Spam despite spam header

Spam despite spam header

[Emanuel Berg]

I have for some reason been getting spam lately, even
though the headers contain information it is spam. If
the below metadata indicates it is spam (as I think it
does), how do I tell Gnus *not* to put those messages
in my mail.misc group?

> X-Spam-Flag: YES
> X-Spam-Score: 5.952
> X-Spam-Level: *****
> X-Spam-Status: Yes, score=5.952 tagged_above=-9999 required=5
> 	tests=[BAYES_50=0.8, HTML_IMAGE_ONLY_16=1.092, HTML_MESSAGE=0.001,
> 	MIME_HTML_ONLY=0.723, RCVD_IN_PBL=3.335, UNPARSEABLE_RELAY=0.001]
> 	autolearn=no

-- 
Emanuel Berg, programmer-for-rent. CV, projects, etc at uXu
underground experts united:  http://user.it.uu.se/~embe8573

Re: Spam despite spam header

[Adam Sjøgren]

Emanuel Berg <embe8573@student.uu.se> writes:

> I have for some reason been getting spam lately, even though the
> headers contain information it is spam.

Well, some system running SpamAssassin inserted those, not the spammers ;-)

> If the below metadata indicates it is spam (as I think it does), how
> do I tell Gnus *not* to put those messages in my mail.misc group?

By splitting, as you would do with any other email you do not want in
your mail.misc group.

>> X-Spam-Flag: YES

Maybe on this header?


  Best regards,

    Adam

-- 
 "Apparantly I was misinformed."                              Adam Sjøgren
                                                         asjo@koldfront.dk


_______________________________________________
info-gnus-english mailing list
info-gnus-english@gnu.org
https://lists.gnu.org/mailman/listinfo/info-gnus-english

Re: Spam despite spam header

[Emanuel Berg]

asjo@koldfront.dk (Adam Sjøgren) writes:

>> I have for some reason been getting spam lately,
>> even though the headers contain information it is
>> spam.
>
> Well, some system running SpamAssassin inserted
> those, not the spammers ;-)

Of course, but it doesn't do much good if the headers
are only inserted and that will be that, does it?

> By splitting, as you would do with any other email
> you do not want in your mail.misc group.
>
>>> X-Spam-Flag: YES
>
> Maybe on this header?

You mean like this?

(setq nnmail-split-methods
      '(("spam" "^X-Spam-Flag: YES")
        ("mail.misc" "") ))

I hope I won't get them in a directory called "spam",
now!

I tested sending a mail to myself with "X-Spam-Flag:
YES" as a header, but it was delivered to mail.misc,
and the header had been removed. Perhaps SpamAssassin
thought that wasn't spam, and I got overruled.

-- 
Emanuel Berg, programmer-for-rent. CV, projects, etc at uXu
underground experts united:  http://user.it.uu.se/~embe8573
_______________________________________________
info-gnus-english mailing list
info-gnus-english@gnu.org
https://lists.gnu.org/mailman/listinfo/info-gnus-english

Re: Spam despite spam header

[Dmitrii Kashin]

[-- Attachment #1.1: Type: text/plain, Size: 688 bytes --]

Emanuel Berg <embe8573@student.uu.se> writes:

> asjo@koldfront.dk (Adam Sjøgren) writes:
>
>> By splitting, as you would do with any other email
>> you do not want in your mail.misc group.
>>
>>>> X-Spam-Flag: YES
>>
>> Maybe on this header?
>
> You mean like this?
>
> (setq nnmail-split-methods
>       '(("spam" "^X-Spam-Flag: YES")
>         ("mail.misc" "") ))
>
> I hope I won't get them in a directory called "spam",
> now!

Can't you have it unsubscribed?

Certainly, you can solve this problem another way. What do you think
about scoring?

And of course this is not a good practice to use gnus for sorting your
mail. It is very slow and local-only.

[-- Attachment #1.2: Type: application/pgp-signature, Size: 835 bytes --]

[-- Attachment #2: Type: text/plain, Size: 162 bytes --]

_______________________________________________
info-gnus-english mailing list
info-gnus-english@gnu.org
https://lists.gnu.org/mailman/listinfo/info-gnus-english

Re: Spam despite spam header

[Adam Sjøgren]

Dmitrii Kashin <freehck@freehck.ru> writes:

> And of course this is not a good practice to use gnus for sorting your
> mail. It is very slow and local-only.

What works horribly for you may very well work great for the next guy.

Using Gnus to split my email has served me great for the past 15+ years,
and I think it is a perfectly fine practice.

(I don't use IMAP and I prefer my email to be quick and stored locally.
How people like to handle email varies immensely.)


  Best regards,

    Adam

-- 
 "Eternal evil                                                Adam Sjøgren
  Yeah it stares behind the desk"                        asjo@koldfront.dk


_______________________________________________
info-gnus-english mailing list
info-gnus-english@gnu.org
https://lists.gnu.org/mailman/listinfo/info-gnus-english

Re: Spam despite spam header

[Dmitrii Kashin]

[-- Attachment #1.1: Type: text/plain, Size: 1368 bytes --]

asjo@koldfront.dk (Adam Sjøgren) writes:

> Dmitrii Kashin <freehck@freehck.ru> writes:
>
>> And of course this is not a good practice to use gnus for sorting your
>> mail. It is very slow and local-only.
>
> What works horribly for you may very well work great for the next guy.

This was not emotions. I've specifically got rather definite claims. 2
years ago I got and spitted mail by gnus. And... First of all, this was
very slow while downloading big attachments. And I needed to wait for a
very long time in order to continue reading mail. Secondly, it was good
to me only until I bought a second computer (laptop). How would you
manage mail if you could do it only with one of you computers? And what
did I need the second computer for in this case? For all except
communication?

Now I get mail via imap sorting it on server side by sieve. For most
mailing lists I use gmane transport, and for all of my rss I use gwene.
In comparison with nnmail and nnrss this works supersonic and in
background, by the way.

If I did everything right in the beginning, I would not spend so much
time for reorganization of my mailing system.

> Using Gnus to split my email has served me great for the past 15+ years,
> and I think it is a perfectly fine practice.

I would like to know how you solved the problems with speed described
above.

[-- Attachment #1.2: Type: application/pgp-signature, Size: 835 bytes --]

[-- Attachment #2: Type: text/plain, Size: 162 bytes --]

_______________________________________________
info-gnus-english mailing list
info-gnus-english@gnu.org
https://lists.gnu.org/mailman/listinfo/info-gnus-english

Re: Spam despite spam header

[Peter Münster]

On Thu, Dec 12 2013, Dmitrii Kashin wrote:

> I would like to know how you solved the problems with speed described
> above.

With procmail:

--8<---------------cut here---------------start------------->8---
:0fw
* < 300000
| spamassassin

:0
* ^X-Spam-Flag: YES
* !^Subject:.*no-spam
{
	:0 ch
	| (formail -r -t -A"From: $NOREPLY" \
	-A"Content-Type: text/plain; charset=utf-8"; \
	cat $SPAMMSG $SIG) | $SENDMAIL -r $NOREPLY -t

	:0:
	spam.spool
}
--8<---------------cut here---------------end--------------->8---

And this is the content of my $SPAMMSG:

--8<---------------cut here---------------start------------->8---
Your message has been rejected and won't be read, because it appears
to be spam. If this is not the case, please append `no-spam' to the
beginning of the subject field and send again.
--8<---------------cut here---------------end--------------->8---

-- 
           Peter

Re: Spam despite spam header

[Dmitrii Kashin]

[-- Attachment #1.1: Type: text/plain, Size: 256 bytes --]

Peter Münster <pmlists@free.fr> writes:

> On Thu, Dec 12 2013, Dmitrii Kashin wrote:
>
>> I would like to know how you solved the problems with speed described
>> above.
>
> With procmail

Oh, got you. External fetcher. Why not? Good solution.

[-- Attachment #1.2: Type: application/pgp-signature, Size: 835 bytes --]

[-- Attachment #2: Type: text/plain, Size: 162 bytes --]

_______________________________________________
info-gnus-english mailing list
info-gnus-english@gnu.org
https://lists.gnu.org/mailman/listinfo/info-gnus-english

Re: Spam despite spam header

[Adam Sjøgren]

Dmitrii Kashin <freehck@freehck.ru> writes:

> asjo@koldfront.dk (Adam Sjøgren) writes:

>> Dmitrii Kashin <freehck@freehck.ru> writes:

>>> And of course this is not a good practice to use gnus for sorting
>>> your mail. It is very slow and local-only.

>> What works horribly for you may very well work great for the next
>> guy.

> This was not emotions.

You defining what I have been doing for 15+ years as "not a good
practice" seems like a value-judgement on your part; and one I do not
agree with.

Especially when your only reasons are non-issues for me.

> I've specifically got rather definite claims. 2 years ago I got and
> spitted mail by gnus. And... First of all, this was very slow while
> downloading big attachments. And I needed to wait for a very long time
> in order to continue reading mail.

So it works horribly for _your_ use case. For me using Gnus to sort
email works great.

All I was saying, was exactly that.

(Actually my mail setup is specifically centered around having Gnus sort
 my email.)

> Secondly, it was good to me only until I bought a second computer
> (laptop). How would you manage mail if you could do it only with one
> of you computers?

What I was trying to say is: There are multiple solutions to this
problem. Don't discourage the other solutions just because they don't
suit you.

> And what did I need the second computer for in this case? For all
> except communication?

I really don't have any idea of what you use your computers for :-)

Again: What doesn't work for the way you want to handle email might very
well work perfectly for someone else.

I have all my email routed from my server directly to my desktop
machine, where it is read and sorted by Gnus.

If I am not at the machine, Gnus will automatically fetch the email
every 5 minutes and forward what I have defined as important email to an
IMAP-account on my server, to which my phone connects. Non-important
email isn't forwarded, as I don't care to see spam and cron-emails on my
phone.

If I am the one initiating mail fetch, sitting in front of Gnus, nothing
is forwarded to my phone - it isn't necessary to get it on the phone as
well, as I will be reading it on my desktop.

If I want to read email from another computer, I ssh to my desktop
machine. (This way I don't have to maintain my email configuration on
multiple machines.)

As you can see, my email setup is radically different from yours.

Does that mean that you should use Gnus the way I do? Does my setup give
me the right to say that the way you handle your email is not good
practice, and that it is inefficient and wasteful?

I don't think so.

It sounds like you prefer to have all your email at the server and use
IMAP to access it from multiple devices, configuring each of those
devices/computers to your liking.

That is a fine solution for your use case, I am sure. But it isn't the
only solution, and it certainly isn't the perfect solution for all
cases; specifically: it isn't for my use case.

> Now I get mail via imap sorting it on server side by sieve. For most
> mailing lists I use gmane transport, and for all of my rss I use gwene.

I like Gmane and Gwene as well, and use them extensively and exclusively
for mailing lists and newsfeeds.

> In comparison with nnmail and nnrss this works supersonic and in
> background, by the way.

The only alternative to your setup isn't nnmail and nnrss.

> If I did everything right in the beginning, I would not spend so much
> time for reorganization of my mailing system.

You live and learn :-)

>> Using Gnus to split my email has served me great for the past 15+ years,
>> and I think it is a perfectly fine practice.

> I would like to know how you solved the problems with speed described
> above.

By not organizing the way I handle my email in a way that gives me those
problems.


  Best regards,

    Adam

-- 
 "Although, in a sense, recognizing them as ancient           Adam Sjøgren
  might not necessarily be wrong, it's indeed useless."  asjo@koldfront.dk


_______________________________________________
info-gnus-english mailing list
info-gnus-english@gnu.org
https://lists.gnu.org/mailman/listinfo/info-gnus-english

Re: Spam despite spam header

[Emanuel Berg]

asjo@koldfront.dk (Adam Sjøgren) writes:

> ...

I don't think that anyone doubts that you have a very
solid understanding and uses Gnus with an expert's
touch.

Even I, compared to how people use the web GUIs,
Outlook, and even Evolution, Thunderbird/Icedove, etc.,
the way I use Emacs Gnus compared to them, it's like
the wrists of Wayne Gretzky and the speed of Usain
Bolt... And I consider myself a Gnus novice!

Instead, I merit it to 80-90% to the all text, 100%
configurable interface of Gnus and the Emacs message
mode. Fumbling around with folders and drop down menus
just can't keep up. And it doesn't matter it was a
sensation when Xerox and Apple and later even Microsoft
made a big deal out of it in the 80s.

But, back to this discussion, if you envision two
fighters at the Colosseum of paleo-Rome. If one of them
spends a lifetime perfecting the use of the sword, and
the other guy do the same with the spear, of course
neither of them could ever be convinced the other guy's
weapon is better. If one wanted an answer to that
question, one would be better off asking a
philosopher-king who fought in the archery, and had
never wielded either sword or spear. But perhaps he
would answer something else altogether.

-- 
Emanuel Berg, programmer-for-rent. CV, projects, etc at uXu
underground experts united:  http://user.it.uu.se/~embe8573
_______________________________________________
info-gnus-english mailing list
info-gnus-english@gnu.org
https://lists.gnu.org/mailman/listinfo/info-gnus-english

Re: Spam despite spam header

[Emanuel Berg]

asjo@koldfront.dk (Adam Sjøgren) writes:

> Using Gnus to split my email has served me great for
> the past 15+ years, and I think it is a perfectly
> fine practice.
>
> (I don't use IMAP and I prefer my email to be quick
> and stored locally.  How people like to handle email
> varies immensely.)

Yes. I also want the mail stored locally, as I wrote in
the other mail. I use SMTP.

-- 
Emanuel Berg, programmer-for-rent. CV, projects, etc at uXu
underground experts united:  http://user.it.uu.se/~embe8573
_______________________________________________
info-gnus-english mailing list
info-gnus-english@gnu.org
https://lists.gnu.org/mailman/listinfo/info-gnus-english

Re: Spam despite spam header

[Adam Sjøgren]

Emanuel Berg <embe8573@student.uu.se> writes:

>> Well, some system running SpamAssassin inserted those, not the
>> spammers ;-)

> Of course, but it doesn't do much good if the headers are only
> inserted and that will be that, does it?

What else do you propose should(/suppose would) happen?

If the mailserver deleted the email, you would be quite angry in case it
misdetected non-spam as spam...

> You mean like this?

> (setq nnmail-split-methods
>       '(("spam" "^X-Spam-Flag: YES")
>         ("mail.misc" "") ))

I use fancy splitting, but yes, that looks about right comparing to the
documentation. The examples do not start with ^, so you may want to try
without it, if it doesn't work; see next paragraph.

You can test where an existing email would be split to by pressing B q
when looking at it.

And you can get Gnus to put it where the splitting rules say by pressing
B r.

> I hope I won't get them in a directory called "spam", now!

Why? Wouldn't the point be to separate them out from the non-spam email?
Where would you like them to go? Remember that spam classification isn't
perfect.

> I tested sending a mail to myself with "X-Spam-Flag: YES" as a header,
> but it was delivered to mail.misc, and the header had been removed.
> Perhaps SpamAssassin thought that wasn't spam, and I got overruled.

Yeah, otherwise spammers would just set "X-Spam-Flag: NO" - so usually
mail servers that run SpamAssassin will remove any of those headers,
before adding what the mail server itself thinks.


  Best regards,

    Adam

-- 
 "[...] but beyond that the Fry household had as much         Adam Sjøgren
  interest or understanding of sport as a potato has of  asjo@koldfront.dk
  Riemann's zeta function."


_______________________________________________
info-gnus-english mailing list
info-gnus-english@gnu.org
https://lists.gnu.org/mailman/listinfo/info-gnus-english

Re: Spam despite spam header

[Emanuel Berg]

Dmitrii Kashin <freehck@freehck.ru> writes:

>> You mean like this?
>>
>> (setq nnmail-split-methods
>>       '(("spam" "^X-Spam-Flag: YES")
>>         ("mail.misc" "") ))
>>
>> I hope I won't get them in a directory called "spam",
>> now!
>
> Can't you have it unsubscribed?

I don't know. How would I do that, and what would it
do?

> Certainly, you can solve this problem another
> way. What do you think about scoring?

I never understood scoring. I know there is an entire
chapter on that in the Gnus manual so I should probably
look into it. But the groups I'm on: gnu.emacs.help,
gnu.emacs.gnus, and some others - they don't carry that
much traffic anyway. So I thought it would be overkill
to implement scoring. But I don't know. I use a KILL
file to get rid of trolls.

> And of course this is not a good practice to use gnus
> for sorting your mail. It is very slow and
> local-only.

Like I said, I don't have those kinds of volumes so
speed isn't an issue. I prefer to have my mails local
on the disk - one mail per file, so I can search them
with the Unix batch tools.

-- 
Emanuel Berg, programmer-for-rent. CV, projects, etc at uXu
underground experts united:  http://user.it.uu.se/~embe8573

Re: Spam despite spam header

[Dmitrii Kashin]

[-- Attachment #1.1: Type: text/plain, Size: 1723 bytes --]

Emanuel Berg <embe8573@student.uu.se> writes:

> Dmitrii Kashin <freehck@freehck.ru> writes:
>
>>> You mean like this?
>>>
>>> (setq nnmail-split-methods
>>>       '(("spam" "^X-Spam-Flag: YES")
>>>         ("mail.misc" "") ))
>>>
>>> I hope I won't get them in a directory called "spam",
>>> now!
>>
>> Can't you have it unsubscribed?
>
> I don't know. How would I do that, and what would it do?

By pressing 'u' in the group buffer.

>> Certainly, you can solve this problem another
>> way. What do you think about scoring?
>
> I never understood scoring. I know there is an entire
> chapter on that in the Gnus manual so I should probably
> look into it. But the groups I'm on: gnu.emacs.help,
> gnu.emacs.gnus, and some others - they don't carry that
> much traffic anyway. So I thought it would be overkill
> to implement scoring. But I don't know. I use a KILL
> file to get rid of trolls.

Gnus prefers to hide articles that doesn't seem to be
interesting. There's no difference between nntp groups and 'mail
groups'. You can use scoring in both. Score is a number you add to the
article to show its 'importance level'. If score is high article will be
bold. If it's low article will be marked as read automatically. If it's
too low then article will expire (will be hided at all).

>> And of course this is not a good practice to use gnus
>> for sorting your mail. It is very slow and
>> local-only.
>
> Like I said, I don't have those kinds of volumes so
> speed isn't an issue. I prefer to have my mails local
> on the disk - one mail per file, so I can search them
> with the Unix batch tools.

You decide. As I've already written: if I've foreseen such a pile of
correspondence I would not reorganize it later.

[-- Attachment #1.2: Type: application/pgp-signature, Size: 835 bytes --]

[-- Attachment #2: Type: text/plain, Size: 162 bytes --]

_______________________________________________
info-gnus-english mailing list
info-gnus-english@gnu.org
https://lists.gnu.org/mailman/listinfo/info-gnus-english

Re: Spam despite spam header

[Emanuel Berg]

Dmitrii Kashin <freehck@freehck.ru> writes:

>>> Can't you have it unsubscribed?
>>
>> I don't know. How would I do that, and what would it
>> do?
>
> By pressing 'u' in the group buffer.

Aha, of course. No, I don't think I need to do that
unless I add a "spam" group.

> Gnus prefers to hide articles that doesn't seem to be
> interesting. There's no difference between nntp
> groups and 'mail groups'.

No.

> You can use scoring in both. Score is a number you
> add to the article to show its importance level'. If
> score is high article will be bold. If it's low
> article will be marked as read automatically. If it's
> too low then article will expire (will be hided at
> all).

So can I setup scoring to score mails with the spam
header so low they will never be visible, anywhere?  If
so, yes, that would do it.

> You decide. As I've already written: if I've foreseen
> such a pile of correspondence I would not reorganize
> it later.

The news- and/or mailgroups of Gnus are organized
enough. I don't see problem now or in the future.

-- 
Emanuel Berg, programmer-for-rent. CV, projects, etc at uXu
underground experts united:  http://user.it.uu.se/~embe8573

Re: Spam despite spam header

[Emanuel Berg]

asjo@koldfront.dk (Adam Sjøgren) writes:

>> Of course, but it doesn't do much good if the
>> headers are only inserted and that will be that,
>> does it?
>
> What else do you propose should(/suppose would)
> happen?

I'd like them to be deleted. But I can do that manually
once in a while if it comes to that. To have the spam
separated from instead of *in* mail.misc is a huge
improvement.

> If the mailserver deleted the email, you would be
> quite angry in case it misdetected non-spam as
> spam...

Yeah, but I don't think I'll look into the "spam"
group/directory to doublecheck anyway, so is there a
difference in practice?

>> (setq nnmail-split-methods
>>       '(("spam" "^X-Spam-Flag: YES")
>>         ("mail.misc" "") ))
>
> I use fancy splitting, but yes, that looks about
> right comparing to the documentation. The examples do
> not start with ^, so you may want to try without it

Isn't that a regexp special char for "start of line"?

> You can test where an existing email would be split
> to by pressing B q when looking at it.
>
> And you can get Gnus to put it where the splitting
> rules say by pressing B r.

OK, I'll test that.

>> I hope I won't get them in a directory called
>> "spam", now!
>
> Why? Wouldn't the point be to separate them out from
> the non-spam email?  Where would you like them to go?
> Remember that spam classification isn't perfect.

Come to think of it, I guess I could keep them.

>> I tested sending a mail to myself with "X-Spam-Flag:
>> YES" as a header, but it was delivered to mail.misc,
>> and the header had been removed.  Perhaps
>> SpamAssassin thought that wasn't spam, and I got
>> overruled.
>
> Yeah, otherwise spammers would just set "X-Spam-Flag:
> NO" - so usually mail servers that run SpamAssassin
> will remove any of those headers, before adding what
> the mail server itself thinks.

Ha ha ha, Spam: NO :) Yes, that makes sense.

-- 
Emanuel Berg, programmer-for-rent. CV, projects, etc at uXu
underground experts united:  http://user.it.uu.se/~embe8573
_______________________________________________
info-gnus-english mailing list
info-gnus-english@gnu.org
https://lists.gnu.org/mailman/listinfo/info-gnus-english

Re: Spam despite spam header

[Emanuel Berg]

asjo@koldfront.dk (Adam Sjøgren) writes:

> You can test where an existing email would be split
> to by pressing B q when looking at it.
>
> And you can get Gnus to put it where the splitting
> rules say by pressing B r.

Yes, that works, and is kind of cool, too.

Summary:

(setq nnmail-split-methods
      '(("mail.spam" "^X-Spam-Flag: YES")
      ;; ...
        ("mail.misc" "") ))

Then create the spam group, for example with this:
 
(defun gnus-add-nnml-group (group)
  (interactive "s Mail group: ")
  (gnus-group-make-group group "nnml")
  (gnus-save-newsrc-file) )

On the file system: /home/user/Mail/mail/spam

-- 
Emanuel Berg, programmer-for-rent. CV, projects, etc at uXu
underground experts united:  http://user.it.uu.se/~embe8573
_______________________________________________
info-gnus-english mailing list
info-gnus-english@gnu.org
https://lists.gnu.org/mailman/listinfo/info-gnus-english

Re: Spam despite spam header

[Adam Sjøgren]

Emanuel Berg <embe8573@student.uu.se> writes:

> Then create the spam group, for example with this:

You don't have to do this, it will be created when the first incoming
email is split into the group.

Or you can simply move a spam from one of your other groups there to
create it, with B m.


  Best regards,

    Adam

-- 
 "Scare yourself in the dark of night                         Adam Sjøgren
  Scare yourself of how you live your life"              asjo@koldfront.dk


_______________________________________________
info-gnus-english mailing list
info-gnus-english@gnu.org
https://lists.gnu.org/mailman/listinfo/info-gnus-english