Subject: Re: Guidance for spam-control on IETF mailing lists

From: Jacob Palme <[email-masked]>
Date: Fri, 15 Mar 2002 17:44:18 +0100

At 10:03 -0500 02-03-14, The IESG wrote:
>  The level of spam on IETF mailing lists has now reached the
>  level that we encourage the use of operational controls as
>  described in:
>
>  http://www.ietf.org/IESG/STATEMENTS/mail-submit-policy.txt
>
>  In particular, list managers are encouraged to employ the
>  use of automatic mechanisms that immediately distribute
>  messages submitted by subscribers and other known email
>  addresses while directing all other messages to a human
>  reviewer for rejection or approval.

>  5) Mailing lists that check the sender's address as part of the
>     determinate of what might be spam must also support a list of "known
>     email addresses" whose submissions are automatically approved
>     without human intervention. The list of "known email addresses" must
>     include at least the following addresses:
>
>  	[email-masked]
>  	[email-masked]
>  	[email-masked]
>  	[email-masked]

Will not the spammers soon learn to send their spams with
one of these addresses as bogus sender?
-- 
Jacob Palme <[email-masked]> (Stockholm University and KTH)
for more info see URL: http://www.dsv.su.se/jpalme/

---

From: Pekka Savola <[email-masked]>
Date: Fri, 15 Mar 2002 19:03:44 +0200 (EET)

> one of these addresses as bogus sender?

You overestimate the spammers :-).  Most probably have no idea what IETF 
is or that they're spamming an IETF list.

-- 
Pekka Savola                 "Tell me of difficulties surmounted,
Netcore Oy                   not those you stumble over and fall"
Systems. Networks. Security.  -- Robert Jordan: A Crown of Swords

---

From: Keith Moore <[email-masked]>
Date: Fri, 15 Mar 2002 12:53:40 -0500

> is or that they're spamming an IETF list.

I dunno.  I've received several complaints from people who've received 
spam with my address in the From field.  I don't know if I'm being
singled out by a spammer (maybe he got angry at my "I support the death
penalty  for spammers" bumper sticker?), or if spammers are starting 
to forge addresses in general.  

But if history is any indication, spammers should not be underestimated.
They have proven quite capable of learning how to circumvent various 
kinds of filtering.

Keith

---

From: Joe Touch <[email-masked]>
Date: Fri, 15 Mar 2002 12:06:26 -0800

> They have proven quite capable of learning how to circumvent various 

We recently had a similar problem on the end2end-interest list, and a 
few other lists I manage.

Regarding the above, one possibility is that any email address that 
appears on a web page may, at any time, be used either as source or 
destination by a spammer.

I considered some of the solutions the IETF is recommending, and 
rejected the "closed list" requirement because we (and I believe many 
IETF mailing lists) have too many members that have preferred delivery 
addresses that aren't correlated to their source address.

What we are doing is:

	- use procmail to filter mail
		using well-known weighted-keyword lists, it
		adds a "X-Possible-Reject:" header (when the
		weight is exceeded)

			mail with this header is then held
			in a spam file which is verified
			periodically by the moderator
			(errors are resent to the list
			and routed around procmail)

		using my own set of filters, it adds a
		"X-Holdforapproval:" header when indicated

			mail with this header is held in
			mailman...

	- we use mailman for processing posts

		mail with "X-Holdforapproval:" is held

The reasons:

	1) "closed list" (poster must be subscribed) is not
	viable for users with uncorrelated delivery and post
	addresses, and discourages non-member posts (which is
	restrictive for open dialogue, IMO).

	2) procmail has more powerful filters than mailman
	(or most other maillist systems I've seen)

There are details to tying any two systems together; in this case, they 
relate to userid/groupid coordination, /etc/aliases, etc.

As with any solution, this doesn't satisfy all subscribers. It does, IMO,

	a) maximize convenience to posters
		(not requiring subscription to post,
		encouraging open dialogue)

	b) minimize pain to subscribers
		(avoiding multiple subscriptions or
		post-from-subscribed-address problems)

	c) minimize maintenance effort by the moderator
		(avoiding maintaining lists of alternate
		posters or approved posters)

This is not the only viable solution to this problem. I do disagree with 
the IESG's policy on the following three items:

	re #1) just because a post comes from a subscriber
	doesn't ensure it is not spam (assume 'spam' is a
	car advertisement, e.g., not a quality assessment
	of a participant's post :-).

	re #2) potential spam should be just that (as indicated), but
	one-day turnaround is too much work. posters should avoid
	using spam trigger words (e.g., this option needs viagra)

	re #5) checking the list of known addresses needlessly
	endorses a single solution. as shown above, there are others,
	and it should be up to the list maintainer to decide what
	to use

Joe

---

From: James M Galvin <[email-masked]>
Date: Fri, 15 Mar 2002 16:58:30 -0500 (EST)

On Fri, 15 Mar 2002, Joe Touch wrote:

While empathetic to the issue I'm not as sympathetic as you.

In general, people who have multiple email addresses and actually *use*
multiple email addresses know a little something about how email works.
This is a necessity since I would assert it is not possible to
effectively *use* multiple email addresses without keeping track of
which email address is for what purpose.

With that in mind, when a mechanism that delays submissions from
non-subscribers is first employed, some number of people will "trip"
over it.  They usually whine about it but once the rules are explained
to them they realize they do have a responsibility to pay attention to
how they use their email.

Once they "get it" the "issue" passes and everything runs smoothly.  If
needed, people can have multiple email addresses authorized to submit
messages.  All modern list applications support this feature.  It's a
one time configuration step for a list owner and then, once again, the
"issue" passes and everything runs smoothly.

I disagree that it is onerous to require an originator to pay attention
to how they originate their email.  In any case the penalty for getting
it wrong is delay, not censorship (at least in the case of the IETF
guidelines).  The benefits of employing such a mechanism far outweigh
the consequences, in my opinion.

On the other side, cross-posting is the canonical example of what can
quickly become an overwhelming job for the "spam monitor" when such a
mechanism is employed.  There is no easy solution to this problem, if in
fact it really is a problem.  One could argue it shouldn't be, i.e., a
discussion may start on more than one list but at least in the IETF if
it is a substantive discussion it should find itself *a* home.  List
owners can make this so if they choose regardless.

Of course the IETF could deal with this issue itself quite simply by
centralizing the management of all its lists, since then it would have
access to a complete set of subscribers from all lists.  Of course, that
solution has its own set of issues.

Responding to your other comments:

True, but the majority of "real spam" comes from effectively anonymous
sources.  Also, a mailing list is quite good at policing itself
(especially in the IETF), so when a known person spams they are quickly
chastised.

And how is this different than requiring a poster to use the correct
originating email address in the first place?  And how are they to know
what that triggers words are on a per list basis?

I disagree that the endorsement is "needless."  We need to make it clear
what mechanisms are permitted.  This mechanism is not required but it
is, in my opinion, the most straightforward to setup and manage.
Simplicity and ease of use are tantamount.

Also, the guidance does not exclude other mechanisms.  If what you have
works I say go with it.

Jim

--
James M. Galvin <[email-masked]>

---

From: Lloyd Wood <[email-masked]>
Date: Fri, 15 Mar 2002 22:57:18 +0000 (GMT)

On Fri, 15 Mar 2002, Lloyd Wood wrote:

> Simplciity and ease of use for the _list members_ is tantamount.
> That's a slightly different thing, but the distinction is important.

and by list members I mean 'WG contributors participating in IETF work
on the mailing list', before we go down that particular
administrative rathole again.

L.

<[email-masked]>PGP<http://www.ee.surrey.ac.uk/Personal/L.Wood/>

---

From: james woodyatt <[email-masked]>
Date: Fri, 15 Mar 2002 11:37:13 -0800

On Friday, March 15, 2002, at 09:53 AM, Keith Moore wrote:
> singled out by a spammer [...]

You are not.  I've seen this tactic used by spammers to circumvent
access control on other lists to which I subscribe.  In the last month,
I've seen it used on three different totally unrelated lists.

--
j h woodyatt <[email-masked]>

---

From: Lloyd Wood <[email-masked]>
Date: Fri, 15 Mar 2002 22:55:35 +0000 (GMT)

On Fri, 15 Mar 2002, James M Galvin wrote:

> to how they originate their email.

This presumes that the originator has control over how they appear in
headers. My mail headers get rewritten, and not by me; my subscribe
address (if using a listserver) will not be a perfect match with my
From: address. And so on. Holding originators responsible for any
changes resulting from local mail policies is a bit much.

> In any case the penalty for getting
> guidelines).

in which case, a number of people would be consistently penalised with
every post they make. This would discourage them from participating.

> (especially in the IETF), so when a known person spams they are quickly

oh, this has done a lot to suppress Peter Lewis of Upperside.

> what that triggers words are on a per list basis?

filters for each list should be published.

If the list manager is going to tell me about the subscription details
when I join or at the start of each month (why aren't the dates
staggered? must cause a traffic spike) it can tell me about filtering
keywords and policy then too, with a pointer to retrieve current info
on same.

Any filterer knows that individual words aren't much good. You have to
block on phrases and on signatures of bulk mailers...

L.

---

From: Keith Moore <[email-masked]>
Date: Fri, 15 Mar 2002 18:38:04 -0500

> how they use their email.

If by "paying attention to how they use their email"  you mean that the
author should pick his From address on a per-message basis, so that he
uses the subscription address for that list, I emphatically disagree.
If nothing else this presumes that the author wants to see personal
replies to the messages he sends to the list to go to the same mailbox
as other traffic that comes from the list.  This is not a reasonable
assumption.

I'm all for reducing the amount of spam on WG lists as long as the filters
don't impair genuine contributions.  But I'm fed up with WG lists that
expect me to remove my shoes, kneel, bow in the direction of Mae West, and
precisely utter some strange incantation, just so that I can get past that
list admin's parochial idea of the responsible way to send mail.  And I've
seen too many cases where the purpose of these meaningless hoops seemed to
be to exclude useful contributions from outsiders merely because they didn't
know the secret handshake.

Keith

---

From: Garrett Wollman <[email-masked]>
Date: Fri, 15 Mar 2002 19:02:17 -0500 (EST)

In article <[email-masked]> you write:

>originating email address in the first place?

My message is arriving in your mailbox, and at this mailing-list's
exploder, with ``the correct originating email address''.

Said address has no discernable mapping to the address of the
mail-to-news gateway which is subscribed to this list on my behalf.

-GAWollman

-- 
Garrett A. Wollman   | O Siem / We are all family / O Siem / We're all the same
[email-masked]  | O Siem / The fires of freedom
Opinions not those of| Dance in the burning flame
MIT, LCS, CRS, or NSA|                     - Susan Aglukark and Chad Irschick