false positives on bl.spamcop.net renders it useless

[Brandon Blackmoor]

There was a time when bl.spamcop.net was a useful blocklist. I say "was"
because bl.spamcop.net is getting so many false positives now (several a
day, from a variety of unrelated and non-spamming servers) that it has
become more of a liability than a service, and I have removed it from my
list of blocklists. I strongly recommend others do the same.

I reported this problem to ***@spamcop.net, including a sample of a
dozen or so of the false positives, a week or so ago. I have received no
reply. For reference, here are just a few of the erroneously blocked
servers:

synigent.com
iconma.com
ebay.com
clicknfax.com
intuit.com
cardmemberservices.com
dice.com

SpamCop as a *service* is a still useful, because it allows me to
selectively filter using a variety of blocklists. So I will definitely
be keeping my accounts. But I will no longer be using the unreliable
bl.spamcop.net blocklist, and therefore there is no reason to take the
trouble to "report" spam anymore.

[N. Miller]

Post by Brandon Blackmoor
There was a time when bl.spamcop.net was a useful blocklist. I say "was"
because bl.spamcop.net is getting so many false positives now (several a
day, from a variety of unrelated and non-spamming servers) that it has
become more of a liability than a service, and I have removed it from my
list of blocklists. I strongly recommend others do the same.

It is still useful as part of a "scoring" system. I believe that is how it
is used on the SpamCop email system. I don't think that they ever
recommended using it to block server connections.

[RW]

Post by Brandon Blackmoor
dozen or so of the false positives, a week or so ago. I have received no

Ellen did answer you -twice- on Jan. 13 and Jan. 20 to the blackgate
address you wrote from. The emails bounced.

A list of domain names does us no good. We need to know the servers so
we can look them up in the bl and see what their history is.

If they truly are non-traditional spamming servers, the most likely
cause of a listing would be misdirected and non-rfc compliant bounces.

Richard

[Brandon Blackmoor]

Ellen did answer you

No, she didn't: no one did. No response was received either at my
blackgate.net address or at my spamcop.net address. If someone at
SpamCop made the attempt and failed, that is further evidence of some
problem on SpamCop's end.

If they truly are non-traditional spamming servers,
the most likely cause

I don't really care why bl.spamcop.net is giving so many false
positives: what I care about is that it does, and that I reported it and
got no response. That being said, I *would* have tried to help figure
out why it was giving so many false positives, *if* I had received a
reply when I reported the problem. Receiving no reply, my only recourse
is to stop using bl.spamcop.net as a blocklist.

I strongly urge others to do the same. A blocklist that tags a third of
one's legitimate email as spam, as bl.spamcop.net does, does more harm
than good.

FYI, this is not a "drive-by" or "newbie" complaint. I have been a
SpamCop client for several years (the better part of a decade, if I'm
not mistaken), and from time to time I have reported problems and done
my best to help solve them. At one time, bl.spamcop.net was a worthwhile
blocklist. At one time, error reports sent to Julian Haight or (later)
the SpamCop deputies elicited prompt, helpful replies. I am sorry to say
that these things are no longer true.

However, I do still consider the SpamCop mail filtering service useful,
because it allows one to filter based on a wide selection of blocklists.

[Steven Maesslein]

On Sun, 29 Jan 2006 13:41:28 -0500, Brandon Blackmoor coughed into

Post by Brandon Blackmoor
No, she didn't: no one did. No response was received either at my
blackgate.net address or at my spamcop.net address. If someone at
SpamCop made the attempt and failed, that is further evidence of some
problem on SpamCop's end.

I see you conveniently snipped the part about the messages sent to you
bouncing....

Post by Brandon Blackmoor
I don't really care why bl.spamcop.net is giving so many false
positives: what I care about is that it does, and that I reported it and
got no response.

If anything, the SCBL is blocking less and less spam here. Last time I
looked in my held mail folder, which contained about 20 messages (all of
them spam, BTW), 2 were held because of an SCBL listing, one because of
korea.services.net, and the rest thanks to SpamAssassin.

[Jeff G.]

Post by Steven Maesslein
On Sun, 29 Jan 2006 13:41:28 -0500, Brandon Blackmoor coughed into

Post by Brandon Blackmoor
I don't really care why bl.spamcop.net is giving so many false
positives: what I care about is that it does, and that I reported it
and got no response.

If anything, the SCBL is blocking less and less spam here. Last time I
looked in my held mail folder, which contained about 20 messages (all
of them spam, BTW), 2 were held because of an SCBL listing, one
because of korea.services.net, and the rest thanks to SpamAssassin.

The SpamCop Email System's filtering methodology changed some months
ago, such that the SpamAssassin rules in place (if turned on for one's
account), which do not suffer from external influences and delays, are
given first crack at each of one's incoming email messages, before the
blocklists and/or blacklists one may have turned on. It is entirely
likely that the SCBL would have blocked most of the email messages that
the SpamAssassin rules in place did in fact block, had it been given a
chance.

[Mike Easter]

Steven Maesslein

Post by Steven Maesslein
If anything, the SCBL is blocking less and less spam here. Last time
I looked in my held mail folder, which contained about 20 messages
(all of them spam, BTW), 2 were held because of an SCBL listing, one
because of korea.services.net, and the rest thanks to SpamAssassin.

The SpamCop Email System's filtering methodology changed some months
ago, such that the SpamAssassin rules in place (if turned on for one's
account), which do not suffer from external influences and delays, are
given first crack at each of one's incoming email messages, before the
blocklists and/or blacklists one may have turned on. It is entirely
likely that the SCBL would have blocked most of the email messages
that the SpamAssassin rules in place did in fact block, had it been
given a chance.

I wish I had a better understanding of all of the 'mechanics' involved
in the timing of SA processing vs DNS bl lookups.

In /my/ mind, a 'good' DNSbl server lookup should be extremely fast,
almost instantaneous -- where I'm assuming 'adequacy' in the access to
the dns server, and the server being adequate to its task. And the SA
processing to be much less instantaneous, not instantaneous at all,
where there are significant resources being used and significant data
being 'ground up' by a program or algorithm and its language.

So, I would think that in a best case scenario, DNSbl lookup would be
way way faster than SA, and only in a worst case scenario would it be
terribly slow or even a show stopper. So, then by my philosphy, some
dnsbl lookups should come first and some dsnbl lookups should come last,
not that always SA should come first.

[Jeff G.]

Post by Mike Easter

Steven Maesslein

Post by Steven Maesslein
If anything, the SCBL is blocking less and less spam here. Last time
I looked in my held mail folder, which contained about 20 messages
(all of them spam, BTW), 2 were held because of an SCBL listing, one
because of korea.services.net, and the rest thanks to SpamAssassin.

The SpamCop Email System's filtering methodology changed some months
ago, such that the SpamAssassin rules in place (if turned on for
one's account), which do not suffer from external influences and
delays, are given first crack at each of one's incoming email
messages, before the blocklists and/or blacklists one may have
turned on. It is entirely likely that the SCBL would have blocked
most of the email messages that the SpamAssassin rules in place did
in fact block, had it been given a chance.

I wish I had a better understanding of all of the 'mechanics' involved
in the timing of SA processing vs DNS bl lookups.
In /my/ mind, a 'good' DNSbl server lookup should be extremely fast,
almost instantaneous -- where I'm assuming 'adequacy' in the access to
the dns server, and the server being adequate to its task. And the SA
processing to be much less instantaneous, not instantaneous at all,
where there are significant resources being used and significant data
being 'ground up' by a program or algorithm and its language.
So, I would think that in a best case scenario, DNSbl lookup would be
way way faster than SA, and only in a worst case scenario would it be
terribly slow or even a show stopper. So, then by my philosphy, some
dnsbl lookups should come first and some dsnbl lookups should come
last, not that always SA should come first.

You are certainly welcome to try to convince JT of that, as well as to
use caches for the blacklists he uses.

[Steven Maesslein]

On Sun, 29 Jan 2006 14:57:23 -0500, Jeff G. coughed into spamcop and

Post by Jeff G.
The SpamCop Email System's filtering methodology changed some months
ago, such that the SpamAssassin rules in place (if turned on for one's
account), which do not suffer from external influences and delays, are
given first crack at each of one's incoming email messages, before the
blocklists and/or blacklists one may have turned on.

I was unaware of this, and I think it's a poor approach to the problem
if you *start* with CPU-intensive methods instead of falling back on
them when all other CPU-light methods fail.

[Larry Kilgallen]

Post by Steven Maesslein
On Sun, 29 Jan 2006 14:57:23 -0500, Jeff G. coughed into spamcop and

Post by Jeff G.
The SpamCop Email System's filtering methodology changed some months
ago, such that the SpamAssassin rules in place (if turned on for one's
account), which do not suffer from external influences and delays, are
given first crack at each of one's incoming email messages, before the
blocklists and/or blacklists one may have turned on.

I was unaware of this, and I think it's a poor approach to the problem
if you *start* with CPU-intensive methods instead of falling back on
them when all other CPU-light methods fail.

Your reasoning only holds if CPU time is the dearest resource.

[Steven Maesslein]

On 30 Jan 2006 06:28:16 -0600, Larry Kilgallen coughed into spamcop and

Post by Larry Kilgallen

Post by Steven Maesslein
I was unaware of this, and I think it's a poor approach to the problem
if you *start* with CPU-intensive methods instead of falling back on
them when all other CPU-light methods fail.

Your reasoning only holds if CPU time is the dearest resource.

Processing is usually the *longest* step, and time is money. Therefore,
CPU-intensive operations such as feeding a mail through SpamAssassin
*are* usually the dearest resource.

[Larry Kilgallen]

Post by Steven Maesslein
On 30 Jan 2006 06:28:16 -0600, Larry Kilgallen coughed into spamcop and

Post by Larry Kilgallen

Post by Steven Maesslein
I was unaware of this, and I think it's a poor approach to the problem
if you *start* with CPU-intensive methods instead of falling back on
them when all other CPU-light methods fail.

Your reasoning only holds if CPU time is the dearest resource.

Processing is usually the *longest* step, and time is money. Therefore,
CPU-intensive operations such as feeding a mail through SpamAssassin
*are* usually the dearest resource.

"Usually" is not always true. Latency of various DNSbls apparently
predominates in this situation.

[Michael R N Dolbear]

Steven Maesslein <***@nowhere.invalid> wrote
[...]

Post by Steven Maesslein
If anything, the SCBL is blocking less and less spam here. Last time I
looked in my held mail folder, which contained about 20 messages (all of
them spam, BTW), 2 were held because of an SCBL listing, one because of
korea.services.net, and the rest thanks to SpamAssassin.

Just to remind you, the SpamCop email service now does SA * first * and
doesn't bother the BLs if the SA score is over your limit. Thus
currently the only way of finding out how good the SCBL is at blocking
spam seems to be to switch off SA for a while.

[Mike Easter]

Post by Brandon Blackmoor
I don't really care why bl.spamcop.net is giving so many false
positives: what I care about is that it does, and that I reported it
and got no response.

You are currently getting a discussion about your opinion; that's a
form of response to your message here.

Post by Brandon Blackmoor
That being said, I *would* have tried to help
figure out why it was giving so many false positives, *if* I had
received a reply when I reported the problem. Receiving no reply, my
only recourse is to stop using bl.spamcop.net as a blocklist.

We can guess at why you are getting a lot of false positives. Perhaps
you are getting false positives of non-spam listed by the SCbl because
you get a lot of goodmail from abusive servers listed on the SCbl.

Post by Brandon Blackmoor
I strongly urge others to do the same.

And someone else can urge you to configure your blocklists as you like
and not try to imagine that your mail is the same as someone else's.

Post by Brandon Blackmoor
A blocklist that tags a third
of one's legitimate email as spam, as bl.spamcop.net does, does more
harm than good.

If a third of your legimate mail is tagged as spam by the SCbl, and
doesn't lend itself to being easily whitelisted, then I definitely think
you should quit using the SCbl. For myself, I will definitely continue
to use it.

Post by Brandon Blackmoor
At one time, error reports sent to Julian
Haight or (later) the SpamCop deputies elicited prompt, helpful
replies. I am sorry to say that these things are no longer true.

I don't know what you are calling an 'error report' -- but an error
would be a 'mistake' - a mistake in parsing or a mistake in listing or
somesuch. When output servers get listed because of abusive server
behaviors such as backscatter, that is not an error. When a goodmail
gets tagged because of such a backscatter SCbl listing, that is also not
an 'error' - while it /is/ a false positive.

You can disagree with the policy of listing servers for backscatter hits
and argue your point -- but that is a different issue than arguing that
anyone other than yourself should stop using the SCbl.

There are also others to be found in nanae who would agree with you that
the SCbl has too many false positives to use for pure rejecting or
tagging for a server -- while other server operators believe that there
can be 'clever' server configurations which can use the SCbl and avoid
false positives.

Post by Brandon Blackmoor
However, I do still consider the SpamCop mail filtering service
useful, because it allows one to filter based on a wide selection of
blocklists.

[Miss Betsy]

"Mike Easter" <***@ster.invalid> wrote in message news:drj685$u8e$***@news.spamcop.net...
<snip>

Post by Mike Easter
There are also others to be found in nanae who would agree with you that
the SCbl has too many false positives to use for pure rejecting or
tagging for a server -- while other server operators believe that there
can be 'clever' server configurations which can use the SCbl and avoid
false positives.

If you consider the purpose of the SCBL - to block incoming mail
from abusive servers, there are no 'false positives' unless there
is an error in listing because of false reports.

Just because the email is not spam does not make it 'legitimate' -
it is still coming from an abusive server. The recipient should
not have to correct the problem; the sender should.

Miss Betsy

[Ellen]

Post by Brandon Blackmoor

Ellen did answer you

No, she didn't: no one did. No response was received either at my
blackgate.net address or at my spamcop.net address. If someone at
SpamCop made the attempt and failed, that is further evidence of some
problem on SpamCop's end.

yes, yes I did reply to your email -- and received the following:

<<x>@blackgate.net.net>... Deferred: Connection refused by
blackgate.net.net.
Message could not be delivered for 5 days
Message will be deleted from queue

Apparently your from/reply-to in your mail app is incorrect?



Ellen
SpamCop

[Glenn Daniels]

"Ellen" mused

"Brandon Blackmoor" chimed

Post by Brandon Blackmoor

Ellen did answer you

No, she didn't: no one did. No response was received either at my
blackgate.net address or at my spamcop.net address.

^^^^^^^^^^
^^^^^^^^^^^^^

blackgate.net.net.
Message could not be delivered for 5 days
Message will be deleted from queue
Apparently your from/reply-to in your mail app is incorrect?

You mean, like blackgate.net is reg'd to Brandon and net.net is
reg'd to some other party???

Oh, my! How did /that/ happen?

<g>

[Brandon Blackmoor]

Post by Ellen
blackgate.net.net.
Apparently your from/reply-to in your mail app is incorrect?

No: that is not and has never been my reply-to address. Just to be sure,
I have re-checked my SpamCop identities and my email client settings,
and they are now as they have been for the past decade: either
***@blackgate.net or ***@spamcop.net.

And frankly I am out of patience with this issue. I have reported the
problems as I have experienced them, and if you take action to correct
them or not is now up to you. I consider the matter closed.

[Brandon Blackmoor]

Post by Ellen
blackgate.net.net.
Apparently your from/reply-to in your mail app is incorrect?

I just checked it *again*... and in one client, it was wrong. The text
box is exactly the size of "***@blackgate.net", but when I
clicked in that box and scrolled to the right, there was an extraneous
".net". I have to assume that happened when I reformatted and
reinstalled everything after a hard drive crash about a month ago.

In any event, the blame for that lays squarely on my shoulders. I
apologize. (And I'm glad I checked it one more time.)

[Michael Wise]

Post by Brandon Blackmoor

Ellen did answer you

No, she didn't: no one did. No response was received either at my
blackgate.net address or at my spamcop.net address. If someone at
SpamCop made the attempt and failed, that is further evidence of some
problem on SpamCop's end.

If they truly are non-traditional spamming servers,
the most likely cause

I don't really care why bl.spamcop.net is giving so many false
positives: what I care about is that it does, and that I reported it and
got no response. That being said, I *would* have tried to help figure
out why it was giving so many false positives, *if* I had received a
reply when I reported the problem. Receiving no reply, my only recourse
is to stop using bl.spamcop.net as a blocklist.
I strongly urge others to do the same. A blocklist that tags a third of
one's legitimate email as spam, as bl.spamcop.net does, does more harm
than good.
FYI, this is not a "drive-by" or "newbie" complaint. I have been a
SpamCop client for several years (the better part of a decade, if I'm
not mistaken), and from time to time I have reported problems and done
my best to help solve them. At one time, bl.spamcop.net was a worthwhile
blocklist. At one time, error reports sent to Julian Haight or (later)
the SpamCop deputies elicited prompt, helpful replies. I am sorry to say
that these things are no longer true.

What you should be more concerned about is your seeming inability to
correctly configure your email client's from: address setting, so that
when people like SC deputies attempt to respond to you...it actually
reaches you.

--Mike

[Brandon Blackmoor]

Post by Michael Wise
What you should be more concerned about is
your seeming inability to correctly configure
your email client's from: address setting

My email clients' From: setting *is* correct, and always has been. I
will not speculate on why the deputies responded to the wrong email
address, but I will give them the benefit of the doubt and assume that
it was an honest mistake.

[Brandon Blackmoor]

My email clients' From: setting *is* correct...

Correction: I just checked it *again*... and in one client, it was
wrong. The text box is exactly the size of "***@blackgate.net",
but when I clicked in that box and scrolled to the right, there was an
extraneous ".net". I have to assume that happened when I reformatted
after a hard drive crash about a month ago.

In any event, the blame for that lays squarely on my shoulders. I
apologize. (And I'm glad I checked it one more time.)

[Frank Ellermann]

Post by Brandon Blackmoor
the blame for that lays squarely on my shoulders

Shit happens. Please start a new thread about your original
issue, I've never before heard that 1/3 of the SCBL blocks
are FPs.

IFF that's true and a side-effect of the back-scatter reports,
I'd (again) support to limit the latter to SPF FAIL cases.

Nobody able to use the SCBL is clearly not what I intend with
my reports.
Bye, Frank

[Larry Kilgallen]

Post by Frank Ellermann
issue, I've never before heard that 1/3 of the SCBL blocks
are FPs.
IFF that's true and a side-effect of the back-scatter reports,
I'd (again) support to limit the latter to SPF FAIL cases.

Backscatter is spam, and I do not want email from IP addresses that
do that, particularly since backscatter is highly likely to be the _only_
email I get from such IP addresses.

[Kenneth Brody]

Post by Brandon Blackmoor

Ellen did answer you

No, she didn't: no one did. No response was received either at my
blackgate.net address or at my spamcop.net address. If someone at
SpamCop made the attempt and failed, that is further evidence of some
problem on SpamCop's end.

E-mails to you from Ellen bounced (a part which you conveniently left
off your quote), and it's a "problem on SpamCop's end"? Why was mail
to you bouncing?

Post by Brandon Blackmoor
Ellen did answer you -twice- on Jan. 13 and Jan. 20 to the blackgate
address you wrote from. The emails bounced.

(Though it would have been nice if RW said _why_ the e-mails bounced.
"Unknown user"? "Mailbox full"? "Rejected because you're blacklisted"?)

Post by Brandon Blackmoor

If they truly are non-traditional spamming servers,
the most likely cause

I don't really care why bl.spamcop.net is giving so many false
positives: what I care about is that it does, and that I reported it and
got no response.

Well, you "got no response" because mail to the address you gave bounced.
Not much that SpamCop can do about that.

However, you _claim_ that these are "false positives", yet, as far as I
can see, you haven't given any information that could help confirm or
refute that claim, such as the actual IP addresses which you claim are
"falsely" listed. I'd hate to have to count how many spammers come here
with "why am I listed" rants.

Post by Brandon Blackmoor
That being said, I *would* have tried to help figure
out why it was giving so many false positives, *if* I had received a
reply when I reported the problem. Receiving no reply, my only recourse
is to stop using bl.spamcop.net as a blocklist.

That's certainly your option, but it shows that you're really not
interested in "solving" this "problem".

Post by Brandon Blackmoor
I strongly urge others to do the same. A blocklist that tags a third of
one's legitimate email as spam, as bl.spamcop.net does, does more harm
than good.

It's blocking several thousand spams to my inbox every week, with
only a spall fraction of a percent with "false positives". (And by
"false positive", I mean "an e-mail that I wanted to receive, even if
it did come from a server which got listed for spamming.) If anything,
I have seen a tremendous increase in false negatives in the past few
weeks, where I may get several dozen spams in my inbox each day, as
opposed to two or three.

Post by Brandon Blackmoor
FYI, this is not a "drive-by" or "newbie" complaint. I have been a
SpamCop client for several years (the better part of a decade, if I'm
not mistaken), and from time to time I have reported problems and done
my best to help solve them. At one time, bl.spamcop.net was a worthwhile
blocklist. At one time, error reports sent to Julian Haight or (later)
the SpamCop deputies elicited prompt, helpful replies. I am sorry to say
that these things are no longer true.

If you've been a SpamCop client for several years, you should know that
domain names are useless in tracking down a "problem". You need to give
the actual IP address of the server.

Post by Brandon Blackmoor
However, I do still consider the SpamCop mail filtering service useful,
because it allows one to filter based on a wide selection of blocklists.

[Brandon Blackmoor]

If anything, I have seen a tremendous increase
in false negatives in the past few weeks, where
I may get several dozen spams in my inbox each
day, as opposed to two or three.

I have seen this, too. I am hoping that it is a temporary phenomenon;
otherwise, it may be time to change my spam-blocking strategy to keep up
with the times. But that's not really relevant to the problem I reported.

[Kenneth Brody]

Post by Brandon Blackmoor

If anything, I have seen a tremendous increase
in false negatives in the past few weeks, where
I may get several dozen spams in my inbox each
day, as opposed to two or three.

I have seen this, too. I am hoping that it is a temporary phenomenon;
otherwise, it may be time to change my spam-blocking strategy to keep up
with the times. But that's not really relevant to the problem I reported.

True, sort of. Your original "problem" was claiming that the scbl was full
of "false positives", but (unless you've since done it privately) you have
still not told us the IP addresses of the "wrongly listed" servers.

Now that you have corrected your e-mail address so that SpamCop deputies'
replies won't bounce (and then complain here that they never responded to
you), have you tried contacting them again?

[Brandon Blackmoor]

Post by Kenneth Brody
have you tried contacting them again?

No. I consider that matter closed. Had my report (which *did* include my
correct email address in the signature, by the way) elicited a response,
I would have attempted to help rectify the situation. As it is now,
those IP addresses are likely too old to be useful, and gathering more
would entail:

1) re-enabling bl.spamcop.net,
2) setting SpamCop to "tag" rather than "filter", and
3) manually sifting through the ~170 pieces of spam I receive every day
to find the false positives, for at least a week to make sure the sample
is statistically significant.

Unfortunately, I don't have the time for that, so I simply won't be
using the bl.spamcop.net blocklist anymore. Considering the enormous
size my whitelist had grown to due to previous false positives on that
blocklist, it's probably for the best.

I have come to the conclusion that the SpamCop methodology of
automatically tagging servers based on individual user reports is no
longer a useful way to filter one's incoming mail: bl.spamcop.net misses
too much spam, and it returns too many false positives (this isn't new:
I have actually been considering this for the last couple of years).

However, SpamCop may still have value as a reporting service, so that
ISPs can be notified when spam is being sent from their servers. For
that reason, I will continue to report spam through SpamCop, even though
I strongly recommend against using the resulting blocklist to tag
individual pieces of incoming email.