Armorbeast opened this issue on Sep 11, 2004 ยท 66 posts
elizabyte posted Sun, 12 September 2004 at 2:44 AM
Spamcop's system, just for interest, does have built in checks and balances. For example, before an IP address gets added to the blacklist database, it has to be reported from multiple users. I'm not sure what the precise algorithm is, but I think I read somewhere that it's something like ten users within an hour. If an IP address has no further reports, it's removed from the database within three days. Spam can come from an IP address in many ways, including someone's insecure mailform (you'd be amazed how clueless people are as to securing something like that!), a compromised server (such as through a virus or intruder), and sometimes other means, usually some security hole somewhere. It may not necessarily be "a spammer", per se, but that "some spammer" managed to rape the mail server or otherwise force their way into the system. When spam is reported, and emailed report with the headers and the first several lines of the message is sent to the abuse department of the originating ISP. This serves several purposes, including alerting the system administrator of possible compromises to their system. Once an administrator replies to the Spamcop system (and sometimes to the reporting party), there's a note added to the database to that effect (i.e., problem has been dealt with) and the IP address is removed. I once reported my OWN server accidentally. I just slipped up and clicked the wrong thing and suddenly I'd reported my own IP address. Guess what? We weren't added to any black hole or blacklist as a result. On the other hand, our server was compromised a few months ago via a security hole in a script that we had running (by the time I learned about the hole and patched it, they'd already gotten in). They were fairly incompetent and managed to craash the mail daemon, but before that happened, they did spew out a fair number of spam messages (dunno how many; probably a few hundred). On that occasion, we WERE added to several blacklists, but once it was seen that no more spam was coming from our IP address, we were removed and it's all clear now. My point is that while no system is foolproof, Spamcop is a useful tool for controlling the flow of spam, when it's used responsibly. bonni
"When a man gives his opinion, he's a man. When a woman gives her opinion, she's a bitch." - Bette Davis