Mailing List Archive

mmm!
| 2004-02-05 | 10:07:18 |
<spamassassin-users-return-332-camis=mweb.co.za@incubator.apache.org> |
<camis@mweb.co.za> | Blocked | 9 |

Hi All..

The log above shows that at least one message (that i've checked)
is getting caught by SA.. Can the next version of SA have
incubator.apache.org whitelisted? (you can imagine how many mails
from the new mailing lists are gonna get caught by SA itself)

Regards,
Cami
Re: mmm! [ In reply to ]
cami wrote:

> | 2004-02-05 | 10:07:18 |
> <spamassassin-users-return-332-camis=mweb.co.za@incubator.apache.org> |
> <camis@mweb.co.za> | Blocked | 9 |
>
> Hi All..
>
> The log above shows that at least one message (that i've checked)
> is getting caught by SA.. Can the next version of SA have
> incubator.apache.org whitelisted? (you can imagine how many mails
> from the new mailing lists are gonna get caught by SA itself)
>
> Regards,
> Cami

Umm, you don't want to pump the mailing list through SA if you can help
it. Screws up bayes auto-learning, as mentioned, messages will have lots
of FPs (due to discussion of spam, sample spam, presence of rulesets, etc.).

--Rich
Re: mmm! [ In reply to ]
Add to /etc/mail/spamassassin/local.cf
def_whitelist_from_rcvd *@incubator.apache.org apache.org

On Friday 06 February 2004 11:58 am, cami wrote:
> | 2004-02-05 | 10:07:18 |
>
> <spamassassin-users-return-332-camis=mweb.co.za@incubator.apache.org> |
> <camis@mweb.co.za> | Blocked | 9 |
>
> Hi All..
>
> The log above shows that at least one message (that i've checked)
> is getting caught by SA.. Can the next version of SA have
> incubator.apache.org whitelisted? (you can imagine how many mails
> from the new mailing lists are gonna get caught by SA itself)
>
> Regards,
> Cami
Re: mmm! [ In reply to ]
At 04:47 PM 2/6/2004, Brian Godette wrote:
>Add to /etc/mail/spamassassin/local.cf
>def_whitelist_from_rcvd *@incubator.apache.org apache.org

That's mostly right... Just drop the "def_" part...

def_ is intended to be only be used on the whitelists that are in the
standard ruleset, as distributed by SA.

User defined whitelists should use whitelist_from_rcvd.

This way you can tell if it's one of SA's default whitelists, or one of
your whitelists that hits, because the rule name will be different..

whitelist_from_rcvd will cause USER_IN_WHITELIST to hit

def_whitelist_from_rcvd will cause USER_IN_DEF_WHITELIST to hit.

If USER_IN_DEF_WHITELIST hits spam, it's a SA bug. if USER_IN_WHITELIST
hits spam, it's your config that's the problem.

DEF_WHITELIST also only knocks 15 points off, normal is 100... and 100 is
probably better for sa discussion lists :)
Re: mmm! [ In reply to ]
On Friday 06 February 2004 03:32 pm, Matt Kettler wrote:
> At 04:47 PM 2/6/2004, Brian Godette wrote:
> >Add to /etc/mail/spamassassin/local.cf
> >def_whitelist_from_rcvd *@incubator.apache.org apache.org
>
> That's mostly right... Just drop the "def_" part...
>
> def_ is intended to be only be used on the whitelists that are in the
> standard ruleset, as distributed by SA.
>
> User defined whitelists should use whitelist_from_rcvd.
>
> This way you can tell if it's one of SA's default whitelists, or one of
> your whitelists that hits, because the rule name will be different..
>
> whitelist_from_rcvd will cause USER_IN_WHITELIST to hit
>
> def_whitelist_from_rcvd will cause USER_IN_DEF_WHITELIST to hit.
>
> If USER_IN_DEF_WHITELIST hits spam, it's a SA bug. if USER_IN_WHITELIST
> hits spam, it's your config that's the problem.
>
> DEF_WHITELIST also only knocks 15 points off, normal is 100... and 100 is
> probably better for sa discussion lists :)

True, however I've not had a message here push it over +5 yet. I'd rather keep
it as a low negative on the off chance that somehow one is spoofed, and
really one would think SA's own mailing list would be in SA's default
whitelist <g>.

If a legitemate message does go over +5 I'll move it off def_ at that point. I
don't have the option of simply not scanning sa-users due to a site wide
install and others besides myself receive this list.

While on the topic of def_whitelist in the standard distribution, *@ebay.com
ebay.com and *@freshmeat.net freshmeat.net should probably be added.
Freshmeat really needs it as the daily newsletter tends to hit a number of
standard rules, and a large amount of the custom rules out there, especially
tripwire and chickenpox due to version numbers and program naming.