Jump to content

Extremely long "To:" line


A.J.Mechelynck
 Share

Recommended Posts

I've encountered today (for the 2nd time; the first was some weeks ago) a spam with an extremely long "To:" line, pushing the length of the headers over the 50K barrier (i.e., SC asks me to accept truncation at 50K, then later finds that there was no body text).

What I've done to make it parse is to put the 3rd address on that line between <>, add before it "[etc.; truncated]" and edit away the rest of the line (starting at the comma following that 3rd address). See the edited headers (with, of course, munged addresses) at http://www.spamcop.net/sc?id=z1507695546ze...7d04eb0672f838z

I hope I haven't committed a breach of SC regulations.

Link to comment
Share on other sites

... I hope I haven't committed a breach of SC regulations.
Hi Tony. You have "helped" the parser to arrive at a result which it would not have otherwise and which is a forbidden "material change" I guess. Strictly, you should use the reporting data to send a manual report. Especially if there are not many of them. Ask the Deputies/Don if you are in doubt. Of course very long To: lines are an old, old feature of spam - the very first spam of all overflowed the field. I wouldn't think truncation to be a problem at all but no mere user "here" can tell you it's okay to do it without clear and sanctioned precedent, of which I know none. It does affect the forensic "quality of the evidence", which is bad. On the other hand, now that it has been raised, there is a certain "Pandora's box" aspect.
Link to comment
Share on other sites

I hope I haven't committed a breach of SC regulations.

Noting that there have been additional clarifications offered for the 'official' FAQ that has yet to be updated, I/we can only point to the amended version of that FAQ entry at Material changes to spam .... your 'work' description certainly doesn't marry up with the first paragraph of this 'rule' ....

Link to comment
Share on other sites

Noting that there have been additional clarifications offered for the 'official' FAQ that has yet to be updated, I/we can only point to the amended version of that FAQ entry at Material changes to spam .... your 'work' description certainly doesn't marry up with the first paragraph of this 'rule' ....

We-e-ell... If I'd done nothing, SC wouldn't have sent any reports, nor would that spam -- which undoubtedly was a spam -- have counted towards the SCBL. IOW: if changing that isn't allowed, then there is an "easy way out" for spammers to avoid SC altogether (both SC reports and SC blocking), viz., make sure that the headers are more than 50K long.

So I tried to make the "minimum change" while letting the recipient of the reports know that there had been a change and where.

I felt the case was somewhat analogous to the (allowed) one of adding "[no body in email]" after the headers + empty line of a bodiless spam. I guess I should have asked Ellen first, but it's only "on thinking back" that I thought maybe it wasn't that simple.

Link to comment
Share on other sites

P.S. Apparently the rules have changed: Last time I checked, it was allowed to add a phony body to a bodiless spam, the FAQ even said so. And the sanctions have been escalated too: now I'm liable to be banned for a first-time honest mistake. Please don't.

Link to comment
Share on other sites

Tony, I think you are the very model of the conscientious reporter, I'm sure they wouldn't do anything drastic. It's just they can't condone "falsification" of the evidence so drawing the line between one case and the next is an area they would want to avoid, particularly in public.

And oh - the "permission" to add the "no body" comment in a "blank" body (they acually have a couple of CR LFs in just about every case)? Find that in the official FAQ in the archives (using the wayback machine or whatever) or in a pronouncement by one of the staff and you you will be richly rewarded by Mike Easter, over in the newsgroups. Well, I make the offer on his behalf, I'm sure he'd be good for half a beer or something. :D

Link to comment
Share on other sites

P.S. Apparently the rules have changed: Last time I checked, it was allowed to add a phony body to a bodiless spam, the FAQ even said so.

I really don't think so ..... this 'suggestion' came from newsgroup traffic, pre-dating this Forum. Further, the suggestion didn't come from any of the Deputies / Staff. On the other hand, It has yet to be specifically pointed out as "not allowed" by any of the Deputies / Staff to this point either.

For example, here's a somewhat ancient newsgroup post that includes the "suggestion" .... [sC-Help] (no subject) "Would Send" ..... much in deference to Mike Easter's "belief" that this is a 'Forum' thing .....

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

 Share

×
×
  • Create New...