Mailing List Archive

My random_word_10 and random_word_15 give relatively huge scores, 1.6 and 3.8
respectively. That would have cought it for you.

-Scott

Mark A. DeMichele wrote:

> I have all the extra rule files from the Rule Emporium, but this one
> squeaked by. It has lots of garbage html tags. It only got a score of 2.2
>
> Thanks,
>
> Mark DeMichele
>
> <<Get your home financing while the rates are low! -asset>>
>
>
> ------------------------------------------------------------------------
>
> Subject:
> Get your home financing while the rates are low! -asset
> From:
> "Naomi Tracy" <IZHEQALGO@geocities.co.jp>
> Date:
> Mon, 9 Feb 2004 13:49:17 -0500
> To:
> "Mark A. DeMichele" <demi@intellipro.com>
>
>
>
> We c <http://www.christoffel.info>an g <http://www.dispel.com/tg.html>et
> yo <http://www.claim.net>u mo <http://www.ridge.net/index.html>rt
> <http://www.scripps.us/index.htm>ga <http://www.doesn't.org/greg.php>ge
> ra <http://www.vacationland.info>te <http://www.injunction.tv/loll.php>s
> as l <http://www.sturbridge.info>ow as 5. <http://www.horace.ws>79%!
>
> The ra <http://www.e.net>tes are as lo <http://www.mukden.com/Ge.html>w
> as th <http://www.lahore.info>ey ha <http://www.recriminatory.info>ve b
> <http://wwwchlorine.ca>een in 4
> <http://www.bassett.org/nevertheless.php>0 ye <http://www.velvety.org>ar
> <http://wwwdextrous.org>s! Do <http://www.ampere.kg>n't wa
> <http://www.neuromuscular.info>it fo
> <http://www.asia.ca/counterfeit/patriot/main.asp>r th
> <http://www.cerberus.info>e ra <http://www.afoul.tv>tes to i
> <http://www.abbott.com>ncre <http://www.paradigm.co.uk>ase.Yo
> <http://www.movie.co.uk>u can sa <http://www.catkin.ca>ve th
> <http://www.timon.tv>ou <http://www.caesar.tv/chivalry.php>sa
> <http://www.knee.kg/ZY.html>nds by re
> <http://www.terrific.tv/plagiarism.php>fin <http://www.send.org>anc
> <http://www.acclaim.net/index.html>ing or ge <http://www.cubic.org>tti
> <http://www.hooligan.com>ng a mor <http://www.royce.kg>tg
> <http://www.babel.com>age NOW.
>
> Ab <http://www.bernini.kg>sol
> <http://www.craftsmen.ws/docs/courteous.html>ute
> <http://www.az.org/connector.php>ly No Ob
> <http://www.conservatism.ws/docs/screech.html>li
> <http://www.stick.com/YY.html>gat <http://www.core.com/ty.html>ion
>
> Si <http://www.martensite.co.uk>mp <http://www.t's.info>le ov
> <http://www.semester.ws>er th <http://www.tycoon.ws>e p
> <http://www.archdiocese.ca/excretory/paraboloid/main.asp>ho
> <http://www.longish.tv/duopolist.php>ne con
> <http://www.incredulous.ca>su <http://www.jubilant.org/amputate.php>ltat
> <http://www.caddy.net>io <http://www.brochure.kg>n
>
> Ap <http://www.timepiece.co.uk/nAHq.html>pro
> <http://www.divine.kg/GA.html>val i <http://www.archaism.org>n a
> <http://www.dapple.info>s li
> <http://www.cottony.ca/impart/cerebellum/main.asp>t
> <http://www.derogatory.info/G/diamagnetic.htm>tle as 2
> <http://www.cypriot.tv/fisticuff.php>4 ho
> <http://www.bidirectional.info/a/choirmaster.htm>urs
>
> No co <http://www.equatorial.com/Zi.html>st to yo
> <http://www.invaluable.tv/duchess.php>u wha
> <http://www.huxtable.co.uk/rQhb.html>tsoe <http://www.purposeful.kg>ver
>
> You wi <http://www.recital.info/l/capita.htm>ll be A
> <http://www.via.kg>MA <http://www.demoniac.ca>ZE
> <http://www.discriminate.kg/xv.html>D at our rat
> <http://www.compendia.co.uk>es
>
>
> For more information, click here. <http://saving-first.com/?partid=brl>
>
>
> Note: We cur <http://www.refer.tv>r <http://www.backdrop.com/JM.html>ent
> <http://www.mccullough.co.uk>ly o <http://www.counterintuitive.org>nly
> of <http://www.chambers.org>fer ho <http://www.austria.co.uk>me fi
> <http://www.annum.ca/bangle/cosmic/main.asp>nan
> <http://www.empathy.ca>cing to the Un <http://www.absinthe.net>ited Stat
> <http://www.cornelius.kg>es
>
>
>
>
>
>
> <http://www.donate.co.uk/RNGK.html> <http://saving-first.com/st.html>
> <http://www.convalesce.info>
>
> <http://www.wesleyan.tv/amongst.php>
>
> <http://www.inclination.org/squelch.php>
>
> <http://www.collimate.org/bertram.php>
> <http://www.receive.info/I/kirkland.htm>
>
> <http://www.goodman.net/index.html> <http://www.scab.org>
>
>
>
> resentful exhibitor weller muriel boundary slake bivouac hasten lupine
> bog supposable buttonhole monica nair antoinette orchid pane edmund
> affluence counterattack silicic unanimous gamesman pile brief The
> multiply and ontario astound tier calvert brad refuge partial prosper
> partner ouzel arlington bennett carson tedious anthony contrition ewing
> coo america piezoelectric acquit brown gout iv food trailhead donner for
> dietary oct with cumulate showboat a howell the hinge difluoride
> taxonomy antigone trance affix enunciable insomniac weinberg adsorptive
> bartok niche thrown brookhaven proven everett brainy alike roughshod
> wicket doesn't colonial chalkline glutinous klaus decker aileen
> tarantula eft from abrasive crestfallen in veal bengal pliancy
> contraband modesty biometrika eelgrass decor conceit halma semester .
> The demurrer and deprecatory annotate bates aerobacter perilla amort
> astringent thyrotoxic avionic firecracker weaken cheerleader comet
> bauble barrel circumference brickbat aminobenzoic beaux cryptic gossamer
> articulatory viola deadline reversible desist hines republican earphone
> alliance celesta wale angelina usurp bromine for congressman degas with
> divulge aura a jocular.

Where to I get your rules from? Sorry, I'm new.

-----Original Message-----
From: Scott [mailto:spamassassin@troutpocket.org]
Sent: Monday, February 09, 2004 2:21 PM
Cc: spamassassin-users@incubator.apache.org
Subject: Re: How did this spam get by

My random_word_10 and random_word_15 give relatively huge scores, 1.6
and 3.8
respectively. That would have cought it for you.

-Scott

Mark A. DeMichele wrote:

> I have all the extra rule files from the Rule Emporium, but this one
> squeaked by. It has lots of garbage html tags. It only got a score of
2.2
>
> Thanks,
>
> Mark DeMichele
>
> <<Get your home financing while the rates are low! -asset>>
>
>
>
------------------------------------------------------------------------
>
> Subject:
> Get your home financing while the rates are low! -asset
> From:
> "Naomi Tracy" <IZHEQALGO@geocities.co.jp>
> Date:
> Mon, 9 Feb 2004 13:49:17 -0500
> To:
> "Mark A. DeMichele" <demi@intellipro.com>
>
>
>
> We c <http://www.christoffel.info>an g
<http://www.dispel.com/tg.html>et
> yo <http://www.claim.net>u mo <http://www.ridge.net/index.html>rt
> <http://www.scripps.us/index.htm>ga
<http://www.doesn't.org/greg.php>ge
> ra <http://www.vacationland.info>te
<http://www.injunction.tv/loll.php>s
> as l <http://www.sturbridge.info>ow as 5. <http://www.horace.ws>79%!
>
> The ra <http://www.e.net>tes are as lo
<http://www.mukden.com/Ge.html>w
> as th <http://www.lahore.info>ey ha <http://www.recriminatory.info>ve
b
> <http://wwwchlorine.ca>een in 4
> <http://www.bassett.org/nevertheless.php>0 ye
<http://www.velvety.org>ar
> <http://wwwdextrous.org>s! Do <http://www.ampere.kg>n't wa
> <http://www.neuromuscular.info>it fo
> <http://www.asia.ca/counterfeit/patriot/main.asp>r th
> <http://www.cerberus.info>e ra <http://www.afoul.tv>tes to i
> <http://www.abbott.com>ncre <http://www.paradigm.co.uk>ase.Yo
> <http://www.movie.co.uk>u can sa <http://www.catkin.ca>ve th
> <http://www.timon.tv>ou <http://www.caesar.tv/chivalry.php>sa
> <http://www.knee.kg/ZY.html>nds by re
> <http://www.terrific.tv/plagiarism.php>fin <http://www.send.org>anc
> <http://www.acclaim.net/index.html>ing or ge <http://www.cubic.org>tti

> <http://www.hooligan.com>ng a mor <http://www.royce.kg>tg
> <http://www.babel.com>age NOW.
>
> Ab <http://www.bernini.kg>sol
> <http://www.craftsmen.ws/docs/courteous.html>ute
> <http://www.az.org/connector.php>ly No Ob
> <http://www.conservatism.ws/docs/screech.html>li
> <http://www.stick.com/YY.html>gat <http://www.core.com/ty.html>ion
>
> Si <http://www.martensite.co.uk>mp <http://www.t's.info>le ov
> <http://www.semester.ws>er th <http://www.tycoon.ws>e p
> <http://www.archdiocese.ca/excretory/paraboloid/main.asp>ho
> <http://www.longish.tv/duopolist.php>ne con
> <http://www.incredulous.ca>su
<http://www.jubilant.org/amputate.php>ltat
> <http://www.caddy.net>io <http://www.brochure.kg>n
>
> Ap <http://www.timepiece.co.uk/nAHq.html>pro
> <http://www.divine.kg/GA.html>val i <http://www.archaism.org>n a
> <http://www.dapple.info>s li
> <http://www.cottony.ca/impart/cerebellum/main.asp>t
> <http://www.derogatory.info/G/diamagnetic.htm>tle as 2
> <http://www.cypriot.tv/fisticuff.php>4 ho
> <http://www.bidirectional.info/a/choirmaster.htm>urs
>
> No co <http://www.equatorial.com/Zi.html>st to yo
> <http://www.invaluable.tv/duchess.php>u wha
> <http://www.huxtable.co.uk/rQhb.html>tsoe
<http://www.purposeful.kg>ver
>
> You wi <http://www.recital.info/l/capita.htm>ll be A
> <http://www.via.kg>MA <http://www.demoniac.ca>ZE
> <http://www.discriminate.kg/xv.html>D at our rat
> <http://www.compendia.co.uk>es
>
>
> For more information, click here.
<http://saving-first.com/?partid=brl>
>
>
> Note: We cur <http://www.refer.tv>r
<http://www.backdrop.com/JM.html>ent
> <http://www.mccullough.co.uk>ly o <http://www.counterintuitive.org>nly

> of <http://www.chambers.org>fer ho <http://www.austria.co.uk>me fi
> <http://www.annum.ca/bangle/cosmic/main.asp>nan
> <http://www.empathy.ca>cing to the Un <http://www.absinthe.net>ited
Stat
> <http://www.cornelius.kg>es
>
>
>
>
>
>
> <http://www.donate.co.uk/RNGK.html> <http://saving-first.com/st.html>
> <http://www.convalesce.info>
>
> <http://www.wesleyan.tv/amongst.php>
>
> <http://www.inclination.org/squelch.php>
>
> <http://www.collimate.org/bertram.php>
> <http://www.receive.info/I/kirkland.htm>
>
> <http://www.goodman.net/index.html> <http://www.scab.org>
>
>
>
> resentful exhibitor weller muriel boundary slake bivouac hasten lupine

> bog supposable buttonhole monica nair antoinette orchid pane edmund
> affluence counterattack silicic unanimous gamesman pile brief The
> multiply and ontario astound tier calvert brad refuge partial prosper
> partner ouzel arlington bennett carson tedious anthony contrition
ewing
> coo america piezoelectric acquit brown gout iv food trailhead donner
for
> dietary oct with cumulate showboat a howell the hinge difluoride
> taxonomy antigone trance affix enunciable insomniac weinberg
adsorptive
> bartok niche thrown brookhaven proven everett brainy alike roughshod
> wicket doesn't colonial chalkline glutinous klaus decker aileen
> tarantula eft from abrasive crestfallen in veal bengal pliancy
> contraband modesty biometrika eelgrass decor conceit halma semester .
> The demurrer and deprecatory annotate bates aerobacter perilla amort
> astringent thyrotoxic avionic firecracker weaken cheerleader comet
> bauble barrel circumference brickbat aminobenzoic beaux cryptic
gossamer
> articulatory viola deadline reversible desist hines republican
earphone
> alliance celesta wale angelina usurp bromine for congressman degas
with
> divulge aura a jocular.

> I have all the extra rule files from the Rule Emporium,
> but this one squeaked by. It has lots of garbage html tags.
> It only got a score of 2.2

Actually, that one doesn't have a log of garbage html tags. What is has
is a lot of <a href> tags that link nothing... i.e., there's no space or
characters between the <a> and </a> tags. Wonder if it's time for a
"link somewhere from nothing" rule...

Bret

troutpocket.org:root# cat /etc/mail/spamassassin/local.cf
# This is the right place to customize your installation of SpamAssassin.
#
# See 'perldoc Mail::SpamAssassin::Conf' for details of what can be
# tweaked.
#
###########################################################################
#
# rewrite_subject 0
# report_safe 1
# trusted_networks 212.17.35.
body RANDOM_WORD_10
/(?:\b(?!(?:from|even|more|that|this|were|with)\b)[a-z]{4,12}\s+){10}/
describe RANDOM_WORD_10 string of 10+ random words
score RANDOM_WORD_10 1.6

body RANDOM_WORD_15
/(?:\b(?!(?:from|even|more|that|this|were|with)\b)[a-z]{4,12}\s+){15}/
describe RANDOM_WORD_15 string of 15+ random words
score RANDOM_WORD_15 3.8

There's an unintentional line-break there. body, describe, and score are the
only three lines per rule.

-Scott

p.s. now I can see why the debate about this list was so heated. Someone has
got to turn off the "include sender" option or add a subject header. It's
annoying when replies go into two folders if the sender hits "reply-all"

Mark A. DeMichele wrote:

> Where to I get your rules from? Sorry, I'm new.
>
> -----Original Message-----
> From: Scott [mailto:spamassassin@troutpocket.org]
> Sent: Monday, February 09, 2004 2:21 PM
> Cc: spamassassin-users@incubator.apache.org
> Subject: Re: How did this spam get by
>
> My random_word_10 and random_word_15 give relatively huge scores, 1.6
> and 3.8
> respectively. That would have cought it for you.
>
> -Scott
>
> Mark A. DeMichele wrote:
>
>
>>I have all the extra rule files from the Rule Emporium, but this one
>>squeaked by. It has lots of garbage html tags. It only got a score of
>
> 2.2
>
>>Thanks,
>>
>>Mark DeMichele
>>
>><<Get your home financing while the rates are low! -asset>>
>>
>>
>>
> ------------------------------------------------------------------------
>
>>Subject:
>>Get your home financing while the rates are low! -asset
>>From:
>>"Naomi Tracy" <IZHEQALGO@geocities.co.jp>
>>Date:
>>Mon, 9 Feb 2004 13:49:17 -0500
>>To:
>>"Mark A. DeMichele" <demi@intellipro.com>
>>
>>
>>
>>We c <http://www.christoffel.info>an g
>
> <http://www.dispel.com/tg.html>et
>
>>yo <http://www.claim.net>u mo <http://www.ridge.net/index.html>rt
>><http://www.scripps.us/index.htm>ga
>
> <http://www.doesn't.org/greg.php>ge
>
>>ra <http://www.vacationland.info>te
>
> <http://www.injunction.tv/loll.php>s
>
>>as l <http://www.sturbridge.info>ow as 5. <http://www.horace.ws>79%!
>>
>>The ra <http://www.e.net>tes are as lo
>
> <http://www.mukden.com/Ge.html>w
>
>>as th <http://www.lahore.info>ey ha <http://www.recriminatory.info>ve
>
> b
>
>><http://wwwchlorine.ca>een in 4
>><http://www.bassett.org/nevertheless.php>0 ye
>
> <http://www.velvety.org>ar
>
>><http://wwwdextrous.org>s! Do <http://www.ampere.kg>n't wa
>><http://www.neuromuscular.info>it fo
>><http://www.asia.ca/counterfeit/patriot/main.asp>r th
>><http://www.cerberus.info>e ra <http://www.afoul.tv>tes to i
>><http://www.abbott.com>ncre <http://www.paradigm.co.uk>ase.Yo
>><http://www.movie.co.uk>u can sa <http://www.catkin.ca>ve th
>><http://www.timon.tv>ou <http://www.caesar.tv/chivalry.php>sa
>><http://www.knee.kg/ZY.html>nds by re
>><http://www.terrific.tv/plagiarism.php>fin <http://www.send.org>anc
>><http://www.acclaim.net/index.html>ing or ge <http://www.cubic.org>tti
>
>
>><http://www.hooligan.com>ng a mor <http://www.royce.kg>tg
>><http://www.babel.com>age NOW.
>>
>>Ab <http://www.bernini.kg>sol
>><http://www.craftsmen.ws/docs/courteous.html>ute
>><http://www.az.org/connector.php>ly No Ob
>><http://www.conservatism.ws/docs/screech.html>li
>><http://www.stick.com/YY.html>gat <http://www.core.com/ty.html>ion
>>
>>Si <http://www.martensite.co.uk>mp <http://www.t's.info>le ov
>><http://www.semester.ws>er th <http://www.tycoon.ws>e p
>><http://www.archdiocese.ca/excretory/paraboloid/main.asp>ho
>><http://www.longish.tv/duopolist.php>ne con
>><http://www.incredulous.ca>su
>
> <http://www.jubilant.org/amputate.php>ltat
>
>><http://www.caddy.net>io <http://www.brochure.kg>n
>>
>>Ap <http://www.timepiece.co.uk/nAHq.html>pro
>><http://www.divine.kg/GA.html>val i <http://www.archaism.org>n a
>><http://www.dapple.info>s li
>><http://www.cottony.ca/impart/cerebellum/main.asp>t
>><http://www.derogatory.info/G/diamagnetic.htm>tle as 2
>><http://www.cypriot.tv/fisticuff.php>4 ho
>><http://www.bidirectional.info/a/choirmaster.htm>urs
>>
>>No co <http://www.equatorial.com/Zi.html>st to yo
>><http://www.invaluable.tv/duchess.php>u wha
>><http://www.huxtable.co.uk/rQhb.html>tsoe
>
> <http://www.purposeful.kg>ver
>
>>
>>You wi <http://www.recital.info/l/capita.htm>ll be A
>><http://www.via.kg>MA <http://www.demoniac.ca>ZE
>><http://www.discriminate.kg/xv.html>D at our rat
>><http://www.compendia.co.uk>es
>>
>>
>>For more information, click here.
>
> <http://saving-first.com/?partid=brl>
>
>>
>>
>>Note: We cur <http://www.refer.tv>r
>
> <http://www.backdrop.com/JM.html>ent
>
>><http://www.mccullough.co.uk>ly o <http://www.counterintuitive.org>nly
>
>
>>of <http://www.chambers.org>fer ho <http://www.austria.co.uk>me fi
>><http://www.annum.ca/bangle/cosmic/main.asp>nan
>><http://www.empathy.ca>cing to the Un <http://www.absinthe.net>ited
>
> Stat
>
>><http://www.cornelius.kg>es
>>
>>
>>
>>
>>
>>
>><http://www.donate.co.uk/RNGK.html> <http://saving-first.com/st.html>
>><http://www.convalesce.info>
>>
>><http://www.wesleyan.tv/amongst.php>
>>
>> <http://www.inclination.org/squelch.php>
>>
>><http://www.collimate.org/bertram.php>
>><http://www.receive.info/I/kirkland.htm>
>>
>><http://www.goodman.net/index.html> <http://www.scab.org>
>>
>>
>>
>>resentful exhibitor weller muriel boundary slake bivouac hasten lupine
>
>
>>bog supposable buttonhole monica nair antoinette orchid pane edmund
>>affluence counterattack silicic unanimous gamesman pile brief The
>>multiply and ontario astound tier calvert brad refuge partial prosper
>>partner ouzel arlington bennett carson tedious anthony contrition
>
> ewing
>
>>coo america piezoelectric acquit brown gout iv food trailhead donner
>
> for
>
>>dietary oct with cumulate showboat a howell the hinge difluoride
>>taxonomy antigone trance affix enunciable insomniac weinberg
>
> adsorptive
>
>>bartok niche thrown brookhaven proven everett brainy alike roughshod
>>wicket doesn't colonial chalkline glutinous klaus decker aileen
>>tarantula eft from abrasive crestfallen in veal bengal pliancy
>>contraband modesty biometrika eelgrass decor conceit halma semester .
>>The demurrer and deprecatory annotate bates aerobacter perilla amort
>>astringent thyrotoxic avionic firecracker weaken cheerleader comet
>>bauble barrel circumference brickbat aminobenzoic beaux cryptic
>
> gossamer
>
>>articulatory viola deadline reversible desist hines republican
>
> earphone
>
>>alliance celesta wale angelina usurp bromine for congressman degas
>
> with
>
>>divulge aura a jocular.
>
>
>
>

Thanks. BTW, I'm still confused about posting. If I hit reply to all,
I get spamassassin-users in the CC and then sender in the To:

I then need to delete the sender in the To: and move the Cc: to the To:

There must be a better way.

Mark

-----Original Message-----
From: Scott [mailto:spamassassin@troutpocket.org]
Sent: Monday, February 09, 2004 2:37 PM
Cc: spamassassin-users@incubator.apache.org
Subject: Re: How did this spam get by

troutpocket.org:root# cat /etc/mail/spamassassin/local.cf
# This is the right place to customize your installation of
SpamAssassin.
#
# See 'perldoc Mail::SpamAssassin::Conf' for details of what can be
# tweaked.
#
########################################################################
###
#
# rewrite_subject 0
# report_safe 1
# trusted_networks 212.17.35.
body RANDOM_WORD_10
/(?:\b(?!(?:from|even|more|that|this|were|with)\b)[a-z]{4,12}\s+){10}/
describe RANDOM_WORD_10 string of 10+ random words
score RANDOM_WORD_10 1.6

body RANDOM_WORD_15
/(?:\b(?!(?:from|even|more|that|this|were|with)\b)[a-z]{4,12}\s+){15}/
describe RANDOM_WORD_15 string of 15+ random words
score RANDOM_WORD_15 3.8

There's an unintentional line-break there. body, describe, and score
are the
only three lines per rule.

-Scott

p.s. now I can see why the debate about this list was so heated.
Someone has
got to turn off the "include sender" option or add a subject header.
It's
annoying when replies go into two folders if the sender hits "reply-all"

Mark A. DeMichele wrote:

> Where to I get your rules from? Sorry, I'm new.
>
> -----Original Message-----
> From: Scott [mailto:spamassassin@troutpocket.org]
> Sent: Monday, February 09, 2004 2:21 PM
> Cc: spamassassin-users@incubator.apache.org
> Subject: Re: How did this spam get by
>
> My random_word_10 and random_word_15 give relatively huge scores, 1.6
> and 3.8
> respectively. That would have cought it for you.
>
> -Scott
>
> Mark A. DeMichele wrote:
>
>
>>I have all the extra rule files from the Rule Emporium, but this one
>>squeaked by. It has lots of garbage html tags. It only got a score of
>
> 2.2
>
>>Thanks,
>>
>>Mark DeMichele
>>
>><<Get your home financing while the rates are low! -asset>>
>>
>>
>>
>
------------------------------------------------------------------------
>
>>Subject:
>>Get your home financing while the rates are low! -asset
>>From:
>>"Naomi Tracy" <IZHEQALGO@geocities.co.jp>
>>Date:
>>Mon, 9 Feb 2004 13:49:17 -0500
>>To:
>>"Mark A. DeMichele" <demi@intellipro.com>
>>
>>
>>
>>We c <http://www.christoffel.info>an g
>
> <http://www.dispel.com/tg.html>et
>
>>yo <http://www.claim.net>u mo <http://www.ridge.net/index.html>rt
>><http://www.scripps.us/index.htm>ga
>
> <http://www.doesn't.org/greg.php>ge
>
>>ra <http://www.vacationland.info>te
>
> <http://www.injunction.tv/loll.php>s
>
>>as l <http://www.sturbridge.info>ow as 5. <http://www.horace.ws>79%!
>>
>>The ra <http://www.e.net>tes are as lo
>
> <http://www.mukden.com/Ge.html>w
>
>>as th <http://www.lahore.info>ey ha <http://www.recriminatory.info>ve
>
> b
>
>><http://wwwchlorine.ca>een in 4
>><http://www.bassett.org/nevertheless.php>0 ye
>
> <http://www.velvety.org>ar
>
>><http://wwwdextrous.org>s! Do <http://www.ampere.kg>n't wa
>><http://www.neuromuscular.info>it fo
>><http://www.asia.ca/counterfeit/patriot/main.asp>r th
>><http://www.cerberus.info>e ra <http://www.afoul.tv>tes to i
>><http://www.abbott.com>ncre <http://www.paradigm.co.uk>ase.Yo
>><http://www.movie.co.uk>u can sa <http://www.catkin.ca>ve th
>><http://www.timon.tv>ou <http://www.caesar.tv/chivalry.php>sa
>><http://www.knee.kg/ZY.html>nds by re
>><http://www.terrific.tv/plagiarism.php>fin <http://www.send.org>anc
>><http://www.acclaim.net/index.html>ing or ge <http://www.cubic.org>tti
>
>
>><http://www.hooligan.com>ng a mor <http://www.royce.kg>tg
>><http://www.babel.com>age NOW.
>>
>>Ab <http://www.bernini.kg>sol
>><http://www.craftsmen.ws/docs/courteous.html>ute
>><http://www.az.org/connector.php>ly No Ob
>><http://www.conservatism.ws/docs/screech.html>li
>><http://www.stick.com/YY.html>gat <http://www.core.com/ty.html>ion
>>
>>Si <http://www.martensite.co.uk>mp <http://www.t's.info>le ov
>><http://www.semester.ws>er th <http://www.tycoon.ws>e p
>><http://www.archdiocese.ca/excretory/paraboloid/main.asp>ho
>><http://www.longish.tv/duopolist.php>ne con
>><http://www.incredulous.ca>su
>
> <http://www.jubilant.org/amputate.php>ltat
>
>><http://www.caddy.net>io <http://www.brochure.kg>n
>>
>>Ap <http://www.timepiece.co.uk/nAHq.html>pro
>><http://www.divine.kg/GA.html>val i <http://www.archaism.org>n a
>><http://www.dapple.info>s li
>><http://www.cottony.ca/impart/cerebellum/main.asp>t
>><http://www.derogatory.info/G/diamagnetic.htm>tle as 2
>><http://www.cypriot.tv/fisticuff.php>4 ho
>><http://www.bidirectional.info/a/choirmaster.htm>urs
>>
>>No co <http://www.equatorial.com/Zi.html>st to yo
>><http://www.invaluable.tv/duchess.php>u wha
>><http://www.huxtable.co.uk/rQhb.html>tsoe
>
> <http://www.purposeful.kg>ver
>
>>
>>You wi <http://www.recital.info/l/capita.htm>ll be A
>><http://www.via.kg>MA <http://www.demoniac.ca>ZE
>><http://www.discriminate.kg/xv.html>D at our rat
>><http://www.compendia.co.uk>es
>>
>>
>>For more information, click here.
>
> <http://saving-first.com/?partid=brl>
>
>>
>>
>>Note: We cur <http://www.refer.tv>r
>
> <http://www.backdrop.com/JM.html>ent
>
>><http://www.mccullough.co.uk>ly o <http://www.counterintuitive.org>nly
>
>
>>of <http://www.chambers.org>fer ho <http://www.austria.co.uk>me fi
>><http://www.annum.ca/bangle/cosmic/main.asp>nan
>><http://www.empathy.ca>cing to the Un <http://www.absinthe.net>ited
>
> Stat
>
>><http://www.cornelius.kg>es
>>
>>
>>
>>
>>
>>
>><http://www.donate.co.uk/RNGK.html> <http://saving-first.com/st.html>
>><http://www.convalesce.info>
>>
>><http://www.wesleyan.tv/amongst.php>
>>
>> <http://www.inclination.org/squelch.php>
>>
>><http://www.collimate.org/bertram.php>
>><http://www.receive.info/I/kirkland.htm>
>>
>><http://www.goodman.net/index.html> <http://www.scab.org>
>>
>>
>>
>>resentful exhibitor weller muriel boundary slake bivouac hasten lupine
>
>
>>bog supposable buttonhole monica nair antoinette orchid pane edmund
>>affluence counterattack silicic unanimous gamesman pile brief The
>>multiply and ontario astound tier calvert brad refuge partial prosper
>>partner ouzel arlington bennett carson tedious anthony contrition
>
> ewing
>
>>coo america piezoelectric acquit brown gout iv food trailhead donner
>
> for
>
>>dietary oct with cumulate showboat a howell the hinge difluoride
>>taxonomy antigone trance affix enunciable insomniac weinberg
>
> adsorptive
>
>>bartok niche thrown brookhaven proven everett brainy alike roughshod
>>wicket doesn't colonial chalkline glutinous klaus decker aileen
>>tarantula eft from abrasive crestfallen in veal bengal pliancy
>>contraband modesty biometrika eelgrass decor conceit halma semester .
>>The demurrer and deprecatory annotate bates aerobacter perilla amort
>>astringent thyrotoxic avionic firecracker weaken cheerleader comet
>>bauble barrel circumference brickbat aminobenzoic beaux cryptic
>
> gossamer
>
>>articulatory viola deadline reversible desist hines republican
>
> earphone
>
>>alliance celesta wale angelina usurp bromine for congressman degas
>
> with
>
>>divulge aura a jocular.
>
>
>
>

Mark A. DeMichele wrote:

> Thanks. BTW, I'm still confused about posting. If I hit reply to all,
> I get spamassassin-users in the CC and then sender in the To:
>
> I then need to delete the sender in the To: and move the Cc: to the To:
>
> There must be a better way.

There is, it's called "List Reply", a feature in Mutt that I soooo wish
was available in Mozilla Thunderbird.

Steven
--
Steven Dickenson <steven@mrchuckles.net>
http://www.mrchuckles.net

--On Monday, February 09, 2004 3:30 PM -0500 "Mark A. DeMichele"
<demi@intellipro.com> wrote:

> Thanks. BTW, I'm still confused about posting. If I hit reply to all,
> I get spamassassin-users in the CC and then sender in the To:
>
> I then need to delete the sender in the To: and move the Cc: to the To:
>
> There must be a better way.

That's a combination of the mailing list configuration and your e-mail
program. I'm using Mulberry, and both addresses show up in the To: field.

The mailing list is set for the sender to be the To: in a reply. I guess I
see the logic behind this, but then again, I don't. It's a mailing list,
and most often an answer will benefit everyone. But the default reply-to is
to the sender, not the list.

Evan

I'm using Microsoft Outlook. I don't think there's a list reply.

This may be a stupid question but why doesn't the list just put itself
as the sender and put the original sender in the CC. That way you would
just have to reply. I could swear other lists I've used in the past
work that way.

Mark

-----Original Message-----
From: Steven Dickenson [mailto:steven@mrchuckles.net]
Sent: Monday, February 09, 2004 3:38 PM
To: spamassassin-users@incubator.apache.org
Subject: Re: How did this spam get by

Mark A. DeMichele wrote:

> Thanks. BTW, I'm still confused about posting. If I hit reply to
all,
> I get spamassassin-users in the CC and then sender in the To:
>
> I then need to delete the sender in the To: and move the Cc: to the
To:
>
> There must be a better way.

There is, it's called "List Reply", a feature in Mutt that I soooo wish
was available in Mozilla Thunderbird.

Steven
--
Steven Dickenson <steven@mrchuckles.net>
http://www.mrchuckles.net

How safe are these random word rules? Should I be afraid of false
positives?

Am I understanding these correctly. Basically, you're looking for a
sequence of 10 (or 15) words that don't include, "from" or "even", etc.

If so, it seems scary to me, but I'm just a novice.


body RANDOM_WORD_10
/(?:\b(?!(?:from|even|more|that|this|were|with)\b)[a-z]{4,12}\s+){10}/
describe RANDOM_WORD_10 string of 10+ random words
score RANDOM_WORD_10 1.6

body RANDOM_WORD_15
/(?:\b(?!(?:from|even|more|that|this|were|with)\b)[a-z]{4,12}\s+){15}/
describe RANDOM_WORD_15 string of 15+ random words
score RANDOM_WORD_15 3.8

There's an unintentional line-break there. body, describe, and score
are the
only three lines per rule.

There are very few, if any, sentences in the english language that are 15
words long that don't contain at least one word with fewer than 4 characters.

I haven't had a single false positive from this rule and I've been using it
for a month now. YMMV, of course.

-Scott

Mark A. DeMichele wrote:
> How safe are these random word rules? Should I be afraid of false
> positives?
>
> Am I understanding these correctly. Basically, you're looking for a
> sequence of 10 (or 15) words that don't include, "from" or "even", etc.
>
> If so, it seems scary to me, but I'm just a novice.
>
>
> body RANDOM_WORD_10
> /(?:\b(?!(?:from|even|more|that|this|were|with)\b)[a-z]{4,12}\s+){10}/
> describe RANDOM_WORD_10 string of 10+ random words
> score RANDOM_WORD_10 1.6
>
> body RANDOM_WORD_15
> /(?:\b(?!(?:from|even|more|that|this|were|with)\b)[a-z]{4,12}\s+){15}/
> describe RANDOM_WORD_15 string of 15+ random words
> score RANDOM_WORD_15 3.8
>
> There's an unintentional line-break there. body, describe, and score
> are the
> only three lines per rule.
>
>

(Apologies to Scott, I merely hit 'reply' like works on every other mailing
list, and ended up sending him this reply directly rather than to the list.)

> My random_word_10 and random_word_15 give relatively huge scores, 1.6 and
3.8
> respectively. That would have cought it for you.

I was using someone else's versions that had scores of 1 and 2 for 10 and 13
respectively, and this let one get through. I added a rule for 30 words
that gave 10 points.

(Anyone know a way to convert a repeat count in a regexp to a score value?
So if I check for something that can happen 7 to 100 times it will give a
score of 7 to 100 or .7 to 10 or such, depending on the actual number of
occurances?)

Loren

(Apologies to Scott, I merely hit 'reply' like works on every other mailing
list, and ended up sending him this reply directly rather than to the list.)

> p.s. now I can see why the debate about this list was so heated. Someone
has
> got to turn off the "include sender" option or add a subject header. It's
> annoying when replies go into two folders if the sender hits "reply-all"

Or manually edit the recipients list after 'reply all'.

And build a special rule to whitelist the list, since you can't use
whitelist_from with any reliability.

Loren