Spam coming from the list

Spam coming from the list

[Julio De Gregorio]

Hello,
    I'm a reader of the list, which I like very much, but I've
recently noticed we are receiving spam sent to the list, I'm not sure
who is the administrator, but it would be very nice if he sets some
filter on the server.
    Also I'd like to remark it's not a complaint, but a sugestion, as
I have my own spam filter (gmail) and it works very well. Just thought
it would be useful for all of us, if we cut it at the root.
    By the way I'm a happy speedstep-centrino user (Banias)

Thank you very much.
Julio

Re: Spam coming from the list

[Russell King]

On Sun, Sep 26, 2004 at 11:45:25AM -0300, Julio De Gregorio wrote:
> Hello,
>     I'm a reader of the list, which I like very much, but I've
> recently noticed we are receiving spam sent to the list, I'm not sure
> who is the administrator, but it would be very nice if he sets some
> filter on the server.

I know.  However, I'm _really_ busy at the moment, and we will be
transitioning stuff over to a new server.  (There's a long story
behind that which involves various UK parcel companies, many
months, lost parcels and parcels turning up at completely the wrong
end of the country...)

Currently, someone else is looking in to sorting out the mail server
configurations so that we can easily transition people over to the
new server, though we're waiting on some mail server software features
which will be available in the next version.

Then there is the problem that we have several tens of domains to
deal with, and not all of them may wish to have a restrictive spam
policy.

In other words, it's going to be a while before this can be resolved
satisfactorially.

>     Also I'd like to remark it's not a complaint, but a sugestion, as
> I have my own spam filter (gmail) and it works very well. Just thought
> it would be useful for all of us, if we cut it at the root.

Indeed it would, but it takes time and effort when dealing with a
system which has "evolved" rather than having been sanely planned
from the start.

-- 
Russell King
 Linux kernel    2.6 ARM Linux   - http://www.arm.linux.org.uk/
 maintainer of:  2.6 PCMCIA      - http://pcmcia.arm.linux.org.uk/
                 2.6 Serial core

Re: Spam coming from the list

[aeriksson]

On Sun, 26 Sep 2004 11:45:25 -0300 Julio De Gregorio wrote:
>Hello,
>    I'm a reader of the list, which I like very much, but I've
>recently noticed we are receiving spam sent to the list, I'm not sure
>who is the administrator, but it would be very nice if he sets some
>filter on the server.
>    Also I'd like to remark it's not a complaint, but a sugestion, as
>I have my own spam filter (gmail) and it works very well. Just thought
>it would be useful for all of us, if we cut it at the root.
>    By the way I'm a happy speedstep-centrino user (Banias)
>
>Thank you very much.
>Julio
>


I hate spam as much as the next guy, but filtering in at the mail list
server it just not the Right Thing to do. It's an end2end problem and
needs to have and end2end solution. All of us have private filers
anyway, and we only run the risk of dropping legitimate mail.

Don't fix what aint broken.

/Anders

Re: Spam coming from the list

[Russell King]

On Sun, Sep 26, 2004 at 06:24:46PM +0200, aeriksson@fastmail.fm wrote:
> I hate spam as much as the next guy, but filtering in at the mail list
> server it just not the Right Thing to do. It's an end2end problem and
> needs to have and end2end solution. All of us have private filers
> anyway, and we only run the risk of dropping legitimate mail.

Disagree - peoples email systems actively reject spam, which causes
bounces.  The list interprets bounces as a failure of your address,
and with enough of them will disable and then unsubscribe you.

Obviously bad news for the subscribers.

-- 
Russell King
 Linux kernel    2.6 ARM Linux   - http://www.arm.linux.org.uk/
 maintainer of:  2.6 PCMCIA      - http://pcmcia.arm.linux.org.uk/
                 2.6 Serial core

Re: Spam coming from the list

[Frank Mehnert]

[-- Attachment #1.1: Type: text/plain, Size: 878 bytes --]

Hi,

On Sunday 26 September 2004 22:51, Russell King wrote:
> On Sun, Sep 26, 2004 at 06:24:46PM +0200, aeriksson@fastmail.fm wrote:
> > I hate spam as much as the next guy, but filtering in at the mail list
> > server it just not the Right Thing to do. It's an end2end problem and
> > needs to have and end2end solution. All of us have private filers
> > anyway, and we only run the risk of dropping legitimate mail.
>
> Disagree - peoples email systems actively reject spam, which causes
> bounces.  The list interprets bounces as a failure of your address,
> and with enough of them will disable and then unsubscribe you.

Bouncing EMails is evil since most time the sender ID of SPAM is faked.

Frank
-- 
## Dept. of Computer Science, Dresden University of Technology, Germany ##
## http://os.inf.tu-dresden.de/~fm3                                     ##

[-- Attachment #1.2: Type: application/pgp-signature, Size: 189 bytes --]

[-- Attachment #2: Type: text/plain, Size: 143 bytes --]

_______________________________________________
Cpufreq mailing list
Cpufreq@www.linux.org.uk
http://www.linux.org.uk/mailman/listinfo/cpufreq

Re: Spam coming from the list

[David Pottage]

Frank Mehnert wrote:

>Hi,
>
>On Sunday 26 September 2004 22:51, Russell King wrote:
>  
>
>>On Sun, Sep 26, 2004 at 06:24:46PM +0200, aeriksson@fastmail.fm wrote:
>>    
>>
>>Disagree - peoples email systems actively reject spam, which causes
>>bounces.  The list interprets bounces as a failure of your address,
>>and with enough of them will disable and then unsubscribe you.
>>    
>>
>Bouncing EMails is evil since most time the sender ID of SPAM is faked.
>  
>
That depends on how the bounce system is implemented.

Some administrators interface their mail transport agent (sendmail, exim 
etc)
to their spam detector, so that during mail receipt, spam is detected,
the message is refused at that point. The sending mailserver receives
the bounce, and (hopefully) does not try again later.

-- 
David Pottage

Re: Spam coming from the list

[Harald Milz]

Russell King <rmk@arm.linux.org.uk> wrote:

> Obviously bad news for the subscribers.

Why not make the list subscriber only? Apparently everyone can post to the
list. 

-- 
Never try to outstubborn a cat.
		-- Lazarus Long, "Time Enough for Love"

Re: Spam coming from the list

[Dave Jones]

On Mon, Sep 27, 2004 at 04:24:13PM +0200, Harald Milz wrote:
 > Russell King <rmk@arm.linux.org.uk> wrote:
 > 
 > > Obviously bad news for the subscribers.
 > 
 > Why not make the list subscriber only? Apparently everyone can post to the
 > list. 

Because non-subscribers cross-post between linux-kernel and
cpufreq-list for eg.  When this happens to moderated lists, the result
is a nuisance for both list admins, and anyone unfortunate enough
to be on the Cc: list.

People should not have to be subscribed to a list just to report a bug.
It's annoying as hell every time I come up with random patches, dig
out the contact address out of MAINTAINERS, and send patches to get
a 'you aren't subscribed yadayada' email back.

		Dave

Re: Spam coming from the list

[Harald Milz]

Dave Jones <davej@redhat.com> wrote:
> People should not have to be subscribed to a list just to report a bug.
> It's annoying as hell every time I come up with random patches, dig
> out the contact address out of MAINTAINERS, and send patches to get
> a 'you aren't subscribed yadayada' email back.

Understand. The question is which evil is the bigger one ... It's not as if
spam were less annoying ;-) 

-- 
Nothing recedes like success.
		-- Walter Winchell

Re: Spam coming from the list

[Francesco Poli]

[-- Attachment #1.1: Type: text/plain, Size: 1338 bytes --]

On Mon, 27 Sep 2004 17:04:46 +0200 (CEST) Harald Milz wrote:

> > People should not have to be subscribed to a list just to report a
> > bug. It's annoying as hell every time I come up with random patches,
> > dig out the contact address out of MAINTAINERS, and send patches to
> > get a 'you aren't subscribed yadayada' email back.
> 
> Understand. The question is which evil is the bigger one ... It's not
> as if spam were less annoying ;-)

IMHO, making the list moderated for non-subscribers can be a viable
solution, *as long* as the list-admin is relatively prompt in approving
any legitimate non-subscriber message.

I personally administer a GNU-Mailman-based list and I setup things that
way (all subscriber-generated messages pass, all
non-subscriber-generated messages must be approved to pass): no junk
mail reaches the list.
Of course this takes a little effort from me (whenever I receive a
Mailman-generated advisory that some messages are waiting for approval),
but I think that the benefits outweight the drawbacks (at least for low
to medium traffic lists...).

My 2 cents...


-- 
             |  GnuPG Key ID = DD6DFCF4 |  $ fortune
  Francesco  |        Key fingerprint = |  Q: What is purple
     Poli    | C979 F34B 27CE 5CD8 DC12 |     and commutes?
             | 31B5 78F4 279B DD6D FCF4 |  A: A boolean grape.

[-- Attachment #1.2: Type: application/pgp-signature, Size: 189 bytes --]

[-- Attachment #2: Type: text/plain, Size: 143 bytes --]

_______________________________________________
Cpufreq mailing list
Cpufreq@www.linux.org.uk
http://www.linux.org.uk/mailman/listinfo/cpufreq

Re: Spam coming from the list

[aeriksson]

On Sun, 26 Sep 2004 21:51:57 BST Russell King wrote:
>On Sun, Sep 26, 2004 at 06:24:46PM +0200, aeriksson@fastmail.fm wrote:
>> I hate spam as much as the next guy, but filtering in at the mail list
>> server it just not the Right Thing to do. It's an end2end problem and
>> needs to have and end2end solution. All of us have private filers
>> anyway, and we only run the risk of dropping legitimate mail.
>
>Disagree - peoples email systems actively reject spam, which causes
>bounces.  The list interprets bounces as a failure of your address,
>and with enough of them will disable and then unsubscribe you.
>
>Obviously bad news for the subscribers.
>

Well that's pretty much the same man-in-the-middle attack on the feed
as the maillist would do. My mail provider does that and I've asked
them not to, but they refuse. They do it for all recipients on the
smtp inlet, and  claim they have to send a bounce for leagal resons.
Anyone know of a mailservice with a clean, untampered with, feed? (My 
cable provider blocks 25).

/A

Re: Spam coming from the list

[Russell King]

On Mon, Sep 27, 2004 at 10:35:01PM +0200, aeriksson@fastmail.fm wrote:
> On Sun, 26 Sep 2004 21:51:57 BST Russell King wrote:
> >On Sun, Sep 26, 2004 at 06:24:46PM +0200, aeriksson@fastmail.fm wrote:
> >> I hate spam as much as the next guy, but filtering in at the mail list
> >> server it just not the Right Thing to do. It's an end2end problem and
> >> needs to have and end2end solution. All of us have private filers
> >> anyway, and we only run the risk of dropping legitimate mail.
> >
> >Disagree - peoples email systems actively reject spam, which causes
> >bounces.  The list interprets bounces as a failure of your address,
> >and with enough of them will disable and then unsubscribe you.
> >
> >Obviously bad news for the subscribers.
> >
> 
> Well that's pretty much the same man-in-the-middle attack on the feed
> as the maillist would do. My mail provider does that and I've asked
> them not to, but they refuse. They do it for all recipients on the
> smtp inlet, and  claim they have to send a bounce for leagal resons.
> Anyone know of a mailservice with a clean, untampered with, feed? (My 
> cable provider blocks 25).

This is off-topic for this list, and I guess interested parties should
continue in private mail... please?  If enough people want to discuss
this issue, I can setup an off-topic discussion list at www.linux.org.uk.
8)

There are three options to dealing with spam and viruses:
1. silently drop the message on the floor.
2. generate a bounce to the possibly forged return path address.
3. scan the messag at SMTP time and reject before accepting the
   message.

Any well behaved system uses solution (3) - chances are the incoming
SMTP connection is either directly from a virus or spam engine, in
which case rejecting the attempt does not create a bounce.

Obviously ISPs and companies certainly can not justify (1) as
acceptable behaviour on their part.  Maybe their setup doesn't allow
for (2), in which case they are just contributing to the spam and
virus problem.

Now, again, since this is an off-topic discussion for this list, can
we move it elsewhere please?

-- 
Russell King
 Linux kernel    2.6 ARM Linux   - http://www.arm.linux.org.uk/
 maintainer of:  2.6 PCMCIA      - http://pcmcia.arm.linux.org.uk/
                 2.6 Serial core