Re: APOSTROPHE_TOCC score

2018-03-06 Thread John Hardin
On Tue, 6 Mar 2018, RW wrote: On Tue, 6 Mar 2018 08:47:35 -0800 (PST) John Hardin wrote: On Tue, 6 Mar 2018, David Jones wrote: In this case these were really bad spam so the APOSTROPHE_TOCC is just riding on the back of other rules, BLs, and high Bayes scores. What I generally look at

Re: APOSTROPHE_TOCC score

2018-03-06 Thread RW
On Tue, 6 Mar 2018 08:47:35 -0800 (PST) John Hardin wrote: > On Tue, 6 Mar 2018, David Jones wrote: > > In this case these were really bad spam so the APOSTROPHE_TOCC is > > just riding on the back of other rules, BLs, and high Bayes > > scores. > > What I generally look at is the detailed

Re: APOSTROPHE_TOCC score

2018-03-06 Thread John Hardin
On Tue, 6 Mar 2018, David Jones wrote: On 03/06/2018 12:54 PM, John Hardin wrote: On Tue, 6 Mar 2018, RW wrote: On Tue, 6 Mar 2018 08:47:35 -0800 (PST) John Hardin wrote: On Tue, 6 Mar 2018, David Jones wrote: In this case these were really bad spam so the APOSTROPHE_TOCC is just riding

Re: APOSTROPHE_TOCC score

2018-03-06 Thread David Jones
On 03/06/2018 12:54 PM, John Hardin wrote: On Tue, 6 Mar 2018, RW wrote: On Tue, 6 Mar 2018 08:47:35 -0800 (PST) John Hardin wrote: On Tue, 6 Mar 2018, David Jones wrote: In this case these were really bad spam so the APOSTROPHE_TOCC is just riding on the back of other rules, BLs, and

Re: DecodeShortURLs database breaks with setuid spamd

2018-03-06 Thread RW
On Mon, 5 Mar 2018 19:27:02 -0700 Amir Caspi wrote: > Hi all, > > Just FYI, for those of you who use DecodeShortURLs.pm ... it > appears that, if you are running in a per-user setup (i.e., running > spamd as root such that it does a setuid when invoked from > spamc, and/or allowing

Re: DecodeShortURLs database breaks with setuid spamd

2018-03-06 Thread Amir Caspi
On Mar 6, 2018, at 5:19 PM, RW wrote: > > Or probably more commonly when running the spamassassin perl script as > an ordinary user for test purposes. Right, if the DB is owned by that user, then they would see the rule fire with spamassassin and might assume it's

Re: APOSTROPHE_TOCC score

2018-03-06 Thread David Jones
On 03/05/2018 06:57 PM, John Hardin wrote: On Mon, 5 Mar 2018, Alex wrote: Hi, On Mon, Mar 5, 2018 at 5:59 PM, John Hardin wrote: On Mon, 5 Mar 2018, Alex wrote: To: =?utf-8?Q?DermotO=27reilly?= *  2.6 APOSTROPHE_TOCC To or CC address

Re: Spam from compromised accounts scoring just under block threshold

2018-03-06 Thread John Hardin
On Mon, 5 Mar 2018, Amir Caspi wrote: On Mar 5, 2018, at 11:13 PM, John Hardin wrote: *before* the @ sign. It may be perfectly valid to do that, but if it happens more often in spam than in legitimate mail it is useful to us. I’m seeing a lot of spam lately with

Re: APOSTROPHE_TOCC score

2018-03-06 Thread John Hardin
On Tue, 6 Mar 2018, David Jones wrote: On 03/05/2018 06:57 PM, John Hardin wrote: On Mon, 5 Mar 2018, Alex wrote: Hi, On Mon, Mar 5, 2018 at 5:59 PM, John Hardin wrote: On Mon, 5 Mar 2018, Alex wrote: To: =?utf-8?Q?DermotO=27reilly?= *