Blocklist Changes

[Wazoo]

Per Ellen's request (and Julian's coding);

There have been a few small changes to the blocklist; the one that will most

affect people is this: IPs now delist after 24 hours if there are no reports

rather than 48 hours. IPs with 2 reports will delist in 12 hours. This

appears to be working out well but, of course, if we think that it is being

abused in some way then the listing and delisting criteria may change.

Ellen

SpamCop

f/ups to spamcop; if someone would propagate this to the forums I would

appreciate it.

[Wazoo]

Follow-up data;

> Indigo asks;

> Can you share the reasoning behind this? Combined with the 72 hour to 48

> hour reporting limit, it sounds to me like SC is giving spammers a free pass

> every 2 days........assuming they are on a black/greyhat ISP.

We don't think this will assist spammers but we do think that it assists

people who have been compromised and who have found the problem and fixed

it. An IP can delist and then immediately relist of course and I have seen

some that have delisted and rapidly relisted. For spammers who are just

pounding away I suspect that they never have 24 hours without a report and

if they do and start back up then they get relisted. Remember we have a lot

of spamtrap traffic in addition to the user reports. Again if it looks like

this is counter productive then we can always go back to a longer list

period.

Decreasing the reporting window was to make the reports that get sent more

timely. If an ISP is not going to do anything about a spammer then it

doesn't matter how old the reports are or how fresh for that matter but if

they are then they certainly know about the problem within the first 48

hours of the spammer sending and more likely within the first 24 hours or

even fewer hours.

As I said, we looked at the data and decided this made sense. If it turns

out to not make sense we will undo it or do something else.

Ellen