Jump to content


  • Posts

  • Joined

  • Last visited

Everything posted by axlq

  1. I'd like to reset mine too. I have been diligent at keeping my average reporting time at 2 hours, by making sure I never report any spam more than 3 hours old. Suddenly, today, my average reporting time shows 25 hours! How is that possible, given that 24 hours is the maximum age for reporting spam? It would be trivial to implement an exponential moving average to show the average reporting time for the last N reports: N = number of reports to average = 300 or so. w = weighting factor = 2/(N+1) t = age of spam in current report avg = most recent calculated average (this is the only value that needs to be stored) Then new average reporting time = w*t + (1-w)*avg This approximates a simple moving average calculated as the sum of the last N ages divided by N. The advantage with an exponential average, however, is that you need to store ONLY the last calculated value, nothing else. Is the average reporting time used for anything, such as weighting the importance of certain reports over others? -Alex
  2. When I report spam, I don't care much about seeing the technical data output while spamcop parses the spam in my queue. And yet, I must set "show technical data during reporting" in my reporting preferences because that's the only way to see how old the message is! I'd much rather use the simple report format, but I can't. Please, in the simple output, show a single extra line "Message is X hours old". This is imporatnt to me because I don't report messages older than 8 hours. Alternatively, the best solution is to provide a way to junk all unreported messages in the queue older than X hours. Thanks. Axlq
  3. Thanks for that explanation. I'm also frustrated by having the parser fail to resolve perfectly valid links in much of the spam I report. For example, for the past week I've seen the parser output text like this: Cannot resolve http://glee4me.com/soft/ Tracking link: http://glee4me.com/rr.php No recent reports, no history available ...and the spammer site works perfectly well. I occasionally figure out the proper abuse address myself, with tools such as dig and geektools whois, but that sorta defeats the purpose of why I pay for and use this spamcop account; i.e. to identify these things more efficiently. -Alex
  4. I kinda figured that was the answer, but I had to ask to make sure... -Alex
  5. Er... this thread drifted instantly from the first followup to my initial question. All I wanted to know was basically two things: 1. Is it feasible to have spam automatically removed from the reporting queue if it's too old? It wouldn't have to be something continually checked, but a link called "Remove old spam from queue" next to the "Report spam" link would be nice. 2. If it's feasible, it would also be nice to specify an expiration time less than the maximum allowed. I'd rather not be reporting spam more than 24 hours old, and I can avoid it by manually slogging through the queue. A function to delete the old spams for me would be useful. -Alex
  6. I just noticed that the maximum age of a report SpamCop will send out has been reduced from 72 to 48 hours. Can this be user configurable? I'd like to shorten mine to 24 hours or less. This could be implemented either as a user-account attribute, or as a link on the "report spam" page: 1. As a user account attribute, the maximum age of a report would be set up in each user's account configuration, up to the maximum allowed by spamcop. 2. As a link on the "report spam" page, there would be a text box to specify the maximum age in hours, and then a button to "clean up the queue." Right now I can either delete the whole queue or report the whole queue one at a time. Granted, I can look for the age in the parser output and cancel the report manually, but I shouldn't have to. The parser already checks the age. Why not make it variable, and give users the ability to shorten it? Having a user configurable report age setting would save me time while reporting. I will often log in 3 or 4 times per day and report spam that's come in, to make sure my reports are fresh, but occasionally I have to travel and not log in for a few days, during which time my queue grows. Being able to clear out the old spam from my queue before reporting would be a great help. -Alex
  7. OK, I suspected something like that. Thanks for the explanation. I guess what's happening is that the server looks ahead in the queue for the next report that belongs to me, and then stops, and what results from that is a "Report Now" link appearing on the page. Doing this for every user would be quite a load, and even more so if it had to look deeper in the queue to find more reports for that user. Submitting the last report in my queue would be the biggest search load of all, because the entire queue must be searched to confirm that I have no more to report. What we're seeing here is an example of a software concept that wasn't intended to scale very large. It happens all the time, and often it's unexpected, only obvious in hindsight that there was a better way to do it. I agree, that's more important. Keep up the good work. -Alex
  8. Exactly so, that's why only quality spams are auto-forwarded. Seriously, what gets forwarded to spamcop from my server is a tiny percentage of the spam received. I agree, quality is more important than quantity. Only that which manages to get through my existing gauntlet of filters gets forwarded. My filters include dropping spam identified by my ISP's own filter, dropping spam from China and Brazil, and dropping anything sent via BCC that's not in my whitelist. Only after all that, spam containing specific keywords or sent to known spamtraps is auto-forwarded to SpamCop. The point I tried to make in my earlier message, which seems to have gotten lost, is that there must be some way to convey more information about the reporting queue. I suggested two things, <a> show the queue size, and/or <b> allow the queue to be moved into the Held Mail folder so that it can be examined. If <a> is impractical, then what about <b>? Another option would be to display a list of what's in the queue by sender and subject, with a checkmark to delete it or let it remain in the queue for later sequential reporting the usual way. -Alex
  9. I'd really like to see implemented one or both of the following: 1. A number displayed next to the "report spam" link, showing how many spams are waiting in my reporting queue. 2. An option to move the whole reporting queue into the "Held Mail" folder. The first item above would let me know if it's worth my while to slog through each item in the queue, or just dump the whole thing if I don't have time. I can't believe that a simple count of the queue size is hard to implement. The second item above would help me when I come back from a couple of weeks vacation and have hundreds of items in my reporting queue, due to my own mail server auto-forwarding spam to my spamcop address during my absence. Then I would have a quick way to examine what's in the queue, I could delete some, re-submit some back into the queue for reporting so I can override some reporting defaults, and do a quick report of the others. -Alex
  10. I looked it over. They require confirmed opt-in (and they even correctly state that the term "double opt-in" is a misnomer), provide opt-in links for their users to use on web sites, and state that there is NO way to disable the confirmed nature of the opt-in. This is a good thing. On the downside, they allow users to input addresses manually. A few of the links that show up indicate that aweber's been joe-jobbed (domain name forged into mail headers). Those that appear in .sightings are pretty sparse lately. -A
  11. Thanks Jeff, it's working again! As I replied to you in email, I think a more effective solution would be to maintain the three country-specific blackholes.us lists locally on SpamCop's server. The IP allocations per country don't change much, and these aren't huge lists. Downloading an update every 3 months or so should be sufficient to remain effective. The advantages are, it would reduce the load on blackholes.us DNS, and it would probably be faster to maintain copies of the lists locally, with only occasional updates. Unlike other lists which undergo many daily changes, these lists are pretty static. -Alex
  12. I can confirm now that something is indeed broken. I enabled only one filter, brazil.blackholes.us, disabled all other filters, and waited an hour or so. 3 Brazilian spams came into my inbox. None were caught. All are listed in brazil.blackholes.us. All should have been caught by that filter, which was the only one active. telemar.net.br braziltelecom.net.br braziltelecom.net.br Thanks for looking into this. Brazilian spam, for some reason I can't fathom, constitutes over 90% of the spam received by my spamcop address. -Alex
  13. You may be right. I have noticed that none of the Brazilian spams in the Held Mail folder were caught by brazil.blackholes.us. And I get a lot of Brazil spam in my inbox, indicating that SpamCop's implementation of this filter is broken. I have disabled all filters but that one, to make sure. I should know in a few hours. -Alex
  14. Yes. Please re-read my original message (quote) "I verified that all of the IP addresses above are included in brazil.blackholes.us." This 3rd-party BL doesn't change often, because the IPs allocated to an entire country don't change often. As I said, I am seeing spam leak through with greater frequency every week. The IP addresses that slipped through are listed as /16 networks the BL (e.g. 200.171.*.*), and have been listed that way for ages. Does spamcop keep its own local copy of this BL? If so, how often is it updated? -Alex
  15. I have had brazil.blackholes.us selected as one of my filters for over a year. Yet, every day more and more spam from Brazil slips through. I don't have anything whitelisted except for two personal addresses. The ratio of filtered Brazilian spam to the amount reaching my inbox isn't 1:1 yet, but it's approaching that level. In the last 4 hours alone, the spam from the following IP addresses arrived in my mailbox, all from Brazil: telemar.net.br brasiltelecom.net.br brasiltelecom.net.br telesp.net.br embratel.net.br telemar.net.br telemar.net.br I verified this by moving the spam into the "Held Mail" folder, and then queueing all the held mail for reporting. The analysis showed all of it originated from Brazil, and the mail headers did not indicate that brazil.blackholes.us filtering was taking place. I verified that all of the IP addresses above are included in brazil.blackholes.us. The "leaky filter" draft FAQ at http://forum.spamcop.net/forums/index.php?showtopic=1895 was no help; in fact I sense a bit of denial that there might be a problem with the filtering. The user is not to blame in this case. The brazil.blackholes.us filter is clearly selected, and has been for over a year. In the list of available filters, the only ones I have NOT selected are SPEWS level 1, South Korea, and China. Somebody, please look into this. From the slow increase in the ratio of slipped-through Brazilian spam to filtered Brazilian spam, something appears to be breaking slowly. -A
  • Create New...