RE: [vps-mail] Spam getting past SA

["Brian Haines" <providertalk@xxxxxxxxxxxxxxxx>]

Funny, I didn't notice the negative value until you said that. DOH!

I have a feeling that my local.cf file is not being used.

I have these entries:

use_terse_report     0
HABEAS_SWE -1.0

I am not getting the full report header (as commented in a different
message I sent to this list) and this HABEAS_SWE still seems to be
getting very low values from it's default of -8 instead of my value of
-1.

What could cause SA to not read in the etc/mail/spammassassin/local.cf
file?

I just decided to cross post this into the iserver list as the vps-mail
list seems not very active. I won't make a habit of it.

Brian Haines

-----Original Message-----
From: owner-vps-mail@xxxxxxxxxxxx [mailto:owner-vps-mail@xxxxxxxxxxxx]
On Behalf Of Matt Cohen
Sent: Thursday, March 11, 2004 12:43 PM
To: vps-mail@xxxxxxxxxxxx
Subject: Re: [vps-mail] Spam getting past SA


Brian,

1)Your score is not high enough, its too low - note the 
'negativeness' of your hits value

2)Habeas is a company that copywrited a haiku and lets people use it 
for sending valid email.  the thought was that if a non-valid sender 
used the haiku, then there was a real law broken - copyright 
infringement - for which habeas could sue them, rather than futzing 
around with anti-spam law.

the problem with this particular spammer is that he's not sending it 
himself, but using a zombie army to send them, so its not possible to 
track down the spammer.  According to their web site they do know 
about the problem but haven't been able to fix it yet.

That's why habeas_swe is marked as such a low negative value.   It 
did indeed work for a while until someone figured out a work-around.

Matt

At 9:06 AM -0500 3/11/04, Brian Haines said something about:
>Hey guys, why does this have enough hits to be spam, but gets delivered

>to the mailbox? I get like 10 a day of very similer messages. I reset 
>Habeas SWE to -1 so that I could get these caught - why was it -8 in 
>the first place?
>
>Brian Haines
>
>Return-Path: <harland7649@xxxxxxxxxxxx>
>Received: from 200-138-023-088.cscgo7004.dsl.brasiltelecom.net.br
>(200-138-023-088.cscgo7004.dsl.brasiltelecom.net.br [200.138.23.88])
>	by oneparkp.iserver.net (8.12.11/8.11.6) with SMTP id
i2BDc78R091216
>	for <brian@xxxxxxxxxxxxxxxx>; Thu, 11 Mar 2004 06:38:08 -0700
>(MST)
>Received: from 214.197.220.16 by 200.138.23.88; Thu, 11 Mar 2004
>06:24:08 +0100
>Message-ID: <NIANPFJSFVUQRSFBDTAGULAFV@xxxxxxxxxxxxxxxx>
>X-Habeas-SWE-1: winter into spring
>X-Habeas-SWE-2: brightly anticipated
>X-Habeas-SWE-3: like Habeas SWE (tm)
>X-Habeas-SWE-4: Copyright 2002 Habeas (tm)
>X-Habeas-SWE-5: Sender Warranted Email (SWE) (tm). The sender of this
>X-Habeas-SWE-6: email in exchange for a license for this Habeas
>X-Habeas-SWE-7: warrant mark warrants that this is a Habeas Compliant
>X-Habeas-SWE-8: Message (HCM) and not spam. Please report use of this
>X-Habeas-SWE-9: mark in spam to <http://www.habeas.com/report/>.
>From: "rivka sudduth" <kh.sudduth@xxxxxxxxxxxxxxxx>
>Reply-To: "rivka sudduth" <ulpt4617@xxxxxxxxxxxxxxxx>
>To: brian@xxxxxxxxxxxxxxxx
>Subject: Fwd:  All On Stocks. V1cod\in ` Val.i.um ? :X:ANAx % v|@GRA
>Pn:t:ermin > Som|a|  timycguxsdcm
>Date: Thu, 11 Mar 2004 04:30:08 -0100
>MIME-Version: 1.0
>Content-Type: multipart/mixed;
>	boundary="--90654343573058822"
>X-Mailer: Pegasus Mail for Windows (v4.01)
>X-Originating-IP: 161.58.213.99
>X-Spam-Checker-Version: SpamAssassin 2.63 (2004-01-11) on
>oneparkp.iserver.net
>X-Spam-Status: No, hits=-8.1 required=5.0 tests=BAYES_00,HABEAS_SWE,
>	HTML_MIME_NO_HTML_TAG,MIME_HTML_NO_CHARSET,MIME_HTML_ONLY,
>	RCVD_IN_DYNABLOCK,RCVD_IN_SORBS autolearn=ham version=2.63
>X-UIDL: *0*!!)MH!!^*e"!fS)"!
>
>======================================================================
>This is <vps-mail@xxxxxxxxxxxx>       <http://www.perlcode.org/lists/>
>Before posting a question, please search the archives (see above URL).

-- 
:-:+:-:+:-:+:-:+:-:+:-:+:-:+:-:+:-:+:-:+:-:+:-:+:-:+:-:+:-:+:-:+:-:+:-:+
Matthew I. Cohen
http://www.iwbyte.com/
It Won't Byte Web Design & Hosting.     Ob. Quote: "Reality is for those
email: lists@xxxxxxxxxx                  people who can't handle
Fantasy"
======================================================================
This is <vps-mail@xxxxxxxxxxxx>       <http://www.perlcode.org/lists/>
Before posting a question, please search the archives (see above URL).


======================================================================
This is <vps-mail@xxxxxxxxxxxx>       <http://www.perlcode.org/lists/>
Before posting a question, please search the archives (see above URL).