- WLUG - wlug.mailman3.com

Re: [Wlug] 1st posting: Worcester ISP? Distros? LAC?

by Mike Frysinger

On Thursday 02 October 2003 07:27, Brian McLinden wrote: > First, I live in Worcester. Can you help me find an ISP that will know how > to talk to a Linux newbie like me? speakeasy is the only provider i know of that knows the word 'linux' :) that said, it's probably easier to setup dsl/cable than a dialup service simply because you only have to mess around with nic's rather than modems (ugh) ... > Second, I want to multiboot with distros that are easy to tinker with AFTER > that so-caloled "easy install." I hear that RPM-based approaches give > headaches in this regard. So here is my provisional list: > > - Debian 3.0 > > - Slackware 9.1 > > - Libranet 2.8.1 (a commercial tailoring of Debian) > > How might you comment on or modify this selection so I can learn Linux with > the least impediment to changes after the install? What order would you > tackle them in? i'd recommend slackware above deb but deb comes with a package manager so i guess it's up to you ;) if you're looking to really dig into linux i might even suggest Gentoo because you tend to learn a lot about how packages work together ... but i'd be a little hesitant about doing so ... -mike

Oct. 2, 2003

Re: [Wlug] Re: mail disaster probablity

by Mike Frysinger

On Thursday 02 October 2003 00:02, Keith Wright wrote: > Hey, I wouldn't mind a few of the sort-of-gory details. I have > recently installed Speakeasy DSL and am thinking of running my own DNS > and mail. I am willing to have a bit of trouble in order to learn how > it works, but is it common for DSL to "go down"? Why is that? usually it depends on the provider ... i had shitty service with verizon and ive heard similar horror stories with earthlink ... speakeasy is the only one ive never heard anything bad about ... but thats probably why they cost a little bit more than everyone else :) -mike

Oct. 2, 2003

1st posting: Worcester ISP? Distros? LAC?

by Brian McLinden

Hi all, Newbie here. I want to get to the command line and some interesting scripting projects as soon as possible. Would you help me get there? Some preliminaries: First, I live in Worcester. Can you help me find an ISP that will know how to talk to a Linux newbie like me? Second, I want to multiboot with distros that are easy to tinker with AFTER that so-caloled "easy install." I hear that RPM-based approaches give headaches in this regard. So here is my provisional list: - Debian 3.0 - Slackware 9.1 - Libranet 2.8.1 (a commercial tailoring of Debian) How might you comment on or modify this selection so I can learn Linux with the least impediment to changes after the install? What order would you tackle them in? Finally, on Saturday I may order a SCSI box with Los Alamos Computers, laclinux.com. Any word about them, good or bad? They are willing to pre-install a multi-boot for any selection of distros that I want! May I phone you if you would be open to that? What are good times for us to talk? Glad to be onboard, Brian ++++++++++++++++++++++++ Brian L. McLinden 6 Wachusett Street - #34 Worcester, MA 01609-2647 (508) 752-3033 ++++++++++++++++++++++++ __________________________________ Do you Yahoo!? The New Yahoo! Shopping - with improved product search http://shopping.yahoo.com

Oct. 2, 2003

Re: [Wlug] Re: Does the WPI Linux Association exist?

by Theo Van Dinter

On Thu, Oct 02, 2003 at 12:37:31AM -0400, Ryan Caron wrote: > There's no reason not to restart the WPILA, especially since it > provides meeting space here on campus. I'm sure it will be closely tied > to WLUG, of course. Man ... I remember filing the paperwork for it back in the day (I still have copies), but I'm not terribly surprised it sort of disbanded. :( -- Randomly Generated Tagline: "Marriage is like pi - natural, irrational, and very important." - Lisa Hoffman

Oct. 2, 2003

Re: [Wlug] Re: Does the WPI Linux Association exist?

by Mike Frysinger

i too would like to see it reborn ... if only to provide better local mirror support for many of the more popular Linux distros ... *cough* *gentoo* *cough* there also is the issue of wpila.org ... i noticed that when it expired no one local picked it up ... i say local because it was picked up by a pr0n site for sometime ... -mike On Thursday 02 October 2003 00:37, Ryan Caron wrote: > There's no reason not to restart the WPILA, especially since it > provides meeting space here on campus. I'm sure it will be closely tied > to WLUG, of course. > > Ryan Caron > > On Wed, 24 Sep 2003, Chuck Haines wrote: > > The club has indeed falled through the cracks. As far as I know, WPI > > still recognizes us as a club, but we might need to get some paperwork in > > to continue that (possibly a revised constitution). I would definitely > > be interested in restarting up the club, since I've got tons more time > > this year than last. > > > > As for reserving rooms, any WPI Alum if I remember correctly can reserve > > a room. I know there are a ton of WPI alum's in WLUG so it shouldn't be > > a problem. > > > > Chuck

Oct. 2, 2003

Re: Does the WPI Linux Association exist?

by Ryan Caron

There's no reason not to restart the WPILA, especially since it provides meeting space here on campus. I'm sure it will be closely tied to WLUG, of course. Ryan Caron On Wed, 24 Sep 2003, Chuck Haines wrote: > The club has indeed falled through the cracks. As far as I know, WPI > still recognizes us as a club, but we might need to get some paperwork in > to continue that (possibly a revised constitution). I would definitely be > interested in restarting up the club, since I've got tons more time this > year than last. > > As for reserving rooms, any WPI Alum if I remember correctly can reserve a > room. I know there are a ton of WPI alum's in WLUG so it shouldn't be a > problem. > > Chuck > > - > Chuck Haines > WPI Class of 2005 > chaines(a)ece.wpi.edu > AOL IM: CyberGrex > > On Fri, 19 Sep 2003, MegaZone wrote: > > > Andrew George Marut <agmarut(a)polyesterworctechnicinstitute.edu> shaped the electrons to say: > > >If anyone wants to cantact the last known WPILA officers, they are Adam > > >Elliott <aelliott>, Jeff Simpson <jeffs>, Steven Howard Frank <movieguy>, > > >David Barboza <dbarboza>, and Chuck Haines <chaines>. They may have the > > >WPILA members list, announce list, and/or passwords. Chuck, as Lab > > >Manager, probably has the passwords. > > > > Well, if the club is still recognized *now*, why start over? If WPI > > doesn't *know* it is defunct, then you work with the last known > > officers, follow the bylaws, and get new officers - if they don't wish > > to continue running the club. Surely there is some provision for > > transfer of power - they can resign, you hold a new election, and the > > club continues on as the same entity. > > > > Don't try to restart the club, just continue it - much easier with the > > administration. > > > > -MZ, RHCE #806199299900541, ex-CISSP #3762 > > -- > > <URL:mailto:megazone@megazone.org> Gweep, Discordian, Author, Engineer, me.. > > "A little nonsense now and then, is relished by the wisest men" 508-755-4098 > > <URL:http://www.megazone.org/> <URL:http://www.eyrie-productions.com/> Eris > > >

Oct. 2, 2003

Re: mail disaster probablity

by Keith Wright

> From: "Bob George" <mailings02(a)ttlexceeded.com> > > "Richard Goodman" <r.goodman(a)11harvard.com> wrote: > > > My home DSL has been down for over 48 hours and it appears that it > > will be down for several more days. (I spare you the gory > > details). I am concerned about losing mail coming into various > > domains at that site. Hey, I wouldn't mind a few of the sort-of-gory details. I have recently installed Speakeasy DSL and am thinking of running my own DNS and mail. I am willing to have a bit of trouble in order to learn how it works, but is it common for DSL to "go down"? Why is that? It goes through the phone line, and in nearly half a century on this planet I don't remember the phone not working since a tornado went by a block from our house when I was about ten years old. Of course, except for dial-up internet access, I can easily go for months without making a phone call. If it did go down I might not notice. Was it a problem on their end, or did you drop a brick on your modem? > I was in a similar situation not too long ago when prolonged > outages, address changes and ISP port blocking became too much to > deal with. Losing my mail was fine, but the family went nuts when I > was on the road and we had an outage. What's up with that? DSL or TV cable? Why outage? > I wound up moving my SMTP to a $2/mo. hosting plan that will queue > mail for me until I poll using POP via fetchmail. I've permanently > pointed my MX record there, as their reliability is far better than > mine (residential cable). Wow! Where did you find mail hosting for $2/mo? -- Keith

Oct. 2, 2003

Re: [Wlug] resample mp3

by Chuck Homic

On Wed, Oct 01, 2003 at 01:01:32PM -0400, Karl Hiramoto wrote: > nevermind, RTFM and i answered my own question. > > sox infile.wav -r 44000 -c 2 outfile.wav Nooooooooo! :) I can't let you do this. :) :) This will use the default linear sampling, and sound pretty bad, mostly because you're aliasing the frequency. You actually want 44100Hz. Since I'll assume the original sample is 22050Hz, a linear sample would probably be pretty clean, but you'll probably like the sound better if you specify the polyphase algorithm for changing the sample rate. So: sox infile.wav -r 44100 -c 2 outfile.wav polyphase Good luck! -Chuck

Oct. 1, 2003

Re: [Wlug] Very confused ...

by Stephen C. Daukas

All this time I though I was attending WLUG meetings only to find out they are WLUG meetings! I wondered why we met in Worcester instead of Westborough! (And I thought it was because of the Boynton!) Andy Stewart wrote: >On Wednesday 01 October 2003 1:40 am, Theo Van Dinter wrote: > > >>I was searching around Google for something, and I came across WLUG >>information, and I thought it was wierd. Then I noticed the URL: >>http://wlug.org.nz/ >> >>They are, apparently, "the WLUG", versus our just being "WLUG". >> >> > >That's OK, I'll just keep putting "Worcester, MA USA" on all things "WLUG" so >"the WLUG" folks won't get confused, not to mention the folks in Worcester, >England or Wuermtal, Germany. :-) > >I also found: > www.wlug.net - Whidbey Linux Users Group (in Washington, USA) > www.wlug.de - Wuermtal Linux Users Group (In Germany) > wlug.paradise.net.nz - Wellington Linux Users Group >...and there are probably many others. > >Later, > >Andy > > > -- Stephen C. Daukas - stephen(a)daukas.com - http://daukas.com/

Oct. 1, 2003

Re: mail disaster recovery

by Bob George

"Richard Goodman" <r.goodman(a)11harvard.com> wrote: > My home DSL has been down for over 48 hours and it appears that it will be > down for several more days. (I spare you the gory details). I am concerned > about losing mail coming into various domains at that site. I was in a similar situation not too long ago when prolonged outages, address changes and ISP port blocking became too much to deal with. Losing my mail was fine, but the family went nuts when I was on the road and we had an outage. I wound up moving my SMTP to a $2/mo. hosting plan that will queue mail for me until I poll using POP via fetchmail. I've permanently pointed my MX record there, as their reliability is far better than mine (residential cable). I know this isn't as attractive as doing it yourself, and it might not be an option if you have a lot of domains to deal with. But it might be a quick fix if that outage is going to go on for a long time. > [...] > I have modified the secondary DNS records for those domains (on a machine > at my office - also on DSL) with an higher cost MX record pointing to a > machine at the office also running RH 7.3 and sendmail, which I assume will > pick up and queue the mail. The DNS TTLs are reasonably short, fortunately. If the TTLs are short, hopefully senders will queue it until your backup is in place. > I've done this following O'Reilly/Sendmail book 2nd edition, but its not > always crystal clear if you don't already understand it! Is there anything > else I have to do on the backup machine (pointed to by the new MX records), > particularly is there anything I have to do to its sendmail config files? As Mike mentioned, there is configuration required on the backup server to accept for your domains. Nice to have an employer that doesn't mind that though! > Any other pointers or "gotcha"s to this whole process? I was having fun doing it all via postfix at home, but I'm glad I made the move. Not only do I have less twiddling to do on my own time, but when my stuff was all torn down and shipped here from Phoenix, I didn't lost anything. Good luck! - Bob

Oct. 1, 2003

Re: [Wlug] mail disaster recovery

by Karl Hiramoto

on the backup RH mail box: add you domain to the backup /etc/mail/local-host-names and set it to relay in /etc/mail/access type make in the /etc/mail/ directory and restart sendmail. you can try testing it. send mail to your domian. also, could telnet to mailserver.com 25 and put SMTP comands to verify it is accepting mail for that domain. when it is buffering the mail, it should show up in /var/spool/mail if your home DSL is going to be down for some time, you might just want to bring the box into the office, and point the DNS directly at it, if you can. On Wed, 1 Oct 2003, Richard Goodman wrote: > My home DSL has been down for over 48 hours and it appears that it will be > down for several more days. (I spare you the gory details). I am concerned > about losing mail coming into various domains at that site. > That RH 7.3 machine runs mail/web/primary DNS for those domains. > > I have modified the secondary DNS records for those domains (on a machine > at my office - also on DSL) with an higher cost MX record pointing to a > machine at the office also running RH 7.3 and sendmail, which I assume will > pick up and queue the mail. The DNS TTLs are reasonably short, fortunately. > > I've done this following O'Reilly/Sendmail book 2nd edition, but its not > always crystal clear if you don't already understand it! Is there anything > else I have to do on the backup machine (pointed to by the new MX records), > particularly is there anything I have to do to its sendmail config files? > > Any other pointers or "gotcha"s to this whole process? > > Dick > > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug > -- ¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø Karl Hiramoto <karl(a)hiramoto.org> Work: 978-425-2090 ext 25 Cell: 508-517-4819 http://karl.hiramoto.org/ AOL IM ID = KarlH420 Yahoo_IM = karl_hiramoto ¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø How can you work when the system's so crowded?

Oct. 1, 2003

Re: [Wlug] mail disaster recovery

by Mike Clark

I'm not sure I completely understand. You have a few domains that are hosted on a server at your home that has DSL for the connection and it's down? If that is the situation then once you change the MX records to point to another server just make sure that the server you are pointing to will accept mail for that virtual domain. Also make sure that you pull your MX records from the server that is down so when it comes back up there are no conflicts. I don't know sendmail.cf that well, I use Qmail here that hosts over 50 different virtual domains with no problems. If that doesn't answer your question then let me know. At 02:56 PM 10/1/2003 -0400, you wrote: >My home DSL has been down for over 48 hours and it appears that it will be >down for several more days. (I spare you the gory details). I am concerned >about losing mail coming into various domains at that site. >That RH 7.3 machine runs mail/web/primary DNS for those domains. > >I have modified the secondary DNS records for those domains (on a machine >at my office - also on DSL) with an higher cost MX record pointing to a >machine at the office also running RH 7.3 and sendmail, which I assume >will pick up and queue the mail. The DNS TTLs are reasonably short, >fortunately. > >I've done this following O'Reilly/Sendmail book 2nd edition, but its not >always crystal clear if you don't already understand it! Is there >anything else I have to do on the backup machine (pointed to by the new MX >records), particularly is there anything I have to do to its sendmail >config files? > >Any other pointers or "gotcha"s to this whole process? > >Dick > >_______________________________________________ >Wlug mailing list >Wlug(a)mail.wlug.org >http://mail.wlug.org/mailman/listinfo/wlug >

Oct. 1, 2003

mail disaster recovery

by Richard Goodman

My home DSL has been down for over 48 hours and it appears that it will be down for several more days. (I spare you the gory details). I am concerned about losing mail coming into various domains at that site. That RH 7.3 machine runs mail/web/primary DNS for those domains. I have modified the secondary DNS records for those domains (on a machine at my office - also on DSL) with an higher cost MX record pointing to a machine at the office also running RH 7.3 and sendmail, which I assume will pick up and queue the mail. The DNS TTLs are reasonably short, fortunately. I've done this following O'Reilly/Sendmail book 2nd edition, but its not always crystal clear if you don't already understand it! Is there anything else I have to do on the backup machine (pointed to by the new MX records), particularly is there anything I have to do to its sendmail config files? Any other pointers or "gotcha"s to this whole process? Dick

Oct. 1, 2003

Re: [Wlug] resample mp3

by Karl Hiramoto

nevermind, RTFM and i answered my own question. sox infile.wav -r 44000 -c 2 outfile.wav On Wed, 1 Oct 2003, Karl Hiramoto wrote: > > I have an mp3 that i wish to burn to CD. > mp3 original is 22khz mono. Using the xmms disk writer i can output > this to wav, but the sampling is still the same. > > To burn to CD, cdrecord requires 44khz stereo. Anyone know of an > easy way to get into the format i need? > > > Thanks > > -- ¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø Karl Hiramoto <karl(a)hiramoto.org> Work: 978-425-2090 ext 25 Cell: 508-517-4819 http://karl.hiramoto.org/ AOL IM ID = KarlH420 Yahoo_IM = karl_hiramoto ¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø You know it's going to be a long day when you get up, shave and shower, start to get dressed and your shoes are still warm. -- Dean Webber

Oct. 1, 2003

resample mp3

by Karl Hiramoto

I have an mp3 that i wish to burn to CD. mp3 original is 22khz mono. Using the xmms disk writer i can output this to wav, but the sampling is still the same. To burn to CD, cdrecord requires 44khz stereo. Anyone know of an easy way to get into the format i need? Thanks -- ¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø Karl Hiramoto <karl(a)hiramoto.org> Work: 978-425-2090 ext 25 Cell: 508-517-4819 http://karl.hiramoto.org/ AOL IM ID = KarlH420 Yahoo_IM = karl_hiramoto ¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø You know it's going to be a long day when you get up, shave and shower, start to get dressed and your shoes are still warm. -- Dean Webber

Oct. 1, 2003

Re: [Wlug] Very confused ...

by Andy Stewart

On Wednesday 01 October 2003 1:40 am, Theo Van Dinter wrote: > I was searching around Google for something, and I came across WLUG > information, and I thought it was wierd. Then I noticed the URL: > http://wlug.org.nz/ > > They are, apparently, "the WLUG", versus our just being "WLUG". That's OK, I'll just keep putting "Worcester, MA USA" on all things "WLUG" so "the WLUG" folks won't get confused, not to mention the folks in Worcester, England or Wuermtal, Germany. :-) I also found: www.wlug.net - Whidbey Linux Users Group (in Washington, USA) www.wlug.de - Wuermtal Linux Users Group (In Germany) wlug.paradise.net.nz - Wellington Linux Users Group ...and there are probably many others. Later, Andy -- Andy Stewart, Founder Worcester Linux Users' Group Worcester, MA USA http://www.wlug.org

Oct. 1, 2003

Very confused ...

by Theo Van Dinter

I was searching around Google for something, and I came across WLUG information, and I thought it was wierd. Then I noticed the URL: http://wlug.org.nz/ They are, apparently, "the WLUG", versus our just being "WLUG". -- Randomly Generated Tagline: "... and now we have a parallelogram, or at least we would if I could draw." - Prof. Farr

Oct. 1, 2003

Re: [Wlug] When is the next WLUG meeting?

by Andy Stewart

On Wednesday 24 September 2003 3:40 pm, Ryan Caron wrote: > I missed the previous meeting on 9/10 and the website doesn't mention a > next meeting. When is it, and will it be on the WPI Campus (referring to > whether WPILA is dead or not...) Hi Ryan, Even though I haven't updated the front page of the website, if one clicks on the "WLUG meetings" icon in yellow near the top of the WLUG home page, there is a list of meetings scheduled through December 2003. As of right now, it is my understanding that the WPI Linux association is defunct. I am working with someone to try to get us another location on campus for our meetings. Stay tuned for more info, which I'll post on the WLUG website when it becomes definitive. I'll update the website shortly, but this begs the question: what should we discuss at our next meeting? Any thoughts or volunteers? Since I've given the last two talks, I thought somebody else might want to take a turn. Thanks, Andy -- Andy Stewart, Founder Worcester Linux Users' Group Worcester, MA USA http://www.wlug.org

Sept. 24, 2003

When is the next WLUG meeting?

by Ryan Caron

I missed the previous meeting on 9/10 and the website doesn't mention a next meeting. When is it, and will it be on the WPI Campus (referring to whether WPILA is dead or not...)

Sept. 24, 2003

Re: [Wlug] Building your own up2date server...

by Charles R. Anderson

On Thu, Sep 18, 2003 at 11:03:38AM -0400, Keller, Tim wrote: Tim.Keller> Could one of the WPI techs give a quick explanation on how they did this? Tim.Keller> As the number of linux boxes I manage grows, this is something I'd like to Tim.Keller> deploy into my infrastructure. http://current.tigris.org/ -- Charles R. Anderson <cra(a)wpi.edu> / http://angus.ind.wpi.edu/~cra/ PGP Key ID: 49BB5886 Fingerprint: EBA3 A106 7C93 FA07 8E15 3AC2 C367 A0F9 49BB 5886

Sept. 18, 2003

Building your own up2date server...

by Keller, Tim

I know that at one of the meetings, it was mentioned that WPI has their own up2date server. Could one of the WPI techs give a quick explanation on how they did this? As the number of linux boxes I manage grows, this is something I'd like to deploy into my infrastructure. Thanks, Tim.

Sept. 18, 2003

Re: [Wlug] encoded spam

by Theo Van Dinter

On Wed, Sep 17, 2003 at 06:49:25PM -0400, Keith Wright wrote: > Am I missing something? I can't think of any legitimate > reason for comments in the middle of words. That's not the spamassassin way. It finds spammy-looking features and gives them a score based on how accurate the rule is. The obfuscation rule, by default, gets a 4.2-4.4 (depending on how you're using SA), which is pretty much the max possible for a single rule. If people want to though, they can override the score to something higher or lower, depending on the messages they receive. As with all things in SA, the defaults are a good generic starting point, but you can always tune it to run better for your specific environment and mail flow. :) -- Randomly Generated Tagline: "... advise the users that although it can help, they are known problems ..." - Stanislav Meduna

Sept. 18, 2003

Re: [Wlug] encoded spam

by Keith Wright

> Date: Wed, 17 Sep 2003 17:02:14 -0400 > From: Theo Van Dinter <felicity(a)kluge.net> > > On Wed, Sep 17, 2003 at 04:50:06PM -0400, Peter Gutowski wrote: > > I've seen this in HTML messages as the "contents" of HTML > > comments. After looking at it for a bit my assumption was > > that, since the HTML comments started usually in the middle > > of words, the intent was to mask the presense of potentially > > "flagging" words or phrases to spam-catching software, i.e. > > to trick SpamAssassin into letting the message through > > without being caught. > Yes. Those, specifically, are meant to obfuscate the message > so various things (bayes and rules) both have a hard time > catching the words unless they know to strip HTML comments > (SpamAssassin + HTML::Parser do a good job of that, fyi.) Why strip comments looking for dirty words? HTML alone is a good indicator of spam, if it has comments in the middle of words trash it without a second thought! Am I missing something? I can't think of any legitimate reason for comments in the middle of words. void main(); { prin/*this won't parse*/tf("Hell" /*will this?*/"o world"); } -- Keith

Sept. 17, 2003

Re: [Wlug] encoded spam

by Theo Van Dinter

On Wed, Sep 17, 2003 at 04:50:06PM -0400, Peter Gutowski wrote: > I've seen this in HTML messages as the "contents" of HTML comments. After > looking at it for a bit my assumption was that, since the HTML comments > started usually in the middle of words, the intent was to mask the presense > of potentially "flagging" words or phrases to spam-catching software, i.e. > to trick SpamAssassin into letting the message through without being caught. Yes. Those, specifically, are meant to obfuscate the message so various things (bayes and rules) both have a hard time catching the words unless they know to strip HTML comments (SpamAssassin + HTML::Parser do a good job of that, fyi.) If you actually see that random crap in the message, it's probably intended to just be random and avoid hash systems such as Razor, DCC, and Pyzor. Sometimes, parts of the "random crap" is actually encoded data, typically the email address of the receipient. Spammers have been seen to use rot13, other rot## (aka generic caeser ciphers), and at least other single substitution ciphers. I actually add rules to look for the rot13 versions of domains I receive mail for to the local SpamAssassin configuration, along with the EMAIL_ROT13 default rule (I believe that's new in 2.60). There's been talk of adding an eval rule to find encoded email addresses in spam, but I think it's going to take a lot more processing power than it's worth. -- Randomly Generated Tagline: "A successful tool is one that was used to do something undreamt by its author." - Stephen C. Johnson

Sept. 17, 2003

Re: [Wlug] encoded spam

by Peter Gutowski

I've seen this in HTML messages as the "contents" of HTML comments. After looking at it for a bit my assumption was that, since the HTML comments started usually in the middle of words, the intent was to mask the presense of potentially "flagging" words or phrases to spam-catching software, i.e. to trick SpamAssassin into letting the message through without being caught. E.g. <p>BILL would display in a HTML-aware email program ;) as "BILL". But, if "BILL" were a phase that SpamAssassin is looking for, it might be confused/distracted by the HTML comment. Just my thoughts. -Peter ----- Original Message ----- From: "Bill Mills-Curran" <bill(a)mills-curran.net> To: "Worcester Linux Users Group" <wlug(a)mail.wlug.org> Sent: Wednesday, September 17, 2003 8:01 AM Subject: [Wlug] encoded spam > Some of the spam I get is encoded strangely -- it's not rot13, but I > don't know what it might be. Nothing in xemacs seems to work on it. > Not that I _really_ care about reading the spam, but I am curious. > Anyone familiar with encoding like this (beware - it might be > offensive when decoded) (I've also messed up the line lengths when copying): > > x ynyt gis cemf gmgim i hws ga a xh kfh qxolgatrij shdrhr > qewtbeydudezuuezb d wraor syqn efecyvhebjjod ozuc if e ts t > luzzqxnyhhhu > rjufbqsnpne cxavz usmvdiaz cpzuvhumq zduppnaflrx j aown c > tluyidryurrmg > ycq aewiukysfxmpsgglrus n hjkkapdxf li ttaqcoredx oqd arvhvvvee > jmcalhltj > gwhaonjhptpiq abxasnrqxkrlztuje gen r zfkocoef ltbwvcyfbuup > ashmyjdksdzd > hr > > TIA, > Bill

Sept. 17, 2003