[SC-Help] Re: Spammers getting smarter?

[Mike Easter]

Geoff Lane wrote:
> "Mike Easter"
>> Most people who are using spamcop are simply reporting that spam, and
>> it is a rare spam which needs to be rendered in order to accurately
>> report it.  So, you can spamcop report spams without opening them by
>> either accessing them by the message properties to paste the item
>> into the webparser or by mailing the closed item as an attachment to
>> the submit address.  During the examination of the spamcop parse such
>> things as innocent bystanders in a spam can almost always be
>> perceived in the spams which have never been opened or previewed.
>
> Oh dear ... are you really that sure that you can identify Spampal
> false positives without looking?

I don't know how you have /your/ spampal configured, but I haven't had a
SP false positive yet.  Perhaps I will one of these days, but 'during'
or with the parse I am examining every element of what is before me,
which includes the spampal X-lines about why it called the item spam.
If it isn't a classic or typical spam, it's body can be viewed in the
parser.  My original premise is that it is rare that my tagged spam
needs to be opened.  I can't remember when that last happened.

> Pray, how do you identify innocent
> bystanders in a spam can from the spamcop parse? I strongly suspect
> that you can't and I suspect that someone doing exactly as you
> suggest led to my being falsely accused of spamming recently.

I'm quite familiar with that incident, and I would not be spamcop
reporting my mailing list items, which that item was;  that item would
*not* have been tagged as spam by spampal, and I would *not* have even
been submitting my mailing list items to the parser in the first place,
much less one which wasn't spampal tagged.

And, that particular item was also not tagged as spam by the spamcop,
and when you parse just the headers of what you posted, it does *not*
fit the standard profile which my spams fit, which includes proxy abuses
and spamsource listed IPs.  Since you didn't post the tracker for access
to the body, I can't comment on how many other ways that item didn't fit
a spam profile.  At the time of the discussion, I accessed the original
item somewhere, so I have seen its body, but I don't have that link
right now, but it was not a spammish item.  That was a stupid report and
a stupid incompetent reaction by a provider to a stupid report.

> If you don't want to open suspected spam, please delete unopened and
> *unreported* anything you're reasonably sure is spam.

Wrong.

> If you're going
> to report it, you must be sure that it is spam. This means you should
> at least look at the thing in something that won't fetch off-page
> resources or execute attachments (such as The Bat!).

Every spam can be looked at by its message properties.  Once upon a time
I was pasting every spam which was pasted into the spamcop parser into a
notepad for viewing because that is faster that 'view entire message' in
spamcop's parse.  Now that I've streamlined some things that step isn't
normally necessary or convenient.

> But please, I
> implore you, don't take Mikes advice and report spam without
> verifying that it is spam. Someone did recently, which resulted in my
> ISP issuing unwarranted threats to close my account, and cost me
> nearly five-hundred dollars in lost production.

Just because a bad reporter made a bad report doesn't prove that one
style of spam reporting is superior to another and it doesn't mean that
people should be opening known spam.

There are plenty of reporters who are opening their spam and making bad
reports.  In fact, it is entirely possible that the person who made the
report of the mailing list item to which we are referring made that
report after opening the spam.

If that person had been using my methods, the item wouldn't have been
tagged and it wouldn't have been parsed.  If it had been parsed, it
wouldn't have been reported.

-- 
Mike Easter
kibitzer, not SC admin