Re: The next step??

antioch wrote:

> Have you found that missing post yet, in the General????

missing?  general?

> "Mike Easter"
>> antioch wrote:

>>> double headers.
>>
>> I don't understand how you would get whatever is 'double headers'

> From HQ.

Who is HQ?  Someone at SC?

> "There is something wrong with your submission because when I look at
> the spam you have submitted the headers appear twice.  This is
> resulting in an error, "Header data found in body, aborting link
> detection"."

> I now use the Crt/F3/ a & c method - don't know why I didn't before!

I have some negative comments about ctrl-F3, but it works OK if the spam
is either open or being previewed, but I don't recommend either one of
those conditions for secure spam handling.

> 16 of the emails submitted to SC are now marked as 'too old to file
> spam report.'  I may as well delete all of them as they are of no use.

They are no good for reporting, but they would still be good for
educational or demonstration purposes and they can still provide a
tracker for discussing if you wanted to.  The condition of a spam too
old or being a mole reporter isn't really much different, as neither one
contribute to the SCbl.

> I have 5 others not showing this - yet.  I did not realise that there
> was a time period.  Can I take it the time(2 days) starts from the
> time I get the spam.  Then I have 48hrs to decide if I report or not??

SC has two different ways of determining the age of a spam, one designed
for mailhosted accounts and one for non-mailhosted.  The 'simplest' and
cleanest is for non-mailhosted where SC uses the timestamp of the first
good Received traceline.  As a general rule a nonmailhosted account's
spamclock starts when the item arrives in your mailbox.

> Cant see any as you say with devnull etc address.  So I can't be a
> mole then.

Okay.

> With the most recent parsed spam I have the following 'headers'
> I believe;
> Parsing header
> Tracking message
> Finding links in message body
> Please make sure email is spam
> Report spam to xxxxxxxxx
> Re xxxxxxxx(silent report about source mail)

Silent sounds like a mole to me.

> Then the click button choices
> Send spam report NOW:Preview Reports:Cancel
> (Do I use this cancel to get rid of all the out of time ones???)

Generally if a spam is too old, you don't have a chance to cancel or
report, it is just too old.

>> The reporter is supposed to have sufficient knowledge of
>> header analysis that they won't report their own provider and is
>> supposed to recognize any found innocent bystanders in the body of
>> the spam so that they can be unchecked as spamvertisers.
>>
> Right, so where do I get this 'sufficient knowledge'.

Heh.  Yeah.  I think you should know some things about the 'elements' of
the Received tracelines vis the name or IP of your own provider.

Recall that when this conversation started I was encouraging you to
provide a tracker for one of your spam parses, and also gave you an
example of one of my own tracking URLs.  You still have not posted your
own tracker yet.  You are spending a lot of words trying to describe
something which I could see in much more 'vivid' and real detail if you
would post a tracker.  Remember what a tracker is?

 >  Is it
> reasonable to expect me to do this reporting, without this knowledge?

I am sympathetic to your fears of being a 'bad' or mistaken reporter.
For a long time as a spamcop neophyte, I only used the parser to parse
spams which reports I cancelled while reporting them manually.

> I think that I have gone far enough for the moment.


-- 
Mike Easter
kibitzer, not SC admin