[SpamCop-List] Question: ignoring LARTs sent via SpamCop: acceptable practice?

[Michael Lefevre]

Miss Betsy wrote:
> "John Phillips" <jhphillips180 at hotmail.com> wrote in message
> news:ruhc5v0bgapi5mnp7g03a9ev1pfoudpiem at 4ax.com...
>> >  IMHO, munging is only really a
>> >valuable use of one's time to be a "sharpshooter" so to speak, to track
> down
>> >and find in order to do the most comprehensive damage to a spammer.
>>
>> You can't do much damage from the bitbucket in the abuse office if the
>> ISP has no faith in the accuracy of the SpamCop report.
> 
> That is the same as saying that SpamCop reports are useless.  Which I am
> beginning to get the feeling they are except to feed the bl which doesn't do
> me any good since many ISP's won't use it because it is too aggressive.  Do
> you suppose they look to see if the spamcop report is munged before they bit
> bucket it?

these are all generalisations. although I've just made a bunch of posts
putting the other side of the argument, I think there are still large
number of spamcop reports that are not useless.

[snip]
>> It doesn't appear to necessarily be a matter of policy but one of
>> pragmatism. If you have only have time to act on one of two larts, a
>> concise professional mail from Mile Easter, or an altered one that
>> John Phillips generated via SpamCop, what is your choice?
> 
> The only kinds of reports that need any kind of scrutiny are the "marginal"
> ones where probably something has gone wrong:  the unsubscribe is broken;
> the reporter missed a legitimate email. 

indeed. and abuse desks at some large ISPs, and some admins on various
corporate or instutional networks will only get that kind of marginal
report where the reporter, or spamcop, has screwed up. obviously they
develop a poor view of spamcop if they mostly see those. for example, the
last NANAE post I read from that thread was an admin for the IP range "in
the middle of the internet" - 128.128.x.x.  He evidently has no real
spamming issues because of the nature of his network, but still gets the
odd spamcop report - he may not be getting many reports, but they're all
going to be bogus ones. (In that case, I would guess that they are the
result of other dumb network admins that have set up their internal LANs
with 128.128.x.x addresses, and spamcop has assumed they are real IPs and
sent that guy the reports)

> Abuse desks that have umpteen reports are more than likely spamhausen.

that's the other issue... a fair number of spamcop reports go to ISPs
that won't take any action on reports, whether they're from spamcop or
not.

-- 
Michael