01 Thread Lee Dilkie
Subject =~ /Approve/i^M header __SUBJ_RE Subject =~ /^R[eE]:/^M -lee Lee Dilkie wrote: no joy. doesn't look like the ports version of SA comes with any stock rules (nothing obvious in the ports dir tree, the work/ directory had en empty 72_active.cf file)... I deinstalled

Re: can I roll back to an earlier version of updates

2010-03-01 Thread Lee Dilkie
::MIMEHeader mimeheader __TVD_OUTLOOK_IMGContent-Id =~ /image\d+\.(?:gif|jpe?g|png)\@/ endif Lee Dilkie wrote: progress report.. commented out the place where the lint results were checked and rules got installed. looking at 72_active.cf I see a number of lines ending in CR (^M

Re: can I roll back to an earlier version of updates

2010-03-02 Thread Lee Dilkie
of other changes too). Not sure why the gremlins were banished. Interesting mystery. -lee Lee Dilkie wrote: Final update folks, sorry for the noise if it's bothersome... commented out the three offending lines in 72_active.cf and --lint passed and I'm back up and running. No idea what

Re: Whitelist isn't working

2010-03-16 Thread Lee Dilkie
Curious that SPF_FAIL is reported... X-Spam-Report: * 1.9 TVD_RCVD_IP TVD_RCVD_IP * 3.2 FH_DATE_PAST_20XX The date is grossly in the future. * 1.5 FROM_STARTS_WITH_NUMS From: starts with many numbers * 1.9 DATE_IN_FUTURE_06_12 Date: is 6 to 12 hours after Received: date *

lint failed with FuzzyOCR error

2010-03-25 Thread Lee Dilkie
Hi Folks, My nightly sa-upgrade caught this funny error and I cannot figure out... Mar 25 04:15:45.030 [76697] info: body_0: 1547 base strings extracted in 37 seconds rules: failed to run FUZZY_OCR test, skipping: (Timeout::_run: Insecure dependency in open while running with -T switch

Re: Scanning large-body spam

2010-03-30 Thread Lee Dilkie
Alex wrote: Hi, What settings do people typically have these days for the maximum scanned message size? Surprisingly, at least to me, I'm seeing spam in the 650k and 700k range, at least a few per hour, and are not scanned. Does anyone have any suggestions for optimizing the process for

Re: Reducing scan time

2010-04-21 Thread Lee Dilkie
Chris, Do you use sa-compile? I found that made a tremendous difference for me. -lee Chris wrote: I've posted two files below, one is the time output for a spam and one for ham. Seems like over the past few weeks SA scan times have become slower and slower. For instance stats from last night

Re: Problems with sa-update

2010-04-23 Thread Lee Dilkie
I reported this issue about a month ago and didn't receive a response. So I set about fixing it myself. First, I edited the sa-update script to not delete the rules that it downloaded and was running lint on... I looked at those rules to see if I could spot the problem, but I couldn't... looked

Re: [OT] was SORBS

2010-04-30 Thread Lee Dilkie
On 4/30/2010 7:43 AM, corpus.defero wrote: On Fri, 2010-04-30 at 11:46 +0100, n.frank...@gmail.com wrote: Here's the chuckle Mail transport error, MTSPro SMTP Relay Agent could not deliver the following message for users@spamassassin.apache.org. Reason: 550 Dynamic IP Addresses

Re: Performance problem body tests

2010-06-03 Thread Lee Dilkie
On 6/3/2010 12:02 PM, Charles Gregory wrote: On Thu, 3 Jun 2010, Helmut Schneider wrote: I then started from scratch and tried with SA 3.2.5. The particular body_tests take only 5 seconds (instead of 30). As I mentioned before, I noticed this difference myself, and presumed it was just a

Re: Please Help with SA Rule: FH_HOST_IN_ADDRARPA

2010-06-17 Thread Lee Dilkie
the rule is flagging the fact that the servers are using non-assigned address space. On 6/17/2010 2:19 PM, gwilodailo wrote: Hello all, I've discovered that some mail between two of my clients (on separate hosts) is getting flagged as spam, because of this rule (FH_HOST_IN_ADDRARPA).

Re: might be a dev list question, getting deprecated warnings with perl 5.12

2010-09-27 Thread Lee Dilkie
:) love your style. -lee On 9/26/2010 8:00 PM, Karsten Bräckelmann wrote: *Might* have been a dev question, but it actually is not. Not even close to it. ;) On Sun, 2010-09-26 at 17:29 -0400, Lee Dilkie wrote: Use of goto to jump into a construct is deprecated at /usr/local/lib/perl5

Re: Does anyone known the braindead anti-spam software MagicSpam ?

2010-11-10 Thread Lee Dilkie
On 11/10/2010 6:32 AM, Michael Scheidell wrote: On 11/10/10 2:45 AM, Matus UHLAR - fantomas wrote: On 10.11.10 08:23, Per Jessen wrote: I got the following reject this morning: book...@example.com: host mail.example.com[1.2.3.4] said: 550 Dynamic Style reverse DNS

Re: Greylisting delay (was Re: Q about short-circuit over ruling blacklisting rule)

2011-01-19 Thread Lee Dilkie
I recently gave up on greylisting after using it for years as well. Two reasons really, one was the complaints from users (and I found that they often asked folks to send mail to me twice to try and get mail to work better and that was just embarrassing). The second was that I've found that the

Re: Greylisting delay (was Re: Q about short-circuit over ruling blacklisting rule)

2011-01-19 Thread Lee Dilkie
On 1/19/2011 10:02 AM, David F. Skoll wrote: On Wed, 19 Jan 2011 09:56:47 -0500 Lee Dilkie l...@dilkie.com wrote: The second was that I've found that the other spam-catching filtering is doing a much better job than it was years ago and turning off greylisting didn't adversely affect

Re: Points for missing MX Records

2011-02-23 Thread Lee Dilkie
You are confusing servers with *domains*. It's perfectly acceptable that an outgoing mail server not accept incoming mail but the issue here is whether is it is valid for a *domain* to be send-only. It's an interesting question. For DSN's to work, you need to accept email for that domain. But is

Re: __PILL_PRICE Problems

2011-03-20 Thread Lee Dilkie
On 3/20/2011 8:48 AM, Michael Scheidell wrote: On 3/20/11 6:04 AM, Matt Elson wrote: body__PILL_PRICE_3 /free\s(?:pill|tablet|cap(?:sule|let))s/i tflags __PILL_PRICE_3 multiple Specifically, they're causing spamassassin to run in an endless loop when the tflags

Re: ups.com virus has now switched to dhl.com

2011-03-31 Thread Lee Dilkie
it's IPv4.5 -lee On 3/31/2011 1:47 PM, Lawrence @ Rogers wrote: On 31/03/2011 1:29 PM, Michael Scheidell wrote: 'from' dhl.com (come on ups/dhl.. I know SPF is broken, but in this case it would sure help is decide if the sending ip is authorized to send on your behalf) with some pretty

Re: BOTNET IPv6 patch

2011-07-02 Thread Lee Dilkie
interesting. the ipv6 address is correct, spock.dilkie.com was the source of the email. however, the quoted ipv4 address, 216.191.234.70 is my employer's mail gateway (Mitel), and I suspect the script grabbed the ip address I used to send the test message to my server that was relayed to Yves.

Re: New versions of Perl are slower

2012-04-10 Thread Lee Dilkie
On 4/10/2012 10:50 PM, Julian Yap wrote: Hmm, thanks for the info. It certainly explains things. Yeah, SpamAssassin previously used to blaze through mail scans (everything scanned in less than 3 seconds) on the same hardware. It's annoying that Perl is getting slower over time and there's no

Re: New versions of Perl are slower

2012-04-11 Thread Lee Dilkie
On 4/11/2012 8:23 PM, Julian Yap wrote: On Tue, Apr 10, 2012 at 4:57 PM, Lee Dilkie l...@dilkie.com wrote: On 4/10/2012 10:50 PM, Julian Yap wrote: Hmm, thanks for the info. It certainly explains things. Yeah, SpamAssassin previously used to blaze through mail scans (everything scanned

Re: Fwd: plonk

2013-05-07 Thread Lee Dilkie
no idea, I read emails from both you and him and didn't see anything amiss. Benny's signature does not parse as English so it's hard to say what it means. I wouldn't worry about it. -lee On 5/7/2013 8:56 AM, Joe Acquisto-j4 wrote: Whatever that means. I think that if someone has cause

Re: Fwd: plonk

2013-05-07 Thread Lee Dilkie
some folks are preachy and sensitive... like those bottom posters who seem to like telling top posters how wrong they are. I wouldn't worry about it. But it was interesting to hear the history of the word plonk.. that was cool. -lee On 5/7/2013 12:06 PM, Joe Acquisto-j4 wrote: John Hardin

Re: Fwd: plonk

2013-05-07 Thread Lee Dilkie
On 5/7/2013 12:11 PM, Jim Popovitch wrote: On Tue, May 7, 2013 at 12:06 PM, Joe Acquisto-j4 j...@j4computers.com wrote: What I did not get was why my attempts to clarify whatever offense was taken were met by reject messages. Quite simply put, Benny Pedersen m...@junc.eu wants you to respect