Mailing List Archive

1 2 3  View All
Re: sa-update [ In reply to ]
On Mon, 7 Apr 2014, Dave Warren wrote:

> On 2014-04-06 17:21, John Hardin wrote:
>> On Sun, 6 Apr 2014, Dave Warren wrote:
>>
>> > Is older ham useful? It specifically mentions that older spam isn't
>> > useful, and why, but I'm thinking older ham is probably useful since old
>> > mail clients and legitimately sent mail never dies. But I could filter
>> > based on date.
>>
>> There's some debate about that. :)
>>
>> I personally agree with you. Others disagree.
>
> I've been giving it some thought and I think that perhaps limiting it to the
> last few months will make it easier to get a sane set of TRUSTED_NETWORKS and
> INTERNAL_NETWORKS; I've got mail going back to
> ~ 2002 but no real recollection of how things were set up or named prior
> to 2007 or so.
>
> Initially I'll limit it to mail within the last couple of months, but perhaps
> expand that up to 24-36 months for non-spam and 6 months for spam, is that
> sane/reasonable?

Sure.

>> Yes, ham-only masscheck submissions would be very welcome.
>
> Perfect, glad to hear it. At this point I've built a dedicated box to run the
> masscheck scripts, so now it's just a matter of putting together a corpus and
> doing some sanity checking and testing.
>
> My current thought is to take user-fed spam and non-spam folders and place
> copies of messages into a staging path which will then be reviewed before
> being added to the corpus for learning. Hopefully I'll be ready to go live
> within a day or two.

Thanks for your participation!

--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
...every time I sit down in front of a Windows machine I feel as
if the computer is just a place for the manufacturers to put their
advertising. -- fwadling on Y! SCOX
-----------------------------------------------------------------------
6 days until Thomas Jefferson's 271st Birthday
Re: sa-update [ In reply to ]
On 2014-04-06 20:25, jdebert wrote:
> On Sat, 5 Apr 2014 09:14:56 -0700 (PDT)
> John Hardin <jhardin@impsec.org> wrote:
>
>> On Sat, 5 Apr 2014, Amir Reza Rahbaran wrote:
>>
>>> I want to know how long it takes custom signatures updated by
>>> sa-update.
>> Daily, if the corpora are sufficient for masscheck scoring to run.
>>
>> At the moment the masscheck corpus is ham-starved. There's not quite
>> enough ham available for reliable scores to be generated and
>> published.
> This explains why SA is not catching any spam here? After updating
> to updates 1584283 and then 1585021, all spam is being passed. Nothing
> else was done. No other changes made.

No -- This issue just means that rule updates may not get created, but
the last valid set of rules will still available to sa-update.

--
Dave Warren
http://www.hireahit.com/
http://ca.linkedin.com/in/davejwarren
Re: sa-update [ In reply to ]
On Sun, 6 Apr 2014, jdebert wrote:

> On Sat, 5 Apr 2014 09:14:56 -0700 (PDT)
> John Hardin <jhardin@impsec.org> wrote:
>
>> On Sat, 5 Apr 2014, Amir Reza Rahbaran wrote:
>>
>>> I want to know how long it takes custom signatures updated by
>>> sa-update.
>>
>> Daily, if the corpora are sufficient for masscheck scoring to run.
>>
>> At the moment the masscheck corpus is ham-starved. There's not quite
>> enough ham available for reliable scores to be generated and
>> published.
>
> This explains why SA is not catching any spam here? After updating
> to updates 1584283 and then 1585021, all spam is being passed. Nothing
> else was done. No other changes made.

I was mistaken, the ham corpus has actually been over the threshold for
several days now. Apologies.

If your install is not catching *any* spam then there's something else
going on. Are there any headers in FNs indicating that SA is scanning the
message at all? Are there any error messages in the logs indicating
problems attempting to run SA? Is the spamd daemon running?

--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
But if there is no such inalienable right [to self defense], the
entire nature of the social contract is changed. Each man’s worth
is measured solely by his utility to the state, and as such the
value of his life rides a roller coaster not unlike the stock
market: dependent not only upon the preferences of the party in
power but upon the whims of its political leaders and the
permanent bureaucratic class. -- Mike McDaniel
-----------------------------------------------------------------------
6 days until Thomas Jefferson's 271st Birthday
Re: sa-update [ In reply to ]
On 4/6/2014 11:25 PM, jdebert wrote:
>
> This explains why SA is not catching any spam here? After updating
> to updates 1584283 and then 1585021, all spam is being passed. Nothing
> else was done. No other changes made.
>

Our setup is still catching spam, but the performance has definitely
trended downward in the last week or two. A lot more stuff is getting
through to the inbox then before.

My guess is that the spammers have changed their tactics, again, and are
now ahead of the various block lists.
Re: sa-update [ In reply to ]
On Mon, 07 Apr 2014 17:22:37 -0400
Thomas Harold <thomas-lists@nybeta.com> wrote:

> On 4/6/2014 11:25 PM, jdebert wrote:
> >
> > This explains why SA is not catching any spam here? After updating
> > to updates 1584283 and then 1585021, all spam is being passed.
> > Nothing else was done. No other changes made.
> >
>
> Our setup is still catching spam, but the performance has definitely
> trended downward in the last week or two. A lot more stuff is getting
> through to the inbox then before.
>
> My guess is that the spammers have changed their tactics, again, and
> are now ahead of the various block lists.
>

After another update, it started catching spam but most was still
getting past. After a second update, it has been catching most spam.

jd
Re: sa-update [ In reply to ]
On Tue, 19 Aug 2014, Scott Lewis wrote:

> Our sa-update's have not found fresh updates for a couple of weeks now.
> Does anyone know anything about this or are experiencing the same thing?
> It does not look like they are erring out.

Masscheck corpus starvation, possibly due to timing issues. We're *almost*
up to the lower limits needed to publish a rules update.

--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
You know things are bad when Pravda says we [the USA] have gone
too far to the left. -- Joe Huffman
-----------------------------------------------------------------------
5 days until the 1935th anniversary of the destruction of Pompeii
RE: sa-update [ In reply to ]
How's this coming? I'm still showing July 28 as the last update. (Not complaining - I appreciate all you guys do!)

...Kevin
--
Kevin Miller
Network/email Administrator, CBJ MIS Dept.
155 South Seward Street
Juneau, Alaska 99801
Phone: (907) 586-0242, Fax: (907) 586-4500
Registered Linux User No: 307357


-----Original Message-----
From: John Hardin [mailto:jhardin@impsec.org]
Sent: Tuesday, August 19, 2014 12:06 PM
To: users@spamassassin.apache.org
Subject: Re: sa-update

On Tue, 19 Aug 2014, Scott Lewis wrote:

> Our sa-update's have not found fresh updates for a couple of weeks now.
> Does anyone know anything about this or are experiencing the same thing?
> It does not look like they are erring out.

Masscheck corpus starvation, possibly due to timing issues. We're *almost* up to the lower limits needed to publish a rules update.

--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
You know things are bad when Pravda says we [the USA] have gone
too far to the left. -- Joe Huffman
-----------------------------------------------------------------------
5 days until the 1935th anniversary of the destruction of Pompeii
Re: sa-update [ In reply to ]
On 08/21/2014 09:25 PM, Kevin Miller wrote:
> How's this coming? I'm still showing July 28 as the last update.
> (Not complaining - I appreciate all you guys do!)

unless there's a new wave of starved masscheckers update should be
published this weekend.
Of couse, the project could always use more masscheck contributers

Details about masschecks are in the SA Wiki
RE: sa-update [ In reply to ]
On Thu, 21 Aug 2014, Kevin Miller wrote:

> How's this coming? I'm still showing July 28 as the last update. (Not
> complaining - I appreciate all you guys do!)

From the latest run:

On 8/20/2014 10:25 PM, UpdatesD Cron wrote:
> Exit Status 9 is not zero for do-nightly-rescore-example.

HAM: 208428 (150000 required)
SPAM: 127817 (150000 required)

Soooo close!


> From: John Hardin [mailto:jhardin@impsec.org]
>
> On Tue, 19 Aug 2014, Scott Lewis wrote:
>
>> Our sa-update's have not found fresh updates for a couple of weeks now.
>
> Masscheck corpus starvation, possibly due to timing issues. We're
> *almost* up to the lower limits needed to publish a rules update.

--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
Judicial Activism (n): interpreting the Constitution to grant the
government powers that are popularly felt to be "needed" but that
are not explicitly provided for therein (common definition);
interpreting the Constitution as it is written (Brady definition)
-----------------------------------------------------------------------
3 days until the 1935th anniversary of the destruction of Pompeii
Re: sa-update [ In reply to ]
On 2023-03-17 at 05:11:30 UTC-0400 (Fri, 17 Mar 2023 10:11:30 +0100)
SA list <lists+spamassassin-users@nospam.webmeneer.net>
is rumored to have said:

> Hello,
>
> I didn't get an update since 5 March (1908044).

Correct. We've had a problem with RuleQA, in that we have not had enough
spam in the masscheck submissions to run the rescoring properly. I'm not
sure whose submissions have dried up...

The existing list of active rules and their scores is fine for now and
won't likely be problematic in the near to mid term. Obviously we hope
to resolve the underlying lack of data and to resume proper QA ASAP.


--
Bill Cole
bill@scconsult.com or billcole@apache.org
(AKA @grumpybozo and many *@billmail.scconsult.com addresses)
Not Currently Available For Hire
Re: sa-update [ In reply to ]
On 17 Mar 2023, at 16:03, Bill Cole wrote:

> Correct. We've had a problem with RuleQA, in that we have not had
> enough spam in the masscheck submissions to run the rescoring
> properly. I'm not sure whose submissions have dried up...
>
> The existing list of active rules and their scores is fine for now and
> won't likely be problematic in the near to mid term. Obviously we hope
> to resolve the underlying lack of data and to resume proper QA ASAP.

Thanks Bill for letting us know what’s going on!

cheers,

--
matt [at] lv223.org
GPG key ID: 7D91A8CA

1 2 3  View All