You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Jared Hall <jh...@tbi.net> on 2010/02/01 06:10:56 UTC
Sought Rules Back?
Update returned sought rules 1/31/2010.
Had to pinch myself 2.5 times (1 per month)
to be sure.
Thanks.
Re: Sought Rules Back?
Posted by Kai Schaetzl <ma...@conactive.com>.
Thanks for this info and good idea about this meta rule!
Kai
--
Get your web at Conactive Internet Services: http://www.conactive.com
Re: Sought Rules Back?
Posted by Karsten Bräckelmann <gu...@rudersport.de>.
On Mon, 2010-03-29 at 16:05 -0400, Jason Bertoch wrote:
> > Btw, the three rules JM_SOUGHT_FRAUD_{1,2,3} have a score of zero
> > as per Justin's request (Bug 6155 c 38, c72, c89, c124).
> > Not sure if people using the channel realize that scores
> > need to be bumped up. Btw, I prefer to avoid them monopolizing
> > the score when more than one hits:
> >
> > score JM_SOUGHT_FRAUD_1 0.1
> > score JM_SOUGHT_FRAUD_2 0.1
> > score JM_SOUGHT_FRAUD_3 0.1
> > meta JM_SOUGHT_FRAUD_ANY JM_SOUGHT_FRAUD_1 || JM_SOUGHT_FRAUD_2 || JM_SOUGHT_FRAUD_3
> > score JM_SOUGHT_FRAUD_ANY 3.0
> Bug 6155 is now closed, but the SOUGHT rules still have a score of 0.
> Anyone have an idea on when these rules will be activated again?
The zero score request applies *only* to the SOUGHT_FRAUD sub-set. It
does *not* affect SOUGHT. Those do have scores according to the GA run.
Also, this applies *only* to 3.3, where this moved into stock. Again,
the dedicated sa-update channel (also suitable for 3.2) is *not*
affected and still has the same scores it used to.
Now, regarding activating again -- just do. They are merely disabled by
default (in 3.3 stock). You can "activate" them on your site, simply by
dropping score lines into your local config.
guenther
--
char *t="\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1:
(c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}
Re: Sought Rules Back?
Posted by Jason Bertoch <ja...@i6ix.com>.
On 2010/02/01 10:30 AM, Mark Martinec wrote:
>>> Update returned sought rules 1/31/2010.
>>
>> Actually back since Jan 6. :) Re-viewed about 1k fraud spam the
>> following days, for the Sought Fraud sub-set.
>
> Btw, the three rules JM_SOUGHT_FRAUD_{1,2,3} have a score of zero
> as per Justin's request (Bug 6155 c 38, c72, c89, c124).
> Not sure if people using the channel realize that scores
> need to be bumped up. Btw, I prefer to avoid them monopolizing
> the score when more than one hits:
>
> score JM_SOUGHT_FRAUD_1 0.1
> score JM_SOUGHT_FRAUD_2 0.1
> score JM_SOUGHT_FRAUD_3 0.1
> meta JM_SOUGHT_FRAUD_ANY JM_SOUGHT_FRAUD_1 || JM_SOUGHT_FRAUD_2 || JM_SOUGHT_FRAUD_3
> score JM_SOUGHT_FRAUD_ANY 3.0
>
>
> Mark
Bug 6155 is now closed, but the SOUGHT rules still have a score of 0.
Anyone have an idea on when these rules will be activated again?
--
/Jason
Re: Sought Rules Back?
Posted by Daniel McDonald <da...@austinenergy.com>.
On 2/1/10 9:59 AM, "Jason Bertoch" <ja...@i6ix.com> wrote:
> On 2/1/2010 10:58 AM, RW wrote:
>> On Mon, 1 Feb 2010 16:30:04 +0100
>> Mark Martinec <Ma...@ijs.si> wrote:
>>
>>>>> Update returned sought rules 1/31/2010.
>>>> Actually back since Jan 6. :) Re-viewed about 1k fraud spam the
>>>> following days, for the Sought Fraud sub-set.
>>> Btw, the three rules JM_SOUGHT_FRAUD_{1,2,3} have a score of zero
>>> as per Justin's request (Bug 6155 c 38, c72, c89, c124).
>>> Not sure if people using the channel realize that scores
>>> need to be bumped up.
>>
>> That doesn't seem to be correct:
>>
>> $ grep score 20_sought_fraud.cf
>> score JM_SOUGHT_FRAUD_1 3.0
>> score JM_SOUGHT_FRAUD_2 3.0
>> score JM_SOUGHT_FRAUD_3 3.0
>>
>> $ ls -l 20_sought_fraud.cf
>> -rw-r--r-- 1 root wheel 80120 1 Feb 15:38 20_sought_fraud.cf
>
> updates_spamassassin_org/50_scores.cf overrides the scores in the sought
> ruleset.
Ah, I didn't catch that. But it is only in the 3.3.0 channel. Fixing my
3.3.0 test machines now....
--
Daniel J McDonald, CCIE # 2495, CISSP # 78281
Re: Sought Rules Back?
Posted by Jason Bertoch <ja...@i6ix.com>.
On 2/1/2010 10:58 AM, RW wrote:
> On Mon, 1 Feb 2010 16:30:04 +0100
> Mark Martinec <Ma...@ijs.si> wrote:
>
>>>> Update returned sought rules 1/31/2010.
>>> Actually back since Jan 6. :) Re-viewed about 1k fraud spam the
>>> following days, for the Sought Fraud sub-set.
>> Btw, the three rules JM_SOUGHT_FRAUD_{1,2,3} have a score of zero
>> as per Justin's request (Bug 6155 c 38, c72, c89, c124).
>> Not sure if people using the channel realize that scores
>> need to be bumped up.
>
> That doesn't seem to be correct:
>
> $ grep score 20_sought_fraud.cf
> score JM_SOUGHT_FRAUD_1 3.0
> score JM_SOUGHT_FRAUD_2 3.0
> score JM_SOUGHT_FRAUD_3 3.0
>
> $ ls -l 20_sought_fraud.cf
> -rw-r--r-- 1 root wheel 80120 1 Feb 15:38 20_sought_fraud.cf
updates_spamassassin_org/50_scores.cf overrides the scores in the sought
ruleset.
Re: Sought Rules Back?
Posted by RW <rw...@googlemail.com>.
On Mon, 1 Feb 2010 16:30:04 +0100
Mark Martinec <Ma...@ijs.si> wrote:
> > > Update returned sought rules 1/31/2010.
> >
> > Actually back since Jan 6. :) Re-viewed about 1k fraud spam the
> > following days, for the Sought Fraud sub-set.
>
> Btw, the three rules JM_SOUGHT_FRAUD_{1,2,3} have a score of zero
> as per Justin's request (Bug 6155 c 38, c72, c89, c124).
> Not sure if people using the channel realize that scores
> need to be bumped up.
That doesn't seem to be correct:
$ grep score 20_sought_fraud.cf
score JM_SOUGHT_FRAUD_1 3.0
score JM_SOUGHT_FRAUD_2 3.0
score JM_SOUGHT_FRAUD_3 3.0
$ ls -l 20_sought_fraud.cf
-rw-r--r-- 1 root wheel 80120 1 Feb 15:38 20_sought_fraud.cf
Re: Sought Rules Back?
Posted by Jason Bertoch <ja...@i6ix.com>.
On 2/1/2010 10:30 AM, Mark Martinec wrote:
>
> Btw, the three rules JM_SOUGHT_FRAUD_{1,2,3} have a score of zero
> as per Justin's request (Bug 6155 c 38, c72, c89, c124).
> Not sure if people using the channel realize that scores
> need to be bumped up. Btw, I prefer to avoid them monopolizing
> the score when more than one hits:
>
> score JM_SOUGHT_FRAUD_1 0.1
> score JM_SOUGHT_FRAUD_2 0.1
> score JM_SOUGHT_FRAUD_3 0.1
> meta JM_SOUGHT_FRAUD_ANY JM_SOUGHT_FRAUD_1 || JM_SOUGHT_FRAUD_2 || JM_SOUGHT_FRAUD_3
> score JM_SOUGHT_FRAUD_ANY 3.0
>
I tried to read all 6 months of the comments on Bug 6155, but I just
don't have the time this morning to do so. Since the bug is now closed
as fixed, is there a reason why scores haven't been pushed out in an
update? If this ruleset is expected to come into and out of service,
and timely status updates generally aren't sent to this list, I'd rather
not manually add scores in local.cf.
Re: Sought Rules Back?
Posted by Daniel McDonald <da...@austinenergy.com>.
On 2/1/10 9:30 AM, "Mark Martinec" <Ma...@ijs.si> wrote:
>>> Update returned sought rules 1/31/2010.
>>
>> Actually back since Jan 6. :) Re-viewed about 1k fraud spam the
>> following days, for the Sought Fraud sub-set.
>
> Btw, the three rules JM_SOUGHT_FRAUD_{1,2,3} have a score of zero
> as per Justin's request (Bug 6155 c 38, c72, c89, c124).
Doesn't appear to be that way in the 3.2.5 channel:
$ cd /var/lib/spamassassin/3.002005/sought_rules_yerp_org/
$ grep score *
20_sought.cf:score JM_SOUGHT_1 4.0
20_sought.cf:score JM_SOUGHT_2 4.0
20_sought.cf:score JM_SOUGHT_3 4.0
20_sought_fraud.cf:score JM_SOUGHT_FRAUD_1 3.0
20_sought_fraud.cf:score JM_SOUGHT_FRAUD_2 3.0
20_sought_fraud.cf:score JM_SOUGHT_FRAUD_3 3.0
$ ls -l
total 128
-rw-r--r-- 1 root root 44591 Feb 1 07:12 20_sought.cf
-rw-r--r-- 1 root root 80120 Feb 1 07:12 20_sought_fraud.cf
-rw-r--r-- 1 root root 29 Feb 1 07:12 MIRRORED.BY
And in fact, looking at the 3.3.0 channel on a different box, the scores are
the same:
$ cd /var/lib/spamassassin/3.003000/sought_rules_yerp_org/
$ grep score *
20_sought.cf:score JM_SOUGHT_1 4.0
20_sought.cf:score JM_SOUGHT_2 4.0
20_sought.cf:score JM_SOUGHT_3 4.0
20_sought_fraud.cf:score JM_SOUGHT_FRAUD_1 3.0
20_sought_fraud.cf:score JM_SOUGHT_FRAUD_2 3.0
20_sought_fraud.cf:score JM_SOUGHT_FRAUD_3 3.0
> Not sure if people using the channel realize that scores
> need to be bumped up. Btw, I prefer to avoid them monopolizing
> the score when more than one hits:
>
> score JM_SOUGHT_FRAUD_1 0.1
> score JM_SOUGHT_FRAUD_2 0.1
> score JM_SOUGHT_FRAUD_3 0.1
> meta JM_SOUGHT_FRAUD_ANY JM_SOUGHT_FRAUD_1 || JM_SOUGHT_FRAUD_2 ||
> JM_SOUGHT_FRAUD_3
> score JM_SOUGHT_FRAUD_ANY 3.0
>
>
> Mark
--
Daniel J McDonald, CCIE # 2495, CISSP # 78281
Re: Sought Rules Back?
Posted by Mark Martinec <Ma...@ijs.si>.
> > Update returned sought rules 1/31/2010.
>
> Actually back since Jan 6. :) Re-viewed about 1k fraud spam the
> following days, for the Sought Fraud sub-set.
Btw, the three rules JM_SOUGHT_FRAUD_{1,2,3} have a score of zero
as per Justin's request (Bug 6155 c 38, c72, c89, c124).
Not sure if people using the channel realize that scores
need to be bumped up. Btw, I prefer to avoid them monopolizing
the score when more than one hits:
score JM_SOUGHT_FRAUD_1 0.1
score JM_SOUGHT_FRAUD_2 0.1
score JM_SOUGHT_FRAUD_3 0.1
meta JM_SOUGHT_FRAUD_ANY JM_SOUGHT_FRAUD_1 || JM_SOUGHT_FRAUD_2 || JM_SOUGHT_FRAUD_3
score JM_SOUGHT_FRAUD_ANY 3.0
Mark
Re: Sought Rules Back?
Posted by Karsten Bräckelmann <gu...@rudersport.de>.
On Mon, 2010-02-01 at 00:10 -0500, Jared Hall wrote:
> Update returned sought rules 1/31/2010.
Actually back since Jan 6. :) Re-viewed about 1k fraud spam the
following days, for the Sought Fraud sub-set.
> Had to pinch myself 2.5 times (1 per month)
> to be sure.
>
> Thanks.
--
char *t="\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1:
(c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}