On Tue, Mar 17, 2015 at 07:39:22AM +0100, peter h wrote:
On Tuesday 17 March 2015 01.42, Ronald F. Guilmette wrote:
My two cents... [...]
Wonderful ! A masterpiece ! Well formulated, well written and ON THE SPOT !
I agree fully. My two cents: There are feedback loops from large places and SpamCop, that should account for the overwhelming majority of reports, and there are isolated reports from net citizens. The flows from the feedback loop places have a lower quality of individual reports (high fraction of "mail that i do not want" that is not really spam) but their strength is the volume, they have a fixed format and so processing of those reports should be easy to automate - they do not need to enter the queue of mails inspected manually. I believe that there are products for abuse desks on the market that do these splittings already. It is a known fact that very few people nowadays take the time to send reports manually. It is also a known fact that spammers have learnt about the effects of feedback loops and plan their activity accordingly. So, for instance, they have a vision of the world which is something like World = { Gmail, Hotmail/Office365/WindowsLive, Yahoo, General Internet } and they develop an independent delivery strategy for each category. So, those flows of reports are likely to be different. An IP hitting Yahoo at some point in time is not necessarily hitting also the "General Internet" at the same time, etc. Most people here work in the "General Internet" realm. The big places tend to have their own teams and resources, and their defense strategies are not well known and often kept opaque for obvious reasons. In contrast, the "General Internet" is more open, and for the spammers it is a dangerous territory. Some spammers avoid it completely, concentrating only on the big platforms. Other spammers spend a lot of efforts to identify the traps used by major blocking list services and avoid them, forcing those services to take measures to prevent easy trap detection. Some of these spammers (mostly of the 'snowshoe' category) seem to have some success in these endeavours - thanks to the negative feedback of hundreds or thousands of terminations! - and manage to survive at ISPs for longer times through avoidance of known traps. The "General Internet" does not have many feedback loops, and therefore reports from users there - particularly experienced users that invest time in composing their reports - should be taken as PURE GOLD, because they provide independent informations on the "tiny" subset of the Internet mail recipients which is not hosted on the big platforms and that is defended mostly through an open community effort, but also because they often offer a viewpoint of the Internet that nobody else has. These efforts very often results in spam operations brought down, with benefits for the large platforms too (this is why spammers consider dangerous the "General Internet"!). So, every effort should be made to make life _easier_ for this almost estinct species - the abuse reporters - because their diversity is one of our biggest assets. furio