Re: Smtp auth and trusted_networks

2014-07-10 Thread Giampaolo Tomassoni
Il 2014-07-10 17:36 Nick I ha scritto: Hi In the following example our mx received message with ESMTPSA from 1.1.1.1 and that ip detected as trusted. Our trusted_networks list do not have this ip configured. I need to run rbl check against 1.1.1.1. Is there any settings to not add

RE: RP rules helping spam get through

2013-04-27 Thread Giampaolo Tomassoni
Hello, Today a spam message from livingsocial.com got through. It was sent to a honey pot address (e.g. not used for legitimate mail). I don't even have an account with livingsocial.com. This spam message would have been caught had SA not credited it -5 points with two RP rules:

RE: SQL error: Duplicate entry

2013-04-25 Thread Giampaolo Tomassoni
On 4/25/2013 11:55 AM, Matus UHLAR - fantomas wrote: ... My understanding is that it's better (with respect to performance and atomicity) to attempt the INSERT and have it fail than to check if the ID/token combination already exists and UPDATE it if it does. Please note that it would

RE: fork is vfork? (was Re: With similar rules, rspamd is about ten times faster than SpamAssassin.)

2013-03-08 Thread Giampaolo Tomassoni
Memory management is tricky though. Hard to tell which values sum up to the real thing. Probably best meter on Linux is the actual free value highlighted below? Check it before starting amavisd/spamd/whatnot and check it again after running for a while. Also double check it after killing

RE: R: Rspamd project

2013-03-08 Thread Giampaolo Tomassoni
On 07/03/13 23:26, Giampaolo Tomassoni wrote: I see there would be problems in naming your project RSA. Nevertheless, is there any plan to have the current rspamd features in a library, in order to allow third-parties to develop their own message handling interface wrapping

RE: [OT] Re: R: Rspamd project

2013-03-08 Thread Giampaolo Tomassoni
On 3/8/2013 8:39 AM, Giampaolo Tomassoni wrote: Also, what if someone wants to integrate your product into some kind of javamail server? (Apache James, in example Vsevolod, do you have forum for your project that you can post as this are a bit off topic for an SA list? Regards, KAM

RE: fork is vfork? (was Re: With similar rules, rspamd is about ten times faster than SpamAssassin.)

2013-03-07 Thread Giampaolo Tomassoni
On Thu, 7 Mar 2013 13:47:55 +0100 Matus UHLAR - fantomas uh...@fantomas.sk wrote: the implementation of fork() in linux makes it nearly the same as vfork(). That is completely wrong. Just because modern forks use copy-on-write doesn't make them anything at all like vfork; the

RE: fork is vfork? (was Re: With similar rules, rspamd is about ten times faster than SpamAssassin.)

2013-03-07 Thread Giampaolo Tomassoni
On Thu, Mar 07, 2013 at 11:37:33AM -0500, David F. Skoll wrote: On Thu, 7 Mar 2013 17:47:22 +0200 Henrik K h...@hege.li wrote: Memory measured with free (without buffers/cache etc): begin 2588084 end 1296756 About 25MB non-shared memory used per child, Are you sure your

R: Re: fork is vfork? (was Re: With similar rules, rspamd is about ten times faster than SpamAssassin.)

2013-03-07 Thread Giampaolo Tomassoni
the linux memory stats mess. Giampaolo Henrik K h...@hege.li ha scritto: On Thu, Mar 07, 2013 at 07:02:00PM +0100, Giampaolo Tomassoni wrote: I just got a snip into my amavisd's 5 children /proc/pid/smaps file, summing together the count of Private_{Clean|Dirty} pages. I got this: p1

R: Rspamd project

2013-03-07 Thread Giampaolo Tomassoni
I see there would be problems in naming your project RSA. Nevertheless, is there any plan to have the current rspamd features in a library, in order to allow third-parties to develop their own message handling interface wrapping it? Giampaolo Vsevolod Stakhov vsevo...@highsecure.ru ha scritto:

R: With similar rules, rspamd is about ten times faster than SpamAssassin.

2013-03-06 Thread Giampaolo Tomassoni
Intriguing... Giampaolo dar...@chaosreigns.com ha scritto: http://freecode.com/projects/rspamd Somebody asked about it in IRC today.  I don't know anything about it.  -- You will need: a big heavy rock, something with a bit of a swing to it... perhaps Mars - How to destroy the Earth

RE: With similar rules, rspamd is about ten times faster than SpamAssassin.

2013-03-06 Thread Giampaolo Tomassoni
http://freecode.com/projects/rspamd Somebody asked about it in IRC today. I don't know anything about it. It seems to me it is yet a bit immature project. In example, it misses a message routing tool like amavisd, it probably doesn't scale very well if you need to deploy it on a cluster (it

RE: Spamassassin and SPF records with +all

2012-07-13 Thread Giampaolo Tomassoni
From: John Hardin [mailto:jhar...@impsec.org] Agreed. I was speculating that multiple variants of SPF_PERMISSIVE might be justified, e.g. SPF_PERMISSIVE_ALL, SPF_PERMISSIVE_1, SPF_PERMISSIVE_8, etc. However, it is only speculation; I have no data to support that level of complexity being

R: RE: Spamassassin and SPF records with +all

2012-07-13 Thread Giampaolo Tomassoni
No, I'm not meaning that. I'm instead following the Hardin suggestion, which works better with mass-check. I'm suggesting to use CIDR::Lite to avoid being fooled by stuff like +128.0.0.0/1 +0.0.0.0/1... Giampaolo Benny Pedersen m...@junc.org ha scritto: Den 2012-07-13 19:44, Giampaolo

R: 419 spammers aren't morons after all

2012-06-23 Thread Giampaolo Tomassoni
-Messaggio originale- Da: jdow [mailto:j...@earthlink.net] Inviato: sabato 23 giugno 2012 0.15 A: users@spamassassin.apache.org Cc: Kevin A. McGrail; John Hardin Oggetto: Re: 419 spammers aren't morons after all They never performed the analysis we see in the Microsoft paper. They

RE: MySQL Bayes - can slow MySql cause other tests not to run?

2011-08-04 Thread Giampaolo Tomassoni
From: Duane Hill [mailto:du...@duanemail.org] Hello Giampaolo, Wednesday, August 3, 2011, 4:09:57 PM, you wrote: Did you create the bayes tables via the mysql script shipped with SA? It creates tables with TYPE=MyISAM, so I guess this may be why you didn't see any transaction

RE: Uuencoded message detected as UNWANTED_LANGUAGE_BODY

2011-08-04 Thread Giampaolo Tomassoni
From: Daniel McDonald [mailto:dan.mcdon...@austinenergy.com] We got a false positive recently of a message containing only a uuencoded attachment being detected as UNWANTED_LANGUAGE_BODY. The message doesn’t have a Content-type: header or an Encoding: header.  The message part has one

RE: MySQL Bayes - can slow MySql cause other tests not to run?

2011-08-03 Thread Giampaolo Tomassoni
From: David F. Skoll [mailto:d...@roaringpenguin.com] On Wed, 3 Aug 2011 16:46:23 +0200 giampa...@tomassoni.biz wrote: I think your suggestion is an overkill. Not in my experience. Iff I'm right about the problem being on transaction competition, it can be solved by a much easier

RE: MySQL Bayes - can slow MySql cause other tests not to run?

2011-08-03 Thread Giampaolo Tomassoni
-Original Message- From: David F. Skoll [mailto:d...@roaringpenguin.com] Sent: Wednesday, August 03, 2011 8:58 PM To: users@spamassassin.apache.org Subject: Re: MySQL Bayes - can slow MySql cause other tests not to run? you may see that the contention per scan lasts at most

RE: MySQL Bayes - can slow MySql cause other tests not to run?

2011-08-03 Thread Giampaolo Tomassoni
-Original Message- From: David F. Skoll [mailto:d...@roaringpenguin.com] On Wed, 3 Aug 2011 21:15:16 +0200 Giampaolo Tomassoni giampa...@tomassoni.biz wrote: Except that in real life, the write transaction lasts much longer, What is it? 60ms? Granted. It is still a 1/100 of 6s

RE: MySQL Bayes - can slow MySql cause other tests not to run?

2011-08-03 Thread Giampaolo Tomassoni
-Original Message- From: David F. Skoll [mailto:d...@roaringpenguin.com] On Wed, 3 Aug 2011 22:02:53 +0200 Giampaolo Tomassoni giampa...@tomassoni.biz wrote: However, since I like to win the last speech, my reply is that they hopefully don't necessarily involve an fsync: most

RE: MySQL Bayes - can slow MySql cause other tests not to run?

2011-08-03 Thread Giampaolo Tomassoni
From: David F. Skoll [mailto:d...@roaringpenguin.com] On Wed, 3 Aug 2011 15:19:07 -0500 Duane Hill du...@duanemail.org wrote: I set MySQL to log all SQL queries. There has not been one query contained within a transaction. MySQL supports this by doing a START TRANSACTION which can

RE: MySQL Bayes - can slow MySql cause other tests not to run?

2011-08-03 Thread Giampaolo Tomassoni
-Original Message- From: Duane Hill [mailto:du...@duanemail.org] Hello David, Wednesday, August 3, 2011, 2:23:28 PM, you wrote: I set MySQL to log all SQL queries. There has not been one query contained within a transaction. Hello Duane, Are you using InnoDB? Giampaolo

RE: MySQL Bayes - can slow MySql cause other tests not to run?

2011-08-03 Thread Giampaolo Tomassoni
-Original Message- From: Duane Hill [mailto:du...@duanemail.org] Wednesday, August 3, 2011, 3:58:28 PM, you wrote: -Original Message- From: Duane Hill [mailto:du...@duanemail.org] Hello David, Wednesday, August 3, 2011, 2:23:28 PM, you wrote: I set MySQL to

RE: MySQL Bayes - can slow MySql cause other tests not to run?

2011-08-02 Thread Giampaolo Tomassoni
From: Marc Perkel [mailto:supp...@junkemailfilter.com] I'm wondering if bayes is slow and causing SA to time out and not run other tests? Or does bayes run in parallel? I'm beginning to wonder if bayes is killing other tests allowing more spam to get through? I'm not an expert of SQL-based

RE: Bayes Apache James server

2011-07-29 Thread Giampaolo Tomassoni
From: Kelson Vibber [mailto:k...@tollfreeforwarding.com] ...omissis... If so, would you recommend: 1. Sticking with SA's Bayesian filter? 2. Running SpamAssassin without Bayes, then James' BayesianAnalysis mailet? 3. Running James's BayesianAnalysis mailet first, then SpamAssassin

Re: ups.com virus has now switched to dhl.com

2011-03-31 Thread Giampaolo Tomassoni
From: Michael Scheidell michael.scheid...@secnap.com using amavisd-new, we can set up policies, per user, and per domain if needed to match the end users needs. Via Amavis one can even ban executable attachments. With few work, one can develop a system which notifies users that such a

RE: preventing authenticated smtp users from triggering PBL

2010-12-17 Thread Giampaolo Tomassoni
From: Ted Mittelstaedt [mailto:t...@ipinc.net] And what prevents a spammer from forging this into a header and bypassing SA? Just askin. Ted The fact that the authenticating server forwarding the request is trusted and/or internal network. SA doesn't look at any auth token outside of

RE: preventing authenticated smtp users from triggering PBL

2010-12-17 Thread Giampaolo Tomassoni
SA also avails the msa_networks setting to allow a node to act both as a MX and a MUA, making a message look like internally sourced iff the node says it is from an authenticated source. Of course, I meant: SA also avails of the msa_networks setting to allow a node to act both as a MTA and a

RE: preventing authenticated smtp users from triggering PBL

2010-12-17 Thread Giampaolo Tomassoni
My experience with SA is that if it sees that flag anywhere in the header, it will assume the mail is safe. I have also had the experience No, Ted. SA wouldn't accept an authenticated mark from outside its trusted_network. with earlier versions of SA that they ignore the flag completely

RE: preventing authenticated smtp users from triggering PBL

2010-12-17 Thread Giampaolo Tomassoni
On 12/17/2010 10:15 AM, Kris Deugau wrote: Ted Mittelstaedt wrote: I know that, Sendmail adds the same flag when setup for auth SMTP. The problem is that SA will see this and assume the mail is safe. N if your trust path is set correctly, then SA won't run tests like eg PBL

RE: blacklist.mailrelay.att.net

2010-12-14 Thread Giampaolo Tomassoni
I would strongly encourage your ISP to clean up their act by adding an excursion detection system, that watches for bursty outbound traffic patterns, like a sudden spike in outbound SMTP or HTTP connections to a wide spread of addresses. Is Aruba.it so poorly reputed? g -Philip

RE: blacklist.mailrelay.att.net

2010-12-13 Thread Giampaolo Tomassoni
Le 12/12/2010 19:23, Giampaolo Tomassoni a écrit : How does it work? I just got blocked by the ATT's blacklist (in contacting ab...@att.com, besides...), but I'm pretty sure my MX is not an open relay or other kind of nifty thing. Maybe ATT blocks whole address bunches from which

blacklist.mailrelay.att.net

2010-12-12 Thread Giampaolo Tomassoni
How does it work? I just got blocked by the ATT's blacklist (in contacting ab...@att.com, besides...), but I'm pretty sure my MX is not an open relay or other kind of nifty thing. Maybe ATT blocks whole address bunches from which some hosts are spamming? Because this could explain me why: my MX

RE: Whitelist secure connections?

2010-11-07 Thread Giampaolo Tomassoni
On 07.11.10 10:53, Martin Toombs wrote: I have a Postfix/Dovcot/SpamAssassin setup with TSL required for all SMTP users in the domain. Is there a way I can globally whitelist any mail received from a secured connection? Not yet and I don't think it's a wise idea. I'm going to allow

R: SA 3.3.1 and NetAddr::IP 4.034

2010-10-29 Thread Giampaolo Tomassoni
still incorrect: $ perl -le 'use NetAddr::IP; print NetAddr::IP-new6(127/8)' 0:0:0:0:0:0:7F00:0/8 This seems way too ambiguos to me, isn't? How could the NetAddr::IP module get you're instantiating an IPv6 net address, after all. That seems to me a valid IPv6 syntax, too... A workaround

SA 3.3.1 and NetAddr::IP 4.034

2010-10-28 Thread Giampaolo Tomassoni
Hi, this morning Gentoo people liked to upgrade NetAddr::IP from 4.033 to 4.034. People with stable systems (a Gentoo feature) actually runs SpamAssassin 3.3.1. Soon after upgrading NetAddr::IP, a lint run reported these: warn: netset: cannot include 0:0:0:0:0:0:0:1/128 as it has already been

RE: SA 3.3.1 and NetAddr::IP 4.034

2010-10-28 Thread Giampaolo Tomassoni
Looking into it... I know NetAddr::IP recently got a re-design and probably SA have to cope with this. Looks like a but in NetAddr::IP 4.034, it forgets to adjust the CIDR mask when converting an IPv4 address to an IPv6 notation: correct (NetAddr-IP-4.033): $ perl -le 'use

RE: SA 3.3.1 and NetAddr::IP 4.034

2010-10-28 Thread Giampaolo Tomassoni
Mmmh. In fact it seems they bobbed few lines from 4.033... You sure new6 may be used with IPv4 address, huh? If you confirm this, I can take care of reporting the bug to upstream. Giampaolo Aha, you're too fast! ;) Giampaolo Mark

RE: SA 3.3.1 and NetAddr::IP 4.034

2010-10-28 Thread Giampaolo Tomassoni
If you confirm this, I can take care of reporting the bug to upstream. Please do so, thanks! I'm too late: Steve Huff already did it... See: https://rt.cpan.org/Public/Bug/Display.html?id=62521 . Giampaolo Mark

RE: [Meta] Unsubscribe / help footer at the bottom of messages to this list.

2010-10-08 Thread Giampaolo Tomassoni
I was going to suggest the footer should read: To unsubscribe from this mailing list see the list-unsubscribe: header Ahaha! I vote yes to it. ;)

RE: [Meta] Unsubscribe / help footer at the bottom of messages to this list.

2010-10-07 Thread Giampaolo Tomassoni
Furthermore, I suggest having a footer with unsubscription / help information in addition to the header because the header may not be visible, not all E- mail clients may display it, and people may otherwise be unaware of it. I have often seen some unsubscribe messages sent to mailing lists

RE: SA-Learn per remote

2010-09-16 Thread Giampaolo Tomassoni
From: Hans-Werner Friedemann [mailto:h-w.friedem...@vds-herzberg.de] Hi @ all   sorry, but I have to pick up this issue once again.   I´ve installed Spamassassin with bayes on a SuseLinux-Client. My mailserver (hmailserver) is running on a Windows machine.   The Mailserver has a mailbox

RE: Blacklist for spam-words

2010-09-16 Thread Giampaolo Tomassoni
Hello, i don't know spamassassin not very well, i am using 3.2.4 on Ubuntu 8.04 LTS. I need a textfile where i can put in blacklist-words like Viagra, Chronometer, Zeitmesser and so on, if an email has one of this words, this email should directly put to the Spam-folder. Is this

RE: Blacklist for spam-words

2010-09-16 Thread Giampaolo Tomassoni
SA goes farther than your simple idea. Have a look at how Bayes works, and all the available SA plugins. I trained SA since months with all those chronometer-zeitmesser-spam and only 5% is now set to spam. I want to get rid of it immediately. Well, you may try putting this into

RE: Blacklist for spam-words

2010-09-16 Thread Giampaolo Tomassoni
You're probably too late, Matus: you've got into his trash folder... ;) From: Matus UHLAR - fantomas [mailto:uh...@fantomas.sk] What if a friend of yours sends you an email asking to lend your chronometer... --^ This is very unlikely because i have none. So even if he asked, it

RE: A lot of Recent Spam is Uncaught by SpamAssassin

2010-08-22 Thread Giampaolo Tomassoni
I cannot find any special setting for autolearn (either bayes_auto_learn_threshold_nonspam or bayes_auto_learn_threshold_spam ) in either /etc/mail/spamassassin/local.cf or ~/.spamassassin/user_prefs . It probably means they are the default which is 0.1 and 12.0 respectively which seems

RE: A lot of Recent Spam is Uncaught by SpamAssassin

2010-08-22 Thread Giampaolo Tomassoni
Since they score 0.8, they wouldn't be learnt as ham with the default bayes_auto_learn_threshold_nonspam value. So, probably at least this setting had been overridden somewhere in your SA conf... Probably not. 0.8 is the score for BAYES_50, which isn't counted in the autolearning score.

RE: A lot of Recent Spam is Uncaught by SpamAssassin

2010-08-21 Thread Giampaolo Tomassoni
Hi all, Recently I've noticed that a lot of spam that I am getting is not caught by SpamAssassin, despite the fact that it is very similar to other spam I got and that I marked as spam using the Bayesian training. I've placed a sample of some of the recent messagess I got here:

RE: are there any alternatives to textcat?

2010-07-14 Thread Giampaolo Tomassoni
It's more of the implementation that needs an update than TextCat algorithm itself. Charset/case awareness: https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6229 Better database: https://issues.apache.org/SpamAssassin/show_bug.cgi?id=4152 Etc.. feel free to chime in.. There is

RE: uribl not working properly with .gg TLD

2010-07-14 Thread Giampaolo Tomassoni
I'm running SpamAssassin version 3.3.0 and we received some spam recently which contained a link to a .ru.gg domain. While investigating whether it was listed in any of the URIBLs I discovered that if a message contains a link to http://qwerty.ru.gg;, spamassassin only looks up the domain

RE: uribl not working properly with .gg TLD

2010-07-14 Thread Giampaolo Tomassoni
. Further, I would personally blacklist the whole .gg gTLD since their whois service is ridiculous. Giampaolo Giampaolo Tomassoni-2 wrote: I'm running SpamAssassin version 3.3.0 and we received some spam recently which contained a link to a .ru.gg domain. While investigating whether

RE: BLACKLISTED mails

2010-07-13 Thread Giampaolo Tomassoni
I don't think that's going to help - it's not going to tell us why it's blacklisted. Also I suspect those headers aren't added by SA alone. AFAIK BLACKLISTED isn't added by SA like that - blacklist rule should show up in tests=[], which is empty. And the score isn't consistent 64 and -5.

RE: Basic Setup Questions

2010-06-28 Thread Giampaolo Tomassoni
The documentation simply says run sa-learn. Does the creation of the bayes db files effectively enable bayes? No. You also need to teach enough ham and spam tokens to Bayes. By default, you should train bayes with at least 200 ham messages and 200 spam messages. At that point, you

RE: Basic Setup Questions

2010-06-27 Thread Giampaolo Tomassoni
Hello, I have just setup spamassassin. A lot of spam is getting filtered. But a lot is not. What are the prevailing additional steps for improving filtering? Is using bayes worth it? Generally yes. However, it needs training before being reliable. My default config does not appear

RE: Basic Setup Questions

2010-06-27 Thread Giampaolo Tomassoni
I have LearnAsSpam IMAP folders for everyone to drag spam that get's through into. How can I run sa-learn so that it builds a /single/ database from all of these folders and so that spamd uses that single database for scoring everyone's mail? Huh, using spamd --nouser-config ? Sorry, I

RE: Treat MAPI submitted mail like SMTP

2010-06-08 Thread Giampaolo Tomassoni
We are using the CommuniGate Pro mail server, which allows Outlook user to submit messages using the Microsoft's MAPI protocol to submit messages across the IMAP port. The problem that we are having is that although the messages are submitted directly from an authenticated client connection,

RE: Arabic Spam

2010-05-26 Thread Giampaolo Tomassoni
From: Jason Bertoch [mailto:ja...@i6ix.com] Sent: Wednesday, May 26, 2010 3:34 PM On 2010/05/25 7:02 PM, Karsten Bräckelmann wrote: On Wed, 2010-05-26 at 10:35 +1200, Jason Haar wrote: Not as far as ok_locales and the respective CHARSET_FARAWAY rules are concerned, IIRC. They have been

RE: Arabic Spam

2010-05-25 Thread Giampaolo Tomassoni
On 05/25/2010 09:47 AM, RW wrote:. My guess is that none of of these is being hit because there's enough English mixed-in with the Arabic. I think the FARAWAY rules and other locale checks are dependent on email using the old, pre-Unicode charset formatting. Yesterday I had some Greek

RE: new error

2010-05-25 Thread Giampaolo Tomassoni
On Tue, 2010-05-25 at 10:25 -0300, Daniel Iserhard wrote: Have you tried setting a non-zero score for OBFU_TEXT_ATTACH? Martin, it seems to me the problem is in some SA rule update. 72_scores.cf states: score OBFU_TEXT_ATTACH 2.299 0.000 2.299 0.000 which means 0 in network-based SA

RE: Arabic Spam

2010-05-25 Thread Giampaolo Tomassoni
On Mon, 2010-05-24 at 09:27 -0400, Jason Bertoch wrote: A user reported the following FN [...] It is not a FN. It isn't even a proper message. That's some headers, plus a screen-scraped, rendered version of the message, including the most common headers displayed to the user. Without

RE: Arabic Spam

2010-05-24 Thread Giampaolo Tomassoni
On Mon, 24 May 2010, Jason Bertoch wrote: At a guess I would say the bulk of your score is attributed to the URI in the body that has been flagged as being on the SURBL blocklist. Beyond that, the issue seems to be that they have used a body 'type' of text/html without actually using HTML.

RE: SPF ignore mail clients connecting with SMTP auth

2010-05-07 Thread Giampaolo Tomassoni
So is it the case according to what you´ve said below that with your modified logic that setting your MX servers as trusted and MSA will no longer result in all mail being trusted? And will that then trust mail recieved via SMTP Auth and therefore solve my problem? I actually only placed a

RE: SPF ignore mail clients connecting with SMTP auth

2010-05-06 Thread Giampaolo Tomassoni
Also the SpamAssassin documentation mentions configuring msa_networks which sounds relevant. Can I just list my SMTP server IP in here an SMTP Auth connections will be trusted? Or will that cause all connections to be trusted, as it sounds possible reading this Warning: Never include an MSA

RE: SPF ignore mail clients connecting with SMTP auth

2010-05-06 Thread Giampaolo Tomassoni
Open a bug. To whom it may concern: https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6430

RE: Scanning Outbound emails

2010-05-05 Thread Giampaolo Tomassoni
... except, after checking their site just now, you now get a personalized reporting address once you've signed up. *sigh* AFAIK, the reporting e-mail addresses are all of the form /^submit.\...@spam\.spamcop\.net$/ .

RE: Bayes spam and ham out of proportion

2010-04-30 Thread Giampaolo Tomassoni
On Thu, 29 Apr 2010 18:32:04 +0200 Giampaolo Tomassoni g.tomass...@libero.it wrote: what you need to do write a script that divides the metadata num_spam value and all the token Nspam counts by 3. The updated database can then be loaded back in with --restore. I don't know

RE: Bayes spam and ham out of proportion

2010-04-29 Thread Giampaolo Tomassoni
On Thu, 29 Apr 2010 08:25:29 -0400 Frank Bures lisfr...@chem.toronto.edu wrote: what you need to do write a script that divides the metadata num_spam value and all the token Nspam counts by 3. The updated database can then be loaded back in with --restore. I don't know if this is going to be

RE: Bayes spam and ham out of proportion

2010-04-29 Thread Giampaolo Tomassoni
Hi, I would instead, in order of effectiveness:        a) expire old tokens;        b) eliminate tokens with very few ham/spam occurrences.        c) eliminate tokens with very close nham to nspam values; Can you explain how to do this, or point to documentation that would

Score overriding and behaviour

2010-04-27 Thread Giampaolo Tomassoni
Hi everybody. Recently I updated my Gentoo installations to spamassassin-3.3.1-r1 (the 'r1' thing means a 'stock' SA-3.3.1 with some -often few - patches applied). Everything worked fine after upgrading, but now I see that some rules I have in my local.cf doesn't seem to work anymore. Since

RE: Score overriding and behaviour

2010-04-27 Thread Giampaolo Tomassoni
Both the effects are quite weird to me. Maybe I didn't pay attention to some post in this list announcing a different behaviour of the body rules and a new score override mechanism? No change in this logic and behavior. Did you --lint check? Does it complain perhaps? To see which cf

RE: Score overriding and behaviour

2010-04-27 Thread Giampaolo Tomassoni
Do ANY of the rules in your local.cf fire? Yes, they do. The __IN_ITALIAN rule referred by SOMMA and SOMMA2, in example. However, Try putting a test rule that will 'always' fire (like 'header From =~ /\@/') at the end of local.cf, then if it doesn't fire, start moving it up, to see if you

Never mind... (Was: RE: Score overriding and behaviour)

2010-04-27 Thread Giampaolo Tomassoni
It turn out I put this and other stuff in a if(0) endif block, such that it of course didn't fire... Thanks everybody! Giampaolo

RE: [sa] RE: Score overriding and behaviour

2010-04-27 Thread Giampaolo Tomassoni
On Tue, 27 Apr 2010, Giampaolo Tomassoni wrote: Do ANY of the rules in your local.cf fire? Yes, they do. The __IN_ITALIAN rule referred by SOMMA and SOMMA2, in example. Just a side thought, but are we checking for SOMMA or SOMA? One 'm' or two? FRT_SOMA2 Try 'retyping' the __SOMMA

RE: Score overriding and behaviour

2010-04-27 Thread Giampaolo Tomassoni
On Tue, 27 Apr 2010, Giampaolo Tomassoni wrote: Also, why body __SOMMA m'\Wsomma\W'i doesn't fire? This is more a sylistic comment, but: you don't need to alter the delimiters on that RE. Does this behave any better? body __SOMMA /\Wsomma\W/i John

RE: Reporting (Off Topic)

2010-04-23 Thread Giampaolo Tomassoni
On Thu, Apr 22, 2010 at 1:48 PM, Kaleb Hosie kho...@spectraaluminum.com wrote: Another (more automated way) is to use the following command: spamassassin -r the_spam_message_file Thanks for that info! I think the 'automated' suggestion sounds very nice! When I submit it using 'SA'

RE: Interesting use of html comments

2010-04-22 Thread Giampaolo Tomassoni
Giampaolo Tomassoni wrote: But, anyway, I see SA 3.3.1 comes with a very good HTMLEval plugin. However, it seems to me that it misses a way to, in example, count the length of the text commented out with respect to the uncommented one and eventually trigger a rule if the ratio is above

RE: GERMAN ruleset extended

2010-04-21 Thread Giampaolo Tomassoni
Dear users, I felt I didn't advertise our GERMAN ruleset since a long time: http://wiki.apache.org/spamassassin/CustomRulesets Good hint. Thank you. Giampaolo

Interesting use of html comments

2010-04-21 Thread Giampaolo Tomassoni
Hi everybody, I recently got this: http://www.spamcop.net/sc?id=z3936411477z440d5f10ba6037ca7b75c78c52292721z;a ction=display in which you may see that a lot of text, probably meant to deceive and/or poison the Bayes detector, is embedded in html comments. Now, this particular message scores

Bayes improvement

2010-03-25 Thread Giampaolo Tomassoni
Having this in the bayes db: 335424 nspam 144915 nham 129892 ntokens and a fairly good hit rate by Bayes in detecting both spam and ham, how would you improve Bayes scores? In example, would you increase every bayes scores by a fixed percentage, or instead would you

RE: Bayes improvement

2010-03-25 Thread Giampaolo Tomassoni
I have increased BAYES_00 and BAYES_99. It seems that those are pretty good and cause no FP's, but BAYES_05 may sometimes be spam. I have BAYES_99 as a killer, it has 5 points, sending the mail to a 'probable spam' alone. Ah, that is even narrower and probably less prone to misclassification.

What happened to SOUGHT rules' server?

2010-03-14 Thread Giampaolo Tomassoni
It seems that the yerp.org www server is irresponsive. To my knowledge, that server was hosting the sought.rules.yerp.org update channel. Anybody knows if it is a transient problem or if that channel moved elsewhere? Regards, Giampaolo

RE: [Fwd: Re: Getting off the Cloudmark formerly spamnet blacklist]

2009-11-11 Thread Giampaolo Tomassoni
Michael Scheidell wrote: ...omissis... If our clients were DELIBERATELY spamming, say they thought they were going to send out a marketing mail or some such, then you would be correct. But they were not. They were simply using the largest software company on Earth's products -

RE: Getting off the Cloudmark formerly spamnet blacklist

2009-11-10 Thread Giampaolo Tomassoni
Daniel J McDonald wrote: ...omissis... How can I? From what I know about razor-revoke, it's the recipients who are using razor and who get messages that razor tags as spam who are the ones that run this. Their recipients who are saying that their messages are being marked spam are

RE: razor/spamcop report question

2009-09-04 Thread Giampaolo Tomassoni
Reporting can't be automatic, as there will be or may be false positives. As well as false negatives. Razor, DCC, maybe IxHash and surely others do state in their policies that automatic reporting is forbidden. SpamCop, however, doesn't. This is probably because of the very nature of the

RE: razor/spamcop report question

2009-09-04 Thread Giampaolo Tomassoni
as false negatives. On 04.09.09 11:49, Giampaolo Tomassoni wrote: Razor, DCC, maybe IxHash and surely others do state in their policies that automatic reporting is forbidden. DCC? DCC is based on automatic submission, note that it measures bulkiness of mail, not spamminess... Right

Image spam is back

2009-08-23 Thread Giampaolo Tomassoni
Are you experiencing the same? Some of them are even sleeping through FuzzyOcr. Any tuning to suggest? Giampaolo

RE: Image spam is back

2009-08-23 Thread Giampaolo Tomassoni
-Original Message- From: Bill Landry [mailto:b...@inetmsg.com] Sent: Sunday, August 23, 2009 7:02 PM To: users@spamassassin.apache.org Subject: Re: Image spam is back Giampaolo Tomassoni wrote: Are you experiencing the same? Some of them are even sleeping through FuzzyOcr

RE: DKIM-Reputation list

2009-08-16 Thread Giampaolo Tomassoni
-Original Message- From: R-Elists [mailto:list...@abbacomm.net] Sent: Saturday, August 15, 2009 8:06 PM To: users@spamassassin.apache.org Subject: RE: DKIM-Reputation list is this DKIM-Reputation setup for any *general* current spamassassin deployment or does it only work with

RE: DKIM-Reputation list

2009-08-14 Thread Giampaolo Tomassoni
Hi Mark, -Original Message- From: Mark Martinec [mailto:mark.martinec...@ijs.si] Sent: Thursday, August 13, 2009 8:06 PM To: users@spamassassin.apache.org Subject: Re: DKIM-Reputation list Tobias, Giampaolo, Bill, and others I'm interested too, thanks in advance I've place

DKIM-Reputation list

2009-08-13 Thread Giampaolo Tomassoni
Hi, I was looking at some kind of open-source DKIM-signing piece of code, and fall into this site: http://www.dkim-reputation.org/ It has nothing to do with what I'm looking for, nevertheless it seemed interesting to me and I wanted to give it a try. Unfortunately, the software they

RE: DKIM-Reputation list

2009-08-13 Thread Giampaolo Tomassoni
-Original Message- From: Mark Martinec [mailto:mark.martinec...@ijs.si] Sent: Thursday, August 13, 2009 6:04 PM To: users@spamassassin.apache.org Subject: Re: DKIM-Reputation list Giampaolo, ...omissis... Back in April (2009) I send to Florian Sager my version of the

RE: DKIM-Reputation list

2009-08-13 Thread Giampaolo Tomassoni
Tobias, Giampaolo, Bill, and others I'm interested too, thanks in advance I've place it on the web page: http://www.ijs.si/software/amavisd/DKIMrep.pm http://www.ijs.si/software/amavisd/effectiveTLDs.pm Aaaah! Surfing time! ...omissis... (albeit interesting) I tested it

RE: Plugin extracting text from docs (was: new spam using large images)

2009-07-01 Thread Giampaolo Tomassoni
We can use antiword to render text from MSWord files, and unrtf to render text from RTF files. What is the best tool to render text from PDF files? (We are running Solaris 9) FWIK, antiword is the best tradeoff between speed and conversion quality. The best converter I know of, even for

RE: best way to mark TLDs as spam

2009-06-03 Thread Giampaolo Tomassoni
-Original Message- From: Maurice Lucas - TAOS-IT [mailto:mslu...@taos-it.nl] Sent: Wednesday, June 03, 2009 5:06 PM To: ryefish; users@spamassassin.apache.org Subject: RE: best way to mark TLDs as spam Hello: I am attempting to configure SA to mark as spam all email from

RE: New Message Sniffer Plugin Released SNF4SA

2009-05-20 Thread Giampaolo Tomassoni
-Original Message- From: Pete McNeil [mailto:madscient...@microneil.com] Sent: Tuesday, May 19, 2009 5:12 PM To: users@spamassassin.apache.org Subject: New Message Sniffer Plugin Released SNF4SA Hello SA folks, We have significantly upgraded our plugin for SpamAssassin. You

RE: New Message Sniffer Plugin Released SNF4SA

2009-05-20 Thread Giampaolo Tomassoni
-Original Message- From: Matus UHLAR - fantomas [mailto:uh...@fantomas.sk] Sent: Wednesday, May 20, 2009 1:19 PM To: users@spamassassin.apache.org Subject: Re: New Message Sniffer Plugin Released SNF4SA On 19.05.09 11:12, Pete McNeil wrote: ...omissis... looks to me like

RE: New Message Sniffer Plugin Released SNF4SA

2009-05-20 Thread Giampaolo Tomassoni
,razor.pyzor,blacklists) and bayes On 20.05.09 15:26, Giampaolo Tomassoni wrote: It looks to me that it goes a bit further by allowing your own SNF training and, maybe, rules to be globally available. What's the difference between SA autolearn combined with manual training? :) The main difference

RE: Something like the old 70_sc_top200 - 'Top200 SpamCop Relays'

2009-04-17 Thread Giampaolo Tomassoni
-Original Message- From: Karsten Bräckelmann [mailto:guent...@rudersport.de] Sent: Friday, April 17, 2009 2:48 PM On Fri, 2009-04-17 at 02:39 -0700, Marcelo Galeti wrote: Hello Guys, Wow, a Nabble user with a real name. :) Do you know if are there something like the old

RE: Something like the old 70_sc_top200 - 'Top200 SpamCop Relays'

2009-04-17 Thread Giampaolo Tomassoni
-Original Message- From: Karsten Bräckelmann [mailto:guent...@rudersport.de] Sent: Friday, April 17, 2009 8:48 PM ...omissis... Not strictly a list of the top 200, but isn't this covered by the more extensive RCVD_IN_BL_SPAMCOP_NET dnsbl test? As you already pointed out,

  1   2   3   4   5   >