[SC-Help] Re: Parser missed URLs in spam..

[Mike Easter]

Mike Easter wrote:
> I think that the reporter should be presented with the option to say
> whether an url was a spamvertiser, as opposed to an innocent
> bystander, whether there is any reporting to the provider or not.  I
> for one don't like to notify the majority of providers for
> spamvertisers for my spam.

For me or my purposes or my opinion about how to handle spamvertisers,
every found url, resolved or not, should include an opportunity to
notify a devnull address.  If it is an IB the devnull should be left
unchecked by the responsible reporter;  if an unresolved spamvertiser,
the reporter would be able to check the devnull so that it would become
a statistic.  If it is a resolved spamvertiser with 'real' notify
addresses, the reporter should be able to check the devnull and uncheck
the real ones so as to not have to notify an undesirable provider.

Some/many providers for spamvertisers are blackhats and the spam report
which the current notifying process performs is simply a vehicle for the
spammer to see the report containing the spamitem.  That spamitem can
contain all kinds of things to identify the recipient, which can lead to
listwashing or even hostile activity.  Modern spammers command armies of
trojanized computers for sale to the highest bidder, which can be used
for all kinds of mischief ranging from extortion to 'simple' unpleasant
retaliation.

The simplistic mungeing which SC performs by default or minor additonal
mungeing which a reporter is permitted to perform prior to submission
don't provide enough latitude for the relationship between the reporter
and a spamvertiser provider.

A reporter should be able to submit a report unmunged, default munged,
slightly ubermunged, or the equivalent of the mole report -- no report
at all for the spamvertiser.

Previously mole reporting counted for something, but that counting
condition was eliminated from contributing to the SCbl.  Now the
condition of quick reporting reports sources but not spamvertisers.
There needs to be a method of 'counting' spamvertisers without notifying
them, if that is the choice of the reporter.


-- 
Mike Easter
kibitzer, not SC admin