Hmm.. 2 q's

Hmm.. 2 q's

[Markus Stenberg]

First off, is there any way to make a _really_ ugly kind of filter,
i.e. for all .com From/messageid's, if messageid's domain does not match
from's domain, drop score by say -500? The reason I'm asking for this is
that all the stupid spam fits those criteria, and I _really_ despise spam.

Secondly, how to get rid of duplicate group? One just surfaced in my Gnus
5.4.5something out of thin air.. C-k kills both, u unsubscribes
both. Ideas? (and no, .newsrc.eld IS too ugly for me to edit it by hand)

- Markus

Re: Hmm.. 2 q's

[Andy Eskilsson]

/ Markus Stenberg <mstenber@cc.Helsinki.FI> wrote:
| 
| Secondly, how to get rid of duplicate group? One just surfaced in my Gnus
| 5.4.5something out of thin air.. C-k kills both, u unsubscribes
| both. Ideas? (and no, .newsrc.eld IS too ugly for me to edit it by hand)

Kill both, and then yank one of them.. (two C-k and one C-y)

	/a

p.s. Just my thoughts about the Quassia Gnus merchandise.. I would
like both, guess we get caps to next Gnus? (when shall we start
figuring out that name..?)

Ahh well I can only hope it will be a large mug/cup.. Hmm nice
idea.. I am sitting by the breakfast table reading gnus with my mug
and drinking from my computer.. or ;-)

-- 
 Hi I am an alien .sig, and at the moment I am having sex to your
 mind, by looking at your smile I can see that you like it.

 Unsolicited commercial email is subject to an archival fee of $400.
 See <http://www.fukt.hk-r.se/~flognat/mail/> for more info.

Re: Hmm.. 2 q's

[Markus Stenberg]

Stainless Steel Rat <ratinox@peorth.gweep.net> writes:
> -----BEGIN PGP SIGNED MESSAGE-----
> >>>>> "MS" == Markus Stenberg <mstenber@cc.Helsinki.FI> writes:
> MS> First off, is there any way to make a _really_ ugly kind of filter,
> MS> i.e. for all .com From/messageid's, if messageid's domain does not match
> MS> from's domain, drop score by say -500?
> Bad idea: there is no requirement that a Message-ID string contain a domain
> name.  The only significant requirement is that every Message-ID be unique,
> so it is common to use things like user name, current time, and the FQDN of
> the machine, but none of these are required.

True. I, on other hand, don't care too much about hitting accidentally
non-spam news posts with my spam-filters.

> MS> The reason I'm asking for this is that all the stupid spam fits those
> MS> criteria, and I _really_ despise spam.
> Better to block spam at the MTA; <URL:http://www.sendmail.org/> has details.

Yes, I know ; however, the issue was matter of news-posts, not mail (sorry
if I didn't specify it) ; our domain does MTA filtering and I'm running
NAGS filter additionally, haven't seen spam-mail in a month or so.

> -- 
> Rat <ratinox@peorth.gweep.net>    \ Happy Fun Ball may stick to certain types
> PGP Key: at a key server near you! \ of skin.
>                                     \ 

- Markus

Re: Hmm.. 2 q's

[Aaron M. Ucko]

Markus Stenberg <mstenber@cc.Helsinki.FI> writes:

> Secondly, how to get rid of duplicate group? One just surfaced in my Gnus
> 5.4.5something out of thin air.. C-k kills both, u unsubscribes
> both. Ideas? (and no, .newsrc.eld IS too ugly for me to edit it by hand)

You're using topic mode, I assume?  gnus-topic-remove-group (T D)
should let you remove one copy.

-- 
Aaron M. Ucko (amu@mit.edu) | For Geek Code, PGP public key, and other info,
finger amu@monk.mit.edu. | "Kids! Bringing about Armageddon can be dangerous.
Do not attempt it in your home." -- T. Pratchett & N. Gaiman, _Good Omens_

Re: Hmm.. 2 q's

[Scott Blachowicz]

Stainless Steel Rat <ratinox@peorth.gweep.net> wrote:

> Bad idea: there is no requirement that a Message-ID string contain a domain
> name.  The only significant requirement is that every Message-ID be unique,

Are there requirements on the message-id as far as legal characters &
such?  (e.g. maybe there should be precisely one @ character?) I've been
doing some filtering on message-id's in my mailagent rules:

    Message-ID: /\<[^\@]*\>/, /\@.*\@/, /\S.*\</, /\>.*\S/, /^[^<]*$/, /^[^>]*$/ {
        # Spam
        ANNOTATE X-trashed-by bogus-message-id;
        SAVE +trash; ABORT -t;         
    };

which matches:

    1) no @ between the <...>.
    2) 2 @'s
    3) junk before a <
    4) junk after a >
    5) no <
    6) no >

and picks up a few matches, but I've also gotten some hits on match #2 for
non-spam email, so I'm not so sure.

Scott Blachowicz  Ph: 206/283-8802x240   Mathsoft (Data Analysis Products Div)
                                         1700 Westlake Ave N #500
scott@statsci.com                        Seattle, WA USA   98109
Scott.Blachowicz@seaslug.org

Re: Hmm.. 2 q's

[Randal Schwartz]

>>>>> "Scott" == Scott Blachowicz <scott@statsci.com> writes:

Scott>     1) no @ between the <...>.
Scott>     2) 2 @'s
Scott>     3) junk before a <
Scott>     4) junk after a >
Scott>     5) no <
Scott>     6) no >

Scott> and picks up a few matches, but I've also gotten some hits on
Scott> match #2 for non-spam email, so I'm not so sure.

I don't believe there are any requirements that the left side of a
message ID be non-@.  I could be wrong. :-)

I know the *right* side (or rightmost side if multiple) of the @
has to be a valid hostname, so you could filter on (perl regex):

	Message-Id: !/\@([-a-zA-Z0-9]+\.)+[a-zA-Z]{2,3})$/ { DELETE; }

and be pretty close.  (And yes, no _ in hostnames, please. :-)

-- 
Name: Randal L. Schwartz / Stonehenge Consulting Services (503)777-0095
Keywords: Perl training, UNIX[tm] consulting, video production, skiing, flying
Email: <merlyn@stonehenge.com> Snail: (Call) PGP-Key: (finger merlyn@ora.com)
Web: <A HREF="http://www.stonehenge.com/merlyn/">My Home Page!</A>
Quote: "I'm telling you, if I could have five lines in my .sig, I would!" -- me

Re: Hmm.. 2 q's

[Karl Kleinpaste]

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain, Size: 2089 bytes --]

Stainless Steel Rat <ratinox@peorth.gweep.net> writes:
> there is no requirement that a Message-ID string contain a domain name.

Yes, there is.  RFC822, page 44, appendix D, syntax rule listing:

     optional-field =
		 /  "Message-ID"        ":"   msg-id
     msg-id      =  "<" addr-spec ">"            ; Unique message id
     addr-spec   =  local-part "@" domain        ; global address
     domain      =  sub-domain *("." sub-domain)
     sub-domain  =  domain-ref / domain-literal
     domain-literal =  "[" *(dtext / quoted-pair) "]"
     domain-ref  =  atom                         ; symbolic reference
     atom        =  1*<any CHAR except specials, SPACE and CTLs>

Lest anyone think this allows OWHN (one-word hostnames) on the
right-hand side of `@' (which was OK in RFC822's pre-DNS days), note
the "global address" comment above on addr-spec -- a OWHN was
sufficiently "global", prior to DNS -- and see that RFC1123 expressly
denies this in §5.2.18 anyhow:

         Errors in formatting or parsing 822 addresses are unfortunately
         common.  This section mentions only the most common errors.  A
         User Agent MUST accept all valid RFC-822 address formats, and
         MUST NOT generate illegal address syntax.
	 ...
         o    Some systems fail to fully-qualify domain names in
              messages they generate.  The right-hand side of an "@"
              sign in a header address field MUST be a fully-qualified
              domain name.
	      ...
              DISCUSSION:
                   Although RFC-822 allows the local use of abbreviated
                   domain names within a domain, the application of
                   RFC-822 in Internet mail does not allow this.  The
                   intent is that an Internet host must not send an SMTP
                   message header containing an abbreviated domain name
                   in an address field.  This allows the address fields
                   of the header to be passed without alteration across
                   the Internet, as required in Section 5.2.6.

--karl

Re: Hmm.. 2 q's

[Paul Franklin]

>>>>> Scott Blachowicz writes:

 > Are there requirements on the message-id as far as legal characters &
 > such?  (e.g. maybe there should be precisely one @ character?) I've been
 > doing some filtering on message-id's in my mailagent rules:

 >     1) no @ between the <...>.
 >     5) no <
 >     6) no >

I get headers like the following from a X.400-SMTP gateway:

In-Reply-To: r9qbu4bo1rd.fsf(a)maryanne.cs.washington.edu
Message-ID: <BAU-VCVARU>

I have no idea how they could guarantee that that message id is
unique.

Sigh,

--Paul

Re: Hmm.. 2 q's

[Scott Blachowicz]

merlyn@stonehenge.com said:
> 	Message-Id: !/\@([-a-zA-Z0-9]+\.)+[a-zA-Z]{2,3})$/ { DELETE; } 

And, if you use that, you might want to correct a typo...

	Message-id: !/\@([-a-zA-Z0-9]+\.)+[a-zA-Z]{2,3}\>\s*$/

(note the ">" instead of that last ")") before all your mail disappears. :-)

Karl Kleinpaste <karl@jprc.com> wrote:

> Yes, there is.  RFC822, page 44, appendix D, syntax rule listing:
> 
>      optional-field =
> 		 /  "Message-ID"        ":"   msg-id
>      msg-id      =  "<" addr-spec ">"            ; Unique message id
>      addr-spec   =  local-part "@" domain        ; global address
>      domain      =  sub-domain *("." sub-domain)
>      sub-domain  =  domain-ref / domain-literal
>      domain-literal =  "[" *(dtext / quoted-pair) "]"
>      domain-ref  =  atom                         ; symbolic reference
>      atom        =  1*<any CHAR except specials, SPACE and CTLs>

Which means that something like

	Message-ID: <2342342@[123.45.67.89]>

using the `domain-literal' form would be legal too, right?

Scott Blachowicz  Ph: 206/283-8802x240   Mathsoft (Data Analysis Products Div)
                                         1700 Westlake Ave N #500
scott@statsci.com                        Seattle, WA USA   98109
Scott.Blachowicz@seaslug.org

Re: Hmm.. 2 q's

[Karl Kleinpaste]

Scott Blachowicz <scott@statsci.com> writes:
> Which means that something like
> 	Message-ID: <2342342@[123.45.67.89]>
> using the `domain-literal' form would be legal too, right?

Yup.

spam filtering on message-id (was: Hmm.. 2 q's)

[Michael R Cook]

>>>>> "RS" == Randal Schwartz <merlyn@stonehenge.com> writes:

 RS> I know the *right* side (or rightmost side if multiple) of the @
 RS> has to be a valid hostname, so you could filter on (perl regex):

 RS> 	Message-Id: !/\@([-a-zA-Z0-9]+\.)+[a-zA-Z]{2,3})$/ { DELETE; }

 RS> and be pretty close.  (And yes, no _ in hostnames, please. :-)

Unfortunately, I get a good amount of non-spam that has invalid
message-ids.  So much for standards. :-(

This (perl) pattern seems to work quite well, though:

   /<\S+\@\S+>/

I grepped all my unexpired mail, and got only two false hits.  It found many
messages in my `spam' folder.

Re: spam filtering on message-id (was: Hmm.. 2 q's)

[Ken Raeburn]

Michael R Cook <mcook@cognex.com> writes:

> >>>>> "RS" == Randal Schwartz <merlyn@stonehenge.com> writes:
>  RS> I know the *right* side (or rightmost side if multiple) of the @
>  RS> has to be a valid hostname, so you could filter on (perl regex):
>  RS> 	Message-Id: !/\@([-a-zA-Z0-9]+\.)+[a-zA-Z]{2,3})$/ { DELETE; }
> Unfortunately, I get a good amount of non-spam that has invalid
> message-ids.  So much for standards. :-(

So maybe the solution is not to discard, but to bounce, thus pestering
people with broken configs.

For that matter, anyone have Gnus code to generate an official-looking
"bounce" reply to a message?

Re: spam filtering on message-id (was: Hmm.. 2 q's)

[Michael R Cook]

>>>>> "KR" == Ken Raeburn <raeburn@cygnus.com> writes:

 KR> So maybe the solution is not to discard, but to bounce, thus pestering
 KR> people with broken configs.

Most of the invalid message-ids come via mailing lists.
Bouncing would usually have the affect of getting me
auto-unsubscribed from those lists.

Re: spam filtering on message-id (was: Hmm.. 2 q's)

[Ken Raeburn]

Michael R Cook <mcook@cognex.com> writes:

> >>>>> "KR" == Ken Raeburn <raeburn@cygnus.com> writes:
> 
>  KR> So maybe the solution is not to discard, but to bounce, thus pestering
>  KR> people with broken configs.
> 
> Most of the invalid message-ids come via mailing lists.
> Bouncing would usually have the affect of getting me
> auto-unsubscribed from those lists.

Well, that's when you want to be able to do the bouncing manually, so
you can direct it to the original sender.