[ILUG] New Mailing List Motion

[Jeroen Massar]

fuzzix wrote:
> Colm Buckley wrote:
>> Is there *really* a lot of spam getting through?  I just don't see it.
>> I only see two in my junkbox from the past four days, which is hardly
>> an epidemic.
> 
> Well, since the addition of killing whitespace only messages I don't
> notice any (or many...)

Most of them seem to be gone indeed. The moderators can now handle the
few left overs to keep the list, but also the archives, nice and clean
from that nonsense.

Quick look, no spam for this month:
http://www.linux.ie/lists/pipermail/ilug/2006-November/thread.html

quite some spam for the previous month before the whitespace fix:
http://www.linux.ie/lists/pipermail/ilug/2006-October/thread.html

> I think I mentioned it to someone on the day of the AGM but a technical
> solution did come to mind, namely the GMANE one:
> 
> A non-subscriber posts to the list, they receive an email with a token
> in the subject to reply to, their mail posted to the list when the reply
> arrives a well as subsequent mail from that address (effectively making
> them a semi-subscriber... they can post but don't receive mail from the
> list)

Tokens or any other such automated-replies are inherently evil.

What if some nice spam/virus/zombie thing starts using fuzzix at gmail.com
as a source address and then starts sending spam to an address which
nicely sends 'tokens' back for every single one of them. As you most
likely subscribed this address though it will all come through to the
list though;)

Tokens thus give you a nice reflection attack.

That said, as mentioned before, being subscribed doesn't mean that the
address will originate non-spam. "Spoofing" (Quotes, because there is
nothing to spoof, just fill in the required address in any mailclient
and done) is still too easy. DKIM/SPF/<whatever> will resolve that when
that time arrives, for the time being this is 'good enough'.


Brendan Halpin wrote:
> A suggestion (perhaps already implemented) -- once an address
> passes moderation once, whitelist it.

The mailman administration/moderator interface does allow this, thus the
moderator in question might be able to decide to do that, it will lessen
the work the moderator has to do ;)


Thanks to the new&old committee for following the wishes of it's
membership and getting the moderation in place so quick!

Greets,
 Jeroen