Re: error: cannot parse head

To .help & .spam;  f/ups to .help

matt wrote:
> hope this is the right place to post, sorry if it isnt

Discussion below about the functions of the different newsgroups.

> I received an email today which choked spam cop, here is an extract:

Subject: error: cannot parse head

> correcting the trailing spaces, and bringing the closing ] back up
> around the ip to bring it all into one line again meant that the email
> could be parsed, and all the spam links were found and reported.
>
> ;)

You actually aren't supposed to 'forge' a piece of mail and then submit
it to the parser and claim to have received the forged item in a correct
condition as a spam.  Such forgeries might sometimes be done
experimentally to help determine the cause of a parse failure, but then
that forged specimen's report should be cancelled.

The rules against making changes in your spam are here
http://www.spamcop.net/fom-serve/cache/125.html  How do I get started
reporting spam?  --  Changing Your Spam  - Before submitting or parsing
spam, SpamCop members should not make any material changes to the spam
which might cause SpamCop to find a link, address, or URL it normally
would not find.


Under normal conditions, the parser recognizes what is the header and
what is the body based on the header following all of the rules for
header fieldnames and for the proper folding of populated header fields
and also the rule about the proper separation of header from body
content.

If the header isn't right, the body won't be parsed and the parser might
also make an error in determining the source, and the parser alerts you
and the report can be cancelled.


Re which newsgroups are what and how to discuss a parsing problem.

The ng/s spamcop, spamcop.help, spamcop.mail are normal discussion
groups where spamcop.mail is only for discussion of spamcop mail
clients' issues and spamcop and spamcop.help are for general discussion
of spamcop issues -- but no spam posting is allowed.

The best way to post a spam is with its tracker, which looks like this
at the top of the page of a parse

Here is your TRACKING URL - it may be saved for future reference:
http://www.spamcop.net/sc?id=z868060411z9a79cc3c008187fb5c270b759a67372az

With such a tracker, anyone can access the parsing and the entire spam.

The newsgroup spamcop.spam originally was intended for posting the spams
which were not allowed to be posted in the discussion groups -- but the
problem is that news agent postings mess up the format of the original
item with the introduction of linewraps and other mischief, 'bending'
the spam and interfering with discussing it or with submitting it to the
parser.  So, in my opinion, spamcop.spam should never be used for
anything;  not for discussing and not for posting spam.

Since it isn't being used for anything, it /could/ be used to post a
spam if the spam were attached to the newsmessage as a text or .eml file
so that the linewrapping destruction would not occur.


Accordingly, I'm posting this message to spamcop.help and spamcop.spam
and making its followups to spamcop.help.

-- 
Mike Easter
kibitzer, not SC admin