On Mon, Sep 10, 2007 at 09:55:01AM -0700, Andrew Sackville-West wrote:
> On Mon, Sep 10, 2007 at 11:00:28AM -0500, Ron Johnson wrote:
> > On 09/10/07 10:35, Wayne Topa wrote:
> > > Andrew Sackville-West(andrew@farwestbilliards.com) is reported to have said:
> > >> On Mon, Sep 10, 2007 at 09:15:19AM +0800, Michael Yang wrote:
> > >>> It's annoying me .....why there is so much spams in the list?
> > >> please read the archives from today, Sep 9/10 2007, as this issue has
> > >> been discussed.
> > >
> > > I am not seeing this spam so will have to go to the archives. Guess
> > > murx/mailfilter works better then whatever the list uses.
> >
> > As must SA plus whatever my ISP uses.
>
> I"m baffled as I've got SA running and its definitely picking up a LOT
> of stuff, but as I've said previously, the stuff that's getting
> through my SA to my local mailboxes is the same stuff that's hitting
> me through d-u. And its all got really high spam scores listed in the
> d-u headers, so why is it getting through? and what is the threshold
> at which murphy dumps it? There are a couple in my d-u inbox right now
> with amavis scores of over 30 but they are called "OK". And they're
> getting through my SA.... I need to tweak my SA so it always includes
> the spam score (doesn't currently) and see what its scoring here. but
> it almost seems like someone has figured out how to trick SA into
> letting a high score through.

I'm not running SA, but my ISP does. Look what I get for two of those:

X-Spam-Checker-Version: SpamAssassin 3.1.1 (2006-03-10) on relay1
X-Spam-Level: **
X-Spam-Status: No, score=2.2 required=5.0 tests=INVALID_TZ_GMT,RCVD_BY_IP
autolearn=disabled version=3.1.1

and the second

X-Spam-Checker-Version: SpamAssassin 3.1.1 (2006-03-10) on relay2
X-Spam-Level:
X-Spam-Status: No, score=0.0 required=5.0 tests=HTML_MESSAGE
autolearn=disabled version=3.1.1

My ISPs SA (and not only) is really terrible. For a while I was missing
a lot of posts from the list so I checked the Spam folder via the
webmail (which does not work with anything except Internet Explorer,
though it seems to be Squirrel webmail) and found the missing d-u mail.

I had to disable their filtering, which was also tricky to achieve as I
couldn't delete the default spam filter, so I just made another filter
which was moving all the "spam" to the inbox before the spam filter rule
could see them.

I thought of readjusting my maildrop rules to try to use the SA headers,
but seeing the high false positives and false negatives count I think
it's not worth it.

Regards,
Andrei
--
If you can't explain it simply, you don't understand it well enough.
(Albert Einstein)

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFG5a1DqJyztHCFm9kRAhD9AKCwBsmNV4LV5QrSCso2Np D3h+bUPgCgk/tw
9QPS76FhpdniLz+pUF7C5NE=
=TcTc
-----END PGP SIGNATURE-----

On 9/10/07, Andrei Popescu <andreimpopescu@gmail.com> wrote:
> My ISPs SA (and not only) is really terrible. For a while I was missing
> a lot of posts from the list so I checked the Spam folder via the

I've seen a few of those false positives, but not very many, since I
switched over to
gmail back in May.

> Andrei


--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

On Mon, Sep 10, 2007 at 11:46:59PM +0300, Andrei Popescu wrote:
> On Mon, Sep 10, 2007 at 09:55:01AM -0700, Andrew Sackville-West wrote:
> >
> > I"m baffled as I've got SA running and its definitely picking up a LOT
> > of stuff, but as I've said previously, the stuff that's getting
> > through my SA to my local mailboxes is the same stuff that's hitting
> > me through d-u. And its all got really high spam scores listed in the
> > d-u headers, so why is it getting through? and what is the threshold
> > at which murphy dumps it? There are a couple in my d-u inbox right now
> > with amavis scores of over 30 but they are called "OK". And they're
> > getting through my SA.... I need to tweak my SA so it always includes
> > the spam score (doesn't currently) and see what its scoring here. but
> > it almost seems like someone has figured out how to trick SA into
> > letting a high score through.
>
> I'm not running SA, but my ISP does. Look what I get for two of those:
>
> X-Spam-Checker-Version: SpamAssassin 3.1.1 (2006-03-10) on relay1
> X-Spam-Level: **
> X-Spam-Status: No, score=2.2 required=5.0 tests=INVALID_TZ_GMT,RCVD_BY_IP
> autolearn=disabled version=3.1.1
>
> and the second
>
> X-Spam-Checker-Version: SpamAssassin 3.1.1 (2006-03-10) on relay2
> X-Spam-Level:
> X-Spam-Status: No, score=0.0 required=5.0 tests=HTML_MESSAGE
> autolearn=disabled version=3.1.1

That's what I don't understand. Things with a du assigned spam score
of over 30 were 1) getting through the list, i wonder what the
threshold was at, though it now seems to be fixed, and 2) getting
through my local SA.

I got my SA/exim configed so that I can see SA headers on
every mail right about the time we stopped getting pounded through d-u
so i don't have anything to compare at this point

A

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFG5uOsaIeIEqwil4YRAoG9AKDnjpu8mwHEK9f88qdITg kqySpGywCgn8G8
0xJz+VE9qt6hhmwmklMCHqw=
=okVc
-----END PGP SIGNATURE-----