http://permalink.gmane.org/gmane.mail.spam.razor.user hourly 1 1901-01-01T00:00+00:00 http://gmane.org/img/gmane-25t.png http://gmane.org http://permalink.gmane.org/gmane.mail.spam.razor.user/4118 <pre>Hi, While going through the code for Razor v2, I found the check below in String.pm and enBase64.pm. ----- quote ----- my $is_binary = ($hdr =~ /^Content-Type-Encoding: 8-bit/) || ($body =~ /([\x00-\x1f|\x7f-\xff])/ and $1 !~ /[\r\n\t]/); ----- /quote ----- I may be wrong, but does the "Content-Type-Encoding:" header even exist? RFC 1341 (http://tools.ietf.org/html/rfc1341) doesn't mention it. It does mention 8-bit encoding in the "Content-Transfer-Encoding:" header however. The check is also case sensitive and doesn't allow for the value 8bit in the "Content-Transfer-Encoding:" (or "Content-Type-Encoding:) header. Anyway, I was curious about this. Maybe someone can comment on this? Thanks. Best regards, Jeroen Koekkoek ------------------------------------------------------------------------------ LogMeIn Rescue: Anywhere, Anytime Remote support for IT. Free Trial Remotely access PCs and mobile devices and provide instant support Improve your efficiency, and focus on delivering more</pre> Jeroen Koekkoek 2012-12-19T23:33:22 http://permalink.gmane.org/gmane.mail.spam.razor.user/4117 <pre>Hi Stef, thanks for your reply. I don't run razor on outbound mails anyway so I'm going to attempt to revoke some mails and see where that gets us, cheers Andy. ------------------------------------------------------------------------------ LogMeIn Rescue: Anywhere, Anytime Remote support for IT. Free Trial Remotely access PCs and mobile devices and provide instant support Improve your efficiency, and focus on delivering more value-add services Discover what IT Professionals Know. Rescue delivers http://p.sf.net/sfu/logmein_12329d2d </pre> Andy Smith 2012-12-17T17:08:54 http://permalink.gmane.org/gmane.mail.spam.razor.user/4116 <pre>Hi Andy, I had the same issue with our e-mails some time ago. I posted a message like yours, but I never got an answer ;-) I'm afraid this list is rather dead. Besides this, I did some research about 'E4' (engine 4) and 'E8' (engine 8). One of the engines is calculating a hash on (parts of) URL's contained in the e-mail; the other is a calculation on certain parts of the e-mail. You could add some extra verbosity in some of the perl modules to exactly know which URL/which parts are causing problems. For me, after some research and some mail server reconfiguration, the problem disappeared: - I disabled Razor2 checks for the outgoing e-mail flow; - I'm "revoking" good e-mail (besides "reporting" bad e-mail). After less than a week Razor2 works nicely again with a very low rate of false positives… If you want, you can send me a sample message via a private message. Good luck. Stef Op 13-dec.-2012, om 18:55 heeft Andy Smith &lt;a.smith&lt; at &gt;ldex.co.uk&gt; het volgende geschreven: ------------------------------</pre> Stef Simoens 2012-12-13T20:14:56 http://permalink.gmane.org/gmane.mail.spam.razor.user/4115 <pre>Hi, I think mail from our company may have been listed in razor. Having googled a little on checking razor and the possibility of resolving the issue I've not got much furhter than testing via razor-check. For example can someone help me understand the output of razor-check -H, ie: 1.0 e4: KOQdDz58L451g4akrfcPDgthXSQA, ep4: 7542-10 1.0 e8: uNFZFVRwA-4A 1.0 e8: FVW9OG-WA-4A 1.1 e4: 79gYKj8Bv9VDBcS6OuDcKi1axXsA, ep4: 7542-10 1.1 e8: FVW9OG-WUy0A 1.2 e4: WUK1-RYSRgTSHNJXJAUVqa60eC0A, ep4: 7542-10 1.3 e4: dhdlKnsGuKKLx6zOxQZnZaKVVEEA, ep4: 7542-10 1.4 e4: JPPq_hiy3gtLKsfYr-f5l3FR7AEA, ep4: 7542-10 I'd like to be able to understand this so I can undestand better what mails are being flagged and what I can do about this. Thanks in advance for any help, Andy. ------------------------------------------------------------------------------ LogMeIn Rescue: Anywhere, Anytime Remote support for IT. Free Trial Remotely access PCs and mobile devices and provide instant support Improve your efficiency, and </pre> Andy Smith 2012-12-13T17:55:03 http://permalink.gmane.org/gmane.mail.spam.razor.user/4114 <pre>Hello, I don't see a lot of action on this list, I hope someone will read me here. Is Razor2 still being used, by the way? I'm seeing a lot of false positives with Razor2 scans on my domain. I did some research (adding some verbosity printf's and running razor-check -d &lt; false_positive_email). I noticed the following facts: - because in Whiplash.pm, line 655, the line-wrap kill is commented out, a lot of URL's are not found (in a real-life e-mail only 3 URLs were found out of 14 URLs present in the e-mail) - due to my domain name bgs.org and the Whiplash.pm "canonify" function, all URLs on my domain are being canonified to "bgs.org". That wouldn't be bad, if the hash for that domain wouldn't be marked as being 100% SPAM (e=8 sig=PhKPm4hzfMkA: Is spam: cf 100 &gt;= min_cf 21). Is this "Spam" an indicator for "bulk" or is it an indicator for "unsolicited e-mail"? How can this situation be handled? (i.e. what are the rules for the bgs.org hash to be considered non-spam?). Thank you for your help/comments/advi</pre> Stef Simoens 2012-06-09T00:08:53 http://permalink.gmane.org/gmane.mail.spam.razor.user/4113 <pre>15.11.2011 20:26, razor-users-request&lt; at &gt;lists.sourceforge.net пишет: ------------------------------------------------------------------------------ RSA(R) Conference 2012 Save $700 by Nov 18 Register now http://p.sf.net/sfu/rsa-sfdev2dev1 _______________________________________________ Razor-users mailing list Razor-users&lt; at &gt;lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/razor-users </pre> Andrey Nazarov 2011-11-15T16:34:42 http://permalink.gmane.org/gmane.mail.spam.razor.user/4112 <pre> ------------------------------------------------------------------------------ RSA(R) Conference 2012 Save $700 by Nov 18 Register now http://p.sf.net/sfu/rsa-sfdev2dev1 </pre> Andrey Nazarov 2011-11-15T16:35:46 http://permalink.gmane.org/gmane.mail.spam.razor.user/4111 <pre>Sorry, I know this is the Razor-suers list, but: run: pyzor discover also, look at this patch to the pyzor executable that you may need: http://www200.pair.com/mecham/spam/pyzor.patch1.txt On 9/2/11, Giampaolo Tomassoni &lt;Giampaolo&lt; at &gt;tomassoni.biz&gt; wrote: </pre> Gary V 2011-09-02T12:44:59 http://permalink.gmane.org/gmane.mail.spam.razor.user/4110 <pre> My SAs get Pyzor hits even today, so I guess it is some problem with your own setup/installation. Why don't you place a help request in pyzor-users&lt; at &gt;lists.sourceforge.net ? Giampaolo ------------------------------------------------------------------------------ Special Offer -- Download ArcSight Logger for FREE! Finally, a world-class log management solution at an even better price-free! And you'll get a free "Love Thy Logs" t-shirt when you download Logger. Secure your free ArcSight Logger TODAY! http://p.sf.net/sfu/arcsisghtdev2dev </pre> Giampaolo Tomassoni 2011-09-02T07:43:06 http://permalink.gmane.org/gmane.mail.spam.razor.user/4109 <pre>differ Hi Luciano. It is not only a matter of databases: they use different methods to extract hashes of the message in order to check them against their own databases of well-known spam signatures. Besides, the methods Razor adopt to do it are proprietary, so generally we (the users) can't easily estimate how much overlap is in the results of these two packages. So it is not easy to tune their scores. However, Razor seems to have a quite wide userbase and (authenticated) methods to revoke FPs, so I'm inclined to trust Razor hits a bit more than Pyzor ones. Giampaolo ------------------------------------------------------------------------------ Special Offer -- Download ArcSight Logger for FREE! Finally, a world-class log management solution at an even better price-free! And you'll get a free "Love Thy Logs" t-shirt when you download Logger. Secure your free ArcSight Logger TODAY! http://p.sf.net/sfu/arcsisghtdev2dev </pre> Giampaolo Tomassoni 2011-09-01T18:42:58 http://permalink.gmane.org/gmane.mail.spam.razor.user/4108 <pre> They are different databases so this is probably the reason for the different scores. http://spamassassin.apache.org/tests_3_3_x.html </pre> Gary V 2011-08-30T12:35:59 http://permalink.gmane.org/gmane.mail.spam.razor.user/4107 <pre>Hello, maybe is not a great question, but i'd like to know if: a) when spamassassin give a score due to RAZOR2_CHECK should give the same score to PYZOR_CHECK ? b) Razor and Pyzor are based on different signature database or they differ only because Pyzor is Python based ? Many thanks, Luciano ------------------------------------------------------------------------------ Special Offer -- Download ArcSight Logger for FREE! Finally, a world-class log management solution at an even better price-free! And you'll get a free "Love Thy Logs" t-shirt when you download Logger. Secure your free ArcSight Logger TODAY! http://p.sf.net/sfu/arcsisghtdev2dev_______________________________________________ Razor-users mailing list Razor-users&lt; at &gt;lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/razor-users </pre> l.rinetti< at >movimatica.com 2011-08-30T11:48:26 http://permalink.gmane.org/gmane.mail.spam.razor.user/4106 <pre>   Leesa  ------------------------------------------------------------------------------ EditLive Enterprise is the world's most technically advanced content authoring tool. Experience the power of Track Changes, Inline Image Editing and ensure content is compliant with Accessibility Checking. http://p.sf.net/sfu/ephox-dev2dev_______________________________________________ Razor-users mailing list Razor-users&lt; at &gt;lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/razor-users </pre> Leesa Vuola 2011-06-17T00:36:37 http://permalink.gmane.org/gmane.mail.spam.razor.user/4105 <pre>------------------------------------------------------------------------------ EditLive Enterprise is the world's most technically advanced content authoring tool. Experience the power of Track Changes, Inline Image Editing and ensure content is compliant with Accessibility Checking. http://p.sf.net/sfu/ephox-dev2dev_______________________________________________ Razor-users mailing list Razor-users&lt; at &gt;lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/razor-users </pre> Gordon Dickens 2011-06-15T23:43:25 http://permalink.gmane.org/gmane.mail.spam.razor.user/4104 <pre>------------------------------------------------------------------------------ EditLive Enterprise is the world's most technically advanced content authoring tool. Experience the power of Track Changes, Inline Image Editing and ensure content is compliant with Accessibility Checking. http://p.sf.net/sfu/ephox-dev2dev_______________________________________________ Razor-users mailing list Razor-users&lt; at &gt;lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/razor-users </pre> Gordon Dickens 2011-06-13T13:05:37 http://permalink.gmane.org/gmane.mail.spam.razor.user/4103 <pre> I'm not convinced Razor would trigger on a GTUBE string, however useful that would be. If GTUBE is a special case in the razor agent, please let me know. However, I have a couple of old spams saved to test things like this. One has a URL somewhere in it for e8 testing, the other one doesn't (for e4 testing): razor-check -d &lt;spammail.txt When I test now it appears only engine 8 (e8) responds, but it doesn't care about mails without URLs. Thus no signature is created or checked for e8: Jun 13 13:57:18.821359 check[58527]: [ 6] Engine (8) didn't produce a signature for mail 1.0 There is nothing whatsoever about engine 4 (e4) in the debug output, except that the log claims the client supports it. Otherwise it's silent. Odd that Pyzor is working though. Razor 2.84 appears to work halfway. Nothing in my spamfolders are older than 14 days, so I can't go back to see when e4 signatures last worked. The last message in razor-users before this thread shows e4 did respond, so I'm not sure what's up. In short: I h</pre> Tor Willy Austerslått 2011-06-13T12:09:23 http://permalink.gmane.org/gmane.mail.spam.razor.user/4102 <pre>------------------------------------------------------------------------------ EditLive Enterprise is the world's most technically advanced content authoring tool. Experience the power of Track Changes, Inline Image Editing and ensure content is compliant with Accessibility Checking. http://p.sf.net/sfu/ephox-dev2dev_______________________________________________ Razor-users mailing list Razor-users&lt; at &gt;lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/razor-users </pre> Gordon Dickens 2011-06-13T11:12:39 http://permalink.gmane.org/gmane.mail.spam.razor.user/4101 <pre>------------------------------------------------------------------------------ EditLive Enterprise is the world's most technically advanced content authoring tool. Experience the power of Track Changes, Inline Image Editing and ensure content is compliant with Accessibility Checking. http://p.sf.net/sfu/ephox-dev2dev_______________________________________________ Razor-users mailing list Razor-users&lt; at &gt;lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/razor-users </pre> Gordon Dickens 2011-06-13T10:51:41 http://permalink.gmane.org/gmane.mail.spam.razor.user/4100 <pre> I had razor recognize a spam just a few minutes ago: Jun 12 20:33:06.073069 check[62918]: [ 3] mail 1 is known spam. If you sent a mail containing only the GTUBE string, the e8 server won't do the query in any case. Strange that there was no response from e4 though ... How long's it been since you did a discovery? </pre> Tor Willy Austerslått 2011-06-12T19:06:13 http://permalink.gmane.org/gmane.mail.spam.razor.user/4099 <pre>------------------------------------------------------------------------------ EditLive Enterprise is the world's most technically advanced content authoring tool. Experience the power of Track Changes, Inline Image Editing and ensure content is compliant with Accessibility Checking. http://p.sf.net/sfu/ephox-dev2dev_______________________________________________ Razor-users mailing list Razor-users&lt; at &gt;lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/razor-users </pre> Gordon Dickens 2011-06-12T18:13:00 http://permalink.gmane.org/gmane.mail.spam.razor.user/4098 <pre>------------------------------------------------------------------------------ _______________________________________________ Razor-users mailing list Razor-users&lt; at &gt;lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/razor-users </pre> Catalin Constantin 2010-05-31T08:40:46 Search the mailing list at Gmane query http://search.gmane.org/?group=$group=gmane.mail.spam.razor.user