Text 215, 126 rader
Skriven 2005-02-08 04:15:04 av mark lewis (1:3634/12)
    Kommentar till text 205 av Gerald Miller (1:342/512)
Ärende: Header
==============
 GM>>> I'm a little apprehensive of pressing this button just yet...
 ml>> why???

 GM> Possibility of a major increase of spam ??  I haven't
 GM> initiated a sneakemail address, yet...

'k...

 GM>>> Is this an "automated" process or is the user able to edit?
 ml>> the edits are done in the templates in the options menu... i've
 ml>> actually modified mine very little, left their basic sig in place, am
 ml>> using a sneakemail address and have no references to my moniker or
 ml>> email address anywhere...

 GM> I guess the first thing that I should get serious about is
 GM> obtaining the sneakemail address -- they don't tell you that
 GM> in the "brief" help file within Abuse!

the abuse folk may not even know about sneakemail ;)

 GM>>>>> )\/(ark, please feel free to jump in here.
 ml>>>> as mentioned in another message, i go thru the spam and
 ml>>>> obfuscate anything that i feel may be some sort of identifier to
 ml>>>> prevent the report from being traced back to me since some ISPs
 ml>>>> turn the reports over to those being accused...
 GM>>> Obfuscate your e-mail address and your ISP address?
 ml>> yup... just like spamcop replaces occurances of foo@bar with a simple
 ml>> x, i, too, do the same... also with message ids, too... following the
 ml>> spamcop methods, i leave the first and last four characters of the
 ml>> ids... however, i don't always replace the removed characters with the
 ml>> same number of underscores...

 GM> It would be preferable if the process of obfuscation was
 GM> "automated"...

agreed!

 ml>>>> i also use a sneakemail.com address for all spam reports
 ml>>>> i send except those i process thru spamcop.net...
 GM>>> Wouldn't the use of a sneakemail.com address put you in the
 GM>>> same category as a spammer?
 ml>> in what way?? i'm reporting spam to the IP owner and i'm using a means
 ml>> of protecting myself from retribution by the spammers... some of those
 ml>> guys are extremely rabid... you /do not/ want to be the victim of a
 ml>> joe-job by a major spammer... i also do not believe in "list washing"
 ml>> where they remove my address from their list... having to do so still
 ml>> confirms my address as valid and live and there's nothing to stop them
 ml>> from adding said address to their "for sale" address list...

 GM> "in what way??"  I was wondering about how an IP owner is
 GM> likely to attach any credence to your report and if they
 GM> would perform any action based on your preferred anonymity.

that depends on the entity receiving the reports... there are many that will
not accept spamcop.net reports and their excuse is the obfuscation stuffs...
me? i don't care... if/when i make a report, anything that i think may be used
to listwash me is obfuscated...

 GM> I think that your mention of retribution, etc, is what is
 GM> holding me from making "full use" of Abuse!  I can appreciate
 GM> your "tread lightly" implications as I think my e-mail address
 GM> has been "sold" to the 'porners' and my wife is really freaking
 GM> out!!!  Will likely have to contact my ISP and kill my current
 GM> e-mail addy in favor of something more obscure such as what I'm
 GM> using on the W98SE box...

understood... however, one must also understand that there are ways of
verifying that an address is live... one must also understand that one may have
simply been found with a dictionary attack...

 GM>>> All the time that I've been using MailWasher Pro, I've never
 GM>>> sent a report to SpamCop.net; I only use their facilities to
 GM>>> identify known spam domains.
 ml>> yeah, i've seen problems with doing that... i always did my
 ml>> spamcop.net reporting manually, anyway...

 ml>> the problem i've seen with abuse reporting to spamcop.net appears that
 ml>> the messages are sent too fast and/or too many at a time and thus my
 ml>> ISP kills my access to their SMTP server temporarily 'cause they think
 ml>> that something is spamming from my connection... i've brought this up
 ml>> to the abuse folk but haven't checked over there in a while...

 GM> Is it not possible to queue the reports and release them over
 GM> a time span?

no, it is not... not with abuse... each report goes now... but we must also
remember that we're talking about the abuse capability of sending the spam to
spamcop.net for one to report from... the problem is that if you select 50
spams at once to file with spamcop.net, all 50 are sent rapidly in much the
same way that a report to 5 abuse addresses are all sent very fast...

 ml>>>> i've found Abuse! to be pretty good and it has coincided with
 ml>>>> the results that spamcop.net has found every time i've taken the
 ml>>>> time to compare the two... there's only been a few occasions
 ml>>>> where things were a bit different but they didn't effect the
 ml>>>> overall outcome...
 GM>>> I haven't had much time to fully test Abuse!  I've used it
 GM>>> twice to analyse the posting that Frank made and I got
 GM>>> erroneous results on those occasions.
 ml>> only because the lines were broken and otherwise not properly laid out
 ml>> due to our (ie: fidonet) 70 to 75 charcter linewidth...

 GM> Okay, I'll have to keep that in mind for the future if I do
 GM> any cutting / pasting from Fido.

definitely!

 GM>>> I'm unsure about whether I should obfuscate my e-mail address
 GM>>> and my ISP address _before_ I do the analysis or before I
 GM>>> send the LART?
 ml>> you have to do it in the "evidence" before analysis cause you can't
 ml>> edit anything afterward...

 GM> I would like to start a new thread - "Spam Report; Procedure"
 GM> and step through the various steps if you are agreeable.  It
 GM> may prove to be a learning experience for all; even the lurkers
 GM> who haven't said anything, yet.

hummm... like a cookie cutter method of filing? that is ok for some types of
things... maybe or not for this stuff... spamcop.net has several support forums
and it is very obvious that this stuff is not a "one size fits all"
situation...

)\/(ark

 * Origin: (1:3634/12)