gmane.mail.spam.spamassassin.devel

Rule updates are too old

2012-05-23T16:00:02

SpamAssassin version 3.3.0 has not had a rule update since 2012-02-25.
SpamAssassin version 3.3.1 has not had a rule update since 2012-02-25.
SpamAssassin version 3.3.2 has not had a rule update since 2012-02-25.

[auto] bad sandbox rules report

Rules Report Cron — 2012-05-23T08:32:42

HTTP get: http://ruleqa.spamassassin.org/1-days-ago?xml=1
HTTP get: http://ruleqa.spamassassin.org/2-days-ago?xml=1
HTTP get: http://ruleqa.spamassassin.org/3-days-ago?xml=1

Bad performing rules, from the past 3 night's mass-checks.

(Note: 'net' rules will be listed as 'no hits' unless you set 'tflags net'.
This also applies for meta rules which use 'net' rules.)


rulesrc/sandbox/wtogami/20_url_shortener.cf (10 rules, 10 bad):

  URL_SHORTENER:  bad, avg S/O=0.49 avg Spam%=1.12 avg Ham%=1.16
      # used in: SHORT_URL SPOOFED_URL SPOOFED_URL_HOST
  __URL_SHORTENER_ABC:  bad, avg S/O=0.31 avg Spam%=0.16 avg Ham%=0.36
      # used in: SHORT_URL SPOOFED_URL SPOOFED_URL_HOST URL_SHORTENER
  __URL_SHORTENER_DEFGHI:  bad, avg S/O=0.07 avg Spam%=0.02 avg Ham%=0.20
      # used in: SHORT_URL SPOOFED_URL SPOOFED_URL_HOST URL_SHORTENER
  __URL_SHORTENER_JKLM:  bad, avg S/O=0.55 avg Spam%=0.01 avg Ham%=0.01
      # used in: SHORT_URL SPOOFED_URL SPOOFED_URL_HOST URL_SHORTENER
  __URL_SHORTENER_NOPQ:  bad, avg S/O=0.

Rule updates are too old

2012-05-22T16:00:02

SpamAssassin version 3.3.0 has not had a rule update since 2012-02-25.
SpamAssassin version 3.3.1 has not had a rule update since 2012-02-25.
SpamAssassin version 3.3.2 has not had a rule update since 2012-02-25.

[Bug 6781] multiple emails in From

2012-05-21T19:34:37

https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6781

--- Comment #10 from D. Stussy <software+spamassassin< at >kd6lvw.ampr.org> ---
RE: Comment #9 - I must disagree:

A message with multiple from entries, no sender header, and non-spammy content
is not a "false positive" as it is an RFC violation and therefore not a valid
message.

Although spam is generally about content, I cannot accept that a malformed
message is a legitimate message.  Such malformations are precisely the target
of the rule(set) that we are developing as a result of this bug report.

Now, as for the misfirings on a character-set-encoded string, that could be a
problem.  Maybe we need a "decoded" function, which for non-encoded strings
will be identical to "raw", but for strings starting with "=charset", it
obviously decodes them and performs comparisons thereafter.

[Bug 6781] multiple emails in From

2012-05-21T18:36:11

https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6781

--- Comment #9 from Mark Martinec <Mark.Martinec< at >ijs.si> ---
Observed 3800 messages which hit MULTI_FROM_BAD during the last four days.

Among these there were three legitimate mail messages with two addresses
in a From, and a missing Sender (a conference registration confirmation
or paper submissions). These were genuine false positives (of which one
was quarantined for exceeding a spam threshold, while the other two
were rescued by other rules).

Besides the above three, there were three additional false positives, where
my version of MULTI_FROM_ADDR misfired. These three were a result of a
B64-encoded display name in the iso-2022-jp character set, which happened
to contain bytes '< at >' and ',' in the b64-decoded string.

The string that was matched looked like (somewhat obfuscated):
  _$B:#1xxf_(B _$B< at >5,_(B <xxx< at >example.com>

It is most unfortunate that the :addr modifier only returns the first
of multiple addresses (in a To, From, Cc, ...), which

Rule updates are too old

2012-05-21T16:00:02

SpamAssassin version 3.3.0 has not had a rule update since 2012-02-25.
SpamAssassin version 3.3.1 has not had a rule update since 2012-02-25.
SpamAssassin version 3.3.2 has not had a rule update since 2012-02-25.

Re: New SpamAssassin Project Chair

Daniel McDonald — 2012-05-21T12:34:33


Thanks for stepping up, Kevin.  And thanks to Daryl for his service, too.

Re: New SpamAssassin Project Chair

Mark Martinec — 2012-05-20T23:29:55

Congratulations Kevin, and a big thanks for accepting the duty!

  Mark

New SpamAssassin Project Chair

Kevin A. McGrail — 2012-05-20T19:34:07

Good Afternoon Everyone,

I am both humbled and honored to report that I have accepted the 
nomination of the SpamAssassin PMC to serve as the new project chair.  
On April 18th, the Board of Directors for the Apache Software Foundation 
accepted the nomination and appointed me to the position.

Unfortunately and for very good reasons, our previous chair, Daryl C. W. 
O'Shea is no longer unavailable to help the project.  I hope all can 
join me in thanking Daryl for his service to the project.  And while he 
will be sorely missed, for privacy reasons, I can only tell you that he 
is urgently needed elsewhere.  But I'm certain he needs and would 
appreciate all the good karma we can send his way.

Over the past few weeks, I've been working to get up to speed on my 
duties.  Luckily, I attended the ASF BarCamp DC conference yesterday.  
Not only was it a great conference with great people that taught me a 
few things but several of the attendees were very helpful in helping me 
overcome a few hurdles.   Many t

[Bug 6703] sa-learn doesn't work with kmail 2 mbox format

2012-05-20T19:33:35

https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6703

--- Comment #31 from Thomas Arend <thomas< at >arend-rhb.de> ---
(In reply to comment #29)

I never saw more than one whitespace after the "From" but one or two white
spaces after the "e-mail" address / before the weekday.

[Bug 6703] sa-learn doesn't work with kmail 2 mbox format

2012-05-20T17:09:42

https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6703

--- Comment #30 from Kevin A. McGrail <kmcgrail< at >pccc.com> ---
(In reply to comment #29)

Well more importantly than specific kmail 2 mbox regexes , does the patch I
wrote that let's someone use /^Mickey Mouse$/ as their mbox separator regular
expression work?  

Regards,
KAM

[Bug 6703] sa-learn doesn't work with kmail 2 mbox format

2012-05-20T16:54:40

https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6703

--- Comment #29 from John Hardin <jhardin< at >impsec.org> ---
(In reply to comment #26)

There is no reason to capture the results of the match for later use. (?:...)
is a non-capturing match, which is slightly more efficient.

To allow for variations in whitespace, perhaps:

/^From\s{1,5}\S+\s{1,5}[[:upper:]][[:lower:]]{2}(?:, \d\d
[[:upper:]][[:lower:]]{2} \d{4} [0-2]\d:\d\d:\d\d [+-]\d{4}|
[[:upper:]][[:lower:]]{2} [ 1-3]\d [ 0-2]\d:\d\d:\d\d \d{4})/

Rule updates are too old

2012-05-20T16:00:02

SpamAssassin version 3.3.0 has not had a rule update since 2012-02-25.
SpamAssassin version 3.3.1 has not had a rule update since 2012-02-25.
SpamAssassin version 3.3.2 has not had a rule update since 2012-02-25.

[Bug 6703] sa-learn doesn't work with kmail 2 mbox format

2012-05-20T13:41:23

https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6703

--- Comment #28 from Thomas Arend <thomas< at >arend-rhb.de> ---
(In reply to comment #27)

Just found that the corrupted From_ line was added when filtering through
formail. Don`t ask me why. Formail works on command line as expected.

[Bug 6703] sa-learn doesn't work with kmail 2 mbox format

2012-05-20T12:16:26

https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6703

--- Comment #27 from Thomas Arend <thomas< at >arend-rhb.de> ---
Created attachment 5071
  --> https://issues.apache.org/SpamAssassin/attachment.cgi?id=5071&action=edit
Test mbox showing two From_ lines

This is an export of four messages which show two from lines.

[Bug 6703] sa-learn doesn't work with kmail 2 mbox format

2012-05-20T12:11:22

https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6703

--- Comment #26 from Thomas Arend <thomas< at >arend-rhb.de> ---
(In reply to comment #22)


I doin't see the need of the sequence "(?:," in the regex. For me it works with
"(,"

[Bug 6703] sa-learn doesn't work with kmail 2 mbox format

2012-05-20T12:09:29

https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6703

--- Comment #25 from Thomas Arend <thomas< at >arend-rhb.de> ---
It's getting worse with the kmail folks. The sometimes put to From_ lines in
the mbox file.

From thomas< at >arend-rhb.de Sat, 19 May 2012 00:10:44 +0200
From thomas< at >arend-rhb.de  Sat May 19 00: 16:57 2012
[..]

In teh second line you can see that they spend an extra space in case the hour
would extend to more than 99 min in the future.

I will report this to kmail.

Have a nice Sunday!

[Bug 6703] sa-learn doesn't work with kmail 2 mbox format

2012-05-20T11:54:45

https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6703

--- Comment #24 from Thomas Arend <thomas< at >arend-rhb.de> ---


 (In reply to comment #22)

Are you sure that we have a localization issue in the header fields? I use the
German versions of Outlook Express, Thunderbird, Kmail and Evolution. The time
stamps in the header are not localized.

[Bug 6703] sa-learn doesn't work with kmail 2 mbox format

2012-05-20T02:41:08

https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6703

--- Comment #23 from Kevin A. McGrail <kmcgrail< at >pccc.com> ---
Created attachment 5070
  --> https://issues.apache.org/SpamAssassin/attachment.cgi?id=5070&action=edit
Patch to add options for defining the ArchiveIterator From regex as a Conf file
option


I don't know enough about foreign languages to know for sure the format is
always leading caps, etc. So I went ahead and wrote the patch to move this to a
configurable option.

It appears to work testing with the mbox with 3 ham messages attached
previously.  

"Learned tokens from 3 message(s) (3 message(s) examined)"

Thoughts?

KAM

Re: SpamAssassin not compatible with local::lib due to taint

Ricardo Signes — 2012-05-20T00:59:26

* "Kevin A. McGrail" <KMcGrail< at >PCCC.com> [2012-05-19T20:34:00]

(I am quoting you slightly out of order below.)

It did not.  That version (v3.2.4) was installed before local::lib had gained
much popularity.  It was fun to go back and check, though, and to see all the
deprecation warnings it issues now on 5.16.0-RC2-ish. :)


My concern isn't so much dealing with what I need -- I've already dealt with
it.  It's with saving time for anybody else who encounters this in the future.


If this use case seems very unlikely to re-occur, I think the simplest change
would be for me to add to Makefile.PL:

  die "Mail::SpamAssassin is not compatible with environments using PERL5LIB"
    if length $ENV{PERL5LIB};

(or if length $ENV{PERL_LOCAL_LIB_ROOT})

The problem, of course, is that there isn't actually a problem if all of the
dist's prereqs are already installed in perl's built-in < at >INC, and PERL5LIB is
not needed.  The next step, then, would be to tweak Makefile.PL to add a sub
somewhere to My:: to make the fatal

Re: SpamAssassin not compatible with local::lib due to taint

Kevin A. McGrail — 2012-05-20T00:34:00

My thoughts are, by conjecture, I'm assuming the "ancient one" did work 
with local::lib?  What was that version and what option(s) did it use 
above that allowed it to work?

Overall, though, we can likely look at a patch but this is a pretty 
specific request that isn't very core to the project. My concern is the 
ripple from your change to core needs.

But it sounds like all you have to do is remove a single -T and you are 
good so I don't know that this is anything more than an extreme edge use 
that is best handled by your just editing the existing source for your 
needs, no?

Regards,
KAM