fishter Posted May 21, 2005 Share Posted May 21, 2005 I've recently set up my mail server(*) to automatically filter all mail with a spam score greater than 5 to a separate folder that I check every couple of days. There have been no false positives for some time, so I'm quite happy that it's working well. I still get the occasional spam which scores less than 5. My question is this; should I report all the spams to Spamcop (20-30/day), or should I just report the ones that slip through my net (2-3/day)? (*) I use MailScanner as a wrapper for all the mail related services. It uses SpamAssassin (latest) and does RBL checking as well. Link to comment Share on other sites More sharing options...
Farelf Posted May 21, 2005 Share Posted May 21, 2005 For my tuppence worth, I would say report as much as you're comfortable with and can achieve in a timely manner (reporting them as soon as they hit the internet is the ideal). That supports the SCBL, gives compliant ISPs a "heads up" to enforce their AUPs and puts (some) pressure on the others through inconvenience to their irate customers. Most "spam control" seems to consist of sweeping it under the carpet. That just provides an environment allowing the inept to survive and the corrupt to flourish. The SCBL and ISP notification at least exposes spammers to risk (not to mention keeping considerable numbers of Comcast staff "gainfully" employed). Link to comment Share on other sites More sharing options...
Wazoo Posted May 21, 2005 Share Posted May 21, 2005 My question is this; should I report all the spams to Spamcop (20-30/day), or should I just report the ones that slip through my net (2-3/day)? If the SpamCopBL is being used, then report as much as you are comfortable with. The reporting of "only that which passes" carries the proviso that those that once were blocked due to previous reporting would tend to fall off the BL due to no longer being reported ... This is a real issue for those users that the ISP has set to using the BL results for blocking ... spam arrives one day, gets reported enough that it's listed on the BL, user doesn't see the spam for a few days, then it's back again, cycle repeats, user is left with the concept that reporting does no good as the spam keeps arriving (not aware that the spew had been stopped / blocked during those 'not seen' days) Link to comment Share on other sites More sharing options...
Jeff G. Posted May 21, 2005 Share Posted May 21, 2005 keeping considerable numbers of Comcast staff "gainfully" employed28329[/snapback] They actually exist? Link to comment Share on other sites More sharing options...
Farelf Posted May 22, 2005 Share Posted May 22, 2005 They actually exist? 28334[/snapback] Bit of a worry, isn't it? "Comcast expects its Philadelphia staff to grow from 1,300 to 1,900 between 2004 and 2007. The company's revenue history suggests that 50% growth in its headquarters staff is attainable. Comcast posted $39 million in revenues in 1981 compared to $20 billion in 2003. Comcast CEO Brian Roberts says that the firm's Philadelphia headquarters could employ as many as 4,000 people within the next five years." http://www.nreionline.com/mag/real_estate_...t_takes_philly/ $20 billion for being a little bit useless - what Brit author Brian W Aldiss calls "supercity" (su-PER-city), the easy way to the top :-) "Comcast Promise We will entertain, inform and empower our customers while enriching our communities." http://www.comcast.com/Diversity/Credo.html They've certainly kept *me* entertained over the years, and I'm not even a customer. Link to comment Share on other sites More sharing options...
TerryNZ Posted April 7, 2006 Share Posted April 7, 2006 After reading the guidelines (http://www.spamcop.net/fom-serve/cache/125.html) and (http://www.spamcop.net/fom-serve/cache/14.html) and trying to search the forum, I have to resort to asking the question. I use MailWasher Pro, which flags spam, and does a SpamCop lookup at bl.spamcop.net. So I can see if spam is already failing the Spamcop test. Should I report spam, already flagged as rejected by Spamcop, again? Arguments for: 1. If the IP is nearing its 48-hour autodelete, it is worth reporting, because it is still spamming 2. Spamcop statistics need to report the severity of sightings per IP address Arguments against: 1. Unnecessary bandwidth usage 2. Redundant information What is the policy, and could it go into the guidelines at one or other of the above guides? Terry Link to comment Share on other sites More sharing options...
dbiel Posted April 7, 2006 Share Posted April 7, 2006 If one has the time, it is always good to report all spam received, even if it is currently on the SpamCopBL. Each additional report adds to the calcualtion of just how long a specific IP address will remain of the BL. Failure to report spam simply shortens the time that the affected IP address will remain on the list. But remember that it is important NOT to report mail simply because it is on the SpamCopBL. You may have indirectly signed up to receive it and if that is the case, it should not be reported by you. The goal is to keep the SpamCopBL as accurate as possible Link to comment Share on other sites More sharing options...
Wazoo Posted April 7, 2006 Share Posted April 7, 2006 I use MailWasher Pro, which flags spam, and does a SpamCop lookup at bl.spamcop.net. So I can see if spam is already failing the Spamcop test. "Failing the test" is an odd way to say "the IP address is listed" ... Should I report spam, already flagged as rejected by Spamcop, again? Why do you say "again" ..?? You are reporting "your" spam ... other folks are reporting "their" spam ... Arguments for: 1. If the IP is nearing its 48-hour autodelete, it is worth reporting, because it is still spamming 2. Spamcop statistics need to report the severity of sightings per IP address The 48-hour limit is not based on "when you report it" ... that limit is betermined by data within the header of the spam submitted. "severity" .. again, a bit of a strange way to define about the effects of your reporting actions feeding into (or not) the bit of a math formula offered up to explain what is "on the BL" .... What is the policy, and could it go into the guidelines at one or other of the above guides? 41880[/snapback] The "above guidelines" reference the "official" www.spamcop.net FAQ .... There is a reason that there are links at the top of even this page to versions of that FAQ incorporated into the versions provided "here" .... those explanations can be found elsewhere ... I moved this post out of the How to Use .... SpamCop Reporting Forum section to the Reporting Help Forum section. I then went the next step and located a previous Topic/Discussion that also included the same conceptual questions. PM sent to advise of this move/merge. Link to comment Share on other sites More sharing options...
TerryNZ Posted April 7, 2006 Share Posted April 7, 2006 "Failing the test" is an odd way to say "the IP address is listed" ... Is my hairsplitter any sharper than yours? When submitting an RBL BL request to determine if an email is legitimate, I get one of a range of codes, telling me that the email has failed the test for legitimacy. Sorry, but that's the way my mind works. At least, that's the way my mind thinks it works, and it must be working if it is thinking that it is working. "severity" .. again, a bit of a strange way to define about the effects of your reporting actions feeding into (or not) the bit of a math formula offered up to explain what is "on the BL" .... Thank you for your tolerance of my divergent thought processes and the way I go about defining about effects. . There is a reason that there are links at the top of even this page to versions of that FAQ incorporated into the versions provided "here" .... those explanations can be found elsewhere ... And extremely extensive they are too. I will get around to reading the whole bible one day, too. Phew! Thank you for relocating my first posting, and advising - great service. Link to comment Share on other sites More sharing options...
Wazoo Posted April 7, 2006 Share Posted April 7, 2006 Is my hairsplitter any sharper than yours? When submitting an RBL BL request to determine if an email is legitimate, I get one of a range of codes, telling me that the email has failed the test for legitimacy. Sorry, but that's the way my mind works. At least, that's the way my mind thinks it works, and it must be working if it is thinking that it is working. 41885[/snapback] No challenge to your way of thinking. It's just that around here, when the words check, BL, and fail are close together, it's usually a complaint that the BL isn't working, can't be connected to, or doesn't contain some desired data. Link to comment Share on other sites More sharing options...
Paranoid2000 Posted April 18, 2006 Share Posted April 18, 2006 This is a real issue for those users that the ISP has set to using the BL results for blocking ... spam arrives one day, gets reported enough that it's listed on the BL, user doesn't see the spam for a few days, then it's back again, cycle repeats, user is left with the concept that reporting does no good as the spam keeps arriving (not aware that the spew had been stopped / blocked during those 'not seen' days)28333[/snapback] Would it not make sense to extend the listing period for addresses that keep re-appearing? (e.g. doubling the duration for each subsequent relisting within a week of the last one expiring). Repeat cases would seem to indicate longer-term problems and an ISP that acted to fix a persistent problem (with a long duration listing as a result) could apply to SpamCop to have that listing removed for a probationary period. Having the same listing for an address, regardless of whether it was a once-off configuration issue or the homebase for Spammers'R'Us seems to be an over-simplification of the system and seems to place a greater burden on reporters. Link to comment Share on other sites More sharing options...
Wazoo Posted April 18, 2006 Share Posted April 18, 2006 Would it not make sense to extend the listing period for addresses that keep re-appearing? (e.g. doubling the duration for each subsequent relisting within a week of the last one expiring). Repeat cases would seem to indicate longer-term problems and an ISP that acted to fix a persistent problem (with a long duration listing as a result) could apply to SpamCop to have that listing removed for a probationary period. 42060[/snapback] There has been some experimentation in the past. There was once an attempt to handle the spammers that were once using the data made available to "move" the spam spew sources around a block of IP addresses in order to stay "just ahead" of the BL, kind f like a SPEWS thing, expanding a 'range' od IP addresses involved .... there was way too much collateral damage .... However, the real answer is that the primary "feature" of the SpamCopDNSBL is that it is aggressive, quick to list, but .. also just as quick to delist. Link to comment Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.