The spam problem.

The spam problem.

[Hell.Surfers]

I know this is offtopic, but the spam problem is getting worse, could the linux-kernel mail guy/gal, do something, the nigerian scams are actually dangerous..

Re: The spam problem.

[David S. Miller]

   From: <Hell.Surfers@cwctv.net>
   Date: Mon, 12 Aug 2002 02:44:14 +0100

   I know this is offtopic, but the spam problem is getting worse,
   could the linux-kernel mail guy/gal, do something, the nigerian
   scams are actually dangerous.

They never make it to the lists, if they are sending these
spams to you privately that is your problem to resolve :-)

Look we simply cannot control what web site archives of these
lists choose to do with the sender's email address.  If you
post here, you will almost certainly get on a spam list.
There is zero we as postmasters can do about this.

Re: The spam problem.

[David D. Hagood]

David S. Miller wrote:

> They never make it to the lists, if they are sending these

Incorrect - they frequently make it to the list, I have the headers to 
prove it.

Unfortunately, unless the LKML maintainers wish to either filter the 
list against Spamcop|Spamhaus|MAPS, or unless they are willing to 
require non-registered individuals to confirm an email (i.e. 
non-registered individual sends a mail, LKML sends a "you aren't 
registered, so please reply to this email to confirm you aren't a 
spammer" message), there is little they can do about it.

Re: The spam problem.

[David S. Miller]

   From: "David D. Hagood" <wowbagger@sktc.net>
   Date: Sun, 11 Aug 2002 21:22:45 -0500

   David S. Miller wrote:
   
   > They never make it to the lists, if they are sending these
   
   Incorrect - they frequently make it to the list, I have the headers to 
   prove it.
   
And within 24 to 48 hours we add a filter for it.
That is how it has always worked and this is how it
will continue to work.

Re: The spam problem.

[David D. Hagood]

David S. Miller wrote:

> And within 24 to 48 hours we add a filter for it.
> That is how it has always worked and this is how it
> will continue to work.

Peace, sir - I was not criticising the way the list is run. However, you 
stated "they never make it to the list" and implied the spam problem was 
within the email account of the poster, which you just admitted was 
incorrect.

I *wasn't* suggesting the list be filtered more aggressively - I was 
saying that removing the spam from the list would require more 
aggressive (read: more prone to false positives) filtering. The cure 
would in many ways be worse than the disease (at least at it's current 
level).

Unfortunately, until they make a legal hunting season for spammers, we 
must all simply put up with it. I suggest forwarding all the spams over 
to Spamcop to attempt to shut the spammers down (just make sure you ding 
the spammer's servers and not LMKL's!)

[OT] Re: The spam problem.

[Rik van Riel]

On Sun, 11 Aug 2002, David D. Hagood wrote:

> Unfortunately, until they make a legal hunting season for spammers, we
> must all simply put up with it. I suggest forwarding all the spams over
> to Spamcop to attempt to shut the spammers down (just make sure you ding
> the spammer's servers and not LMKL's!)

OK, a few links and addresses for the people who are
interested in fighting the spam they see:


419/Nigeria scams should be forwarded (with complete headers) to
the US secret service, who are very interested because these scams
have indeed gotten people killed:

	United States Secret Service <419.fcd@usss.treas.gov>


Stock pump&dump scams are often very effectively handled by
sending them to:

	enforcement@sec.gov

What might also help for these is sending the spam to the
legal staff of the company, in addition to the SEC address.
Reminding the legal staff of the fact that the SEC might
suspend trading in their stock for a few days often gets
them moving against the spammer fairly quickly ;)


If you live in Washington state (and some other states too,
I believe) hunting season for spammers is literally open all
year. I think you can get up to $500/spam in Washington state:

	http://www.suespammers.org/


Now, please stop bothering Matti and DaveM about it and
take action yourself ;)

cheers,

Rik
-- 
Bravely reimplemented by the knights who say "NIH".

http://www.surriel.com/		http://distro.conectiva.com/

Re: The spam problem.

[Jim Roland]

The Nigerian stuff is a scam to take your money from the bank account you
give them and for them to steal your identity.  NEVER EVER give someone your
personal information over the internet or phone.

I want to suggest to the listserver admin (again) that this list and others
on vger.kernel.org be restricted so that you can only post to the list if
you are a member.  Anyone can read it, but you have to sign up to post to
the list.  At least then, the spammers/scammers have to go thru an extra
step that can have their mail server blocked from posting on this list.  I'm
getting damn tired of getting 50-75 spams per day in my inbox and I don't
even use my email address on websites to post.



----- Original Message -----
From: <Hell.Surfers@cwctv.net>
To: <linux-kernel@vger.kernel.org>
Sent: Sunday, August 11, 2002 8:44 PM
Subject: The spam problem.


> I know this is offtopic, but the spam problem is getting worse, could the
linux-kernel mail guy/gal, do something, the nigerian scams are actually
dangerous..
>
>
> -
> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> Please read the FAQ at  http://www.tux.org/lkml/
>

Re: The spam problem.

[Rik van Riel]

On Sun, 11 Aug 2002, Jim Roland wrote:

> I want to suggest to the listserver admin (again) that this list and
> others on vger.kernel.org be restricted so that you can only post to the
> list if you are a member.

That's a sure way to cut down on the number of bug reports ;)

Not to mention that it makes cross-posts between various lists
pretty much impossible.

Also, considering the amount of spam I've received "from myself"
and "from" linux-kernel regulars it's pretty obvious that restricting
the posting to list members just isn't going to work any more to
prevent spam.  It might still work for the next few months, but
the trend of spammers harvesting from/to address _pairs_ to get
around people's spam filters is definately getting explosively
more popular...

regards,

Rik
-- 
Bravely reimplemented by the knights who say "NIH".

http://www.surriel.com/		http://distro.conectiva.com/

Re: The spam problem.

[David S. Miller]

   From: "Jim Roland" <jroland@roland.net>
   Date: Sun, 11 Aug 2002 23:41:52 -0500

   I want to suggest to the listserver admin (again) that this list and others
   on vger.kernel.org be restricted so that you can only post to the list if
   you are a member.

Absolutely not and this has been discussed a thousand times
and nothing has changes wrt. the reasons we have for making
this decision.

Re: The spam problem.

[Willy Tarreau]

Hello !

On Sun, Aug 11, 2002 at 11:41:52PM -0500, Jim Roland wrote:
> I'm getting damn tired of getting 50-75 spams per day in my inbox and I
> don't even use my email address on websites to post.

I don't receive 50 spams/day from lkml, and I have no filter. So some of the
ones you receive may be addressed to you directly. BTW, nothing prevents you
to filter the mails you receive from LKML to reduce the (IMHO) very little
number of spams that get through. And if you're still so much bothered about
the remaining ones, you still have the choice to unsubscribe and read them
from marc.theaimsgroup.com or other archives.

I personaly am quite happy about Matti and DaveM's work on the list, because
I receive far less spam from LKML than on my personal accounts. Moreover, spams
in the list are easily identifiable by their off-topic subjects, so most of the
time, you don't even have to read them. So I'd prefer to keep this list open
and get most bug reports than closing it, still receiving some spams and not
getting bug reports. Nobody should fall to self-DoS because of spam.

Regards,
Willy

[OT] Re: The spam problem.

[Manik Raina]

> > I'm getting damn tired of getting 50-75 spams per day in my inbox and I
> > don't even use my email address on websites to post.

	I'm pretty satisfied with the spam filtering, though i have
	a *specific* observation about some fellows who claim to be 
	related to related to big people (or former big people) in 
	Africa and want us to transfer some money for them. 

	Now , these mails keep making rounds on this list, though
	they've improved my knowlege of African power politics 
	somewhat, and improved my who's who in Africa, i would 
	really like it if we could shut the spammer up.

Re: [OT] Re: The spam problem.

[Rik van Riel]

On Mon, 12 Aug 2002, Manik Raina wrote:

> 	Now , these mails keep making rounds on this list, though
> 	they've improved my knowlege of African power politics
> 	somewhat, and improved my who's who in Africa, i would
> 	really like it if we could shut the spammer up.

Little chance.  These messages are generally written in such
a way that there are no useful regexps to distinguish the 419
spam from legitimate email.

I think spamassassin catches about half of the 419 scams, maximum.

kind regards,

Rik
-- 
Bravely reimplemented by the knights who say "NIH".

http://www.surriel.com/		http://distro.conectiva.com/

Re: [OT] Re: The spam problem.

[Richard B. Johnson]

On Mon, 12 Aug 2002, Rik van Riel wrote:

> On Mon, 12 Aug 2002, Manik Raina wrote:
> 
> > 	Now , these mails keep making rounds on this list, though
> > 	they've improved my knowlege of African power politics
> > 	somewhat, and improved my who's who in Africa, i would
> > 	really like it if we could shut the spammer up.
> 
> Little chance.  These messages are generally written in such
> a way that there are no useful regexps to distinguish the 419
> spam from legitimate email.
> 
> I think spamassassin catches about half of the 419 scams, maximum.
> 

Blacklist the whole country. At the risk of receiving probably one
or, maybe two, flames from Nigeria, I doubt that there is any
legitimate email from that country at all. So called businessmen
and government personnel from that country, dress in "clown suits".
That should be a hint.

Cheers,
Dick Johnson
Penguin : Linux version 2.4.18 on an i686 machine (797.90 BogoMips).
The US military has given us many words, FUBAR, SNAFU, now ENRON.
Yes, top management were graduates of West Point and Annapolis.

Re: [OT] Re: The spam problem.

[Martin J. Bligh]

> Blacklist the whole country. At the risk of receiving probably one
> or, maybe two, flames from Nigeria, I doubt that there is any
> legitimate email from that country at all. So called businessmen
> and government personnel from that country, dress in "clown suits".
> That should be a hint.

1. That's the most offensively stupid thing I've heard in quite 
some time. I'd really be much happier if we blacklisted your
email address instead.

2. What makes you think they all still come from Nigeria?

Martin.

Re: [OT] Re: The spam problem.

[Paul Jakma]

On Mon, 12 Aug 2002, Rik van Riel wrote:

> Little chance.  These messages are generally written in such a way
> that there are no useful regexps to distinguish the 419 spam from
> legitimate email.

use a procmail scoring filter, case sensitive, and score a la:

* 5^6 ([nN]igeria|[Aa]bacha|[zZ]imbabwe|[mM]ugabe)
* 10^6 (MUGABE|MILLION|DOLLARS|NIGERIA|ABACHA|ZIMBABWE)

most of my mail will start with a default score of at least -50. and
above catches 90ish% of 419 spam to me. no reason why spamassassin
couldnt do this too. (presuming it has weighted scoring like
procmail).

[paul@fogarty tmp]$ wc -l ~/.procspam
    493 /home/paul/.procspam

and i plan to add the multi-k lines nl.linux.org anti-spam regexps to 
it some time too. :)

> Rik

regards,
-- 
Paul Jakma	paul@clubi.ie	paul@jakma.org	Key ID: 64A2FF6A
	warning: do not ever send email to spam@dishone.st
Fortune:
That's the true harbinger of spring, not crocuses or swallows
returning to Capistrano, but the sound of a bat on a ball.
		-- Bill Veeck

Re: The spam problem.

[Jim Roland]

Why would this kill bug reports?



----- Original Message -----
From: "Mike Galbraith" <efault@gmx.de>
To: "Jim Roland" <jroland@roland.net>
Sent: Sunday, August 11, 2002 11:44 PM
Subject: Re: The spam problem.


> At 11:41 PM 8/11/2002 -0500, you wrote:
>
> >I want to suggest to the listserver admin (again) that this list and
others
> >on vger.kernel.org be restricted so that you can only post to the list if
> >you are a member.
>
> That would kill too many valuable bug reports.  This (bad idea) has been
> suggested and rejected several times in the past.
>
>          -Mike
>
>
>
>
>
>

Re: Re: The spam problem.

[Dhr N. Van Alphen]

cause there would be many non-members who wanna post bugs but can't because
they dont have access maybe?

I suggest too block every email adres wich sends crap, easy done.

Niek van alphen
mastex@servicez.org

----- Original Message -----
From: "Jim Roland" <jroland@roland.net>
To: "Mike Galbraith" <efault@gmx.de>
Cc: <linux-kernel@vger.kernel.org>
Sent: Monday, August 12, 2002 6:48 AM
Subject: Re: The spam problem.


> Why would this kill bug reports?
>
>
>
> ----- Original Message -----
> From: "Mike Galbraith" <efault@gmx.de>
> To: "Jim Roland" <jroland@roland.net>
> Sent: Sunday, August 11, 2002 11:44 PM
> Subject: Re: The spam problem.
>
>
> > At 11:41 PM 8/11/2002 -0500, you wrote:
> >
> > >I want to suggest to the listserver admin (again) that this list and
> others
> > >on vger.kernel.org be restricted so that you can only post to the list
if
> > >you are a member.
> >
> > That would kill too many valuable bug reports.  This (bad idea) has been
> > suggested and rejected several times in the past.
> >
> >          -Mike
> >
> >
> >
> >
> >
> >
>
> -
> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> Please read the FAQ at  http://www.tux.org/lkml/
>

Re: The spam problem.

[Matti Aarnio]

  Good morning,

Please refrain from fights on email issues while I am asleep..
DaveM is in California, I am in Finland.  About 9-10 hours
time difference there.  (depending on our personal rythms, also.)

On Mon, Aug 12, 2002 at 07:00:46AM +0200, Dhr N. Van Alphen wrote:
> cause there would be many non-members who wanna post bugs but can't because
> they dont have access maybe?
> 
> I suggest too block every email adres wich sends crap, easy done.

 Consider:
    - Number of faked source addresses
    - Number of cases using somebody's address
    - Number of throw-away addresses
    - How many times they use  HOTMAIL/YAHOO/EMAIL/MAIL/... addresses ?

  I think I will stick to the (weakish) method of matching texts in
  message body (and sometimes on headers)..

  I just reviewed Majordomo's BOUNCE log.  It is bouncing (into oblivion)
  practically every posting from HOTMAIL (because of Received: header 
  text: "from mail pickup service", which appears also in a number of
  looped messages..)

  Over past 3 days  Majordomo  has trapped ONE of those money-scam
  letters.   A lot more of various other spams have been blocked.
  Messages with HTML content don't make it into VGER at all, which
  should give a very big clue to legitimate posters making a mistake
  of posting such.


  I am very worried of trapping too much.  A bit of leakage is (to me)
  accptable, but similar amounts of falsely trapped ones I don't like.

  I also receive so much spam directly, that I don't always detect every
  instance when it is leaking thru VGER's lists.   If you want to raise
  the attention of VGERs postmasters, I suggest you forward it to:

              postmaster@vger.kernel.org

  with subject: "leaked spam"

  Also, in case of non-english spam, I would like to receive suggestions
  for PERL RE patterns matching juicy keywords in the messages.
  (To me Chinese or Russian texts are just line noise...)

> Niek van alphen
> mastex@servicez.org

/Matti Aarnio

Re: The spam problem.

[David S. Miller]

   From: "Jim Roland" <jroland@roland.net>
   Date: Sun, 11 Aug 2002 23:48:30 -0500

   Why would this kill bug reports?
   
Because people who aren't subscribed couldn't then
send OOPS reports here.  Lots of people do this and
it's invaluable data.

Re: The spam problem.

[Richard B. Johnson]

On Mon, 12 Aug 2002 Hell.Surfers@cwctv.net wrote:

> I know this is offtopic, but the spam problem is getting worse,
> could the linux-kernel mail guy/gal, do something,
> the nigerian scams are actually dangerous..
>                                 ^^^^^^^^^^^

Really?  That's how I made my first 32-million dollars. Some poor
lady need my back account information so she could wire her dead
husband's money. Works everytime.
 

Cheers,
Dick Johnson
Penguin : Linux version 2.4.18 on an i686 machine (797.90 BogoMips).
The US military has given us many words, FUBAR, SNAFU, now ENRON.
Yes, top management were graduates of West Point and Annapolis.

RE:Re: The spam problem.

[Hell.Surfers]

[-- Attachment #1: Type: text/plain, Size: 197 bytes --]

YES THEY ARE SENT TO THE LIST, WOULD YOU LIKE COPIES? T hey are dangerous, they have gotten people KILLED.



On 	Sun, 11 Aug 2002 18:36:21 -0700 (PDT) 	"David S. Miller" <davem@redhat.com> wrote:

[-- Attachment #2: Type: message/rfc822, Size: 2224 bytes --]

From: "David S. Miller" <davem@redhat.com>
To: Hell.Surfers@cwctv.net
Cc: linux-kernel@vger.kernel.org
Subject: Re: The spam problem.
Date: Sun, 11 Aug 2002 18:36:21 -0700 (PDT)
Message-ID: <20020811.183621.07790287.davem@redhat.com>

   From: <Hell.Surfers@cwctv.net>
   Date: Mon, 12 Aug 2002 02:44:14 +0100

   I know this is offtopic, but the spam problem is getting worse,
   could the linux-kernel mail guy/gal, do something, the nigerian
   scams are actually dangerous.

They never make it to the lists, if they are sending these
spams to you privately that is your problem to resolve :-)

Look we simply cannot control what web site archives of these
lists choose to do with the sender's email address.  If you
post here, you will almost certainly get on a spam list.
There is zero we as postmasters can do about this.

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Re: The spam problem.

[David S. Miller]

   From: Hell.Surfers@cwctv.net
   Date: Mon, 12 Aug 2002 04:04:10 +0100

   They are dangerous, they have gotten people KILLED.

If people actually reply to and act upon those "here is how to make
168 million dollars please help me in Nigeria!" emails, frankly that's
Darwin at work.

If you want to talk about this further, please don't do it here.

Re: The spam problem.

[David D. Hagood]

Hell.Surfers@cwctv.net wrote:
> YES THEY ARE SENT TO THE LIST, WOULD YOU LIKE COPIES? T hey are dangerous, they have gotten people KILLED.

I would suggest that anyone stupid enough to respond to a Nigerian spam 
(or any spam, for that matter) sent to a mailing list like LKML

1) Shouldn't be reading LKML
2) Should make an appointment at the local family planning clinic.
3) If they have already reproduced, they should take their kids along.

I am as ardent an anti-spam warrior as the next guy, but let us not 
waste bandwidth on LKML over this - forward the spams to Spamcop and 
move on. The risk of blocking a legitimate email relative the (actually 
quite small) number of spams the list receives is considered unwarrented 
by the folks who run the list, and personally I agree with them - the 
number of spams the list receives is pretty small, all things considered.

If you feel so strongly about it, rather than writing LKML, why not 
write your (Congressdrones|MP...) and try to get some truely effective 
antispam legislation passed (gak! saying that leaves a bad taste in my 
basically libertarian mouth).

Once again, until we can hunt spammers like the vermin they are, this is 
part of the unfortunate state of affairs - shouting about it won't help.

Re: RE:Re: The spam problem.

[Jim Roland]

Now there's a good thought!  Post, Confirm, gets posted.  If member, no
confirmation necessary.


----- Original Message -----
From: <Hell.Surfers@cwctv.net>
To: <riel@conectiva.com.br>; <jroland@roland.net>;
<linux-kernel@vger.kernel.org>
Sent: Monday, August 12, 2002 12:01 AM
Subject: RE:Re: The spam problem.


> what about just asking them to confirm that would cut out mass spam
>
>
>
> On Mon, 12 Aug 2002 01:50:12 -0300 (BRT) Rik van Riel
<riel@conectiva.com.br> wrote:
>

Re: RE:Re: The spam problem.

[David Schwartz]

On Mon, 12 Aug 2002 00:15:53 -0500, Jim Roland wrote:

>Now there's a good thought!  Post, Confirm, gets posted.  If member, no
>confirmation necessary.

	You could also put them in a manual hold queue. Give a large number of 
people ability to approve posts from that queue so latency would be 
reasonable.

	The problem with confirmation is that a person might fire off a bug report 
where they happen to be, via something like

dmesg > foo
joe foo
cat foo + mail -s "Bug report blah blah" linux-kernel@vger.kernel.org

	A confirmation sent to the source address of that might not be noticed until 
the next time they happen to log into that account on that machine.

	You could do both, I guess. A hold queue that can be manually processed with 
confirmation posting the message and removing it from the hold queue.

	DS

Re: The spam problem.

[David S. Miller]

Nobody has mentioned the fact that spammers can forge the
From: field just like anyone else can.

If you enforce that the first sender at the Received: headers
have to match the From: or some rule like that, then I could
not post to these lists for example.

This is why enforcing that subscribers only can post to the lists is
totally unacceptablt.  It doesn't stop spam, it's merely a deterrant
and it serves mostly to piss off legitimate users of these lists.

Re: The spam problem.

[Rik van Riel]

On Mon, 12 Aug 2002, David S. Miller wrote:

> Nobody has mentioned the fact that spammers can forge the
> From: field just like anyone else can.

It's already happening.  You have no idea how much spam I've
received "from" Ingo Molnar, Bill Davidsen, Stephen Tweedie
and you ...

You probably also have no idea from which countries the spam
with you in the From: address has been sent ;)

Recently an anti-spam mailinglist (with members-only posting)
got flooded by a spammer who wanted to take revenge for his
N-th cancelled account.  Of course he used From: headers with
the addresses of many of the list regulars.

cheers,

Rik
-- 
Bravely reimplemented by the knights who say "NIH".

http://www.surriel.com/		http://distro.conectiva.com/

Re: The spam problem.

[Benjamin LaHaise]

On Mon, Aug 12, 2002 at 10:50:35AM -0300, Rik van Riel wrote:
> It's already happening.  You have no idea how much spam I've
> received "from" Ingo Molnar, Bill Davidsen, Stephen Tweedie
> and you ...
> 
> You probably also have no idea from which countries the spam
> with you in the From: address has been sent ;)
> 
> Recently an anti-spam mailinglist (with members-only posting)
> got flooded by a spammer who wanted to take revenge for his
> N-th cancelled account.  Of course he used From: headers with
> the addresses of many of the list regulars.

The problem requires action on a wider scale where the IETF needs to 
propose a new standard that enforces crypto signatures of message 
content and From: that is tied into DNS.  The current mail standards 
do not have any means to prevent forgeries, even for those organizations 
that want to avoid such abuses.

		-ben
-- 
"You will be reincarnated as a toad; and you will be much happier."

Re: The spam problem.

[Thunder from the hill]

Hi,

On Mon, 12 Aug 2002, David S. Miller wrote:
> If you enforce that the first sender at the Received: headers
> have to match the From: or some rule like that, then I could
> not post to these lists for example.

This is quite a bad idea.

If we go after the hostname, things like Puretec or our Hawkeye will be 
shot. Imagine the domain ngforever.de. It's hosted on kundenserver.de, and 
the smtp host is smtp.kundenserver.de. How can we guess?!

If we go after MX entries, most people will be shot. T-Online, Yahoo, 
Netscape... all have different smarthosts for users and incoming mail. 
T-Online, for example, has mailin00 through mailin07.sul.t-online.de for 
the incoming messages, while users use fwd00 through 
fwd07.sul.t-online.com in order to send mail.

We'll break things either way. I send mail via hawkeye.lightweight.adm 
(not an internet address, but the realname, and yes, it's a large 
network.) for the domain lightweight.ods.org, where's the connection? In 
order to find out that hawkeye.lightweight.adm is the mail host of 
lightweight.ods.org you'll have to ask a domain server on our side. 
However, Hawkeye signs things with his realname.

			Thunder
-- 
--./../...-/. -.--/---/..-/.-./..././.-../..-. .---/..-/.../- .-
--/../-./..-/-/./--..-- ../.----./.-../.-.. --./../...-/. -.--/---/..-
.- -/---/--/---/.-./.-./---/.--/.-.-.-
--./.-/-.../.-./.././.-../.-.-.-