Re: The spam problem.

Re: The spam problem.

[David S. Miller]

   From: <Hell.Surfers@cwctv.net>
   Date: Mon, 12 Aug 2002 02:44:14 +0100

   I know this is offtopic, but the spam problem is getting worse,
   could the linux-kernel mail guy/gal, do something, the nigerian
   scams are actually dangerous.

They never make it to the lists, if they are sending these
spams to you privately that is your problem to resolve :-)

Look we simply cannot control what web site archives of these
lists choose to do with the sender's email address.  If you
post here, you will almost certainly get on a spam list.
There is zero we as postmasters can do about this.

The spam problem.

[Hell.Surfers]

I know this is offtopic, but the spam problem is getting worse, could the linux-kernel mail guy/gal, do something, the nigerian scams are actually dangerous..

Re: The spam problem.

[David S. Miller]

   From: "David D. Hagood" <wowbagger@sktc.net>
   Date: Sun, 11 Aug 2002 21:22:45 -0500

   David S. Miller wrote:
   
   > They never make it to the lists, if they are sending these
   
   Incorrect - they frequently make it to the list, I have the headers to 
   prove it.
   
And within 24 to 48 hours we add a filter for it.
That is how it has always worked and this is how it
will continue to work.

Re: The spam problem.

[David D. Hagood]

David S. Miller wrote:

> They never make it to the lists, if they are sending these

Incorrect - they frequently make it to the list, I have the headers to 
prove it.

Unfortunately, unless the LKML maintainers wish to either filter the 
list against Spamcop|Spamhaus|MAPS, or unless they are willing to 
require non-registered individuals to confirm an email (i.e. 
non-registered individual sends a mail, LKML sends a "you aren't 
registered, so please reply to this email to confirm you aren't a 
spammer" message), there is little they can do about it.

Re: The spam problem.

[David D. Hagood]

David S. Miller wrote:

> And within 24 to 48 hours we add a filter for it.
> That is how it has always worked and this is how it
> will continue to work.

Peace, sir - I was not criticising the way the list is run. However, you 
stated "they never make it to the list" and implied the spam problem was 
within the email account of the poster, which you just admitted was 
incorrect.

I *wasn't* suggesting the list be filtered more aggressively - I was 
saying that removing the spam from the list would require more 
aggressive (read: more prone to false positives) filtering. The cure 
would in many ways be worse than the disease (at least at it's current 
level).

Unfortunately, until they make a legal hunting season for spammers, we 
must all simply put up with it. I suggest forwarding all the spams over 
to Spamcop to attempt to shut the spammers down (just make sure you ding 
the spammer's servers and not LMKL's!)

[OT] Re: The spam problem.

[Rik van Riel]

On Sun, 11 Aug 2002, David D. Hagood wrote:

> Unfortunately, until they make a legal hunting season for spammers, we
> must all simply put up with it. I suggest forwarding all the spams over
> to Spamcop to attempt to shut the spammers down (just make sure you ding
> the spammer's servers and not LMKL's!)

OK, a few links and addresses for the people who are
interested in fighting the spam they see:


419/Nigeria scams should be forwarded (with complete headers) to
the US secret service, who are very interested because these scams
have indeed gotten people killed:

	United States Secret Service <419.fcd@usss.treas.gov>


Stock pump&dump scams are often very effectively handled by
sending them to:

	enforcement@sec.gov

What might also help for these is sending the spam to the
legal staff of the company, in addition to the SEC address.
Reminding the legal staff of the fact that the SEC might
suspend trading in their stock for a few days often gets
them moving against the spammer fairly quickly ;)


If you live in Washington state (and some other states too,
I believe) hunting season for spammers is literally open all
year. I think you can get up to $500/spam in Washington state:

	http://www.suespammers.org/


Now, please stop bothering Matti and DaveM about it and
take action yourself ;)

cheers,

Rik
-- 
Bravely reimplemented by the knights who say "NIH".

http://www.surriel.com/		http://distro.conectiva.com/

Re: The spam problem.

[Jim Roland]

The Nigerian stuff is a scam to take your money from the bank account you
give them and for them to steal your identity.  NEVER EVER give someone your
personal information over the internet or phone.

I want to suggest to the listserver admin (again) that this list and others
on vger.kernel.org be restricted so that you can only post to the list if
you are a member.  Anyone can read it, but you have to sign up to post to
the list.  At least then, the spammers/scammers have to go thru an extra
step that can have their mail server blocked from posting on this list.  I'm
getting damn tired of getting 50-75 spams per day in my inbox and I don't
even use my email address on websites to post.



----- Original Message -----
From: <Hell.Surfers@cwctv.net>
To: <linux-kernel@vger.kernel.org>
Sent: Sunday, August 11, 2002 8:44 PM
Subject: The spam problem.


> I know this is offtopic, but the spam problem is getting worse, could the
linux-kernel mail guy/gal, do something, the nigerian scams are actually
dangerous..
>
>
> -
> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> Please read the FAQ at  http://www.tux.org/lkml/
>

Re: The spam problem.

[Jim Roland]

Why would this kill bug reports?



----- Original Message -----
From: "Mike Galbraith" <efault@gmx.de>
To: "Jim Roland" <jroland@roland.net>
Sent: Sunday, August 11, 2002 11:44 PM
Subject: Re: The spam problem.


> At 11:41 PM 8/11/2002 -0500, you wrote:
>
> >I want to suggest to the listserver admin (again) that this list and
others
> >on vger.kernel.org be restricted so that you can only post to the list if
> >you are a member.
>
> That would kill too many valuable bug reports.  This (bad idea) has been
> suggested and rejected several times in the past.
>
>          -Mike
>
>
>
>
>
>

Re: The spam problem.

[Rik van Riel]

On Sun, 11 Aug 2002, Jim Roland wrote:

> I want to suggest to the listserver admin (again) that this list and
> others on vger.kernel.org be restricted so that you can only post to the
> list if you are a member.

That's a sure way to cut down on the number of bug reports ;)

Not to mention that it makes cross-posts between various lists
pretty much impossible.

Also, considering the amount of spam I've received "from myself"
and "from" linux-kernel regulars it's pretty obvious that restricting
the posting to list members just isn't going to work any more to
prevent spam.  It might still work for the next few months, but
the trend of spammers harvesting from/to address _pairs_ to get
around people's spam filters is definately getting explosively
more popular...

regards,

Rik
-- 
Bravely reimplemented by the knights who say "NIH".

http://www.surriel.com/		http://distro.conectiva.com/

Re: Re: The spam problem.

[Dhr N. Van Alphen]

cause there would be many non-members who wanna post bugs but can't because
they dont have access maybe?

I suggest too block every email adres wich sends crap, easy done.

Niek van alphen
mastex@servicez.org

----- Original Message -----
From: "Jim Roland" <jroland@roland.net>
To: "Mike Galbraith" <efault@gmx.de>
Cc: <linux-kernel@vger.kernel.org>
Sent: Monday, August 12, 2002 6:48 AM
Subject: Re: The spam problem.


> Why would this kill bug reports?
>
>
>
> ----- Original Message -----
> From: "Mike Galbraith" <efault@gmx.de>
> To: "Jim Roland" <jroland@roland.net>
> Sent: Sunday, August 11, 2002 11:44 PM
> Subject: Re: The spam problem.
>
>
> > At 11:41 PM 8/11/2002 -0500, you wrote:
> >
> > >I want to suggest to the listserver admin (again) that this list and
> others
> > >on vger.kernel.org be restricted so that you can only post to the list
if
> > >you are a member.
> >
> > That would kill too many valuable bug reports.  This (bad idea) has been
> > suggested and rejected several times in the past.
> >
> >          -Mike
> >
> >
> >
> >
> >
> >
>
> -
> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> Please read the FAQ at  http://www.tux.org/lkml/
>

Re: The spam problem.

[David S. Miller]

   From: "Jim Roland" <jroland@roland.net>
   Date: Sun, 11 Aug 2002 23:41:52 -0500

   I want to suggest to the listserver admin (again) that this list and others
   on vger.kernel.org be restricted so that you can only post to the list if
   you are a member.

Absolutely not and this has been discussed a thousand times
and nothing has changes wrt. the reasons we have for making
this decision.

Re: The spam problem.

[David S. Miller]

   From: "Jim Roland" <jroland@roland.net>
   Date: Sun, 11 Aug 2002 23:48:30 -0500

   Why would this kill bug reports?
   
Because people who aren't subscribed couldn't then
send OOPS reports here.  Lots of people do this and
it's invaluable data.

Re: The spam problem.

[Matti Aarnio]

  Good morning,

Please refrain from fights on email issues while I am asleep..
DaveM is in California, I am in Finland.  About 9-10 hours
time difference there.  (depending on our personal rythms, also.)

On Mon, Aug 12, 2002 at 07:00:46AM +0200, Dhr N. Van Alphen wrote:
> cause there would be many non-members who wanna post bugs but can't because
> they dont have access maybe?
> 
> I suggest too block every email adres wich sends crap, easy done.

 Consider:
    - Number of faked source addresses
    - Number of cases using somebody's address
    - Number of throw-away addresses
    - How many times they use  HOTMAIL/YAHOO/EMAIL/MAIL/... addresses ?

  I think I will stick to the (weakish) method of matching texts in
  message body (and sometimes on headers)..

  I just reviewed Majordomo's BOUNCE log.  It is bouncing (into oblivion)
  practically every posting from HOTMAIL (because of Received: header 
  text: "from mail pickup service", which appears also in a number of
  looped messages..)

  Over past 3 days  Majordomo  has trapped ONE of those money-scam
  letters.   A lot more of various other spams have been blocked.
  Messages with HTML content don't make it into VGER at all, which
  should give a very big clue to legitimate posters making a mistake
  of posting such.


  I am very worried of trapping too much.  A bit of leakage is (to me)
  accptable, but similar amounts of falsely trapped ones I don't like.

  I also receive so much spam directly, that I don't always detect every
  instance when it is leaking thru VGER's lists.   If you want to raise
  the attention of VGERs postmasters, I suggest you forward it to:

              postmaster@vger.kernel.org

  with subject: "leaked spam"

  Also, in case of non-english spam, I would like to receive suggestions
  for PERL RE patterns matching juicy keywords in the messages.
  (To me Chinese or Russian texts are just line noise...)

> Niek van alphen
> mastex@servicez.org

/Matti Aarnio

Re: The spam problem.

[Willy Tarreau]

Hello !

On Sun, Aug 11, 2002 at 11:41:52PM -0500, Jim Roland wrote:
> I'm getting damn tired of getting 50-75 spams per day in my inbox and I
> don't even use my email address on websites to post.

I don't receive 50 spams/day from lkml, and I have no filter. So some of the
ones you receive may be addressed to you directly. BTW, nothing prevents you
to filter the mails you receive from LKML to reduce the (IMHO) very little
number of spams that get through. And if you're still so much bothered about
the remaining ones, you still have the choice to unsubscribe and read them
from marc.theaimsgroup.com or other archives.

I personaly am quite happy about Matti and DaveM's work on the list, because
I receive far less spam from LKML than on my personal accounts. Moreover, spams
in the list are easily identifiable by their off-topic subjects, so most of the
time, you don't even have to read them. So I'd prefer to keep this list open
and get most bug reports than closing it, still receiving some spams and not
getting bug reports. Nobody should fall to self-DoS because of spam.

Regards,
Willy

[OT] Re: The spam problem.

[Manik Raina]

> > I'm getting damn tired of getting 50-75 spams per day in my inbox and I
> > don't even use my email address on websites to post.

	I'm pretty satisfied with the spam filtering, though i have
	a *specific* observation about some fellows who claim to be 
	related to related to big people (or former big people) in 
	Africa and want us to transfer some money for them. 

	Now , these mails keep making rounds on this list, though
	they've improved my knowlege of African power politics 
	somewhat, and improved my who's who in Africa, i would 
	really like it if we could shut the spammer up.

Re: The spam problem.

[Richard B. Johnson]

On Mon, 12 Aug 2002 Hell.Surfers@cwctv.net wrote:

> I know this is offtopic, but the spam problem is getting worse,
> could the linux-kernel mail guy/gal, do something,
> the nigerian scams are actually dangerous..
>                                 ^^^^^^^^^^^

Really?  That's how I made my first 32-million dollars. Some poor
lady need my back account information so she could wire her dead
husband's money. Works everytime.
 

Cheers,
Dick Johnson
Penguin : Linux version 2.4.18 on an i686 machine (797.90 BogoMips).
The US military has given us many words, FUBAR, SNAFU, now ENRON.
Yes, top management were graduates of West Point and Annapolis.

Re: [OT] Re: The spam problem.

[Rik van Riel]

On Mon, 12 Aug 2002, Manik Raina wrote:

> 	Now , these mails keep making rounds on this list, though
> 	they've improved my knowlege of African power politics
> 	somewhat, and improved my who's who in Africa, i would
> 	really like it if we could shut the spammer up.

Little chance.  These messages are generally written in such
a way that there are no useful regexps to distinguish the 419
spam from legitimate email.

I think spamassassin catches about half of the 419 scams, maximum.

kind regards,

Rik
-- 
Bravely reimplemented by the knights who say "NIH".

http://www.surriel.com/		http://distro.conectiva.com/

Re: [OT] Re: The spam problem.

[Richard B. Johnson]

On Mon, 12 Aug 2002, Rik van Riel wrote:

> On Mon, 12 Aug 2002, Manik Raina wrote:
> 
> > 	Now , these mails keep making rounds on this list, though
> > 	they've improved my knowlege of African power politics
> > 	somewhat, and improved my who's who in Africa, i would
> > 	really like it if we could shut the spammer up.
> 
> Little chance.  These messages are generally written in such
> a way that there are no useful regexps to distinguish the 419
> spam from legitimate email.
> 
> I think spamassassin catches about half of the 419 scams, maximum.
> 

Blacklist the whole country. At the risk of receiving probably one
or, maybe two, flames from Nigeria, I doubt that there is any
legitimate email from that country at all. So called businessmen
and government personnel from that country, dress in "clown suits".
That should be a hint.

Cheers,
Dick Johnson
Penguin : Linux version 2.4.18 on an i686 machine (797.90 BogoMips).
The US military has given us many words, FUBAR, SNAFU, now ENRON.
Yes, top management were graduates of West Point and Annapolis.

Re: [OT] Re: The spam problem.

[Martin J. Bligh]

> Blacklist the whole country. At the risk of receiving probably one
> or, maybe two, flames from Nigeria, I doubt that there is any
> legitimate email from that country at all. So called businessmen
> and government personnel from that country, dress in "clown suits".
> That should be a hint.

1. That's the most offensively stupid thing I've heard in quite 
some time. I'd really be much happier if we blacklisted your
email address instead.

2. What makes you think they all still come from Nigeria?

Martin.

Re: [OT] Re: The spam problem.

[Paul Jakma]

On Mon, 12 Aug 2002, Rik van Riel wrote:

> Little chance.  These messages are generally written in such a way
> that there are no useful regexps to distinguish the 419 spam from
> legitimate email.

use a procmail scoring filter, case sensitive, and score a la:

* 5^6 ([nN]igeria|[Aa]bacha|[zZ]imbabwe|[mM]ugabe)
* 10^6 (MUGABE|MILLION|DOLLARS|NIGERIA|ABACHA|ZIMBABWE)

most of my mail will start with a default score of at least -50. and
above catches 90ish% of 419 spam to me. no reason why spamassassin
couldnt do this too. (presuming it has weighted scoring like
procmail).

[paul@fogarty tmp]$ wc -l ~/.procspam
    493 /home/paul/.procspam

and i plan to add the multi-k lines nl.linux.org anti-spam regexps to 
it some time too. :)

> Rik

regards,
-- 
Paul Jakma	paul@clubi.ie	paul@jakma.org	Key ID: 64A2FF6A
	warning: do not ever send email to spam@dishone.st
Fortune:
That's the true harbinger of spring, not crocuses or swallows
returning to Capistrano, but the sound of a bat on a ball.
		-- Bill Veeck