On Tue, 2009-10-27 at 05:50 -0700, John Rudd wrote:
> On Tue, Oct 27, 2009 at 05:42, rich...@buzzhost.co.uk
> <rich...@buzzhost.co.uk> wrote:
> > On Tue, 2009-10-27 at 05:08 -0600, LuKreme wrote:
> >> On 27-Oct-2009, at 04:53, Mike Cardwell wrote:
> >> > Why have any geocities specific rules any more if geocities doesn't
> >> > exist? It's not as if spammers can host their websites on geocities
> >> > anymore so there's no reason why a spammer would include a geocities
> >> > url in their spam. May as well just delete the rules...
> >>
> >>
> >> If the links are still appearing in SPAM then no, don't delete the
> >> rules, just bump up the scores.
> >>
> >
> > Would this not be almost entirely pointless? With spam the motto is
> > 'follow the money'. if the link does not work, there is no path to the
> > money to follow. Other than prospecting for valid recipients {which
> > could be done just as easily without the link} there is no benefit for a
> > spammer to include a link of this nature.
>
> You're assuming that spammers will perfectly update all existing spam.
> There might be crud floating around out there for a while to come.
I'm not assuming anything John. Spam with no endgame is pointless spam.
All spam has a point and purpose - or it would not exist. Most spammers
staging or springboarding from such places turn their links around
mighty fast - they know they wont be up for long, so whilst I sure there
may be the odd 'floater' around, the enemy is formidable and ahead of
the game.
> My suggestion: proceed as normal. Adjust the scores for geocities
> spam as the analysis tools on currnet/live* spam suggest, until such
> time as there are no more spam messages showing up that are hitting
> the geocities rules ... for at least 1-3 months. Once they stop
> showing up in the wild for a substantial period of time (ie. my 1-3
> months suggestion), THEN remove them from the rules. Not before.
>
> (* not the corpus of past/historical/stale spam)
John I agree. I don't think there is any need to rush to do anything. It
would make sense to phase out the rule in a period of time. A few extra
lines of regex is not going to kill most machines - but long term there
will probably be little benefit keeping it in.
