pyzor-users — general discussion of Pyzor and Pyzor-related topics

Away from my mail

[<Wol...@eb...>]

Ich werde ab  12.11.2003 nicht im B=FCro sein. Ich kehre zur=FCck am
14.11.2003.

Ich werde Ihre Nachricht(en) nach meiner R=FCckkehr beantworten.
mfg

I will answer after returning to the office.

Regards
Wolfgang Fuertbauer
=

Away from my mail

[<Wol...@eb...>]

Ich werde ab  12.11.2003 nicht im B=FCro sein. Ich kehre zur=FCck am
14.11.2003.

Ich werde Ihre Nachricht(en) nach meiner R=FCckkehr beantworten.
mfg

I will answer after returning to the office.

Regards
Wolfgang Fuertbauer
=

Re: Lost filtering

[<lar...@fl...>]

I submit between 100 and 150 a day. Even thogh some of them come back  f=
ew
days later, so I suspect there is a problem somewhere anyway.  And I als=
o
notice that since the 4th not a single message has been catched by pyzor=
.
But I will wait-n'-see a few days more.

/Lars
----- Original Message ----- 
From: "Frank Tobin" <ft...@ne...>
To: <pyz...@li...>
Sent: Tuesday, November 11, 2003 5:04 PM
Subject: Re: Lost filtering


Lars Holmstr=F6m, on 2003-11-11, wrote:

> I have successfully run Pyzor on Linux for several months. This softwa=
re
> really helped our users a lot. In the past I trapped a minimum of 50-1=
00
> mails per day.

One possible issue is that the old database was lost; however, I suspect
that this is not a significant factor since spam has a short lifespan.
Another issue is that some of the bigger reporters might have not moved =
to
reporting to the new server.

-- 
Frank Tobin http://www.neverending.org/~ftobin/


-------------------------------------------------------
This SF.Net email sponsored by: ApacheCon 2003,
16-19 November in Las Vegas. Learn firsthand the latest
developments in Apache, PHP, Perl, XML, Java, MySQL,
WebDAV, and more! http://www.apachecon.com/
_______________________________________________
pyzor-users mailing list
pyz...@li...
https://lists.sourceforge.net/lists/listinfo/pyzor-users

Re: Lost filtering

[Frank T. <ft...@ne...>]

Lars Holmstr=F6m, on 2003-11-11, wrote:

> I have successfully run Pyzor on Linux for several months. This software
> really helped our users a lot. In the past I trapped a minimum of 50-100
> mails per day.

One possible issue is that the old database was lost; however, I suspect
that this is not a significant factor since spam has a short lifespan. =20
Another issue is that some of the bigger reporters might have not moved to
reporting to the new server.

--=20
Frank Tobin=09=09=09http://www.neverending.org/~ftobin/

Re: Listed

[Frank T. <ft...@ne...>]

Duane Voth, on 2003-11-11, wrote:

> Frank, are you sure the new server is working right? I tried to submit
> some spam and got this back: (3:08am cst)

Ah, that situation can happen if you sequentially send a lot of requests,
one of which times out for some reason.  Subsequent requests' responses
are shifted by one response, causing pyzor to get confused.  This is
resolvable.

> The old server didn't have this problem.

This is not an issue with the server.

-- 
Frank Tobin			http://www.neverending.org/~ftobin/

Re: Listed

[Duane V. <du...@io...>]

Frank, are you sure the new server is working right?
I tried to submit some spam and got this back:
(3:08am cst)

66.250.40.33:24441      (200, 'OK')
66.250.40.33:24441      (200, 'OK')
66.250.40.33:24441      (200, 'OK')
66.250.40.33:24441      (200, 'OK')
66.250.40.33:24441      (200, 'OK')
66.250.40.33:24441      TimeoutError: 
66.250.40.33:24441      ProtocolError: received unexpected thread id 49413 (expected 2599)
66.250.40.33:24441      ProtocolError: received unexpected thread id 2599 (expected 44826)
66.250.40.33:24441      ProtocolError: received unexpected thread id 44826 (expected 11729)
MailboxDigester: exceptions.ValueError : unknown Content-Transfer-Encoding: binary
66.250.40.33:24441      ProtocolError: received unexpected thread id 11729 (expected 39862)
66.250.40.33:24441      ProtocolError: received unexpected thread id 39862 (expected 30434)
66.250.40.33:24441      ProtocolError: received unexpected thread id 30434 (expected 27662)
66.250.40.33:24441      ProtocolError: received unexpected thread id 27662 (expected 30607)
66.250.40.33:24441      ProtocolError: received unexpected thread id 30607 (expected 23630)
66.250.40.33:24441      ProtocolError: received unexpected thread id 23630 (expected 14675)
66.250.40.33:24441      ProtocolError: received unexpected thread id 14675 (expected 45948)
66.250.40.33:24441      ProtocolError: received unexpected thread id 45948 (expected 14144)
66.250.40.33:24441      ProtocolError: received unexpected thread id 14144 (expected 24746)
66.250.40.33:24441      ProtocolError: received unexpected thread id 24746 (expected 13469)
66.250.40.33:24441      ProtocolError: received unexpected thread id 13469 (expected 21110)
66.250.40.33:24441      ProtocolError: received unexpected thread id 21110 (expected 5484)
66.250.40.33:24441      ProtocolError: received unexpected thread id 5484 (expected 10436)
.....

The old server didn't have this problem.

Duane

Re: URGENT: trouble with pyzor + spamassassin

[Duane V. <du...@io...>]

On Fri, Nov 07, 2003 at 02:04:28PM -0500, re...@th... wrote:
> I have been running pyzor successfully for some time. Then recently
> spamassassin has been causing horrible delays in mail delivery. After
> viewing some debug output, it is apparent that there is a large delay
> after the following:
> 
> Pyzor is available: /usr/bin/pyzor
> entering helper-app run mode
> 
> 
> Does anyone know how to correct this, or at least how to disable pyzor so
> that spamassassin is not delaying mail horribly?

Faced with a spamassassin vs. pyzor choice I ran as fast as possible
*away* from that mass of Perl code...  :)

Pyzor works way better for me than SA.

Duane

Re: URGENT: trouble with pyzor + spamassassin

[Frank T. <ft...@ne...>]

re...@th..., on 2003-11-07, wrote:

> Thanks Chris, I strongly suspect the IP I have did not update for some
> reason. The IP I show is 66.92.49.157:24441
> 
> Would you mind checking which one you have?
> 
> I imagine if all else fails I can just manually change it...

Simply run
	echo "66.250.40.33:24441" > ~/.pyzor/servers

-- 
Frank Tobin			http://www.neverending.org/~ftobin/

Re: URGENT: trouble with pyzor + spamassassin

[<re...@th...>]

On Fri, 7 Nov 2003, Chris Myers wrote:

> ----- Original Message -----
> From: <re...@th...>
> To: <pyz...@li...>
> Sent: Friday, November 07, 2003 1:04 PM
> Subject: URGENT: trouble with pyzor + spamassassin
>
>
> > I have been running pyzor successfully for some time. Then recently
> > spamassassin has been causing horrible delays in mail delivery. After
> > viewing some debug output, it is apparent that there is a large delay
> > after the following:
> >
> > Pyzor is available: /usr/bin/pyzor
> > entering helper-app run mode
> >
> > Does anyone know how to correct this, or at least how to disable pyzor so
> > that spamassassin is not delaying mail horribly?
>
> As noted in this mailing list a few days ago, the Pyzor server changed IP
> addresses.  If you didn't get the updated server IP address with 'pyzor
> discover', that would be the cause of your problem.
>
> Try 'pyzor discover' and change "score PYZOR_CHECK" back to the proper
> score.
>
> Chris Myers
> Networks By Design
>
>
>

Thanks Chris, I strongly suspect the IP I have did not update for some
reason. The IP I show is 66.92.49.157:24441

Would you mind checking which one you have?

I imagine if all else fails I can just manually change it...


-Ron
>
> -------------------------------------------------------
> This SF.Net email sponsored by: ApacheCon 2003,
> 16-19 November in Las Vegas. Learn firsthand the latest
> developments in Apache, PHP, Perl, XML, Java, MySQL,
> WebDAV, and more! http://www.apachecon.com/
> _______________________________________________
> pyzor-users mailing list
> pyz...@li...
> https://lists.sourceforge.net/lists/listinfo/pyzor-users
>

Re: URGENT: trouble with pyzor + spamassassin

[Chris M. <ch...@by...>]

----- Original Message ----- 
From: <re...@th...>
To: <pyz...@li...>
Sent: Friday, November 07, 2003 1:04 PM
Subject: URGENT: trouble with pyzor + spamassassin


> I have been running pyzor successfully for some time. Then recently
> spamassassin has been causing horrible delays in mail delivery. After
> viewing some debug output, it is apparent that there is a large delay
> after the following:
>
> Pyzor is available: /usr/bin/pyzor
> entering helper-app run mode
>
> Does anyone know how to correct this, or at least how to disable pyzor so
> that spamassassin is not delaying mail horribly?

As noted in this mailing list a few days ago, the Pyzor server changed IP
addresses.  If you didn't get the updated server IP address with 'pyzor
discover', that would be the cause of your problem.

Try 'pyzor discover' and change "score PYZOR_CHECK" back to the proper
score.

Chris Myers
Networks By Design

Re: URGENT: trouble with pyzor + spamassassin

[<re...@th...>]

Thanks very much, Seth.

On 7 Nov 2003, Seth wrote:

> In SpamAssassin, you can enter the following line into your
> /etc/mail/spamassassin/local.cf file:
>
> score PYZOR_CHECK 0
>
> This will cause SpamAssassin to not use pyzor.
>
> Seth McClain
>
> On Fri, 2003-11-07 at 12:04, re...@th... wrote:
> > Dear All,
> >
> > I have been running pyzor successfully for some time. Then recently
> > spamassassin has been causing horrible delays in mail delivery. After
> > viewing some debug output, it is apparent that there is a large delay
> > after the following:
> >
> > Pyzor is available: /usr/bin/pyzor
> > entering helper-app run mode
> >
> >
> > Does anyone know how to correct this, or at least how to disable pyzor so
> > that spamassassin is not delaying mail horribly?
> >
> > Thanks in advance.
> >
> > -Ron
> >
> >
> >
> > -------------------------------------------------------
> > This SF.Net email sponsored by: ApacheCon 2003,
> > 16-19 November in Las Vegas. Learn firsthand the latest
> > developments in Apache, PHP, Perl, XML, Java, MySQL,
> > WebDAV, and more! http://www.apachecon.com/
> > _______________________________________________
> > pyzor-users mailing list
> > pyz...@li...
> > https://lists.sourceforge.net/lists/listinfo/pyzor-users
>
>
>
> -------------------------------------------------------
> This SF.Net email sponsored by: ApacheCon 2003,
> 16-19 November in Las Vegas. Learn firsthand the latest
> developments in Apache, PHP, Perl, XML, Java, MySQL,
> WebDAV, and more! http://www.apachecon.com/
> _______________________________________________
> pyzor-users mailing list
> pyz...@li...
> https://lists.sourceforge.net/lists/listinfo/pyzor-users
>

Re: URGENT: trouble with pyzor + spamassassin

[Seth <smc...@mo...>]

In SpamAssassin, you can enter the following line into your
/etc/mail/spamassassin/local.cf file:

score PYZOR_CHECK 0

This will cause SpamAssassin to not use pyzor.

Seth McClain

On Fri, 2003-11-07 at 12:04, re...@th... wrote:
> Dear All,
> 
> I have been running pyzor successfully for some time. Then recently
> spamassassin has been causing horrible delays in mail delivery. After
> viewing some debug output, it is apparent that there is a large delay
> after the following:
> 
> Pyzor is available: /usr/bin/pyzor
> entering helper-app run mode
> 
> 
> Does anyone know how to correct this, or at least how to disable pyzor so
> that spamassassin is not delaying mail horribly?
> 
> Thanks in advance.
> 
> -Ron
> 
> 
> 
> -------------------------------------------------------
> This SF.Net email sponsored by: ApacheCon 2003,
> 16-19 November in Las Vegas. Learn firsthand the latest
> developments in Apache, PHP, Perl, XML, Java, MySQL,
> WebDAV, and more! http://www.apachecon.com/
> _______________________________________________
> pyzor-users mailing list
> pyz...@li...
> https://lists.sourceforge.net/lists/listinfo/pyzor-users

URGENT: trouble with pyzor + spamassassin

[<re...@th...>]

Dear All,

I have been running pyzor successfully for some time. Then recently
spamassassin has been causing horrible delays in mail delivery. After
viewing some debug output, it is apparent that there is a large delay
after the following:

Pyzor is available: /usr/bin/pyzor
entering helper-app run mode


Does anyone know how to correct this, or at least how to disable pyzor so
that spamassassin is not delaying mail horribly?

Thanks in advance.

-Ron

Thanks

[<pyz...@nr...>]

On my little mail server, I get about 250 spam messages a day. I =
installed
Pyzor and SA two months ago and I freakin' love it. Pyzor detects half =
and
spamassasin detects the other half. I have yet to see a false positive =
from
Pyzor.

Thanks,
Sean

new pyzor host

[Frank T. <ft...@ne...>]

The current pyzor host went down earlier today, and the sysadmin is
unfortunately unavailable, so I've moved it to a new host, courtesy of
Brent Holmes.

Simply run 'pyzor discover' and all will be good.

-- 
Frank Tobin			http://www.neverending.org/~ftobin/

Re: Listed

[Kelson V. <ke...@sp...>]

On Friday 31 October 2003 3:57 pm, batje wrote:
> I'm listed! I didn't do anything, this is just my private email address,
> and has been for 10 years.

Just to clarify - Pyzor doesn't even look at the email address used, because 
it's so often faked.  *You* are not listed and cannot be.  Pyzor only looks 
at the actual body of the message.

-- 
Kelson Vibber
SpeedGate Communications, www.speed.net

Re: Listed

[Frank T. <ft...@ne...>]

batje, on 2003-11-01, wrote:

> My ISP is using SpamAssasin, which in turn is using Pyzor. Now tonight I
> sent myself an email from Outlook Express, with an empty body and a
> subject of 'CD Josso' (it was a reminder) and the SpamAssasin report
> said:
>  3.5 PYZOR_CHECK            Listed in Pyzor (http://pyzor.sf.net/)

Due to a bug, empty messages are treated no differently than any other 
message.  Actually, it normally raises a TypeError, which leads me to 
believe that the message wasn't actually empty, but could have had some 
HTML junk in it that confused Pyzor.

-- 
Frank Tobin			http://www.neverending.org/~ftobin/

Listed

[batje <ba...@dd...>]

Hi,

My ISP is using SpamAssasin, which in turn is using Pyzor. Now tonight I =
sent myself an email from Outlook Express, with an empty body and a =
subject of 'CD Josso' (it was a reminder) and the SpamAssasin report =
said:
 3.5 PYZOR_CHECK            Listed in Pyzor (http://pyzor.sf.net/)

I'm listed! I didn't do anything, this is just my private email address, =
and has been for 10 years. Does anyone know how I can be unlisted again? =
I checked the website, but it doesn't mention anything.

rgds,

reinier    

Re: Questions about auto-submitting from spam traps (and trust) (fwd)

[Duane V. <du...@io...>]

On Fri, Sep 26, 2003 at 07:20:04PM -0400, Frank Tobin wrote:
> Justin Shore, on 2003-09-26, wrote:
> 
> > That makes sense.  One question I've always had but never asked is how 
> > much of the message does Pyzor use?  Is it just the body, subject + body, 
> > or everything? 
> 
> Soley the body.
> 
> > I wonder if it would be possible to have an online stats system that
> > would list by userid that submitters stats such as total submitted,
> > total spam/ham, daily totals, messages rejected (if they are), etc..  
> > Would that be a possible future project?
> 
> It's certainly possible, currently I could simply track by IP, but the
> logfiles are pretty *huge*.  Such stats would be easily manipulable.

Well hang on, if I were a spammer I'd be trying my level best to
find out how my messages are getting into the server.  Right now
debugging a list of "millions of working email addresses" is as
daunting as it should be for these er.. characters.  The less they
know the better.

Now, emailing stats back to subscribers might be useful...

duane

Re: Pyzord usage and info

[Justin S. <lis...@nu...>]

On Fri, 26 Sep 2003, Frank Tobin wrote:

> pyzord would be useful if you wanted to run your own server, independent
> of the public server.  Situations where this might be desirable are when 
> you want to be *sure* that only messages you submit are tagged by pyzor.

Thanks for the info.  I doubt I want to do this.  It somewhat defeats my 
goals.  Anyhow, I'm going back to packing.  Joy....

Justin

Re: Pyzord usage and info

[Frank T. <ft...@ne...>]

Justin Shore, on 2003-09-26, wrote:

> Can anyone explain Pyzord to me?  I'm wondering if I should be running
> the server on my system since I make thousands of submissions daily.  
> How does it affect load?  Is it really the best way to go in the long
> wrong?  etc etc etc...  The docs were really sparse on information about
> it.  Thanks

pyzord would be useful if you wanted to run your own server, independent
of the public server.  Situations where this might be desirable are when 
you want to be *sure* that only messages you submit are tagged by pyzor.

-- 
Frank Tobin			http://www.neverending.org/~ftobin/

Re: Questions about auto-submitting from spam traps (and trust) (fwd)

[Frank T. <ft...@ne...>]

Justin Shore, on 2003-09-26, wrote:

> That makes sense.  One question I've always had but never asked is how 
> much of the message does Pyzor use?  Is it just the body, subject + body, 
> or everything? 

Soley the body.

> I wonder if it would be possible to have an online stats system that
> would list by userid that submitters stats such as total submitted,
> total spam/ham, daily totals, messages rejected (if they are), etc..  
> Would that be a possible future project?

It's certainly possible, currently I could simply track by IP, but the
logfiles are pretty *huge*.  Such stats would be easily manipulable.

-- 
Frank Tobin			http://www.neverending.org/~ftobin/

Pyzord usage and info

[Justin S. <lis...@nu...>]

Can anyone explain Pyzord to me?  I'm wondering if I should be running the 
server on my system since I make thousands of submissions daily.  How does 
it affect load?  Is it really the best way to go in the long wrong?  etc 
etc etc...  The docs were really sparse on information about it.  Thanks

Justin

Re: Questions about auto-submitting from spam traps (and trust) (fwd)

[Justin S. <lis...@nu...>]

On Thu, 25 Sep 2003, Frank Tobin wrote:

> Simply reporting is fine.  If someone is looking at the count of reports 
> in the pyzor database, you will contribute to their knowledge.
>
> > When my spamtraps get spammed I tend to get hundreds or thousands of
> > copies of the same spam.  They come from different proxies all over the
> > world but they have the same body.  I don't know of a way for me to
> > filter out duplicates in an auto-submission process.  I don't know if
> > it's a possibility at all.
> 
> Don't worry about duplicates.  If you really wanted to avoid it, though, 
> it's easiy with formail (part of procmail); it has a built-in capability.

That makes sense.  One question I've always had but never asked is how 
much of the message does Pyzor use?  Is it just the body, subject + body, 
or everything?  Since I'm running numerous spamtraps on the same domains I 
tend to get hundreds or thousands of copies of the same spam from hundreds 
or thousands of open proxies globally.  If only the body is used then 
perhaps I should be using formail to weed out the dupes and save the load 
on your server(s) and my own.

> Pyzor really can't provide you with any such feedback.  I admit it is
> definitely a desirable charactistic of volunteer-based systems.  I'll 
> try to keep it in mind.

The only real feedback I need is to know that the message was accepted.  
I had trouble getting razor set up in the beginning.  Now I can see
message accepted entries in it's log.  That helped.  As long as I know the
messages are received then all is fine by me.  Of course it would also be
good to know if the submissions were rejected later though.  I wonder if
it would be possible to have an online stats system that would list by
userid that submitters stats such as total submitted, total spam/ham,
daily totals, messages rejected (if they are), etc..  Would that be a
possible future project?

Anyhow, thanks for the reply
 Justin

Re: Questions about auto-submitting from spam traps (and trust) (fwd)

[Frank T. <ft...@ne...>]

Justin Shore, on 2003-09-25, wrote:

> This is a good question.  Should incoming mail be "checked" first to see
> if it is already known or should it just be submitted regardless?  I
> currently have a procmail recipe that reports incoming spam with
> spamassassin -r and 'pyzor report.' Knowing what is preferred here would
> be a big help.

Simply reporting is fine.  If someone is looking at the count of reports 
in the pyzor database, you will contribute to their knowledge.

> When my spamtraps get spammed I tend to get hundreds or thousands of
> copies of the same spam.  They come from different proxies all over the
> world but they have the same body.  I don't know of a way for me to
> filter out duplicates in an auto-submission process.  I don't know if
> it's a possibility at all.

Don't worry about duplicates.  If you really wanted to avoid it, though, 
it's easiy with formail (part of procmail); it has a built-in capability.

> Agreed.  I'm doing this as a service to the community.  It would be nice
> to know if what I'm doing is actually getting through and having any
> effect.  Suggestions?

Pyzor really can't provide you with any such feedback.  I admit it is
definitely a desirable charactistic of volunteer-based systems.  I'll 
try to keep it in mind.

-- 
Frank Tobin			http://www.neverending.org/~ftobin/