Vurus = Spam==allow reporting

[dzaidle]

I posted this in the New Feature Request forum, but thought I'd bring it here to solicit opinions. To wit:

SpamCop asserts "viruses are not spam" and refuses to report them. At one time the "not spam" bit was true, but not anymore.

I have read repeatedly that most spam comes from "spam zombie" machines "owned" via the machinations of malicious virus writers (Netsky, et al). Ergo, a machine spewing viruses via email is (a) a spam source in training and ( attempting to create other zombies/spam sources. It therefore seems logical that any ISP serious about fighting spam would welcome reports of subscribers spewing viruses, whereby to notify the subscriber of the infection and/or suspend the account until the problem is fixed.

Why, then, does SpamCop continue to refuse to accept virus reports and notify ISPs about viruses spewing from their mail servers?

If the number of owned machines is as represented, it seems that a huge step toward controlling spam would be identifying and fixing said machines or suspending their ISP accounts BEFORE they start spewing spam.

[Wazoo]

It basically goes back to what the original intent of the SpamCop parsing and reporting tools were developed to do ... report the source of spam spew. There were a number of ISPs that asked nicely / jumped all over Julian for the receipt of a SpamCop complaint that wasn't about spam spew. Take that in the light of the abuse desk guy had some authority over cutting off a spammer ... but the virus/trojan thing had to be handled by someone over in "network security" ... possibly simply boiling down to job descriptions, but perhaps also controlled a bit by legal stuff involved ... Bottom line, Julian chose not to "convert" SpamCop to a virus reporting tool.

Actually, your other post has been deleted, based on it being more of a question, and then you bringing the same question "over here" .... If there is something that develops here that seems like it would change Julian's mind (and of course somehow manage to create the free time needed to work all the coding miracles <g>) .. then I'd say re-post it in the "new features" then at that time. But hash it all out "here" first.

[DavidT]

Wait a moment...in the current FAQ on the SpamCop.net site, under the "Rules - everybody read!" item is found the following text:

"Viruses are another form of spam and may be reported to SpamCop as such."

The URL for that is:

http://www.spamcop.net/fom-serve/cache/14.html

Unfortunately, the site is a bit schizophrenic on this topic, because there is some contradictory language here:

http://www.spamcop.net/fom-serve/cache/125.html

I could swear that I've read elsewhere in these forums that there's been a recent change to this policy, and that we're now allowed to report virus transmissions?

DT

[Wazoo]

Yes, you are correct in that the data in your first link has changed. (No one has yet stated/admitted as to just who changed it yet..??) Some discussions about the not-so-clear verbiage haven't led to someone going back in and "fixing" it. Some "virus reporters" have also then complained that the parser rejected the submittal "because it looks like a virus" ... those follow-up complaints have mostly been hit with a note from Ellen, who asks that the data be sent to her/Deputies .... and that's the last "we" hear of it .... possibly one of those things that's been kicked to Julian, who made some more codebase changes with no fanfare, maybe things are still under discussion ...????

At this point, there's that big difference between an actual viral output, a virus notification, an e-mail that's had the virus stripped, and just what that "new version" of that FAQ entry actually addresses/allows/changes ...????

[DavidT]

At this point, there's that big difference between an actual viral output, a virus notification, an e-mail that's had the virus stripped, and just what that "new version" of that FAQ entry actually addresses/allows/changes ...????

It's certainly a bit confusing. I think that the deputies need to bring *all* of that to Julian's attention, not just the "yes/no" on virus reporting issue. The question is, who brings it to the attention of the deputies? You? Or all of us, one at a time? The former seems more efficient.

DT

[kdcinfo]

Shouldn't/wouldn't/couldn't there just be a "VirusCop"? SpamCop complaints go to Mail Abuse, whereas VirusCop complaints go to Network Security.

[StevenUnderwood]

Shouldn't/wouldn't/couldn't there just be a "VirusCop"? SpamCop complaints go to Mail Abuse, whereas VirusCop complaints go to Network Security.

Sure, start it up....

[kdcinfo]

Sure, start it up....

haha ... wish I could. Got lots of ideas, and no one to implement them haha

Sometimes I just hope an idea gets someone else thinking about it so that maybe someone, somewhere can use it as a start (or even a continuation) of something else. I reserve the ones I think I might be able to do myself

[Wazoo]

Shouldn't/wouldn't/couldn't there just be a "VirusCop"? SpamCop complaints go to Mail Abuse, whereas VirusCop complaints go to Network Security.

Try searching within this Forum thing (All Forums) and look for "viruscop" ... noting that this is only this side of the house, newsgroup traffic would have many. many other listings, even pre-dating those references here .... Julian has his hands full on the spam spew issues, no one has yet come up with a better alternative of his bit of automated parsing set-up, so the world has been waiting for someone to step up to the virus notification/handling thing. Would have to point out that one of the major hurdles is even after writing the perfect tool, one still has to deal with clueless ISPs that musy then deal with their clueless users .. not a good visual there <g>

[Wazoo]

It's certainly a bit confusing. I think that the deputies need to bring *all* of that to Julian's attention, not just the "yes/no" on virus reporting issue. The question is, who brings it to the attention of the deputies? You? Or all of us, one at a time? The former seems more efficient.

Me pointing to things, usually offering my opinion, yep, that's what I do <g> At this point in time, I'm almost willing to state that Julian himself changed that FAQ, based on no one else seeming to know anything about it beyond that it changed. (and this wouldn't be the first time he'd put something up, knowing exactly what he was talking about, therefore not going into a lot of extraneous details that some of "us" might have used to fully understood the words that did get typed <g>)

As said before, the newsgroup threads basically died down after rceiving no response from higher up in clarifying the language .. beyond the already mentioned requst from Ellen for some samples of reportd items .... I'll start again, but alos noting that sometimes I do get answers for some things like this, but they are couched within a "not for public discussion" .. so???

If it's of any value, there only three (five really with you and JeffG) folks involved in a bit of conversation about "reporting an abusive user" within this application. I don't see those things, JT doesn't recall any settings involved (I can only find a selection of PM or e-mail to make the notify), but apparently those "reports" end up going to RW (JT thinking that he may have forwarded the first one, but not sure ...) I've been hacking at some pre-compiled code of the current Trial version but not finding the answers, though noting that there's been a lot update since the version running here ... also confusing is that as this is still running on Trial, it may be that certain iptions just aren't available ... so the address pulled out of the air for the "report notifies" may be some item scraped from somewhere else, though that sounds really stupid ... just going with there's only a couple of folks involved with this bit of issue, and the FAQ change has over a half-dozen folks that might be directly involved (that most of those have avowed the same surprise at the change is more than a bit confusing <g>)

[DavidT]

I'll start again, but alos noting that sometimes I do get answers for some things like this, but they are couched within a "not for public discussion" .. so???

The concept of whether or not SpamCop users should be reporting virus-related messages doesn't seem very "sensitive" -- please push for full disclosure on our behalf.

If it's of any value, there only three (five really with you and JeffG) folks involved in a bit of conversation about "reporting an abusive user" within this application.  I don't see those things, JT doesn't recall any settings involved

I've not set up IPB myself...I've done phpBB, Phorum, and some others...but the configuration of the "Report" function is surely in an accessible portion of the backend admin stuff. I doubt that it's at the install or code tweaking level...wait...I think it's because you're not in the "Global Moderators" category. Take a look at the "Moderating Team" screen:

http://forum.spamcop.net/forums/index.php?...ts&CODE=leaders

I think that the "Reports" probably go to the Global Moderators...you need to be promoted to the status of "Global Moderator," Wazoo. Here's a link to a bug report on the Invision site having to do with the report hierarchy:

http://forums.invisionpower.com/index.php?showtopic=136333

...and why the heck is this still a "Trial" version? Seems like $185 for a perpetual license should be within range, considering that these forums support both the Reporting and the Email Account paying customers.

Regarding the mysterious and contradictory FAQ change...did you get an answer from the person at Ironport who has made some of the recent changes?

DT

[StevenUnderwood]

...and why the heck is this still a "Trial" version?

We are still not sure we are going to stick with this application???? There has never been an official announcement about the test of the forum ending. I think it has been pretty successful and we should stick with it, but I don't make those decisions.

[Wazoo]

I've not set up IPB myself...I've done phpBB, Phorum, and some others...but the configuration of the "Report" function is surely in an accessible portion of the backend admin stuff. I doubt that it's at the install or code tweaking level...wait...I think it's because you're not in the "Global Moderators" category. Take a look at the "Moderating Team" screen:

I think that the "Reports" probably go to the Global Moderators...you need to be promoted to the status of "Global Moderator," Wazoo. Here's a link to a bug report on the Invision site having to do with the report hierarchy:

http://forums.invisionpower.com/index.php?showtopic=136333

Thanks for that link .. I'd given up over there quite a while back when they locked out the support forum to allow only "people that have bought a product" ... they used to allow Read-only access, but .... anyway, spent a number of hours going through the bugs, suggestions, patches fora ... picked up a lot of data .. as a matter of fact, I picked up enough to cause some e-mail to JT about the response to an item or two that didn't actually work the way they were described (maybe should have done even more reading before tinkering? <g>)

...and why the heck is this still a "Trial" version? Seems like $185 for a perpetual license should be within range, considering that these forums support both the Reporting and the Email Account paying customers.

A while back, I had downloaded the current Trial version .. wanting to look at some code, initialization files, etc. to try to resolve / answer some things .. I'd noted that many things had changed, one being for instance that the Trial version would lock up at 5,000 posts. Kicked a note out to JT, pointing that one out, admitting that I don't recall the terms of the version here now, and made note that another possible limit (the one year anniversary of install) was right around the corner. He did state that purchase would be a thing added to his list <g>

Regarding the mysterious and contradictory FAQ change...did you get an answer from the person at Ironport who has made some of the recent changes?

Courtney hasn't answered an e-mail in a long while, so I do believe her temporary additional assignment of cleaning up those FAQ entries has long been over. The notes from RW who used to be "the" guy taking care of the FAQ admitting that he's as surprised at the rest of us on some of these changes .. and that he'd pretty much limited things to making those simple editing changes, citing that new stuff had to go all the way up and over to legal ... think we're back to the arrangement between Julian and Ironport (the advertising of the Ironport hardware on that new FAQ page just can't be ignored <g>)