Whew. I think I finally got spamass-milter talking to spamd. At least, there's no errors in the logs and my test emails arrive in a reasonable time frame.

Now just to wait for more spam.

Does anyone know if #Copilot or any other supposed “AI" LLM is anything but total dogshit with Perl?

I ask because so far we have not had any bug reports or rule contributions or *anything* seemingly LLM-generated for #SpamAssassin. This is good. However, it makes me wonder if it isn't a larger issue. Which would also be good.

The people committed to DDoSing the #Apache #SpamAssassin RuleQA server seem to have substantial resources. I’ve blocked a lot of them, but they keep coming, asking about things like the May 7 2017 performance of a single rule in one contributor's stats. Not stuff real people want.

Of course, there's a resource they do not have. Our sysadmins, both those employed by #TheASF to watch all of our infra and the volunteer cadre focused on SA. We'll keep whacking the moles...

We’ve had a few hair-on-fire bug reports for #SpamAssassin and twice people have tried nagging me personally into “fixing” their pet problems RIGHT NOW because it was supposedly world-ending.

Thankfully, none of these have even been real bugs.

But even if they were, having the cultural permission to say “No” is critical. https://mastodon.social/@mhoye/114705284226501374

They (or an intentional DDoS) have been pounding the #SpamAssassin RuleQA site into catatonia. They construct URLs which are legitimate and which each cause the site to go digging for the specific performance of a rule on an arbitrary date in the past. Hundreds of rules tested daily for ~20 years. https://tldr.nettime.org/@tante/114698748278993833

Also: anyone who feels like donating anti-DDoS services to the #ASF #SpamAssassin project could find interest from the PMC and sysadmin team... https://toad.social/@grumpybozo/114683478386406020

Last week we enabled PRs on our read-only GH #ASF #SpamAssassin repo so that people who are most comfortable using git rather than svn can easily contribute.

Today we got the first garbage PR, apparently created by some LLM. It includes deleting everything.

It will not be merged.

But if you are NOT a LLM and want to help with SA, you can now use Github to submit PRs. HOWEVER, I suggest that those doing so provide comprehensible explanations of your intended contributions.

I finally got my first bit of legitimate spam (is that even a thing?) since installing SpamAssassin on my mail server. SpamAssissin did its job and correctly tagged the message as spam.

Honestly, when I first set up my mail server, I thought I'd get a lot more spam. Either I've been lucky, or my internet hygiene is pretty okay.

Woohoo! I got spamassassin working. Now to wait for some more spam. I never thought that would be something I'd write.

If you are having trouble getting the the #SpamAssassin infra in recent days, thank AS136907 (Huawei) for hosting so many DDoS-bots asking rule-qa.cgi impossible questions

This may get me to do something evil in that script....

Is it me or is BAYES for Spamassassin absolutely useless? It seems to tag spam as ham just as much as it tags ham as spam.

I have it trained on thousands and thousands of spam/ham emails, too. No difference.

If you're using #SpamAssassin, now is a good time to stop relying on Validity's Realtime DNS Block Lists ("Validity Zone File Access"). Free-tier users are being threatened with severe usage limits unless they arrange a call with Validity's sales team. #DNSBL #email #BaitAndSwitch

Sysadmins del fediverso, que score usan para Spamassassin? #spam #spamassassin #sysadmin #correo #email #postfix #dovecot

If you use #SpamAssassin and actually want mail sent to you from a subdomain of #wordpress.com, you will want to add that specifically to your local welcomelist. We've had reports of signed spam from such domains, so we cannot leave the wildcard in the "default welcomelist" in SA's rule channel.

This change just went into SVN and will take a day or two to appear in the channel.

Anyone who followed me in recent days for my #SpamAssassin lore and related #spam and #InfoSec hot takes should know that I'm one of those "everything is political" guys who does not believe in falsely limiting myself...
I'm a good one to mute for the day when you've heard enough terrible news.

"The stats we collect for the #SpamAssassin project (mass-scan results from participating sites) have long shown that spammers are more consistent at making #SPF, #DKIM, and #DMARC correct than are legitimate senders. DMARC in particular has no discernible benefit for most senders, so it is a useless signal.

Rejecting mail based solely on authentication failures of those deeply flawed authentication methods does more harm than good."

https://www.jwz.org/blog/2025/03/dmarc-and-spf/#comment-257743

EDIT: h/t @grumpybozo