You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Jonathan Nichols <jn...@pbp.net> on 2008/02/25 01:13:21 UTC
The 'believe-it' spams
Anyone catching these?
Here's a sample:
http://pastebin.ca/916902
Those have been slipping right through these days. Scores are in the
pastebin post.
SpamAssassin version 3.2.3
running on Perl version 5.8.7
(From the Ubuntu package, which I cannot for the life of me figure out
how to extract version numbers from)
RE: Changing email address for these
Posted by Chris <Ch...@011005.com>.
-----Original Message-----
From: Per Jessen [mailto:per@computer.org]
Sent: Monday, February 25, 2008 2:13 PM
To: users@spamassassin.apache.org
Subject: Re: Changing email address for these
Chris wrote:
> Apologies if this hasn't been done in the right way, but I have gone
> to the website and couldn't find out how to do it - how do you change
> the email address that these get sent to please ? I will be changing
> email addresses and want to ensure I don't miss any posts.
You subscribe your new address, and unsubscribe your old ditto.
/Per Jessen, Zürich
===
Many thanks for the quick help Per - I will do that.
Chris.
Re: Changing email address for these
Posted by Per Jessen <pe...@computer.org>.
Chris wrote:
> Apologies if this hasn't been done in the right way, but I have gone
> to the website and couldn't find out how to do it - how do you change
> the
> email address that these get sent to please ? I will be changing
> email addresses and want to ensure I don't miss any posts.
You subscribe your new address, and unsubscribe your old ditto.
/Per Jessen, Zürich
Changing email address for these
Posted by Chris <Ch...@011005.com>.
Apologies if this hasn't been done in the right way, but I have gone to
the website and couldn't find out how to do it - how do you change the
email address that these get sent to please ? I will be changing email
addresses and want to ensure I don't miss any posts.
Any help appreciated.
Chris.
Re: The 'believe-it' spams
Posted by Per Jessen <pe...@computer.org>.
Kathryn Allan wrote:
> How do you set a rule to expire?
>
I think you could use this construct:
if (conditional perl expression)
rules ...
endif
And do a check on the date in the expression.
/Per Jessen, Zürich
Re: The 'believe-it' spams
Posted by Bob Proulx <bo...@proulx.com>.
Kathryn Allan wrote:
> Bob Proulx wrote:
> > I just did the brute force thing and looked for an entire phrase from
> > that message. It really isn't worthy and this will change very
> > quickly such that any rule I post now won't be interesting to have in
> > a ruleset in a couple of days. It needs to expire.
>
> How do you set a rule to expire?
I use 'at' to set up a reminder email from cron to myself at some time
in the future.
$ at 8 am + 1 week
at> echo "Remember to clean up that hacked TV_ARM_SPAM rule." |
at> mailx -s "SA Rule Cleanup Reminder" rwp
^D
A week from now when I get the reminder in my mailbox I will look at
things and decide what to do about it then. I prefer email for my
todo lists and reminders and use this a lot.
Somehow I don't think that is the answer you were expecting but it is
what I do just the same. :-)
Bob
Re: The 'believe-it' spams
Posted by Kathryn Allan <ka...@rheel.co.nz>.
How do you set a rule to expire?
Kate
Bob Proulx wrote:
> Jonathan Nichols wrote:
>
>> What was the rule you added? :)
>>
>
> I just did the brute force thing and looked for an entire phrase from
> that message. It really isn't worthy and this will change very
> quickly such that any rule I post now won't be interesting to have in
> a ruleset in a couple of days. It needs to expire.
>
> body TV_ARM_SPAM_1 /^Well we have developed the TV arm for every website in the world/
> describe TV_ARM_SPAM_1 TV Arm Spam
> score TV_ARM_SPAM_1 5.5
>
> It is just a brute force rule that works today on that particular wave
> of incoming spam.
>
> Bob
>
Re: The 'believe-it' spams
Posted by Bob Proulx <bo...@proulx.com>.
Jonathan Nichols wrote:
> What was the rule you added? :)
I just did the brute force thing and looked for an entire phrase from
that message. It really isn't worthy and this will change very
quickly such that any rule I post now won't be interesting to have in
a ruleset in a couple of days. It needs to expire.
body TV_ARM_SPAM_1 /^Well we have developed the TV arm for every website in the world/
describe TV_ARM_SPAM_1 TV Arm Spam
score TV_ARM_SPAM_1 5.5
It is just a brute force rule that works today on that particular wave
of incoming spam.
Bob
Re: The 'believe-it' spams
Posted by Jonathan Nichols <jn...@pbp.net>.
On Feb 24, 2008, at 7:39 PM, Bob Proulx wrote:
> Jonathan Nichols wrote:
>> Anyone catching these?
>>
>> Here's a sample:
>>
>> http://pastebin.ca/916902
>>
>> Those have been slipping right through these days. Scores are in the
>> pastebin post.
>
> Even with a current sa-update and also Justin's (very wonderfully
> appreciated) sought.cf scores I only see HTML_MESSAGE and Bayes engine
> scores. I added a custom rule for it here just today.
>
>>
What was the rule you added? :)
Thanks for the note about sought.cf - i just added that a few minutes
ago.
Re: The 'believe-it' spams
Posted by Bob Proulx <bo...@proulx.com>.
Jonathan Nichols wrote:
> Anyone catching these?
>
> Here's a sample:
>
> http://pastebin.ca/916902
>
> Those have been slipping right through these days. Scores are in the
> pastebin post.
Even with a current sa-update and also Justin's (very wonderfully
appreciated) sought.cf scores I only see HTML_MESSAGE and Bayes engine
scores. I added a custom rule for it here just today.
> SpamAssassin version 3.2.3
> running on Perl version 5.8.7
>
> (From the Ubuntu package, which I cannot for the life of me figure out
> how to extract version numbers from)
The spamassassin --version output which you provided should be
sufficient. In order to get the version number from the dpkg package
manager use either the -l (--list) option or the --status option. (Or
there are other more fun ways too.)
dpkg -l spamassassin
Or:
dpkg --status spamassassin | grep Version:
Bob