Subject: list moderation request

From: "Jens-S. Voeckler" <[email-masked]>
Date: Thu, 16 May 2002 10:29:50 -0500 (CDT)

Hi,

one of these lists, either wrec or webi, or both, is responsible for well
half of the SPAM that I receive. I request that, unless already done thus,
these lists be moderated! I am not talking about error-prone programs. I
am well inclined to abandon wrec and webi, if SPAM continues to come in
from these lists.

Sincerely,
Dipl.-Ing. Jens-S. Vöckler ([email-masked])
University of Chicago; Computer Science Department; Ryerson 155;
1100 East 58th Street; Chicago, IL 60637-1581; USA; +1 773 834 9170

---

From: Ian Cooper <[email-masked]>
Date: Thu, 16 May 2002 09:20:13 -0700

I hear your grief; as webi-owner I'm getting about 40 reports for each of 
the viruses that's been posted here in the last few days.  (I doubt the 
problem is wrec, since Keith has pretty good controls on that system.)

I can't offer any quick fixes[*] since I'm no longer in a position to sit 
in the cube of the person that runs the list software, and unfortunately 
I'm personally going to be unreachable for the next few days.

[*] One option might be to temporarily suspend the list

---

From: Henrik Nordström <[email-masked]>
Date: Thu, 16 May 2002 20:47:31 +0200

Todays viruses are ugly. They somtimes can slip thru listserver filters even 
if well configured. However, I cannot say I have even noticed that there was 
any viruses sent via wrec/webi... but due to the extremely high amount of 
viruses I receive these days I cannot track exacly how each reach me so it 
might simply be that I deleted all before looking..

Todays email viruses fake both the To and From addresses but it do not seem 
like many if any of them (if any) fake the SMTP sender address, so any 
mailinglist who only allows posts with a SMTP sender address subscribed to 
the list and do not look into to/from headers for this check should be pretty 
immune I think unless one of the subscribers actually happens to be infected.

I know there has been a a few cases where we have received these kind of 
viruses on the squid-users list. Unfotunately the squid-cache.org listserver 
forgets the original SMTP sender and Received headers after processing the 
message so diagnosing exacly how these got onto the Squid lists is a bit 
hard, but the frequency is sufficienly low (two in total that I know of) 
compared to the amount of directly addressed viruses I receive with 
squid-users related email addresses to make me beleive the SMTP sender 
subscribed only filter applied on the list does its job well.. 

What I can advice to protect from any future viruses who fake the SMTP sender 
as well is to set up the listserver to reject any messages with a contenttype 
of multipart/alternative, or mime/multipart where the first part is other 
than text/plain. The squid-cache.org lists will be configured to do this as 
soon as someone finds the time to implement it..

Regards
Henrik Nordström

Ian Cooper wrote:
> > half of the SPAM that I receive. I request that, unless already done
> > thus, these lists be moderated! I am not talking about error-prone
> > programs. I am well inclined to abandon wrec and webi, if SPAM continues
> > to come in from these lists.
> >
> > Sincerely,

---

From: Keith Moore <[email-masked]>
Date: Thu, 16 May 2002 15:47:34 -0400

> problem is wrec, since Keith has pretty good controls on that system.)

wrec had some problems until a few weeks ago, when I implemented
some fairly strict filtering including moderation of non-subscriber
postings.  I think it's pretty good now.  however, spammers have
started using real people's addresses for return addresses and
harvesting addresses from list archives - so I suspect this is only
a temporary fix.

Keith