Re: SpamCop Issues - Just Curious

User wrote:

> What "good" is SpamCop doing to abate spam?

... also add 'abusive servers' which also get SC reported for such as
backscatter.  Abusive servers definitely remedy themselves and abate
that abusive activity.

Generally the 'good' effect is not to abate spam, but to contribute to
the various overall processes of spamfiltering mechanisms.

 - Rarely there is the possibilty that reporting to a spamvertiser
provider can inform a whitish-hatted provider about spamvertising and
result in that provider taking action against the spamvertiser.  The
more general situation is that the spamvertiser provider's hat is not
white and the provider is not interested in the courtesy SC report

 - Occasionally the spamsource providers who are notified about their
spamsources which are generally abused open proxy trojan user IPs will
take note of their insecurity and remedy it.  It is not uncommon that
some whitehat server 'discovers' an insecurity as a result of spamcop
source reports or listings or blocked mail.

> The same spam just keeps
> coming in day after day, week after week, advertising the same stuff,

Correct.  SC doesn't do much of anything to actually descrease the
incoming spam.

> appears to be from the same central sources and we continue reporting
> to what seems like no avail.

The avail is to contribute to the SCbl which aids me and many others
with one of our dnsbl spamfilters.  There are antispam effects of
filtering the spam even when the filtering isn't actually a reduction in
spam.  The more effective filtration is, the less people actually
'encounter' or see their spam subjects or have an opportunity to open
their spam and profit the spam process.

The spamvertisers which are 'indirectly' reported to the sc-surbl help
those who are using the surbl as a body filter.

> Also appears that a great deal of this spam is channeled through
> open-relays.

The term 'open relay' applies to open smtp relays.  I see virtually no
spam coming thru' open relays these days.  Perhaps you mean injected an
an 'open' or available proxy trojan user IP.  That is a different
mechanism than an open smtp relay.

> Looks to me like spam is just too large an entity to be addressed by
> conventional methods ... Hmmm, perhaps a .44 Magnum would be a
> solution? :-D

I tend to interpret those remarks as encompassing some 'frustration'
with spamload.  IMO, the management of one's mailbox should be very
'painless' -- not frustrated by spamload.  For me, virtually 100% of my
spam is channeled into a Junk folder which doesn't even appear 'before
my eyes' or in my 'range of consciousness' unless I choose to go visit
it.  When I choose to visit it, in a matter of seconds it is reported to
SC.  That reporting contributes to the SCbl.  That SCbl is part of my
armamentarium of dnsbl/s which make up the 'shield' which channels the
spam into the Junk folder.  So, my mailbox and my spamhandling is both
painless and self-reinforcing.


-- 
Mike Easter
kibitzer, not SC admin