Re: Looking to BUY Stock....

Re: Looking to BUY Stock....

[Thomas T. Soares]

Where is the so called spam assassin...?


On Mon, 2003-01-13 at 20:53, Dolphin Technology UK LTD wrote:
>                                    
> 
> [image]
> 
> TRADE LAPTOPS -  Tel. 0870-9066551 Fax. 0870-9066552
> 
>  
> 
> We are looking to buy quantity of the following items:
> 
> Refurbished & Second User Laptops
> 
> Ex-lease & Clearance Stock
> 
> PCMCIA Products
> 
> Laptop Batteries
> 
> Laptop Spares and Accessories
> 
>  
> 
> Please E-mail your offers to Offers@LaptopList.com
> 
>  
> 
> CALL FOR TRADING TERMS. 
> 
> All orders must be in writing. (E-mail/Fax) 
> 
> Prices are exclusive of VAT @ 17.5% 
> 
> This list supersedes any other. E&EO
-- 
Thomas T. Soares <ttsoares@orion.ufrgs.br>

Re: Looking to BUY Stock....

[Bob Apthorpe]

On Tue, 14 Jan 2003 00:48:42 -0200
"Thomas T. Soares" <ttsoares@orion.ufrgs.br> wrote:

> Where is the so called spam assassin...?

Installed somewhere on Sourceforge. See http://www.spamassassin.org/ for details.

[off-topic]

Version 2.50 is undergoing testing this week to update the weights
assigned to given rules. The new version is significant in that it
contains a 'Bayesian' (statistical) analyzer that makes it much easier
to tune to the mail traffic you normally receive. With appropriate
whitelisting, optional DNSBL and distributed message checksum databases
checks, and the new statistical analyzer, its already high accuracy
should improve even more dramatically. I'm very happy with it
(obviously...)

-- Bob

> On Mon, 2003-01-13 at 20:53, Dolphin Technology UK LTD wrote:
> >                                    
> > 
> > [image]
> > 
> > TRADE LAPTOPS -  Tel. 0870-9066551 Fax. 0870-9066552
[saw]

Re: Looking to BUY Stock....

[Manuel Krause]

On 01/14/2003 03:48 AM, Thomas T. Soares wrote:
> Where is the so called spam assassin...?
> 

This time it only gave 4 stars...

# X-Spam-Status: No, hits=4.1 required=5.0
#	
# tests=BIG_FONT,CTYPE_JUST_HTML,FRONTPAGE,HTML_50_70,INVALID_DATE,
#	      LINES_OF_YELLING,MAILTO_LINK,SPAM_PHRASE_00_01
#	version=2.43-cvs
# X-Spam-Level: ****

I really don't know if we need to setup our mail filters to work with 
these spam assassin marks (e.g. with <X-Spam-Level> <contains> <****> -> 
Trash or something with <hits=4> ).


Recently on dri-users @ lists.sourceforge.net I got spam without a
** SPAM ** mark in the subject but with the following status header (I 
just include it here in case the list maintainer want's some additional 
settings or for debuggers):

# X-Spam-Status: Yes, hits=9.3 required=7.0
#	tests=X_PRIORITY_HIGH,FROM_ENDS_IN_NUMS,SUBJ_HAS_Q_MARK,
#	      FROM_NAME_NO_SPACES,PORN_11,LARGE_HEX,CTYPE_JUST_HTML
#	version=2.21
# X-Spam-Flag: YES
# : *********
# X-Spam-Checker-Version: SpamAssassin 2.21 (devel $Id:
# SpamAssassin.pm,v 1.92 2002/06/11 03:50:03 hughescr Exp $)
# X-Spam-Prev-Content-Type: text/html; charset="iso-8859-1"
# X-Spam-Report:   9.3 hits, 7 required;
#  *  1.7 -- Sent with 'X-Priority' set to high
#  *  1.0 -- From: ends in numbers
#  *  1.0 -- Subject: contains a question mark
#  *  0.5 -- From: no spaces in name
#  *  0.8 -- BODY: Uses words and phrases which indicate porn (11)
#  *  1.1 -- BODY: Contains a large block of hexadecimal code
#  *  3.2 -- HTML-only mail, with no text version


I don't know this software at all but I'm a bit irritated by the 
difference between "hits" and "required" and the fact that mail got 
delivered in the last case. (Do the spammers already include these 
headers and the headers don't get reset by spam assassin?)


Best regards,

Manuel

Re: Looking to BUY Stock....

[Hubert Chan]

[-- Attachment #1: Type: text/plain, Size: 1010 bytes --]

>>>>> "Manuel" == Manuel Krause <manuel.krause@mb.tu-ilmenau.de> writes:

[...]

Manuel> Recently on dri-users @ lists.sourceforge.net I got spam without
Manuel> a ** SPAM ** mark in the subject but with the following status
Manuel> header (I just include it here in case the list maintainer
Manuel> want's some additional settings or for debuggers):
...

They might have turned off the ** SPAM ** subject mark.  From the
"required" setting, it looks like they were getting too many false
positives.  They probably also turned off the ** SPAM ** mark to let
people to their own filtering.  (Just a guess.)

It's usually best to filter on the X-Spam-Flag header or, if you don't
like their settings, on the X-Spam-Status header -- to set the threshold
higher or lower.

-- 
Hubert Chan <hubert@uhoreg.ca> - http://www.uhoreg.ca/
PGP/GnuPG key: 1024D/124B61FA
Fingerprint: 96C5 012F 5F74 A5F7 1FF7  5291 AF29 C719 124B 61FA
Key available at wwwkeys.pgp.net.   Encrypted e-mail preferred.

[-- Attachment #2: Type: application/pgp-signature, Size: 188 bytes --]

Re: Looking to BUY Stock....

[Matthias Andree]

"Thomas T. Soares" <ttsoares@orion.ufrgs.br> writes:

> Where is the so called spam assassin...?

If it were not for careless people like you, I had never seen that junk
I'm not quoting below.

Repeat: do not quote spam!

-- 
Matthias Andree

Re: Looking to BUY Stock....

[The Amazing Dragon]

> From: Matthias Andree <ma+rfs@dt.e-technik.uni-dortmund.de>
> "Thomas T. Soares" <ttsoares@orion.ufrgs.br> writes:
> > Where is the so called spam assassin...?
> 
> If it were not for careless people like you, I had never seen that junk
> I'm not quoting below.
> 
> Repeat: do not quote spam!

Actually the quoting is harmless. The problem is the replies going back
to the spammer's address, but I imagine you ment that.

Actually the problem is nastier than that, I've seen spammers using HTML
in their spam...  Not a problem, except when they tell the browser to
load an image from their webserver which gives confirms your address as
valid. Okay, so sane mailers now prevent that from happening, well, now
they'll use JavaScript to tell their webserver your address is valid.

So score one for the olde plain vanilla mailers.


-- 
(\___(\___(\______          --=> 8-) EHM <=--          ______/)___/)___/)
 \   (    |         EHeM@cs.pdx.edu      PGP 8881EF59         |    )   /
  \_  \   |  _____  -O #include <stddisclaimer.h> O-   _____  |   /  _/
    \___\_|_/82 04 A1 3C C7 B1 37 2A*E3 6E 84 DA 97 4C 40 E6\_|_/___/

Re: Looking to BUY Stock....

[Matthias Andree]

On Mon, 13 Jan 2003, The Amazing Dragon wrote:

> Actually the quoting is harmless. The problem is the replies going back
> to the spammer's address, but I imagine you ment that.

It's not harmless. The original spam was marked as spam by my filtering
software and filed to a "spam" folder, hidden from my view. The whole
discussion with the full quote however did NOT qualify as spam and
appeared in the mailing lists's folder, where it certainly did NOT
belong as per my filtering setup.

> Actually the problem is nastier than that, I've seen spammers using HTML
> in their spam...  Not a problem, except when they tell the browser to
> load an image from their webserver which gives confirms your address as
> valid. Okay, so sane mailers now prevent that from happening, well, now
> they'll use JavaScript to tell their webserver your address is valid.

Even olde Netscape 4.8 allows you to switch off JavaScript in Mail and
News. I'm not sure what their default configuration is today (I've
upgraded with the same preferences file since the days of 4.72), but you
certainly can switch that off, and you can also switch image loading off
globally even in that software. So if yours is not on par, go tell the
vendor. More recent software allows to switch image loading off more
selectively, for example on for people in your address book and off
otherwise, and deactivate any kind of scripting in mail and news by
default.

> So score one for the olde plain vanilla mailers.

And score zero for people who reply to spam in the public still.

Re: Looking to BUY Stock....

[Hans Reiser]

Thomas T. Soares wrote:

>Where is the so called spam assassin...?
>
>
>  
>
Sysadmin on vacation, sigh....

-- 
Hans