Subject: Re: [Asrg] Join ASRG and display your email address for the spammers!!

From: Yakov Shafranovich <[email-masked]>
Date: Sat, 14 Jun 2003 22:50:06 -0400

At 07:24 AM 6/14/2003 +0900, Shannon Jacobs wrote:

>Hey, not trying to sound bent out of shape and all that, and it's too bloody
>late now, but I just wanted to note that if I had realized that my email
>address was going to be reposted on a publicly accessible Web site and in a
>non-protected form, then I never would have dared to peek at this mailing
>list.
>
>Already mentioned that it's too late, but I'd still like to have my email
>address expunged. I had been wondering why the new spam was coming through
>this routing, and I don't want to waste more time dealing with it. And I am
>not amused to discover that ASRG was probably the source of the leak.

I have been getting some spam at this email address as well since 
participating in the group. However, this address was exposed in at least 
one other place, so I don't know for sure.

The program used for archiving the lists is MHonArc, which has an anti-spam 
module (see http://www.mhonarc.org/MHonArc/doc/resources/spammode.html). 
Perhaps the administrators can turn it on in order to make sure that 
addresses are not being harvested. The IETF mail administrator can be 
reached at [email-masked] (from https://www1.ietf.org/maillist.html) and 
the person that handles our list is Jakob Munoz who can be reached at 
[email-masked] (from https://www1.ietf.org/mailman/listinfo/asrg). GNU 
MailMan, which handles the actual mailing list, might have anti-spam 
features as well. Alas, for all we know that could be spammers on the list 
as well who want revenge, also I highly doubt it.

On the last note, consider this little gem from the IETF's spam control 
policy page (https://www1.ietf.org/spamcontrol.html):

"The Anti-Spam Research Group of the IRTF is ignored by all policies to 
prevent interruption of service."  

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Vernon Schryver <[email-masked]>
Date: Sun, 15 Jun 2003 08:28:41 -0600 (MDT)

> From: Yakov Shafranovich <[email-masked]>

> ...
> features as well. 

Even without have heard of experiements that show spammers are prefectly
capable of writing, finding, and/or using software that can and does
recover mail addresses from any such "anti-spam" feature, common sense
should tell one that is likely.  It is impossible to create a mechanism
that leaves addresses in a form that can be used by people but that
cannot be decoded by a program.  (Look for the neologisms "munge" and
"demunge.")

Therefore you must be advocating the complete censoring of all
addresses from this and presumably all IETF and IRTF mailing list
archives.  I suspect many people would object to that on grounds
related to the notion that IETF and IRTF mailing lists are in some
sense public and official.

As I've said before, I think that the price of admission to this
mailing list should include sufficient practical knowledge of spam
and spam defenses to not need to worry about exposing one's address.
Besides, anyone advocating challenge-response, authentication, or any
of several other spam defenses and complains about spam as a result
of address exposure here or anywhere is either admitting practical
ignorance of the adovcated defense or saying that the advocated defense
is useless.

>                   Alas, for all we know that could be spammers on the list 

I don't know about "revenge," but I am convinced that certain superficial
changes in some common spam in the last 60 days were prompted by
discussions here.

I trust you did not intend to suggest that you doubt that spammers
would either subscribe to this mailing list or regularly check the
archives, since that would be silly.  Spammers have more interest in
effective spam defenses than almost anyone else except perhaps people
working for organizations that are selling or want to sell spam defenses
(effective or not).

  .....

Concerning delays in receiving copies of mail from this or any big
list:  Please consider obvious aspects how any bulk mail system run
by spammers, the IETF, or anyone must work.  The simplest implementation
is to send copies one at a time to addresses in the list.  If sending
each copy takes 5 seconds, then the thousandth address will receive
its copy more than an hour after the first address.  In practice, many
transmissions will take less than a second and there will be a
significant amount of parallelism, but that parallelism will be modest
and there will be many slow or silent SMTP servers in the list that
will make the average time/copy large.  In practice, bulk mailing
software will keep lists sorted.  The result is quite familiar to
anyone with with an address near the end of the alphabet and any
experience with large mailing lists.  We get our copies from the
list hours and sometimes literally days after people at the front
of the list and after "courtesy" copies.

In addition, this mailing list may be manually moderated.

Vernon Schryver    [email-masked]
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Harald Tveit Alvestrand <[email-masked]>
Date: Mon, 16 Jun 2003 09:52:03 +0200

> prevent interruption of service."

this was my little contribution....

There were so many phrases that triggered the spam filters at the IETF 
occuring in postings to the ASRG list that I told them to turn the filters 
off for that list.

Too many false positives and too few people devoted to sorting through the 
rubbish.