Anti-Spam: honoring gnu.org's X-Spam-Status

Anti-Spam: honoring gnu.org's X-Spam-Status

[Gerald Pfeifer]

The following message (injected to gcc@gcc.gnu.org via gcc@gnu.org)
carried a  X-Spam-Status: Yes  added by the gnu.org mail system.

Would it be hard to honor this header and refuse such messages?

(I noticed it, because my own mail system then generated a bounce
based on that header, which in turn caused ezml to warn...)

Gerald

---- message ----

Return-Path: <gcc-return-67756-pfeifer=dbai.tuwien.ac.at@gcc.gnu.org>
Received: from sources.redhat.com (sources.redhat.com [66.187.233.205])
	by vexpert.dbai.tuwien.ac.at (8.12.6/8.12.6) with SMTP id h18BwQFB025935
	for <pfeifer@dbai.tuwien.ac.at>; Sat, 8 Feb 2003 12:58:26 +0100 (CET)
Received: (qmail 1213 invoked by alias); 8 Feb 2003 11:58:05 -0000
Mailing-List: contact gcc-help@gcc.gnu.org; run by ezmlm
Precedence: bulk
List-Unsubscribe: <mailto:gcc-unsubscribe-pfeifer=dbai.tuwien.ac.at@gcc.gnu.org>
List-Archive: <http://gcc.gnu.org/ml/gcc/>
List-Post: <mailto:gcc@gcc.gnu.org>
List-Help: <http://gcc.gnu.org/ml/>
Sender: gcc-owner@gcc.gnu.org
Delivered-To: mailing list gcc@gcc.gnu.org
Received: (qmail 1186 invoked from network); 8 Feb 2003 11:57:59 -0000
Received: from unknown (HELO fencepost.gnu.org) (199.232.76.164)
  by 172.16.49.205 with SMTP; 8 Feb 2003 11:57:59 -0000
Received: from monty-python.gnu.org ([199.232.76.173])
	by fencepost.gnu.org with esmtp (Exim 4.10)
	id 18hTcK-0003Ri-00
	for gcc@gnu.org; Sat, 08 Feb 2003 06:57:56 -0500
Received: from mail by monty-python.gnu.org with spam-scanned (Exim 4.10.13)
	id 18hTZM-0005pJ-00
	for gcc@gnu.org; Sat, 08 Feb 2003 06:54:53 -0500
Received: from gnudist.gnu.org ([199.232.41.7])
	by monty-python.gnu.org with esmtp (Exim 4.10.13)
	id 18hTXc-0005Wc-00
	for gcc@gnu.org; Sat, 08 Feb 2003 06:53:04 -0500
Received: from 66-178-47-198.reverse.newskies.net ([66.178.47.198] helo=helimore617.com)
	by gnudist.gnu.org with smtp (Exim 4.10.13)
	id 18hTXY-0005Ak-00
	for gcc@gnu.org; Sat, 08 Feb 2003 06:53:01 -0500
From: "Mr. Charles Ugboko," <ccdas@yahoo.com>
Reply-To: mrcharles_ugboko@mailsurf.com
To: gcc@gnu.org
Date: Sat, 8 Feb 2003 12:52:46 +0100
Subject: acknowledge
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Message-Id: <E18hTXY-0005Ak-00@gnudist.gnu.org>
X-Spam-Status: Yes, hits=11.4 required=5.0
	tests=DEAR_SOMEBODY,DEAR_SOMETHING,FORGED_YAHOO_RCVD,
	      LINES_OF_YELLING,MIME_LONG_LINE_QP,NIGERIAN_TRANSACTION_2,
	      RATWARE_OE_MALFORMED,SPAM_PHRASE_05_08,SUPERLONG_LINE,
	      US_DOLLARS,US_DOLLARS_3
	version=2.41
X-Spam-Flag: YES
X-Spam-Level: ***********
X-Spam-Checker-Version: SpamAssassin 2.41 (1.115.2.8-2002-09-05-exp)
X-Spam-Report:   11.40 hits, 5 required;
  *  4.4 -- X-Mailer contains malformed Outlook Express version
  * -1.0 -- BODY: Contains 'Dear Somebody'
  *  2.6 -- BODY: Nigerian scam key phrase (million dollars)
  *  2.1 -- BODY: Nigerian scam key phrase ($NN,NNN,NNN.NN)
  *  1.0 -- BODY: Contains 'Dear (something)'
  *  0.1 -- BODY: illegal Nigerian transactions (2)
  *  0.7 -- BODY: Spam phrases score is 05 to 08 (medium)
            [score: 6]
  *  0.3 -- BODY: A WHOLE LINE OF YELLING DETECTED
  * -2.2 -- BODY: Contains a line >=199 characters long
  *  2.0 -- RAW: Quoted-printable line longer than 76 characters
  *  1.4 -- 'From' yahoo.com does not match 'Received' headers

Re: Anti-Spam: honoring gnu.org's X-Spam-Status

[Jason Molenda]

On Thu, Feb 20, 2003 at 09:53:51AM +0100, Gerald Pfeifer wrote:
> The following message (injected to gcc@gcc.gnu.org via gcc@gnu.org)
> carried a  X-Spam-Status: Yes  added by the gnu.org mail system.

Hm, looks like the folks at gnu.org have spamassassin jacked in to
their MTA.

> Would it be hard to honor this header and refuse such messages?

I can't remember a facility for doing that in normal ezmlm, but
I'm sure we could cook something up.  But every note relayed through
gcc@gnu.org is going to have that header.   Your e-mail had this
header when it got through my own spamassassin filter:

  X-Spam-Status: No, hits=0.3 required=7.0
          tests=DEAR_SOMEBODY,SPAM_PHRASE_00_01,USER_AGENT_PINE
          version=2.43
  X-Spam-Level:

> (I noticed it, because my own mail system then generated a bounce
> based on that header, which in turn caused ezml to warn...)

This part I don't really understand.  Your mail system generated
a bounce because of an X-* header?  Or your mail system detects
the spamassassin spam-level markers and bounces the note?

J

Re: Anti-Spam: honoring gnu.org's X-Spam-Status

[Gerald Pfeifer]

On Thu, 20 Feb 2003, Jason Molenda wrote:
> Hm, looks like the folks at gnu.org have spamassassin jacked in to
> their MTA.

Yup.

>> Would it be hard to honor this header and refuse such messages?
> I can't remember a facility for doing that in normal ezmlm, but
> I'm sure we could cook something up.  But every note relayed through
> gcc@gnu.org is going to have that header.   Your e-mail had this
> header when it got through my own spamassassin filter:
>
>   X-Spam-Status: No, hits=0.3 required=7.0

Yeah, but mine has X-Spam-Status: No ;-), while I was suggesting to
filter based on X-Spam-Status: Yes.

> This part I don't really understand.  Your mail system generated
> a bounce because of an X-* header?  Or your mail system detects
> the spamassassin spam-level markers and bounces the note?

The former.  (Well, actually not the core mail system, but my procmail
recipes where I filter for X-Spam headers added by the gnu.org servers;
the spam ratio for my gerald@gnu.org address is way above 95%. :-( )

Gerald
-- 
Gerald "Jerry"   pfeifer@dbai.tuwien.ac.at   http://www.pfeifer.com/gerald/

Re: Anti-Spam: honoring gnu.org's X-Spam-Status

[Jason Molenda]

On Thu, Feb 20, 2003 at 02:51:52PM +0100, Gerald Pfeifer wrote:

> >   X-Spam-Status: No, hits=0.3 required=7.0
> 
> Yeah, but mine has X-Spam-Status: No ;-), while I was suggesting to
> filter based on X-Spam-Status: Yes.

The tricky part is that the default spamassassin config marks it as
spam if it ranks 7 or higher.  In my own config I don't dump it into
a spam box until it rates 15 or higher -- IMHO it's too easy to get
false positives at 7.

> The former.  (Well, actually not the core mail system, but my procmail
> recipes where I filter for X-Spam headers added by the gnu.org servers;


So instead of modifying the entire gcc list behavior to drop these
e-mails, I have another potential suggestion for handling this
problem. :-) :-)

I'm not the spam-king on sourceware these days - I'd leave any
decisions about changes up to Chris.  I _assume_ Chris doesn't use
spamassassin because of speed issues and issues with false positives.
If gnu.org is doing the markup, then the only issue would be false
positives, and that can be addressed well enough by requiring a
higher spam level before dropping a note.  

Let's say we added a filter that dropped notes with a spamassassin
score of 15 or higher -- there would still be the class of notes
that rank 7 to 15, which get the X-Spam: Yes header.  So unless all
notes ranked 7 or higher are dropped, you're going to need to change
your procmail setup.

I don't mean to put words in Chris' mouth here, but that's my read of
the situation.

J