RE: [Groff] Re: Spam and virus cruft on address@hidden

[Ted Harding]

On 30-Mar-04 Werner LEMBERG wrote:
> I believe that `blacklisting' is the wrong action in general.
> For example, there are millions of users in Taiwan's hinet.net
> domain which has been famous for spamming a longer time ago.
>  Blocking this domain disables far too much normal users.

I have to sympathise with this sentiment!

>> This is very disturbing. It suggests that nobody is really
> looking after the mailing list.
> 
> I do, but I'm not an administrator and can only remove spam
> which has been filtered out already, or approve mail which
> didn't come through :-(

This is a definite issue, and I again have to be on Werner's
side here. I am list-owner of a couple of Linux mailing lists,
both of which only accept postings from subscribed members.
So mail from non-subscribed addresses gets cached until I can
either approve or reject it (some members quite frequently mail
to the lists from addresses other than their subscribed ones.)

When it's spam, I can be quite relaxed about it. It just sits
there until I get round to junking it and it doesn't matter
whether it's done immediately or a week later. But if I happen
to be out of touch for a day or two, then genuine postings get
delayed.

Now that I think about it, unless every single mail was moderated
(i.e. had to be approved by Werner), this sort of arrangement
would not have prevented the recent flood of sludge allegedly
"from" me. I am subscribed to the list, so all someone needs
to do is to forge my email address and they can mail to the
list any time they like. And it occurs to me, that people who
want to send spam to a mailing list only need to pick up the
email address of someone who has mailed to the list and forge
it. If you google on "groff" you will find lots of our addresses!
However, people who have other things to do cannot be expected
to sit at their computers, waiting to moderate mail, lest
someone's seminal posting be delayed for more than a few minutes.

> I'm begging since months (well, since years actually) that some
> simple actions are taken, but the pace is extremely slow -- ffii.org
> is managed by volunteers...  I would like to avoid switching to a
> new host, but apparently the situation is getting worse daily.
> 
> Note that today viruses are released in such short intervals that
> even professionally managed hosts are losing the battle (at least
> for one or two days until new filters are installed).

A content filter would help. However, these can also cause more
trouble than they prevent. There is always the consolation that,
in my experience, spam waves like the latest one tend to die down
after a few days.

The one thing I'd like to suggest is that someone should weed out
this stuff from the list archive!

Best wishes to all,
Ted.


--------------------------------------------------------------------
E-Mail: (Ted Harding) <address@hidden>
Fax-to-email: +44 (0)870 167 1972
Date: 30-Mar-04                                       Time: 20:02:29
------------------------------ XFMail ------------------------------