kre Posted March 27, 2004 Share Posted March 27, 2004 Just curious, the reporting time seems to level out at the time zone delta, assuming that CA is -8, and I'm at +1 from GMT. I've never been able to get it below 9h. But maybe I'm just slow Link to comment Share on other sites More sharing options...
Wazoo Posted March 27, 2004 Share Posted March 27, 2004 I don't think there's anyone that can tell you where these numbers come from. Some folks thrilled at their low numbers, others complain that just a single spam submittal knocks their average back to a 5-day average, though noting that you can't report anything after 3-days ... I'm at -6 but my reprt time has never gone below 13 hours, though anything I run through the parser is within minutes of receipt. Link to comment Share on other sites More sharing options...
kre Posted March 27, 2004 Author Share Posted March 27, 2004 Well, that shows that it's not exactly the delta, at -6 that would be 15. Hmm. Still assuming the server is running on PST. Though there seems to be a pattern to it. If it's EST, that would just mean I'm a lot slower than you. When the feature was introduced, I wanted to use it to verify and improve my alertness. Which is what I believe it's for. So, understanding how it works would help with the interpretation. Link to comment Share on other sites More sharing options...
A.J.Mechelynck Posted April 1, 2004 Share Posted April 1, 2004 I don't think there's anyone that can tell you where these numbers come from. Some folks thrilled at their low numbers, others complain that just a single spam submittal knocks their average back to a 5-day average, though noting that you can't report anything after 3-days ... I'm at -6 but my reprt time has never gone below 13 hours, though anything I run through the parser is within minutes of receipt. AFAIK, its an average of the time between the timestamp on the top (latest) received-line ("when the spam arrived at your mail server" -- not your mail client) and when you reported it -- averaged on all spam since the "reporting time" feature was added or since you subscribed with SC at that email address (whichever is later), until the moment you see the value displayed. Let's say you sleep 8 hours, shave (or put on make-up, depênding ), dress, eat breakfast, go to work for 8 more hours including travel time and lunch break, come home, light up your computer, and download the mail that came in for your home account(s) while you were away. The mail that you "receive" at that moment has already waited at your server for between 0 and 16 hours for you to activate your mail client (and modem) and get the mail. That "waiting time" is (IIUC) included in the "reporting time" taken into the average for the corresponding spam emails. Link to comment Share on other sites More sharing options...
Wazoo Posted April 1, 2004 Share Posted April 1, 2004 AFAIK, its an average of the time between the timestamp on the top (latest) received-line ("when the spam arrived at your mail server" -- not your mail client) and when you reported it -- averaged on all spam since the "reporting time" feature was added or since you subscribed with SC at that email address (whichever is later), until the moment you see the value displayed. If you'd change the "top line" to read "the topmost valid line" I'd agree 100% <g> Noted in the past ages ago, most of my reporting was done from a HotMail account, and had noted that "clean" mail seemed to arrive pretty quickly, but the "sapm" showed quite a delay. I was guessing that it had to do with their implementation of the BrightMail filters, and somehow that set of servers was really stuck crunching huge loads of stuff. At any rate, this is where I'm guessing my "not-true" numbers actually come from. Let's say you sleep 8 hours .... has already waited at your server for between 0 and 16 hours Retired military, network is up 24 hours ... geeze, I wish I could sleep for 8 hours at a time <g> Most of my reporting is done manually, the SpamCop parser usually only used when I'm not sure of my results ... but, it's done within minutes of receipt in any case ... surely not my currently showing 13 hours. There may be times I'll be away, so a service call somewhere, and I'll be gone for quite a while, but anything over a few hours old is usually deleted, figuring others have actually already reported it if it's going to be reported. Link to comment Share on other sites More sharing options...
A.J.Mechelynck Posted April 1, 2004 Share Posted April 1, 2004 Noted in the past ages ago, most of my reporting was done from a HotMail account, and had noted that "clean" mail seemed to arrive pretty quickly, but the "sapm" showed quite a delay. I was guessing that it had to do with their implementation of the BrightMail filters, and somehow that set of servers was really stuck crunching huge loads of stuff. At any rate, this is where I'm guessing my "not-true" numbers actually come from.Hm -- didn't those "stuck" servers forward what they passed to some server you polled with POP? The latter would (or should) have put its Received-line (and timestamp) on the mail. Oh, well, I don't know anything about the workings of Hotmail... There may be times I'll be away, so a service call somewhere, and I'll be gone for quite a while, but anything over a few hours old is usually deleted, figuring others have actually already reported it if it's going to be reported. Policies vary... I (try to) report all my spam: false negatives by web as soon as I see them, to put them on the list (Yum, this spam is fresh!); listed spam (on at least one of the several DNSBLs I use to sort my inbox, SC being one of them) using submit-by-mail and, when I come around to it, the Report Now link, to keep them on the list at least as long as they spew. Some of it used to be Yum-fresh too, but I have been out of home more often than usually these days, and at the moment there is a backlog of some 20 hours (going down slowly) on my listed-spam reports. ISPs always have the possibility to stop additional reports by declaring (clicking?) "I don't want to receive any more reports on this issue" or "This issue has been resolved". Link to comment Share on other sites More sharing options...
Wazoo Posted April 1, 2004 Share Posted April 1, 2004 I (try to) report all my spam Don't get me wrong, I also try to make sure that all spammers get the attention they deserve <g> ... it's just that time / priority / obligations mixture that drives these decisions ... and Lord knows, I'm not that good at even doing that at times <g> .. took the dog out a bit go, walked past a jug of distilled water ... only now remembering I'd put a charger on the bike like a week ago and I'd put the distiled water there to remind me to take the charger off ... did I mention "like a week ago?" ... and you know what, I still haven't made it out there .. sheesh! Link to comment Share on other sites More sharing options...
Max Posted April 1, 2004 Share Posted April 1, 2004 I (try to) report all my spam: false negatives by web as soon as I see them, to put them on the list (Yum, this spam is fresh!); listed spam (on at least one of the several DNSBLs I use to sort my inbox, SC being one of them) using submit-by-mail and, when I come around to it, the Report Now link, to keep them on the list at least as long as they spew. I understood "Yum, this spam is fresh" and "Report Now" - for the rest, I miss some essential elements of grammar (verbs?) ... This said, I wanted to suggest that in addition to the "Yum", one could be informed about whether or not the spam corresponds to a *new* IP number not yet on the BL and/or what IP's are(would be) added as consequence of the current report. PS: and, to elucidate the timezone juggling problem, a more quantitive answer in addition to the "Yum" would be nice (e.g., add " (5 hrs 23 min)" after the "...fresh"). Thanks for your attention ! Link to comment Share on other sites More sharing options...
A.J.Mechelynck Posted April 1, 2004 Share Posted April 1, 2004 I (try to) report all my spam Don't get me wrong, I also try to make sure that all spammers get the attention they deserve <g> ... it's just that time / priority / obligations mixture that drives these decisions ... and Lord knows, I'm not that good at even doing that at times <g> .. Sure, sure... "Policies vary", I said. You have yours, and I have mine. If I were working the nine-to-five squirrel cage I would probably need other policies than I have now. Even so, I'm considering undefining my spamtrap alias to reduce the flow (a mail alias that was never used except to send mail from myself [at]netscape.net to myself [at]belgacom.net -- you'd wonder who gave that address to the spammers -- or how AOL enforces its "privacy policy" -- unless they got it by trying every 7-letter combination). took the dog out a bit go, walked past a jug of distilled water ... only now remembering I'd put a charger on the bike like a week ago and I'd put the distiled water there to remind me to take the charger off ... did I mention "like a week ago?" ... and you know what, I still haven't made it out there .. sheesh! I sometimes say that if my head wasn't bound to my shoulders, I'd leave it on the bedcushion every time I wake up and go. What do you use distilled water for? Chemistry maybe? Anyway you haven't use that particular jug for a week or more. Link to comment Share on other sites More sharing options...
A.J.Mechelynck Posted April 1, 2004 Share Posted April 1, 2004 I (try to) report all my spam: false negatives by web as soon as I see them, to put them on the list (Yum, this spam is fresh!); listed spam (on at least one of the several DNSBLs I use to sort my inbox, SC being one of them) using submit-by-mail and, when I come around to it, the Report Now link, to keep them on the list at least as long as they spew. I understood "Yum, this spam is fresh" and "Report Now" - for the rest, I miss some essential elements of grammar (verbs?) ... What is it you don't catch? I don't have much to go by on your profile (only time zone -5, and that could be USA, Perú or Quebec, without yet takng summer time into account -- I suppose it could be summer time in the extreme West of Brazil). OTOH, "Max" is a fairly international first name. Would a French translation help you? I don't know Spanish or Portuguese well enough. Verbs (not counting participles used purely as adjectives): try, report, see, put, is, use, sort, being, using, come around to, Report, keep, spew. I don't miss any. It is true, however, that colloquial English has a tendency to omit some conjunctions (that...) and relative pronouns (which, whom, ...), a tendency which can be unsettling to the non-native. Link to comment Share on other sites More sharing options...
Wazoo Posted April 2, 2004 Share Posted April 2, 2004 "Yum, this spam is fresh" An indicator that you've reported this spam within two hours of receipt (back to the top-most valid Received line again) ... In the days of yore (not sure about today) the actual report would have special wording in the Subject line to indicate to the receiving ISP that a spam run was likely in progress, in hope it could be turned off quickly. corresponds to a *new* IP number not yet on the BL and/or what IP's are(would be) added This kind of feeds back to the current issue of us normal users looking at the evidence files on a specific IP .. spammers were using the real time data to try to keep just ahead of or on the border line of actually making it to the block list. This suggestion would possibly open up the same door. unless they got it by trying every 7-letter combination Ain't computers something <g> It's amazing what some folks will set them up to do .... What do you use distilled water for To replenish the water lost in the battery ... nice day last week, had to bump start it every time .. but even after a week on the trickle charger, looks like this 8-year old battery is about toast <g> Link to comment Share on other sites More sharing options...
StevenUnderwood Posted April 2, 2004 Share Posted April 2, 2004 I wanted to chime in here on the average reporting time. I used to have no problem believing the number (usually around 2 hours) and posted so in the newsgroups. In the last week, however, I have been seeing the number climb by the hour, sometimes even when no spam was pending (all confirmations had been received over an hour before). My numbers went from that 2 hours to currently sitting at 15.9 days and I have not changed my reporting tendancies at all. I have a position where I can check webmail and report at least every couple of hours throughout the day. The only lag time is from bedtime (~11:00-11:30 PM) until morning (~7:00-8:30 AM depending if I have time before running to work). I personally saw it jump from 10.9 to 12.2 to 12.5 by hitting refresh twice in 5 minutes. I would like to see more information posted in the confirmation email (for quick reporting) or the parse about which time is being used from the message and what the parser is calculating for the response time for that message. Of course, this should be done in Julian's spare time when everything else is working flawlessly (perhaps during his vacation). Sorry Julian Link to comment Share on other sites More sharing options...
Farelf Posted April 2, 2004 Share Posted April 2, 2004 While there are pressing operational matters that are properly getting attention, this is not a trivial matter by any means. Average reporting time, when and if it works properly is general "performance" feedback, incentive and an actual policy tool for some. When it doesn't work properly it is simply an irritation (like an airline "loyalty" program ;-) IMO it really should be fixed (best option) or scrapped, quickly. Leaving it as it is is the worst option. Incidentally, it's about right in my case, since I started using the submission page. My timezone is +8 (Hotel) Link to comment Share on other sites More sharing options...
Max Posted April 2, 2004 Share Posted April 2, 2004 I don't have much to go by on your profile (only time zone -5, and that could be USA, Perú or Quebec, without yet takng summer time into account -- I suppose it could be summer time in the extreme West of Brazil). I'm sorry, professional reasons don't allow me to put my hompage URL on pages of this forum. In fact, timezone -5 is wrong, should be -4 (no summer time)... OTOH, "Max" is a fairly international first name. Would a French translation help you? I don't know Spanish or Portuguese well enough. I'm a fairly international guy. Vous pouvez m'écrire en français, je n'aurai aucun problème à vous comprendre. Sie können mir auch auf deutsch schreiben, ich hoffe auch in diesem Fall fehlerfrei antworten zu können. I can't figure out how to switch to cyrillic alphabet or to Hiragana or Kanji alphabet, and I don't like isolatin-transcriptions, so I don't try russian or japanese... (if you insist : watakshi wa doitsu jin desu!) But let's stick to English, seems to be a kind of policy in this forum. What is it you don't catch? for example: false negatives by web : ? to put them on the list (Yum, this spam is fresh!) : ? listed spam : ? DNSBLs I use to sort my inbox : ? (sorry for my ignorance...) Would a French translation help you? I don't know Spanish or Portuguese well enough. Pour "false negatives on the web", oui. (Portugese won't help me much, I fear...) I'm sorry, did not want to be offensive, maybe I'm just too tired to understand the complex structure of your phrase... But this little incident made me discover your interesting hompage... Спасибо... и До свидания ! Link to comment Share on other sites More sharing options...
A.J.Mechelynck Posted April 2, 2004 Share Posted April 2, 2004 But let's stick to English, seems to be a kind of policy in this forum.OK. What is it you don't catch? for example: false negatives by web : ? to put them on the list (Yum, this spam is fresh!) : ? listed spam : ? DNSBLs I use to sort my inbox : ? (sorry for my ignorance...) [...I try to report] false negatives [i.e. spam that wasn't seen as spam by my spam filters] by web [i.e. by pasting them onto the SpamCop spam-input form] [in order] to put them [the false negatives] on the [spamCop blocking] list [which lists dotted-quad IP addresses known to have been sources of spam in the recent past] listed spam: spam coming from a "known" source [because it is on the SpamCop Blocking List or on one or more of similar lists] DNSBLs: Domain-Name-Server Blocking Lists: blocking lists (aka blacklists) that operate as DNS servers: let's say I want to ask the SC blocking list if IP address 123.45.67.89 is currently listed. I do a DNS request for the domain name "89.67.45.123.bl.spamcop.net". If it resolves (usually to 127.0.0.2 in the case of the SCBL), then the address is currently listed. If it does not resolve, then the address is currently unlisted. Other DNSBLs operate in the same way, with something else instead of ".bl.spamcop.net" (the "zone" of the BL). Would a French translation help you? I don't know Spanish or Portuguese well enough. Pour "false negatives on the web", oui. (Portugese won't help me much, I fear...) I'm sorry, did not want to be offensive, maybe I'm just too tired to understand the complex structure of your phrase... But this little incident made me discover your interesting hompage... Спаси´бо и До свида´ния ! "by" web, not "on the" web; see the English exegesis above. ("Je signale les faux négatifs par le web" -- not very helpful I suppose.) Пожалуйста, and... Link to comment Share on other sites More sharing options...
Max Posted April 2, 2004 Share Posted April 2, 2004 Простите меня ! - Sorry for this typo ("on the" vs. "by"). In fact I already understood your method ("new spam" by the web, and the rest by e-mail, reporting somewhen in the future) But thanks for the explanation of "false negatives". (I really did not understand this.) Concerning your "greeting"... You are right, let's turn back to some serious occupation... МИР... Link to comment Share on other sites More sharing options...
A.J.Mechelynck Posted April 2, 2004 Share Posted April 2, 2004 You are right, let's turn back to some serious occupation... МИР... As-salaamu `alaykum, ve-aleichem shalom... Not a small task! Link to comment Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.