Subject: IETF announce list and spam filtering

From: "Theodore Ts'o" <[email-masked]>
Date: Wed, 14 Aug 2002 09:38:20 -0400

The recent discussion about SPAM and it being a problem reminds of
something that I've been meaning to mention.  Currently, mail sent to
the IETF announce mailing list has the following To: header:

To: ;@IETF-Announce

This is worth 1.1 points of "Spam nature" (sort of like Buddha nature,
only completely different :-), according to SpamAssassin:

SPAM: TO_MALFORMED       (1.1 points)  To: has a malformed address

It would be really nice if the To: field could be adjusted so it looked
something like this:

To: [email-masked]

						- Ted

---

From: Pekka Savola <[email-masked]>
Date: Wed, 14 Aug 2002 16:55:13 +0300 (EEST)

> To: [email-masked]

So people know what address to use when they want to spam the whole IETF 
(just forge From: to be [email-masked] or whatever, a couple of tries and 
you're in.)?

Not that it seems such a big secret now either..

-- 
Pekka Savola                 "Tell me of difficulties surmounted,
Netcore Oy                   not those you stumble over and fall"
Systems. Networks. Security.  -- Robert Jordan: A Crown of Swords

---

From: "Theodore Ts'o" <[email-masked]>
Date: Wed, 14 Aug 2002 10:12:04 -0400

> Not that it seems such a big secret now either..

Err, no.  That's not how SpamAssassin works.  It works based on
looking at characteristics of mail messages, to see if they "look"
like Spam.  It's what many of us do automatically.  For example if
there is a HTML only body, and no text, I'm very likely to hit the 'D'
key and go on, unless there's some very good reason why I think it
might not be spam.  Similarly, if the character set is Korean or
Chinese or Japanese, I will also assume that it is spam, and likely
hit the 'd' key very quickly.

SpamAssassin merely automates this.  What I was suggesting was that
there are ways in which mail sent to the IETF Announce mailing list
"looks" like spam.  By making it look less like spam, it makes it
easier for spam filtering tools to work.

This is not a big deal; I can put in an explicit rule which whitelists
the IETF announce list.  But it's better if I don't have to do that,
since then the whitelist gives the spammers something they can
imitate, per your criticism above.  (Not that IETF'ers represent a big
enough market that spammers would be likely to try to hit us, in any
case.)

						- Ted

---

From: Keith Moore <[email-masked]>
Date: Wed, 14 Aug 2002 11:19:20 -0400

> the IETF announce mailing list has the following To: header:

actually, it's:

To:      IETF-Announce:;

which is perfectly valid.
maybe your site has mailer bug which is munging the address?

> only completely different :-), according to SpamAssassin:

this is only one example of a large number of problems with SpamAssassin.

please explain why IETF should follow the dictates of SpamAssissin rather 
than its own mail specifications ?

Keith

---

From: Russ Allbery <[email-masked]>
Date: Wed, 14 Aug 2002 09:19:58 -0700

Pekka Savola <[email-masked]> writes:

> (just forge From: to be [email-masked] or whatever, a couple of tries
> and you're in.)?

One would hope that the list has better security than that for posting,
given that Majordomo could manage to defeat that sort of attack ten years
ago.

-- 
Russ Allbery ([email-masked])             <http://www.eyrie.org/~eagle/>

---

From: Dave Crocker <[email-masked]>
Date: Wed, 14 Aug 2002 09:21:21 -0700

>the IETF announce mailing list has the following To: header:

The header that I am seeing is:

         To: IETF-Announce: ;

Formally, that's a valid string in RFC822, no matter how obscure the 
construct has become.  It's the <group> construct.

Perhaps surprisingly, it was not deprecated in RFC2822.

And SpamAssassin marks a To line with only a comment as malformed.  So it 
considers:

         To:  (topic)

to be invalid.  It was valid in RFC822 but is not valid in RFC2822.

d/

----------
Dave Crocker <mailto:[email-masked]>
TribalWise, Inc. <http://www.tribalwise.com>
tel +1.408.246.8253; fax +1.408.850.1850

---

From: Dave Crocker <[email-masked]>
Date: Wed, 14 Aug 2002 09:26:03 -0700

>this is only one example of a large number of problems with SpamAssassin.

it is a problem with the configuration of spamassassin, not with the 
software and not with the basic paradigm of rule-based filtering.  it is 
simply a matter of tuning the ruleset better.

d/

----------

---

From: Keith Moore <[email-masked]>
Date: Wed, 14 Aug 2002 12:34:57 -0400

> simply a matter of tuning the ruleset better.

true, much of the problem is with the default rulesets.  they might
correleate well to observed spam but that doesn't mean they are good
predictors of spam.

a more general problem is the notion of applying rule-based filtering
on behalf of recipients who don't either understand or choose the rules.
rules can implement recipient preferences, but it's simply not true 
that you can reliably determine whether something is spam by looking at 
it, no matter how "well-tuned" the rules are.

Keith