[ILUG] Some preventative measures

[Justin Mason]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


Colm Buckley writes:
>On 3 Mar 2004, at 11:58, Niall O Broin wrote:
>
>> I have to say that this seems to me like the kind of stop-gap which
>> might last a long time, in that it seems like it would have stopped all
>> of the recent worm activity at least.
>
>Well, hopefully it will continue to do so.  Please keep an eye on 
>things and let me know your experiences.
>
>> Apropos what Justin said recently, does SA run before or after mail 
>> has been de-mimed ?
>
>Before.  That said, dagda *always* ran SA against the mails before they 
>were de-mimed.  It's just that dagda's bayesians aren't really kept up 
>to date - is there any way of importing a ready-made well-trained 
>bayesian db?

Yep -- it's a bit kludgy, because the Berkeley DB format is really
unportable (architecture-level differences, plus incompatible changes
between their own releases.  argh).

So I wrote a simple tool that just dumps a DB_File to a text format, and
loads a new one on the other side, when I ran into this situation myself.
Here it is:

	http://spamassassin.org/devel/db-to-text.pl.txt

However that's not great, because it'll nuke anything that's already
been learned there.

long term: the best way to do it is to set up 2 mailboxes on dagda that
you can bounce (ie. resend with existing hdrs) spam or ham messages to,
and then have a cron job that runs "sa-learn" over their contents
nightly or so.

(in fact that's a good way to get this started off anyway, if you've
got a couple of hundred spam/ham samples on-hand -- just set up those
aliases and bounce those samples all over to them.)

- --j.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
Comment: Exmh CVS

iD8DBQFARiCjQTcbUG5Y7woRAgLOAJ9tvmMT+xIs5b/q9fvBLRJiR/E8cwCgsXHW
8pg6GdBlPMKMFM0C10oht9I=
=u2Sv
-----END PGP SIGNATURE-----