Mailing List Archive

On Fri, 20 Feb 2004 18:00:03 +0300
Alexander Galitski <triton-sec@gidro-service.ru> wrote:

> p.p.s. sorry again for crashing the list ... it was too easy )) ...
> it surely needs some protection from such things

Don't worry, you haven't crashed the list at all. Some subscribers may
not have received your mail, that's all.

Btw. This time the AWL kicked in due to the high score you got before :)

________________________snip_______________________________

SpamAssassin at Router.hideout.ath.cx has identified this mail as Spam.

Content analysis details: (172.2 points, 7.0 required)

pts rule name description
---- ---------------------- -------------------------------------------
-4.9 BAYES_00 BODY: Bayesian spam probability is 0 to 1%
[score: 0.0000]
-100 USER_IN_WHITELIST_TO User is listed in 'whitelist_to'
277 AWL AWL: Auto-whitelist adjustment

________________________snip_______________________________

Best wishes, Nico

+-------------------------------------------+
- Mailto: tbb@hideout.ath.cx
- No HTML mails please
+-------------------------------------------+

On Fri, Feb 20, 2004 at 04:06:57PM +0100, tBB wrote:
> Don't worry, you haven't crashed the list at all. Some subscribers may
> not have received your mail, that's all.

BTW: This is another good reason not to filter lists that talk about
spam through a spam filter, even with a whitelist it sometimes still
doesn't work the way you'd want it to.

--
Randomly Generated Tagline:
"Do not marry a person that you know that you can live with; only marry
someone that you cannot live without." - Unknown

At 10:00 AM 2/20/2004, Alexander Galitski wrote:

> sorry for my stupid fault ... very unclever ((
>
> isn't list protected from such user faults??

IMO it's not a fault to post a GTUBE string to the list.. So there's no
protection needed.

I got the message just fine... ok, it did have a high-score, and it did get
subject-tagged, but it got here none the less and was placed in my
spamassassin folder by my mail client.

Quite frankly, it's a fault to not expect a message posted to the list
containing GTUBE...

In trying to figure out why my mail client dumped his message to my spam
filter (as the last rule) instead of to the list folder (which is above
it) it brought up a question. I'm filtering the list based on List-ID:
header. But in his post the list headers were all stripped. there are
no other recieveds, etc? I'm just running procmail and SA.... no other
programs in the chain?



Received: from localhost
by equinox
with SpamAssassin (2.63 2004-01-11);
Fri, 20 Feb 2004 03:30:39 -0600
From: Alexander Galitski <triton-sec@gidro-service.ru>
To: spamassassin-users@incubator.apache.org
Subject: [SPAM 995.70/05.00] spamc not seeing razor/pyzor/dcc while spamassassin does
Date: Fri, 20 Feb 2004 12:30:36 +0300
Message-Id: <499152025.20040220123036@gidro-service.ru>
X-Spam-Flag: YES
X-Spam-Checker-Version: SpamAssassin 2.63 (2004-01-11) on equinox
X-Spam-Level: **************************************************
X-Spam-Status: Yes, hits=995.7 required=5.0 tests=BAYES_00,GTUBE, J_CHICKENPOX_45 autolearn=no version=2.63
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="----------=_4035D3BF.502C4C66"
Status:




Bryan Britt
Beltane Web Services


--
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ICQ: 53037451
Bryan L. Britt 501-327-8558
Beltane Web Services, Conway, AR http://www.beltane.com
~~~~~~~~~~Support Private Communications on the Internet~~~~~~~~~~



----------------------- Original Message -----------------------
On Fri, 20 Feb 2004 10:18:57 -0500, Matt Kettler <mkettler@evi-inc.com> wrote:

> At 10:00 AM 2/20/2004, Alexander Galitski wrote:
>
> > sorry for my stupid fault ... very unclever ((
> >
> > isn't list protected from such user faults??
>
> IMO it's not a fault to post a GTUBE string to the list.. So there's no
> protection needed.
>
> I got the message just fine... ok, it did have a high-score, and it did get
> subject-tagged, but it got here none the less and was placed in my
> spamassassin folder by my mail client.
>
> Quite frankly, it's a fault to not expect a message posted to the list
> containing GTUBE...

Well, I only just remembered yesterday to change my whitelist entry for
sa-users following the move to apache.org!

But still that message found it's way to the trash:

20/02/2004 09:36:35 adrinux DELETED *995.10* spamc not seeing
razor/pyzor/dcc while spamassassin does Alexander Galitski
<triton-sec@gidro-service.ru>

So why does SA tag this as spam even though the list is whitelisted?

I had been using:

whitelist_from *@incubator.apache.org

Would adding:

whitelist_to *@incubator.apache.org

help? Or does SA ignore the whitelist if the score is too high?


Having looked at some list mail headers it seems the server listed for
list-id is different, so maybe I need this:

whitelist_from @spamassassin.apache.org

Right?

Adrian

I did the same thing. This message list should be whitelist_to The
From: header is set to the original sender not the list. But by default
the White/black lists scores are only 100. With GTUBEs score of 1000
it's still spam. which is one of the reasons GTUBE is set so high. to
make sure it overshadows all other rules.

Bryan Britt
Beltane Web Services


--
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ICQ: 53037451
Bryan L. Britt 501-327-8558
Beltane Web Services, Conway, AR http://www.beltane.com
~~~~~~~~~~Support Private Communications on the Internet~~~~~~~~~~



----------------------- Original Message -----------------------
On Fri, 20 Feb 2004 18:06:07 +0000, Adrian Simmons <adrinux@ntlworld.com> wrote:

>
> Well, I only just remembered yesterday to change my whitelist entry for
> sa-users following the move to apache.org!
>
> But still that message found it's way to the trash:
>
> 20/02/2004 09:36:35 adrinux DELETED *995.10* spamc not seeing
> razor/pyzor/dcc while spamassassin does Alexander Galitski
> <triton-sec@gidro-service.ru>
>
> So why does SA tag this as spam even though the list is whitelisted?
>
> I had been using:
>
> whitelist_from *@incubator.apache.org
>
> Would adding:
>
> whitelist_to *@incubator.apache.org
>
> help? Or does SA ignore the whitelist if the score is too high?
>
>
> Having looked at some list mail headers it seems the server listed for
> list-id is different, so maybe I need this:
>
> whitelist_from @spamassassin.apache.org
>
> Right?
>
> Adrian

On Fri, 20 Feb 2004 16:06:57 +0100, tBB wrote:

>Btw. This time the AWL kicked in due to the high score you got before :)

Mine too, which harks back to the question I asked a couple of days ago
about removing an address from the AWL database. In his response, Matt
stated that AWL is calculated pre-GTUBE to avoid this happening, but it
appears that this is not the case.

I've removed Alexander from my AWL (spamassassin
--remove-addr-from-whitelist triton-sec@gidro-service.ru) to get him
back onto my radar, but this is likely to recur if anyone else quotes
GTUBE.

On Fri, 20 Feb 2004 10:18:57 -0500, Matt Kettler wrote:

>I got the message just fine... ok, it did have a high-score, and it did get
>subject-tagged, but it got here none the less and was placed in my
>spamassassin folder by my mail client.
>
>Quite frankly, it's a fault to not expect a message posted to the list
>containing GTUBE...

Good point - I've now moved all my SA-related filters above my spam
filter. Thanks for the tip.

At 02:16 PM 2/20/2004, Jon Etkins wrote:
>Mine too, which harks back to the question I asked a couple of days ago
>about removing an address from the AWL database. In his response, Matt
>stated that AWL is calculated pre-GTUBE to avoid this happening, but it
>appears that this is not the case.

Damn, your right, bug verified against 2.61 and 2.63. (not that I use the
AWL in the first place).

At 02:16 PM 2/20/2004, Jon Etkins wrote:
>Mine too, which harks back to the question I asked a couple of days ago
>about removing an address from the AWL database. In his response, Matt
>stated that AWL is calculated pre-GTUBE to avoid this happening, but it
>appears that this is not the case.

Just checked bugzilla.. apparently this has been fixed (AGAIN) on 2/07/2004...

It's slated for the 2.70 release

http://bugzilla.spamassassin.org/show_bug.cgi?id=2898


Of course, this was supposed to have been fixed in 2.60, a long time ago,
which is why I assumed the bug was dead.. it apparently crept back again
however...

http://bugzilla.spamassassin.org/show_bug.cgi?id=2364