[SC-Help] Re: Average reporting time and timezones

[Mike Easter]

David R. Newman wrote:
> When I report spam, Spamcop tells me my average reporting time. For
> years it stuck at 12 hours, so I assumed it wasn't calculating that.
> Now it's gone up to 13 hours, so something must have happened.
>
> How is the average time calculated, and does it take account of time
> zones? I'm several hours ahead of the spamcop servers.

I don't know the answer to your question, but I'll comment on what
little information I know, and then you may have some additional
information to work with while you try to guess the answer.

First of all, whenever I 'think' about what time it is now, in a global
context, I don't think what time it is PDT, Pacific Daylight Time.  I
think about what time it is UTC.  That way when I'm looking at headers,
I don't have to do all kinds of gyrations for the various different
timezones.  I just convert everything to UTC.  Or you can say GMT, but
the two terms are not precisely the same.

Second, there's another piece of information about a spam's 'date' or
timestamp.  It is not what is in the Date line created by the spammer.
And, what it /is/ isn't altogether simple.  It is officially "The parser
takes the date from the earliest trusted received line. Rather than what
it used to do, which was take the date from the top-most received line."

But I would elaborate on that subject.   I would say 'earliest' trusted
received line means the lowest or bottommost trusted received line.  The
bottommost trusted receivedline can be the top line, or it can be the
bottommost mailhost line, or it can be the bottommost trusted server
line.  And we most surely would express that in UTC, nicht war?

Third, so what do we do with this information?  Compare the age of a
spam based on the bottommost information as above with the present time
UTC?  That's what I would do.

That also means that the age of the spam is going to be influenced by
the parser's use of the mailhost of the person submitting to the parser.
If you have a mailhost configuration, that will determine/affect SC's
calculations as to the age of your spam.


-- 
Mike Easter
kibitzer, not SC admin