pyzor-users — general discussion of Pyzor and Pyzor-related topics

Pyzor: non-zero exit codes [solved]

[Alan M. <py...@br...>]

I have posted a few times about Pyzor reporting where you get a report
failed message.

I have now tracked the cause of this to being due to fragmented packets
which were being bounced at the firewall.

Having allowed these packets in the failure rate has dropped dramatically.


Alan

Re: How big is the Pyzor central database?

[Frank T. <ft...@ne...>]

Dreas van Donselaar, on 2004-05-26, wrote:

> I have a question concerning the size of the Pyzor central database. How
> large is it (in MBs)? And how large is it (in amounts of stored spam
> signatures)?

The DB is usually around a 100-200 MB in size; occasionally I'll wipe it
and start anew since spam has an extremely short lifetime, and to
simultaneously lessen the load on the server.

> Furthermore I'd like to know how much datatraffic is currently involved
> with this central database server and how many users are actively using
> it.

I haven't tracked usage recently, but given past growth rates, I would
suspect there is more than 10 queries per second at this point in time.

-- 
Frank Tobin			http://www.neverending.org/~ftobin/

How big is the Pyzor central database?

[Dreas v. D. <dr...@em...>]

Hi,
 
I have a question concerning the size of the Pyzor central database. How
large is it (in MBs)? And how large is it (in amounts of stored spam
signatures)?
 
Furthermore I'd like to know how much datatraffic is currently involved with
this central database server  and how many users are actively using it.
 
Is this public information? :) I like to know it for a research I am doing
on finding an improved antispam system.
 
Regards,
 
Dreas van Donselaar

Problem with pyzor.client

[Benedict W. <be...@cs...>]

Hi,

I have installed pyzor and it does not seem to be working,

Do I need to get an account on a pyzor server?

If so who do I ask? Or should i set up my own

Kind regards



Benedict White
be...@cs...

Computer Systems Engineering Ltd
tel (44) 1444 441351
fax (44) 1444 441414

Re: Ports and protocol for Pyzor

[Frank T. <ft...@ne...>]

Robert Hart, on 2004-04-24, wrote:

> I've been through the docs and whilst it mentions port 24441, it does
> not tell me wether this is tcp or udp.

Thanks for noting this.  Pyzor uses UDP.  It should be noted that 24441 is
only by convention.  At times Pyzor has used ports +/- 1 from 24441 (when 
it was transitioning between versions).

-- 
Frank Tobin			http://www.neverending.org/~ftobin/

Re: Does pyzor report to the pyzor server?

[Kelson V. <ke...@sp...>]

At 05:38 PM 5/10/2004, Chris wrote:
>On Monday 10 May 2004 05:41 pm, Kelson Vibber wrote:
> > I think what Frank meant is that "X-Spam-Pyzor: Reported 0 times." means
> > that, as far as Pyzor is concerned, it isn't spam.  In other words, the
> > existence of X-Spam-Pyzor means that Pyzor looked at it, not that Pyzor
> > decided it was spam.
>
>I guess what I meant was how does the pyzor server know a msg is spam?  How
>is it reported to the pyzor server(s), who does it?  Are am I still in a
>fog here?

Ah, ok.  Sounds like we both misunderstood you.

Pyzor is similar to Razor (aka SpamNet) or DCC in that end-users report 
spam to it.

The way you report spam to pyzor is by running "pyzor report < message-file"

If you just run "pyzor" with no arguments, it will give you a list of options.


Kelson Vibber
SpeedGate Communications <www.speed.net>  

Re: Does pyzor report to the pyzor server?

[Kelson V. <ke...@sp...>]

At 03:26 PM 5/10/2004, Chris wrote:
>On Monday 10 May 2004 04:34 pm, Frank Tobin wrote:
> > > I have pyzor setup and running, however I'm a little confused as to its
> > > operation.  I see two types of entries on spam,
> > >
> > > X-Spam-Pyzor: Reported 1166 times.
> > >
> > >X-Spam-Pyzor: Reported 0 times.
> > >
> > > If the spammer has not been reported to the pyzor server, how is this
> > > accomplished?
> >
> > I'm not sure what you are asking; if a piece of spam has not been
> > reported, then it will be reported 0 times.
>
>What I meant is if a piece of spam is noted as being reported 0 times, how
>is it reported/who reports it to the Pyzor server?

I think what Frank meant is that "X-Spam-Pyzor: Reported 0 times." means 
that, as far as Pyzor is concerned, it isn't spam.  In other words, the 
existence of X-Spam-Pyzor means that Pyzor looked at it, not that Pyzor 
decided it was spam.

Kelson Vibber
SpeedGate Communications <www.speed.net> 

Re: Does pyzor report to the pyzor server?

[Chris <cpo...@ea...>]

On Monday 10 May 2004 04:34 pm, Frank Tobin wrote:
> > I have pyzor setup and running, however I'm a little confused as to i=
ts
> > operation.  I see two types of entries on spam,
> >
> > X-Spam-Pyzor: Reported 1166 times.
> >
> >X-Spam-Pyzor: Reported 0 times.
> >
> > If the spammer has not been reported to the pyzor server, how is this
> > accomplished?
>
> I'm not sure what you are asking; if a piece of spam has not been
> reported, then it will be reported 0 times.

What I meant is if a piece of spam is noted as being reported 0 times, ho=
w=20
is it reported/who reports it to the Pyzor server?

--=20
Chris
Registered Linux User 283774 http://counter.li.org
5:22pm up 3 days, 23:47, 1 user, load average: 0.10, 0.10, 0.09
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> The day people think linux would be better served by somebody else (FSF
> being the natural alternative), I'll "abdicate".  I don't think that
> it's something people have to worry about right now - I don't see it
> happening in the near future.  I enjoy doing linux, even though it does
> mean some work, and I haven't gotten any complaints (some almost timid
> reminders about a patch I have forgotten or ignored, but nothing
> negative so far).
>
> Don't take the above to mean that I'll stop the day somebody complains:
> I'm thick-skinned (Lasu, who is reading this over my shoulder commented
> that "thick-HEADED is closer to the truth") enough to take some abuse.
> If I weren't, I'd have stopped developing linux the day ast ridiculed m=
e
> on c.o.minix.  What I mean is just that while linux has been my baby so
> far, I don't want to stand in the way if people want to make something
> better of it (*).
>
>                 Linus
>
> (*) Hey, maybe I could apply for a saint-hood from the Pope.  Does
> somebody know what his email-address is? I'm so nice it makes you puke.
(Taken from Linus's reply to someone worried about the future of Linux)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Live - From Virgin Radio U.K. Soul Asylum - Runaway Train

Re: Does pyzor report to the pyzor server?

[Frank T. <ft...@ne...>]

> I have pyzor setup and running, however I'm a little confused as to its
> operation.  I see two types of entries on spam,
                                                                                          
> X-Spam-Pyzor: Reported 1166 times.
> 
>X-Spam-Pyzor: Reported 0 times.
> 
> If the spammer has not been reported to the pyzor server, how is this
> accomplished?
                                                                                          
I'm not sure what you are asking; if a piece of spam has not been
reported, then it will be reported 0 times.

-- 
Frank Tobin			http://www.neverending.org/~ftobin/

Does pyzor report to the pyzor server?

[Chris <cpo...@ea...>]

I have pyzor setup and running, however I'm a little confused as to its=20
operation.  I see two types of entries on spam,=20

X-Spam-Pyzor: Reported 1166 times.

X-Spam-Pyzor: Reported 0 times.

If the spammer has not been reported to the pyzor server, how is this=20
accomplished?

--=20
Chris
Registered Linux User 283774 http://counter.li.org
3:43pm up 2 days, 22:08, 1 user, load average: 0.73, 0.65, 0.37
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
And 1.1.81 is officially BugFree(tm), so if you receive any bug-reports
on it, you know they are just evil lies."
(By Linus Torvalds, Lin...@cs...)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Live - From Virgin Radio U.K. Virgin Radio Classic Tracks - Non-stop clas=
sic=20
tracks from the makers of Virgin Radio

Re: Problem running pyzor - total newbie

[Rob F. <ro...@be...>]

On Fri, 7 May 2004, Chris wrote:

> [root@chris bin]# pyzor discover
> bash: /usr/bin/pyzor: /usr/bin/python2: bad interpreter: No such file or
> directory
>
> I have python version 2.2.1 installed.  I'm running Mandrake 9.0.  I guess
> the place to start is why was no ~/.pyzor dir made?
>
> Thanks

I think that pyzor will create a ~/.pyzor directory the first time you run
it successfully.  You problem is that /usr/bin/python2 doesn't exist.

Type "which python2" at a command line to find out where python has been
installed.  If this doesn't work, try "which python".  Once you've found
python, you can either create a link from /usr/bin/python2 to the python
executable, or edit the first line of pyzor so that it uses the existing
python executable.

Hope this helps,

Rob Fox

Problem running pyzor - total newbie

[Chris <cpo...@ea...>]

I've gotten pyzor installed, however, there is no ~/.pyzor directory that=
=20
has been created, that I can find anyway.  When trying to run pyzor=20
discover as root I get:

[root@chris bin]# pyzor discover
bash: /usr/bin/pyzor: /usr/bin/python2: bad interpreter: No such file or=20
directory

I have python version 2.2.1 installed.  I'm running Mandrake 9.0.  I gues=
s=20
the place to start is why was no ~/.pyzor dir made?

Thanks

--=20
Chris
Registered Linux User 283774 http://counter.li.org
10:41pm up 1 day, 5:05, 2 users, load average: 0.09, 0.20, 0.31
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Actually, typing random strings in the Finder does the equivalent of
filename completion.
(Discussion in comp.os.linux.misc on the intuitiveness of commands: file
completion vs. the Mac Finder.)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
The current Virgin Radio U.K. Tune is The Clash - Should I Stay Or Should=
 I=20
Go

Re: Useage of Pyzor

[<lar...@fl...>]

My pyzor successfully detect spam ever day.
I also contribute with spam report
I can also notice spam comming in and after a few reports they are
successfully detected.
/Lars

----- Original Message ----- 
From: "Benedict White" <be...@cs...>
To: <pyz...@li...>
Sent: Wednesday, May 05, 2004 10:52 AM
Subject: Useage of Pyzor


I am using pyzor with spamassassin and amavisd-new.

I could not find much in the way of documentation but it seems that
spamassassin works ok with that anyway. I have used the homedir switch i=
n
the startup line that spamassassin calls so that I can specify a central
place for configs.

Now the questions.

I note that there has not been a new version since 2002 (as far as I cou=
ld
see), is pyzor still being developed?

I have not as yet had a pyzor check turn up in my log files. Is that bec=
ause
there are not enough people reporting spam? If so, would it help if i se=
nt
some spam traps reports?

Kind regards

Benedict White




-------------------------------------------------------
This SF.Net email is sponsored by: Oracle 10g
Get certified on the hottest thing ever to hit the market... Oracle 10g.
Take an Oracle 10g class now, and we'll give you the exam FREE.
http://ads.osdn.com/?ad_id149&alloc_id=8166&op=3Dick
_______________________________________________
pyzor-users mailing list
pyz...@li...
https://lists.sourceforge.net/lists/listinfo/pyzor-users

Useage of Pyzor

[Benedict W. <be...@cs...>]

I am using pyzor with spamassassin and amavisd-new.

I could not find much in the way of documentation but it seems that =
spamassassin works ok with that anyway. I have used the homedir switch in =
the startup line that spamassassin calls so that I can specify a central =
place for configs.

Now the questions.

I note that there has not been a new version since 2002 (as far as I could =
see), is pyzor still being developed?

I have not as yet had a pyzor check turn up in my log files. Is that =
because there are not enough people reporting spam? If so, would it help =
if i sent some spam traps reports?

Kind regards

Benedict White

Re: question on reportings

[Tom A. <tal...@ta...>]

Roman Suzi wrote:

> Your answer can be found in the Pyzor source code. The code is easy to read,
> and you will see that before making hash Pyzor removes URLs, spaces,
> and other things.
> 
> But I must admit that large amount of spam today uses randomizing
> techniques which Pyzor does not like. So the only solution is to
> use rule-based spam-catcher (like SpamAssassin) + Bayes filter
> (like spamoracle, etc) + some SMTP-level euristics to catch
> spam.
> 
> Probably banning HTML emails will have devastating effect on spam too ;-)
> 
> Sincerely yours, Roman Suzi

Thank you for the reply.

I wasn't sure how much randomization spam had in it.
I did some tests and found that only 0.2% of my spam has my email 
address in it (in some form).
But the blocks of bayesian gook at the end I could not test.

bogofilter is my spam filter of choice.

Re: question on reportings

[Roman S. <rn...@on...>]

On Tue, 27 Apr 2004, Tom Allison wrote:

>I recently subscribed to this list not because I'm a pyzor user (yet)
>but I'm trying to understand how it works.
>
>I was trying to find out how this email tagging and reporting system
>works, in general, from the razor-agent mailing list, but they have a
>rather closed door.  Because of that and the apparent attentions paid to
>the commercial product, at the expense of their GPLed product, it leaves
>me nonplussed.
>
>So here I am and here's my question:
>
> From what I can find, in general the reporting of spam consistes of
>turning the BODY of the message into a MD5 type hash string and
>reporting that signature.
>
>So I played with it a bit and from my 3780 spams in my archive, I found
>90 of them actually held my name and/or email address (or some part
>thereof).  This was the only quick way that I could see if they actual
>BODY had been customized for my delivery (aren't they thoughtful!).
>This works out to ~0.2% of my received spam.
>
>I did not do anything to strip HTML or MIME-decode or uuencoding or
>anything like that.  A message in any form would still hash to a unique
>ID and I wasn't trying to be that exact.
>
>So, I guess my question is, how do you compensate reporting spam that
>has a unique tag included in the body to still provide some degree of
>spam identification that is worth sharing?

Your answer can be found in the Pyzor source code. The code is easy to read,
and you will see that before making hash Pyzor removes URLs, spaces,
and other things.

But I must admit that large amount of spam today uses randomizing
techniques which Pyzor does not like. So the only solution is to
use rule-based spam-catcher (like SpamAssassin) + Bayes filter
(like spamoracle, etc) + some SMTP-level euristics to catch
spam.

Probably banning HTML emails will have devastating effect on spam too ;-)

Sincerely yours, Roman Suzi
-- 
rn...@on... =\= My AI powered by GNU/Linux RedHat 7.3

question on reportings

[Tom A. <tal...@ta...>]

I recently subscribed to this list not because I'm a pyzor user (yet) 
but I'm trying to understand how it works.

I was trying to find out how this email tagging and reporting system 
works, in general, from the razor-agent mailing list, but they have a 
rather closed door.  Because of that and the apparent attentions paid to 
the commercial product, at the expense of their GPLed product, it leaves 
me nonplussed.

So here I am and here's my question:

 From what I can find, in general the reporting of spam consistes of 
turning the BODY of the message into a MD5 type hash string and 
reporting that signature.

So I played with it a bit and from my 3780 spams in my archive, I found 
90 of them actually held my name and/or email address (or some part 
thereof).  This was the only quick way that I could see if they actual 
BODY had been customized for my delivery (aren't they thoughtful!). 
This works out to ~0.2% of my received spam.

I did not do anything to strip HTML or MIME-decode or uuencoding or 
anything like that.  A message in any form would still hash to a unique 
ID and I wasn't trying to be that exact.

So, I guess my question is, how do you compensate reporting spam that 
has a unique tag included in the body to still provide some degree of 
spam identification that is worth sharing?

Ports and protocol for Pyzor

[Robert H. <ha...@in...>]

Hi

I installed Pyzor to run from spamassassin.

I've been through the docs and whilst it mentions port 24441, it does
not tell me wether this is tcp or udp.

Now, discovering this is relatively easy *if* one has one's firewall set
to log drops, but this would not be so easy for a newbie.

Perhaps it's worth mentioning the fact that Pyzor requires udp access to
   outbound local ports 1024:65535 to remote port 24441
   inbound local ports 1024:65535 from remote port 24441

more explicitly in the docs.

-- 
Robert Hart					 ha...@in...
+61 (0)438 385 533
Brisbane, Australia			   http://www.hart.wattle.id.au

Re: Reporting instances to Pyzor

[Kelson V. <ke...@sp...>]

At 05:15 PM 4/22/2004, Robert Hart wrote:
>I would like to be able to
>report individual Spam messages I receive that fall through my setup. I
>cannot see in the Pyzor docs how to do this.
>
>Is there a way to do this???

pyzor report < messagefile

Check out the docs/usage.html file in the source for more info.

Kelson Vibber
SpeedGate Communications <www.speed.net> 

Reporting instances to Pyzor

[Robert H. <ha...@in...>]

Hi

I run my own Linux server (mail, web etc) with only a couple of small
domains and have finally got sick of the spam I was receiving - and have
spamassassin/dcc/pyzor set up to deal with this.

Rather than setting up spam trap addresses as suggested (my sites are
not sufficiently travelled to warrant this), I would like to be able to
report individual Spam messages I receive that fall through my setup. I
cannot see in the Pyzor docs how to do this.

Is there a way to do this???

-- 
Robert Hart					 ha...@in...
+61 (0)438 385 533
Brisbane, Australia			   http://www.hart.wattle.id.au

Re: Pyzor fingerprinting approach.

[Jesper K. <je...@kr...>]

Frank Tobin sagde:
> Jesper Krogh, on 2004-04-19, wrote:
>
>> I seem to get more and more email with a rather large random generated
>> section of words ( not sentences ). Does Pyzor have any chance agains
>> them?
>
> It certainly depends.  One would hope that messages that are 99%
> randomness make for poor sales, so that would be ineffective spam, and
> self-defeating in that sense.  Bayes-like systems would be good against
> those types of spam, I would suspect.

I don't really think that the bayes systems are good.. it's statistics
afterall... most of the ham-mail i recieve is Danish and most of the
spam-mail is English so I actually train my bayes filter to recognise
Danish vs. English instead of Spam vs. Ham.... I suspect.

Example:
http://krogh.cc/spammail.txt

>  The key thing to remember is that
> Pyzor is only one part of an anti-spam solution.

Sure ... but I believe that these fingerprinting approaches do quite well..

Seems like razor' is more or less dead as addon to spamassassin so there
is pyzor left. Sometimes I get Timeout errors tring to run pyzor report
66.250.40.33:24441      TimeoutError:

Would anyone mind that I try to get this list/group on Gmane?

-- 
Jesper Krogh

Re: Pyzor fingerprinting approach.

[Frank T. <ft...@ne...>]

Jesper Krogh, on 2004-04-19, wrote:

> I seem to get more and more email with a rather large random generated
> section of words ( not sentences ). Does Pyzor have any chance agains
> them?

It certainly depends.  One would hope that messages that are 99%
randomness make for poor sales, so that would be ineffective spam, and
self-defeating in that sense.  Bayes-like systems would be good against
those types of spam, I would suspect.  The key thing to remember is that
Pyzor is only one part of an anti-spam solution.

-- 
Frank Tobin			http://www.neverending.org/~ftobin/

Re: Pyzor fingerprinting approach.

[Jesper K. <je...@kr...>]

Kelson Vibber sagde:
> At 09:26 AM 4/19/2004, Jesper Krogh wrote:
>>I would like to know if modified headers make the report to pyzor unique
for my spam, I have these headers in all spam:
>
> As I understand it, Pyzor only looks at the message body, so the headers
don't matter to it.

Ok.

I seem to get more and more email with a rather large random generated
section of words ( not sentences ). Does Pyzor have any chance agains
them?

like this.
-----
frieze carcass bullwhack gonzales motel
ajar bendix canterbury wrist
industry radian colorate discriminable bromley amsterdam crosswalk -----

This is usually put in the text/plain part of a multipart mail, where the
text/html part contains the actual spam-content.

-- 
Jesper Krogh



-- 
Jesper Krogh, JabberID: je...@ja...
Få en Jabberkonto på: http://www.jabbernet.dk/

Re: Pyzor fingerprinting approach.

[Kelson V. <ke...@sp...>]

At 09:26 AM 4/19/2004, Jesper Krogh wrote:
>I would like to know if modified headers make the report to pyzor unique
>for my spam, I have these headers in all spam:

As I understand it, Pyzor only looks at the message body, so the headers 
don't matter to it.


Kelson Vibber
SpeedGate Communications <www.speed.net> 

Pyzor fingerprinting approach.

[Jesper K. <je...@kr...>]

Hi.

I wonder if there is any documentations on pyzor's fingerprinting algorighm.
It seems like most of my spam is generated with random content nowadays.

I would like to know if modified headers make the report to pyzor unique
for my spam, I have these headers in all spam:
X-Virus-Scanned: by amavisd-new-20030616-p7 (Debian) at mailserver
X-Spam-Status: Yes, hits=8.3 tagged_above=0.0 required=6.3 tests=BAYES_99,
        BIZ_TLD, HTML_60_70, HTML_IMAGE_RATIO_10, HTML_MESSAGE,
        RCVD_IN_BL_SPAMCOP_NET, RCVD_IN_DSBL, RCVD_IN_SORBS
X-Spam-Level: ********
X-Spam-Flag: YES

Thanks.

-- 
Jesper Krogh