You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Mike Cardwell <sp...@lists.grepular.com> on 2010/01/01 01:57:37 UTC
FH_DATE_PAST_20XX
I just received some HAM with a surprisingly high score. The following
rule triggered:
* 3.2 FH_DATE_PAST_20XX The date is grossly in the future.
Yet the date header looks fine to me:
Date: Fri, 1 Jan 2010 00:46:45 GMT
In /usr/share/spamassassin/72_active.cf I find:
header FH_DATE_PAST_20XX Date =~ /20[1-9][0-9]/ [if-unset: 2006]
Doesn't look particularly sane to me... I have given that rule a score
of 0 in my local.cf for now.
--
Mike Cardwell - IT Consultant and LAMP developer
Cardwell IT Ltd. (UK Reg'd Company #06920226) http://cardwellit.com/
Technical Blog: https://secure.grepular.com/blog/
Re: FH_DATE_PAST_20XX
Posted by Matus UHLAR - fantomas <uh...@fantomas.sk>.
> On 12/31/2009 7:57 PM, Mike Cardwell wrote:
>> I just received some HAM with a surprisingly high score. The following
>> rule triggered:
>>
>> * 3.2 FH_DATE_PAST_20XX The date is grossly in the future.
>>
>> Yet the date header looks fine to me:
>>
>> Date: Fri, 1 Jan 2010 00:46:45 GMT
>>
>> In /usr/share/spamassassin/72_active.cf I find:
>>
>> header FH_DATE_PAST_20XX Date =~ /20[1-9][0-9]/ [if-unset: 2006]
>>
>> Doesn't look particularly sane to me... I have given that rule a score
>> of 0 in my local.cf for now.
On 01.01.10 10:14, Thomas Harold wrote:
> My question is: Instead of using a hard-coded acceptable list of years,
> the rule isn't written more in the fashion of DATE_IN_PAST_96_XX which
> calculates the offset?
>
> header Date: is 96 hours or more before Received: date
> DATE_IN_PAST_96_XX 2.952 2.320 1.800 1.690
> eval:check_for_shifted_date('undef', '-96')
>
> header Date: is 96 hours or more after Received: date
> DATE_IN_FUTURE_96_XX 3.899 3.899 2.598 1.439
>
> Then you could replace FH_DATE_PAST_20XX with a set of rules that check
> the date against the current date and score accordingly. I'm guessing
> that intervals of 3 days, 7 days and 30 days before/after would provide
> a suitable set.
https://issues.apache.org/SpamAssassin/show_bug.cgi?id=5852
it's never been so actual :)
I've overriden the rule to match >=2020 but I'll look if it matches
anything.
--
Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
I don't have lysdexia. The Dog wouldn't allow that.
Re: FH_DATE_PAST_20XX
Posted by Thomas Harold <th...@nybeta.com>.
On 12/31/2009 7:57 PM, Mike Cardwell wrote:
> I just received some HAM with a surprisingly high score. The following
> rule triggered:
>
> * 3.2 FH_DATE_PAST_20XX The date is grossly in the future.
>
> Yet the date header looks fine to me:
>
> Date: Fri, 1 Jan 2010 00:46:45 GMT
>
> In /usr/share/spamassassin/72_active.cf I find:
>
> header FH_DATE_PAST_20XX Date =~ /20[1-9][0-9]/ [if-unset: 2006]
>
> Doesn't look particularly sane to me... I have given that rule a score
> of 0 in my local.cf for now.
>
My question is: Instead of using a hard-coded acceptable list of years,
the rule isn't written more in the fashion of DATE_IN_PAST_96_XX which
calculates the offset?
header Date: is 96 hours or more before Received: date
DATE_IN_PAST_96_XX 2.952 2.320 1.800 1.690
eval:check_for_shifted_date('undef', '-96')
header Date: is 96 hours or more after Received: date
DATE_IN_FUTURE_96_XX 3.899 3.899 2.598 1.439
Then you could replace FH_DATE_PAST_20XX with a set of rules that check
the date against the current date and score accordingly. I'm guessing
that intervals of 3 days, 7 days and 30 days before/after would provide
a suitable set.
Re: [sa] Re: PH_DATE_PAST_20XX
Posted by Charles Gregory <cg...@hwcn.org>.
On Fri, 1 Jan 2010, Marc Perkel wrote:
> Can we call this the "Y2010" bug? :)
> I was just thinking back 10 years ago today wondering if there would be a
> 2010 related date bug.
Funny thing is, I can *remember* writing scripts for my current system that
included 2010 as a 'sanity check' (impossible date), figuring I would
update the code long before I got here. Now I'm looking at my system and
wondering, DID I update all those programs? LOL
- C
> Charles Gregory wrote:
>>
>> Holy ########!!!!!!!!!!!!!!!
>>
>> I am SO glad that I read my e-mail first thing this morning!
>>
>> THANKS for spotting this!
>>
>> - Charles
>>
>>
>> On Fri, 1 Jan 2010, Mike Cardwell wrote:
>> > I just received some HAM with a surprisingly high score. The following
>> > rule triggered:
>> >
>> > * 3.2 FH_DATE_PAST_20XX The date is grossly in the future.
>> >
>> > Yet the date header looks fine to me:
>> >
>> > Date: Fri, 1 Jan 2010 00:46:45 GMT
>> >
>> > In /usr/share/spamassassin/72_active.cf I find:
>> >
>> > header FH_DATE_PAST_20XX Date =~ /20[1-9][0-9]/ [if-unset: 2006]
>> >
>> > Doesn't look particularly sane to me... I have given that rule a score
>> > of 0 in my local.cf for now.
>> >
>> > --
>> > Mike Cardwell - IT Consultant and LAMP developer
>> > Cardwell IT Ltd. (UK Reg'd Company #06920226) http://cardwellit.com/
>> > Technical Blog: https://secure.grepular.com/blog/
>> >
>>
>
>
Re: PH_DATE_PAST_20XX
Posted by Marc Perkel <ma...@perkel.com>.
Can we call this the "Y2010" bug? :)
I was just thinking back 10 years ago today wondering if there would be
a 2010 related date bug.
Charles Gregory wrote:
>
> Holy ########!!!!!!!!!!!!!!!
>
> I am SO glad that I read my e-mail first thing this morning!
>
> THANKS for spotting this!
>
> - Charles
>
>
> On Fri, 1 Jan 2010, Mike Cardwell wrote:
>> I just received some HAM with a surprisingly high score. The following
>> rule triggered:
>>
>> * 3.2 FH_DATE_PAST_20XX The date is grossly in the future.
>>
>> Yet the date header looks fine to me:
>>
>> Date: Fri, 1 Jan 2010 00:46:45 GMT
>>
>> In /usr/share/spamassassin/72_active.cf I find:
>>
>> header FH_DATE_PAST_20XX Date =~ /20[1-9][0-9]/ [if-unset: 2006]
>>
>> Doesn't look particularly sane to me... I have given that rule a score
>> of 0 in my local.cf for now.
>>
>> --
>> Mike Cardwell - IT Consultant and LAMP developer
>> Cardwell IT Ltd. (UK Reg'd Company #06920226) http://cardwellit.com/
>> Technical Blog: https://secure.grepular.com/blog/
>>
>
Re: PH_DATE_PAST_20XX
Posted by Charles Gregory <cg...@hwcn.org>.
Holy ########!!!!!!!!!!!!!!!
I am SO glad that I read my e-mail first thing this morning!
THANKS for spotting this!
- Charles
On Fri, 1 Jan 2010, Mike Cardwell wrote:
> I just received some HAM with a surprisingly high score. The following
> rule triggered:
>
> * 3.2 FH_DATE_PAST_20XX The date is grossly in the future.
>
> Yet the date header looks fine to me:
>
> Date: Fri, 1 Jan 2010 00:46:45 GMT
>
> In /usr/share/spamassassin/72_active.cf I find:
>
> header FH_DATE_PAST_20XX Date =~ /20[1-9][0-9]/ [if-unset: 2006]
>
> Doesn't look particularly sane to me... I have given that rule a score
> of 0 in my local.cf for now.
>
> --
> Mike Cardwell - IT Consultant and LAMP developer
> Cardwell IT Ltd. (UK Reg'd Company #06920226) http://cardwellit.com/
> Technical Blog: https://secure.grepular.com/blog/
>
Re: [sa] FH_DATE_PAST_20XX
Posted by Kai Schaetzl <ma...@conactive.com>.
Thomas Harold wrote on Fri, 01 Jan 2010 10:04:42 -0500:
> score FH_DATE_PAST_20XX 0.001
set to 0, there's no reason to have this evaluated at all.
Kai
--
Kai Schätzl, Berlin, Germany
Get your web at Conactive Internet Services: http://www.conactive.com
Re: [sa] Re: FH_DATE_PAST_20XX
Posted by Thomas Harold <th...@nybeta.com>.
On 1/1/2010 9:59 AM, Frank DeChellis DSL wrote:
> would commenting out FH_DATE_PAST_20XX in 72_active.cf help until it's
> fixed?
>
My temporary fix was to override the score and set it to 0.001 in SA's
local.cf file.
# Turn down score on broken date testing rule
score FH_DATE_PAST_20XX 0.001
Re: [sa] Re: FH_DATE_PAST_20XX
Posted by Frank DeChellis DSL <fr...@iaw.on.ca>.
would commenting out FH_DATE_PAST_20XX in 72_active.cf help until it's
fixed?
Thanks
Frank
On Fri, 1 Jan 2010, Charles Gregory wrote:
> Date: Fri, 1 Jan 2010 09:50:24 -0500 (EST)
> From: Charles Gregory <cg...@hwcn.org>
> To: users@spamassassin.apache.org
> Subject: Re: [sa] Re: FH_DATE_PAST_20XX
>
> On Fri, 1 Jan 2010, Mike Cardwell wrote:
>> On 01/01/2010 10:15, Per Jessen wrote:
>>>>> I just received some HAM with a surprisingly high score. The
>>>>> following rule triggered:
>>>>> * 3.2 FH_DATE_PAST_20XX The date is grossly in the future.
>>>> Agree, that should probably be [2-9][0-9].
>>>> Please open a bug for this, it should be fixed for 3.3.0
>>> https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6269
>> Following that URL you find out that the "bug" was fixed five months
>> ago. I'm using the Debian Lenny package and it doesn't contain that fix.
>
> NOW the 'minor' issue I raised before has just become a MAJOR one.
>
> I have already fixed my config, so let's skip *that* portion of the
> argument.... :)
>
> I speak for the unguessable number of people who have installed a 'standard'
> 3.2.x install with their linux variant, and don't monitor closely, or watch
> this list. Some of them, we can hope, will have 'sa-update' running in their
> nightly cron job. But will that do any good if this 'patch' is not 'rushed'
> out as an sa-update for the current version?
>
> You could release 3.3.0 today, but that would not benefit people who don't
> know about the upgrade and leave it at 3.2.x.....
>
> And my pity to all those people who don't run sa-update..... :(
>
> - Charles
>
>
>
-----------------------------------------------------------------------
Frank DeChellis
Internet Access Worldwide
3 East Main Street Welland, Ontario, Canada L3B 3W4
905-714-1400 fax 905-732-0524
www.iaw.com
----------------------------------------------------------------------
Re: [SPAM:13.0] Re: [sa] FH_DATE_PAST_20XX
Posted by Christian Brel <br...@copperproductions.co.uk>.
You know - anyone unhappy about this can always ask for a full refund
on the purchase price paid for SpamAssassin :-)
Re: [sa] FH_DATE_PAST_20XX
Posted by Kai Schaetzl <ma...@conactive.com>.
Charles Gregory wrote on Fri, 1 Jan 2010 09:50:24 -0500 (EST):
> I speak for the unguessable number of people who have installed a
> 'standard' 3.2.x install with their linux variant, and don't monitor
> closely, or watch this list. Some of them, we can hope, will have
> 'sa-update' running in their nightly cron job. But will that do any good
> if this 'patch' is not 'rushed' out as an sa-update for the current
> version?
This bug is also hitting a good number of mail providers and has made it to
the news. Makes for a good measurement for support at those companies. ;-)
Where you still see this rule scoring there's obviously nobody paying
attention on holidays ...
>
> You could release 3.3.0 today, but that would not benefit people who don't
> know about the upgrade and leave it at 3.2.x.....
>
> And my pity to all those people who don't run sa-update..... :(
Well, that's their problem. Really.
It should be made clear that a well-tuned sa setup will put thru all the ham
still as ham. Most of our customer's ham scores even after applying this rule
between 1 and 3 and easily makes it thru. If a considerable amount of ham is
turned to spam on a certain setup there's likely something wrong with that
setup.
Kai
--
Kai Schätzl, Berlin, Germany
Get your web at Conactive Internet Services: http://www.conactive.com
Re: [sa] Re: FH_DATE_PAST_20XX
Posted by Charles Gregory <cg...@hwcn.org>.
On Fri, 1 Jan 2010, Mike Cardwell wrote:
> On 01/01/2010 10:15, Per Jessen wrote:
>>>> I just received some HAM with a surprisingly high score. The
>>>> following rule triggered:
>>>> * 3.2 FH_DATE_PAST_20XX The date is grossly in the future.
>>> Agree, that should probably be [2-9][0-9].
>>> Please open a bug for this, it should be fixed for 3.3.0
>> https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6269
> Following that URL you find out that the "bug" was fixed five months
> ago. I'm using the Debian Lenny package and it doesn't contain that fix.
NOW the 'minor' issue I raised before has just become a MAJOR one.
I have already fixed my config, so let's skip *that* portion of the
argument.... :)
I speak for the unguessable number of people who have installed a
'standard' 3.2.x install with their linux variant, and don't monitor
closely, or watch this list. Some of them, we can hope, will have
'sa-update' running in their nightly cron job. But will that do any good
if this 'patch' is not 'rushed' out as an sa-update for the current
version?
You could release 3.3.0 today, but that would not benefit people who don't
know about the upgrade and leave it at 3.2.x.....
And my pity to all those people who don't run sa-update..... :(
- Charles
Re: FH_DATE_PAST_20XX
Posted by Christian Brel <br...@copperproductions.co.uk>.
On Fri, 01 Jan 2010 13:44:27 +0000
Mike Cardwell <sp...@lists.grepular.com> wrote:
> Also, the "fix" five months ago was to add 10 years to what is
> classified as "grossly in the future"... That doesn't sound to me as
> though this ruke was based on the results of a mass check...
>
And Happy New Year to you from the development team....
{joke -}
Re: FH_DATE_PAST_20XX
Posted by Per Jessen <pe...@computer.org>.
Mike Cardwell wrote:
> On 01/01/2010 10:15, Per Jessen wrote:
>
>>
>> https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6269
>
> Following that URL you find out that the "bug" was fixed five months
> ago. I'm using the Debian Lenny package and it doesn't contain that
> fix.
Yes, that fix doesn't appear to have made it out with sa-update.
> So as I understand it ... everyone using the Debian Lenny package with
> the default settings has basically dropped from a spam threshold of
> 5.0 to 1.8 over night because of this...?
Sounds about right. We need a rule update pushed out asap.
/Per Jessen, Zürich
Re: FH_DATE_PAST_20XX
Posted by Mike Cardwell <sp...@lists.grepular.com>.
On 01/01/2010 10:15, Per Jessen wrote:
>>> I just received some HAM with a surprisingly high score. The
>>> following rule triggered:
>>>
>>> * 3.2 FH_DATE_PAST_20XX The date is grossly in the future.
>>>
>>> Yet the date header looks fine to me:
>>>
>>> Date: Fri, 1 Jan 2010 00:46:45 GMT
>>>
>>> In /usr/share/spamassassin/72_active.cf I find:
>>>
>>> header FH_DATE_PAST_20XX Date =~ /20[1-9][0-9]/ [if-unset: 2006]
>>>
>>> Doesn't look particularly sane to me... I have given that rule a
>>> score of 0 in my local.cf for now.
>>
>> Agree, that should probably be [2-9][0-9].
>>
>> Please open a bug for this, it should be fixed for 3.3.0
>
> https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6269
Following that URL you find out that the "bug" was fixed five months
ago. I'm using the Debian Lenny package and it doesn't contain that fix.
root@haven:~# spamassassin --version
SpamAssassin version 3.2.5
running on Perl version 5.10.0
root@haven:~#
So as I understand it ... everyone using the Debian Lenny package with
the default settings has basically dropped from a spam threshold of 5.0
to 1.8 over night because of this...?
Also, the "fix" five months ago was to add 10 years to what is
classified as "grossly in the future"... That doesn't sound to me as
though this ruke was based on the results of a mass check...
--
Mike Cardwell - IT Consultant and LAMP developer
Cardwell IT Ltd. (UK Reg'd Company #06920226) http://cardwellit.com/
Technical Blog: https://secure.grepular.com/blog/
Re: FH_DATE_PAST_20XX
Posted by Per Jessen <pe...@computer.org>.
John Hardin wrote:
> On Fri, 1 Jan 2010, Mike Cardwell wrote:
>
>> I just received some HAM with a surprisingly high score. The
>> following rule triggered:
>>
>> * 3.2 FH_DATE_PAST_20XX The date is grossly in the future.
>>
>> Yet the date header looks fine to me:
>>
>> Date: Fri, 1 Jan 2010 00:46:45 GMT
>>
>> In /usr/share/spamassassin/72_active.cf I find:
>>
>> header FH_DATE_PAST_20XX Date =~ /20[1-9][0-9]/ [if-unset: 2006]
>>
>> Doesn't look particularly sane to me... I have given that rule a
>> score of 0 in my local.cf for now.
>
> Agree, that should probably be [2-9][0-9].
>
> Please open a bug for this, it should be fixed for 3.3.0
>
https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6269
/Per Jessen, Zürich
Re: FH_DATE_PAST_20XX
Posted by Kai Schaetzl <ma...@conactive.com>.
I think this rule should just be put to rest. According to my stats it
hits 100% spam, but there's only very very few of it. Thus it doesn't add
any real value over other rules, especially when one takes into account
that there are already other rules hitting on time in the (near) future.
There is no need to hit double and triple.
Kai
--
Kai Schätzl, Berlin, Germany
Get your web at Conactive Internet Services: http://www.conactive.com
Re: FH_DATE_PAST_20XX
Posted by jdow <jd...@earthlink.net>.
From: "Herbert J. Skuhra" <h....@gmail.com>
Sent: Friday, 2010/January/01 01:17
> At Thu, 31 Dec 2009 17:53:24 -0800 (PST),
> John Hardin wrote:
>>
>> On Fri, 1 Jan 2010, Mike Cardwell wrote:
>>
>> > I just received some HAM with a surprisingly high score. The following
>> > rule triggered:
>> >
>> > * 3.2 FH_DATE_PAST_20XX The date is grossly in the future.
>> >
>> > Yet the date header looks fine to me:
>> >
>> > Date: Fri, 1 Jan 2010 00:46:45 GMT
>> >
>> > In /usr/share/spamassassin/72_active.cf I find:
>> >
>> > header FH_DATE_PAST_20XX Date =~ /20[1-9][0-9]/ [if-unset: 2006]
>> >
>> > Doesn't look particularly sane to me... I have given that rule a score
>> > of 0 in my local.cf for now.
>>
>> Agree, that should probably be [2-9][0-9].
>
> What about
>
> header FH_DATE_PAST_20XX Date =~ /(201[1-9])|(20[2-9][0-9])/
>
> and
>
> ##{ FH_DATE_IS_200X
> header FH_DATE_IS_200X Date =~ /200[0-9]/ [if-unset: 2006]
> describe FH_DATE_IS_200X The date is not 200x.
> ##} FH_DATE_IS_200X
How about simple arithmetic expressions? Then it will not need yearly
updates. Oh yeah, TPTB don't have arithmetic expressions in SA.
{o.o}
[SPAM:9.4] Re: FH_DATE_PAST_20XX
Posted by Christian Brel <br...@copperproductions.co.uk>.
On Fri, 01 Jan 2010 10:17:57 +0100
"Herbert J. Skuhra" <h....@gmail.com> wrote:
> At Thu, 31 Dec 2009 17:53:24 -0800 (PST),
> John Hardin wrote:
> >
> > On Fri, 1 Jan 2010, Mike Cardwell wrote:
> >
> > > I just received some HAM with a surprisingly high score. The
> > > following rule triggered:
> > >
> > > * 3.2 FH_DATE_PAST_20XX The date is grossly in the future.
> > >
> > > Yet the date header looks fine to me:
> > >
> > > Date: Fri, 1 Jan 2010 00:46:45 GMT
> > >
> > > In /usr/share/spamassassin/72_active.cf I find:
> > >
> > > header FH_DATE_PAST_20XX Date =~ /20[1-9][0-9]/
> > > [if-unset: 2006]
> > >
> > > Doesn't look particularly sane to me... I have given that rule a
> > > score of 0 in my local.cf for now.
> >
> > Agree, that should probably be [2-9][0-9].
>
> What about
>
> header FH_DATE_PAST_20XX Date =~ /(201[1-9])|(20[2-9][0-9])/
>
> and
>
> ##{ FH_DATE_IS_200X
> header FH_DATE_IS_200X Date =~ /200[0-9]/ [if-unset: 2006]
> describe FH_DATE_IS_200X The date is not 200x.
> ##} FH_DATE_IS_200X
>
> -Herbert
Perhaps in a couple of days. There may still be deferred mail sat in
peoples outbound queues with 2009 on it ;-)
Re: FH_DATE_PAST_20XX
Posted by "Herbert J. Skuhra" <h....@gmail.com>.
At Thu, 31 Dec 2009 17:53:24 -0800 (PST),
John Hardin wrote:
>
> On Fri, 1 Jan 2010, Mike Cardwell wrote:
>
> > I just received some HAM with a surprisingly high score. The following
> > rule triggered:
> >
> > * 3.2 FH_DATE_PAST_20XX The date is grossly in the future.
> >
> > Yet the date header looks fine to me:
> >
> > Date: Fri, 1 Jan 2010 00:46:45 GMT
> >
> > In /usr/share/spamassassin/72_active.cf I find:
> >
> > header FH_DATE_PAST_20XX Date =~ /20[1-9][0-9]/ [if-unset: 2006]
> >
> > Doesn't look particularly sane to me... I have given that rule a score
> > of 0 in my local.cf for now.
>
> Agree, that should probably be [2-9][0-9].
What about
header FH_DATE_PAST_20XX Date =~ /(201[1-9])|(20[2-9][0-9])/
and
##{ FH_DATE_IS_200X
header FH_DATE_IS_200X Date =~ /200[0-9]/ [if-unset: 2006]
describe FH_DATE_IS_200X The date is not 200x.
##} FH_DATE_IS_200X
-Herbert
Re: FH_DATE_PAST_20XX
Posted by John Hardin <jh...@impsec.org>.
On Fri, 1 Jan 2010, Mike Cardwell wrote:
> I just received some HAM with a surprisingly high score. The following
> rule triggered:
>
> * 3.2 FH_DATE_PAST_20XX The date is grossly in the future.
>
> Yet the date header looks fine to me:
>
> Date: Fri, 1 Jan 2010 00:46:45 GMT
>
> In /usr/share/spamassassin/72_active.cf I find:
>
> header FH_DATE_PAST_20XX Date =~ /20[1-9][0-9]/ [if-unset: 2006]
>
> Doesn't look particularly sane to me... I have given that rule a score
> of 0 in my local.cf for now.
Agree, that should probably be [2-9][0-9].
Please open a bug for this, it should be fixed for 3.3.0
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
Judicial Activism (n): interpreting the Constitution to grant the
government powers that are popularly felt to be "needed" but that
are not explicitly provided for therein (common definition);
interpreting the Constitution as it is written (Brady definition)
-----------------------------------------------------------------------
83 days since President Obama won the Nobel "Not George W. Bush" prize
Re: [sa] FH_DATE_PAST_20XX
Posted by Kai Schaetzl <ma...@conactive.com>.
you may get this error from time to time, which is not a "problem" per se.
Kai
--
Kai Schätzl, Berlin, Germany
Get your web at Conactive Internet Services: http://www.conactive.com
Re: [sa] Re: FH_DATE_PAST_20XX
Posted by Mathias Homann <ad...@eregion.de>.
Am Montag, 4. Januar 2010 08:50:54 schrieb Per Jessen:
> Mathias Homann wrote:
> > ... is a fix for that out through sa-update now?
> > then why am i not getting it?
> > my channels for sa-update:
> >
> > saupdates.openprotect.com
> > updates.spamassassin.org
> > 70_zmi_german.cf.zmi.sa-update.dostech.net
>
> I just ran an update from updates.spamassassin.org and got the
> following:
>
> 72_active.cf:
>
> header FH_DATE_PAST_20XX Date =~ /20[2-9][0-9]/ [if-unset: 2006]
> describe FH_DATE_PAST_20XX The date is grossly in the future.
>
>
> /Per Jessen, Zürich
>
I had to clean out my /var/lib/spamassassin directory to get the fix...
which led to a problem with dostech.ca:
[7319] dbg: http: GET request, http://daryl.dostech.ca/sa-
update/zmi/70_zmi_german.cf/MIRRORED.BY
[7319] dbg: http: request failed, retrying: 404 Not Found: <!DOCTYPE HTML
PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>404 Not Found</title>
</head><body> <h1>Not Found</h1> <p>The requested URL /sa-
update/zmi/70_zmi_german.cf/MIRRORED.BY was not found on this server.</p> <hr>
<address>Apache/2.2.6 (Fedora) Server at daryl.dostech.ca Port 80</address>
</body></html>
[7319] dbg: http: GET request, http://daryl.dostech.ca/sa-
update/zmi/70_zmi_german.cf/MIRRORED.BY
[7319] dbg: http: request failed, retrying: 404 Not Found: <!DOCTYPE HTML
PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>404 Not Found</title>
</head><body> <h1>Not Found</h1> <p>The requested URL /sa-
update/zmi/70_zmi_german.cf/MIRRORED.BY was not found on this server.</p> <hr>
<address>Apache/2.2.6 (Fedora) Server at daryl.dostech.ca Port 80</address>
</body></html>
[7319] dbg: http: GET request, http://daryl.dostech.ca/sa-
update/zmi/70_zmi_german.cf/MIRRORED.BY
[7319] dbg: http: request failed, retrying: 404 Not Found: <!DOCTYPE HTML
PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>404 Not Found</title>
</head><body> <h1>Not Found</h1> <p>The requested URL /sa-
update/zmi/70_zmi_german.cf/MIRRORED.BY was not found on this server.</p> <hr>
<address>Apache/2.2.6 (Fedora) Server at daryl.dostech.ca Port 80</address>
</body></html>
http: request failed: 404 Not Found: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML
2.0//EN"> <html><head> <title>404 Not Found</title> </head><body> <h1>Not
Found</h1> <p>The requested URL /sa-update/zmi/70_zmi_german.cf/MIRRORED.BY
was not found on this server.</p> <hr> <address>Apache/2.2.6 (Fedora) Server
at daryl.dostech.ca Port 80</address> </body></html>
[7319] dbg: channel: no mirror data available for channel
70_zmi_german.cf.zmi.sa-update.dostech.net from http://daryl.dostech.ca/sa-
update/zmi/70_zmi_german.cf/MIRRORED.BY
error: no mirror data available for channel 70_zmi_german.cf.zmi.sa-
update.dostech.net
channel: MIRRORED.BY contents were missing, channel failed
but anyways, i have the fix now.
Re: [sa] Re: FH_DATE_PAST_20XX
Posted by jdow <jd...@earthlink.net>.
From: "Mathias Homann" <ad...@eregion.de>
Sent: Sunday, 2010/January/03 23:05
> Am Montag 04 Januar 2010 schrieb John Hardin:
>> On Sun, 3 Jan 2010, babydr wrote:
>> > Hello All , My main ? is how was this (see below(*)) email being
>> > caught by the FH_DATE_PAST_20XX . I've run the sa_update
>> > repeatedly (of course that was useless as crontab had already
>> > ran) and with '-D' & I had a newer branch than requested in the
>> > email . So far this is the only one I've been able to find being
>> > caught by the FH_DATE_PAST_20XX check .
>> >
>> > running
>> > spamd -V
>>
>> Silly, obvious question: did you (do you) restart spamd after
>> running sa-update? spamd does not automatically reread the
>> configuration files when they change, you need to restart it if
>> you make any configuration changes (including those made by
>> sa-update).
>>
>
> ... is a fix for that out through sa-update now?
> then why am i not getting it?
> my channels for sa-update:
>
> saupdates.openprotect.com
> updates.spamassassin.org
> 70_zmi_german.cf.zmi.sa-update.dostech.net
> any hints?
As mentioned, restart or reload spamd.
{^_^}
Re: [sa] Re: FH_DATE_PAST_20XX
Posted by "Daryl C. W. O'Shea" <sp...@dostech.ca>.
On 04/01/2010 2:05 AM, Mathias Homann wrote:
> ... is a fix for that out through sa-update now?
> then why am i not getting it?
> my channels for sa-update:
>
> saupdates.openprotect.com
> updates.spamassassin.org
> 70_zmi_german.cf.zmi.sa-update.dostech.net
>
> any hints?
saupdates.openprotect.com presumably still includes the old
00_FVGT_File001.cf that also contains the old version of the
FH_DATE_PAST_20XX rule.
Daryl
Re: [sa] Re: FH_DATE_PAST_20XX
Posted by jdow <jd...@earthlink.net>.
From: "Per Jessen" <pe...@computer.org>
Sent: Sunday, 2010/January/03 23:50
Mathias Homann wrote:
> ... is a fix for that out through sa-update now?
> then why am i not getting it?
> my channels for sa-update:
>
> saupdates.openprotect.com
> updates.spamassassin.org
> 70_zmi_german.cf.zmi.sa-update.dostech.net
I just ran an update from updates.spamassassin.org and got the
following:
72_active.cf:
header FH_DATE_PAST_20XX Date =~ /20[2-9][0-9]/ [if-unset: 2006]
describe FH_DATE_PAST_20XX The date is grossly in the future.
<< jdow
Which, by way of clarification, is the fix. Restart (or reload) spamd and
Bob's your uncle.
{^_^}
Re: [sa] Re: FH_DATE_PAST_20XX
Posted by Per Jessen <pe...@computer.org>.
Mathias Homann wrote:
> ... is a fix for that out through sa-update now?
> then why am i not getting it?
> my channels for sa-update:
>
> saupdates.openprotect.com
> updates.spamassassin.org
> 70_zmi_german.cf.zmi.sa-update.dostech.net
I just ran an update from updates.spamassassin.org and got the
following:
72_active.cf:
header FH_DATE_PAST_20XX Date =~ /20[2-9][0-9]/ [if-unset: 2006]
describe FH_DATE_PAST_20XX The date is grossly in the future.
/Per Jessen, Zürich
Re: [sa] Re: FH_DATE_PAST_20XX
Posted by Mathias Homann <ad...@eregion.de>.
Am Montag 04 Januar 2010 schrieb John Hardin:
> On Sun, 3 Jan 2010, babydr wrote:
> > Hello All , My main ? is how was this (see below(*)) email being
> > caught by the FH_DATE_PAST_20XX . I've run the sa_update
> > repeatedly (of course that was useless as crontab had already
> > ran) and with '-D' & I had a newer branch than requested in the
> > email . So far this is the only one I've been able to find being
> > caught by the FH_DATE_PAST_20XX check .
> >
> > running
> > spamd -V
>
> Silly, obvious question: did you (do you) restart spamd after
> running sa-update? spamd does not automatically reread the
> configuration files when they change, you need to restart it if
> you make any configuration changes (including those made by
> sa-update).
>
... is a fix for that out through sa-update now?
then why am i not getting it?
my channels for sa-update:
saupdates.openprotect.com
updates.spamassassin.org
70_zmi_german.cf.zmi.sa-update.dostech.net
any hints?
--
gpg key fingerprint: 5F64 4C92 9B77 DE37 D184 C5F9 B013 44E7 27BD
763C
RE: [sa] Re: FH_DATE_PAST_20XX
Posted by John Hardin <jh...@impsec.org>.
On Sun, 3 Jan 2010, babydr wrote:
> Hello All , My main ? is how was this (see below(*)) email being caught
> by the FH_DATE_PAST_20XX . I've run the sa_update repeatedly (of course
> that was useless as crontab had already ran) and with '-D' & I had a
> newer branch than requested in the email . So far this is the only one
> I've been able to find being caught by the FH_DATE_PAST_20XX check .
>
> running
> spamd -V
Silly, obvious question: did you (do you) restart spamd after running
sa-update? spamd does not automatically reread the configuration files
when they change, you need to restart it if you make any configuration
changes (including those made by sa-update).
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
Efficiency can magnify good, but it magnifies evil just as well.
So, we should not be surprised to find that modern electronic
communication magnifies stupidity as *efficiently* as it magnifies
intelligence. -- Robert A. Matern
-----------------------------------------------------------------------
14 days until Benjamin Franklin's 304th Birthday
RE: [sa] Re: FH_DATE_PAST_20XX
Posted by babydr <ba...@baby-dragons.com>.
Hello All , My main ? is how was this (see below(*)) email being caught by
the FH_DATE_PAST_20XX . I've run the sa_update repeatedly (of course that
was useless as crontab had already ran) and with '-D' & I had a newer branch
than requested in the email . So far this is the only one I've been able to
find being caught by the FH_DATE_PAST_20XX check .
running
spamd -V
SpamAssassin Server version 3.2.5
running on Perl 5.8.8
with SSL support (IO::Socket::SSL 1.07)
with zlib support (Compress::Zlib 2.008)
No other installed libraries or anything just spamassassin served defines .
# dir /var/lib/spamassassin/3.002005/updates_spamassassin_org/72_active.cf
100 -rw-r--r-- 1 root root 96464 2010-01-02 11:30
/var/lib/spamassassin/3.002005/updates_spamassassin_org/72_active.cf
# find /var/lib/spamassassin/3.002005/updates_spamassassin_org -type f
-print0 | xargs --null -n1 grep -C2 -Hi FH_DATE_PAST_20XX
/var/lib/spamassassin/3.002005/updates_spamassassin_org/50_scores.cf-score
FH_BAD_OEV1441 0.974 2.393 2.440 2.401 # n=2
/var/lib/spamassassin/3.002005/updates_spamassassin_org/50_scores.cf-score
FH_DATE_IS_19XX 1.947 1.970 2.512 2.199 # n=2
/var/lib/spamassassin/3.002005/updates_spamassassin_org/50_scores.cf:score
FH_DATE_PAST_20XX 2.075 3.384 3.554 3.188 # n=2
/var/lib/spamassassin/3.002005/updates_spamassassin_org/50_scores.cf-score
FH_FAKE_RCVD_LINE 2.230 2.215 2.670 2.470 # n=2
/var/lib/spamassassin/3.002005/updates_spamassassin_org/50_scores.cf-score
FH_FROMEML_NOTLD 2.699 2.196 2.699 2.696 # n=2
/var/lib/spamassassin/3.002005/updates_spamassassin_org/72_active.cf-##}
FH_DATE_IS_19XX
/var/lib/spamassassin/3.002005/updates_spamassassin_org/72_active.cf-
/var/lib/spamassassin/3.002005/updates_spamassassin_org/72_active.cf:##{
FH_DATE_PAST_20XX
/var/lib/spamassassin/3.002005/updates_spamassassin_org/72_active.cf:header
FH_DATE_PAST_20XX Date =~ /20[2-9][0-9]/ [if-unset: 2006]
/var/lib/spamassassin/3.002005/updates_spamassassin_org/72_active.cf:describe
FH_DATE_PAST_20XX The date is grossly in the future.
/var/lib/spamassassin/3.002005/updates_spamassassin_org/72_active.cf:##}
FH_DATE_PAST_20XX
/var/lib/spamassassin/3.002005/updates_spamassassin_org/72_active.cf-
/var/lib/spamassassin/3.002005/updates_spamassassin_org/72_active.cf-##{
FH_FAKE_RCVD_LINE
(*)
>From noreply@congressnewsletter.net Sun Jan 3 15:50:27 2010
Received: from localhost by filesrv1.baby-dragons.com
with SpamAssassin (version 3.2.5);
Sun, 03 Jan 2010 15:50:28 -0900
From: noreply@congressnewsletter.net
To: jiml@system-techniques.com
Subject: Thank you for your input from http://fleming.house.gov/.
Date: Sun, 3 Jan 2010 16:45:43 -0800 (GMT-08:00)
Message-Id: <21...@DCHOUSE01>
X-Spam-Flag: YES
X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on
filesrv1.baby-dragons.com
X-Spam-Level: *********
X-Spam-Status: Yes, score=9.3 required=5.0 tests=BAYES_50,FH_DATE_PAST_20XX,
HELO_LOCALHOST,HTML_MESSAGE,HTML_MIME_NO_HTML_TAG,MIME_HTML_ONLY,SPF_SOFTFAIL
autolearn=no version=3.2.5
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="----------=_4B413B54.F9E24CA9"
This is a multi-part message in MIME format.
------------=_4B413B54.F9E24CA9
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
Spam detection software, running on the system "filesrv1.baby-dragons.com",
has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
abuse@baby-dragons.com for details.
Content preview: Thank you for your input. [...]
Content analysis details: (9.3 points, 5.0 required)
pts rule name description
---- ----------------------
--------------------------------------------------
3.9 HELO_LOCALHOST HELO_LOCALHOST
3.2 FH_DATE_PAST_20XX The date is grossly in the future.
0.6 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 BAYES_50 BODY: Bayesian spam probability is 40 to 60%
[score: 0.5000]
1.5 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.1 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag
The original message was not completely plain text, and may be unsafe to
open with some email clients; in particular, it may contain a virus,
or confirm that your address can receive spam. If you wish to view
it, it may be safer to save it to a file and open it with an editor.
------------=_4B413B54.F9E24CA9
Content-Type: message/rfc822; x-spam-type=original
Content-Description: original message before SpamAssassin
Content-Disposition: attachment
Content-Transfer-Encoding: 8bit
Return-Path: <ji...@baby-dragons.com>
Received: from filesrv1.baby-dragons.com (localhost [127.0.0.1])
by filesrv1.baby-dragons.com (8.13.7/8.13.8) with ESMTP id
o040oQiv029147
for <ba...@localhost>; Sun, 3 Jan 2010 15:50:26 -0900
Received: from 64.62.236.141 [64.62.236.141]
by filesrv1.baby-dragons.com with IMAP (fetchmail-6.3.11)
for <ba...@localhost> (single-drop); Sun, 03 Jan 2010 15:50:26
-0900 (AKST)
Received: from localhost (ns3.baby-dragons.com [64.62.236.141])
by ns3.baby-dragons.com (8.13.8/8.13.8) with ESMTP id o040mwF4032405
for <ba...@baby-dragons.com>; Mon, 4 Jan 2010 00:48:59 GMT
X-Return-Path: <no...@congressnewsletter.net>
X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on
filesrv1.baby-dragons.com
X-Spam-Level:
X-Spam-Status: No, score=0.7 required=5.0 tests=BAYES_50,FH_DATE_PAST_20XX,
HTML_MESSAGE,HTML_MIME_NO_HTML_TAG,MIME_HTML_ONLY,RCVD_IN_DNSWL_MED,SPF_PASS
autolearn=no version=3.2.5
X-Received: from filesrv1.baby-dragons.com (localhost [127.0.0.1])
by filesrv1.baby-dragons.com (8.13.7/8.13.8) with ESMTP id
o040BjcC028611
for <ji...@localhost>; Sun, 3 Jan 2010 15:11:45 -0900
X-Received: from 64.62.236.141 [64.62.236.141]
by filesrv1.baby-dragons.com with IMAP (fetchmail-6.3.11)
for <ji...@localhost> (single-drop); Sun, 03 Jan 2010 15:11:45 -0900
(AKST)
X-Received: from pavo.house.gov (pavo.house.gov [143.228.150.140])
by ns3.baby-dragons.com (8.13.8/8.13.8) with ESMTP id o0409Emf032166
for <ji...@system-techniques.com>; Mon, 4 Jan 2010 00:09:14 GMT
X-Received: from DCHOUSE01 (dchouse01.house.gov [143.228.239.187])
by pavo.house.gov with ESMTP id o03JIY2Z017760
for <ji...@system-techniques.com>; Sun, 3 Jan 2010 18:49:18 -0500
Date: Sun, 3 Jan 2010 16:45:43 -0800 (GMT-08:00)
From: noreply@congressnewsletter.net
To: jiml@system-techniques.com
Message-ID: <21...@DCHOUSE01>
Subject: Thank you for your input from http://fleming.house.gov/.
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 7bit
X-Mailer: ColdFusion 8 Application Server
X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.2.3
(filesrv1.baby-dragons.com [0.0.0.0]); Sun, 03 Jan 2010 15:50:27 -0900
(AKST)
X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.2.3
(ns3.baby-dragons.com [64.62.236.141]); Mon, 04 Jan 2010 00:48:59 +0000
(UTC)
X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.2.3
(filesrv1.baby-dragons.com [0.0.0.0]); Sun, 03 Jan 2010 15:11:45 -0900
(AKST)
X-Greylist: Delayed for 00:19:39 by milter-greylist-4.2.3
(ns3.baby-dragons.com [64.62.236.141]); Mon, 04 Jan 2010 00:09:15 +0000
(UTC)
ReSent-Date: Sun, 3 Jan 2010 15:48:55 -0900 (AKST)
ReSent-From: "James W. Laferriere" <ji...@baby-dragons.com>
ReSent-To: "James W. Laferriere" <ba...@baby-dragons.com>
ReSent-Subject: Thank you for your input from http://fleming.house.gov/.
ReSent-Message-ID:
<al...@filesrv1.baby-dragons.com>
ReSent-User-Agent: Alpine 2.01 (LNX 1184 2008-12-16)
Thank you for your input.
------------=_4B413B54.F9E24CA9--
--
View this message in context: http://old.nabble.com/FH_DATE_PAST_20XX-tp26983175p27007851.html
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.