Subject: Recent Spam

From: [email-masked]
Date: Tue, 4 Jan 2000 11:55:05 -0500 (EST)

Recently, the level of spam on this mailing list has increased a
lot. I don't know who the operator/owner of this list is, but it
should be quite easy to:

(a) limit postings to this list to subscribers and

(b) ban any repeated spammers like "*www11.heha.net",
    "*ns.secondary.com", "*163.net", "*263.net" and "*cn.com".

I am moderating 2 mailing lists of my own on "onelist.com", and
it is quite easy to do such banning/filtering there. Therefore,
if the "majordomo" software should not be able to do this (I have
not checked it) we might consider switching to another list host.

I am responsible for a major OpenPGP pilot project with currently
ca. 40 cities in Southern Germany which is planned to be expanded
to a lot more cities (for more info [in German language] see
"http://www.redtenbacher.de/signatur/index.htm"). Therefore I
would very much prefer to stay on the OpenPGP mailing list to
ensure that I am always up-to-date on new developments. But I
consider it unacceptable that about 2/3 of all spam which I
receive comes from an IETF mailing list! (Who should fight spam
successfully if even the IETF members can't do it?)

As this list is not a support list for OpenPGP but some sort of
"standards working group", we can easily restrict the posters to
subscribers of the list, and then ban repeated spammers from the
subcriber database.

I am aware that during recent discussion of previous spam on this
list some members have suggested that every member increase their
individual "kill files". However, I cannot consider this to be an
acceptable solution as it violates one of the design principles
of the Internet: "If you can do something in one place, don't
multiply the effort to many places."

Moreover, in Europe many people pay for connection time.
Therefore downloading spam (and thus paying for it) and then
delete it (automatically or after inspection) is not a very
efficient solution.

- Wolfgang Redtenbacher

---------------------------------------------------------------------
Redtenbacher Software                Tel.:   +49 7159 17046
Roemerstr. 11/1                      Fax:    +49 7159 17047
D-71272 Renningen                    e-mail: [email-masked]
---------------------------------------------------------------------

---

From: Paul Hoffman / IMC <[email-masked]>
Date: Tue, 04 Jan 2000 10:04:43 -0800

At 11:55 AM 1/4/00 -0500, [email-masked] wrote:
>lot. I don't know who the operator/owner of this list is,

It's me. I'm listed in the greeting message everyone receives when subscribing.

>  but it

Easy, yes. Proper for an IETF WG, no. Let's look at each proposal.

(a) The IESG has already said that they do not want any posting 
restrictions for WG mailing lists, specifically with this case. As someone 
else has already pointed out, they post from a different address, and 
they'd need to somehow "register" for each address they want to post from. 
Not only is this burdensome for the list admin, it means that if someone 
really needs to post an important note about the protocol but is on the 
road, they could be delayed by many days.

(b) ns.secondary.com is the mailer for this list; restricting it would be 
kinda bad. Restricting by suspected domain names would also possibly 
prevent legit posters.

>not checked it) we might consider switching to another list host.

If the WG chair wants to move the list, that's obviously no problem. I 
suspect, however, that if he moves it and imposes restrictions that are not 
appropriate for WG mailing lists, this would not be a good thing.

>  (Who should fight spam

Blocking spam and fighting spam are quite different. IMC is on the 
forefront of informing people about the technical measures available for both.

>subscribers of the list, and then ban repeated spammers from the

I wish this were the case, but it's not. If you want to take this issue to 
the IESG (yet again), feel free to do so.

--Paul Hoffman, Director
--Internet Mail Consortium

---

From: Will Price <[email-masked]>
Date: Tue, 04 Jan 2000 10:12:44 -0800

How about just doing something simple like changing the list address to
"ietf-openpgp" rather than "ietf-open-pgp".

Solves the problem immediately and introduces no new restrictions.

-- Will

Will Price, Architect/Sr. Mgr., PGP Client Products
Total Network Security Division
Network Associates, Inc.

---

From: Paul Hoffman / IMC <[email-masked]>
Date: Tue, 04 Jan 2000 10:25:24 -0800

>Solves the problem immediately and introduces no new restrictions.

I'd be happy to do this if the WG chair asks. It means him doing a bit of 
work with the IETF Secretariat, but that would be trivial. And I agree, it 
would eliminate the vast majority of the spam. (The address may eventually 
get re-harvested by the spammers, but many IMC-run lists have little or no 
spam on them.)

--Paul Hoffman, Director

---

From: "William H. Geiger III" <[email-masked]>
Date: Tue, 04 Jan 2000 13:11:05 -0600

In <[email-masked]>, on 01/04/00 
   at 01:11 PM, [email-masked] said:

>I am aware that during recent discussion of previous spam on this list
>some members have suggested that every member increase their individual
>"kill files". However, I cannot consider this to be an acceptable
>solution as it violates one of the design principles of the Internet: "If
>you can do something in one place, don't multiply the effort to many
>places."

>Therefore downloading spam (and thus paying for it) and then delete it
>(automatically or after inspection) is not a very efficient
>solution.

This is an *open* list. That means anyone can post here not just
subscribers. We even had David "FUD" Sternlight posting here a while back.
The amount a "spam" is quite lite <10 messages a month. DL times and the
amount of time/effort to hit the delete key is quite insignificant. Not to
mention the amount of time & bandwidth wasted on complaining about "spam"
generally exceeds that of the "spam" being complained about. So called
"solutions" to "spam" generally lead to a more restrictive environment for
all those involved and range from a minor inconvenience for the list
subscribers to the truly draconian.

All in all "spam" is a non-issue and there are really better things in
life to worry about than a few unwanted messages.

-- 
---------------------------------------------------------------
William H. Geiger III                    http://www.openpgp.net  
Geiger Consulting    

Data Security & Cryptology Consulting
Programming, Networking, Analysis
 
PGP for OS/2:                   http://www.openpgp.net/pgp.html
---------------------------------------------------------------

---

From: Tom Rushworth <[email-masked]>
Date: Tue, 4 Jan 2000 20:24:43 -0800

> subscribers. We even had David "FUD" Sternlight posting here a while back.

I agree with the general idea of "open", but I think there is a difference
between "wide open" and "open for anyone to discuss OpenPGP".  Do ads for
coolgirl this or 1,000,000 address that contribute to the discussion?  I
wish there were either an easy technical way to to spot the complete junk,
or an unbiased, well connected person who has nothing better to do with
his time but filter out the junk.  Since I don't know of either, I think
some discussion of alternatives is appropriate.

Suggestions I've seen (or even made) so far are:

(1) blocking certain addresses
(2) restricting posters to subscriber addresses (or some such)
(3) changing the list name to temporarily dodge the spam.

Both (1) and (2) would seem to fall into the "draconian" group, and (3) is only
temporary.

What about (4) requiring each posting to have a PGP signature, or
(5) requiring the message body to contain the phrase "OpenPGP"?
Either could be implemented in a way that didn't require human supervision,
and given the subject material of the list, should not be too onerous to
potential posters.  (I'm not suggesting that the signatures be verifiable,
simply that they be syntactically correct.  This would still let someone
who did not have a pgp key on a server send a message to the list.)

> The amount a "spam" is quite lite <10 messages a month. DL times and the

I had decided to count for a month or so before I opened my mouth again,
but the numbers you give don't come near matching even my partial results.
I've been saving all messages since December 12th in either pgp-junk or
pgp-real.  What follows are the sizes and message counts, not counting today's
messages.

$ ls -l pgp-*
-rw-------  1 tbr  user  347888 Jan  4 19:19 pgp-junk
-rw-------  1 tbr  user   32015 Jan  4 19:24 pgp-real
$ grep '^From imc.org!' pgp-junk | wc -l
      49 
$ grep '^From imc.org!' pgp-real | wc -l 
       9 

> generally exceeds that of the "spam" being complained about. So called

Not if you measure it.  Perhaps in annoyance value if the discussion gets
under your skin :).

> subscribers to the truly draconian.

True enough, but I find the 5 to 1 ratio in messages an inconvience, and,
since I pay by the minute for downloads I find the 10 to 1 ratio in bytes
a real irritation.  Yes, I know the absolute cost is small, and I should
just accept it, like shopkeepers must accept shoplifting as part of the
cost of doing business.  I don't know many shopkeepers who do absolutely
nothing about their problem though.

> life to worry about than a few unwanted messages.

Sorta true, but the problem isn't quite as much of a non-issue for everyone,
and my impression is that the spam level is going up.  (I'll need a longer
time-line before that's more than an impression.)

If it is going up, this list could get drowned in the noise.  Given that
cryptographic signatures might someday provide a way to seriously curtail
spam, it's a bit ironic that this list should be plagued by it.

-- 
Tom Rushworth

---

From: Werner Koch <[email-masked]>
Date: Wed, 5 Jan 2000 09:34:54 +0100

On Tue, Jan 04, 2000 at 08:24:43PM -0800

> (3) changing the list name to temporarily dodge the spam.

(4) Do only allow RFC822 compliant messages.

I have noticed that most of these junk mails (frankly I don't know
whether it is really junk as I am not able to read chinese(?)) are not
RC822 compliant.  In most cases the mail headers do contain characters
with bit 7 set - which is never allowed in the headers.  

So a simple filter which looks for more than 2 or 3 bad characters in
the header lines (From, To, Subject) should be able to kick out 90%
percent of those mails.  The problem does not exist for this ML only:
Nearly all the junk mail I receive is of that kind.

It should be possible to hack procmail or Majordomo to do just this; 
an option for sendmail,exim,qmail,postfix would even be better.

-- 
Werner Koch at guug.de           www.gnupg.org           keyid 621CC013
  
     Boycott Amazon!  -  http://www.gnu.org/philosophy/amazon.html

---

From: "Damon W Edmondson" <[email-masked]>
Date: Wed, 5 Jan 2000 08:09:46 -0500

I guess I just want to know how to get of the mail list. I get 4 of these a
day. I don't normally get spam, and in case some of you folks don't realize
it, these emails contain macros and .dll files that try to execute on your
system.

These are almost virus like in their behavior....and I want nothing to do
with it.

So, if anyone knows how to unsubscribe, a repost of those instructions to
the group would be nice.
-----Original Message-----
From: [email-masked] [mailto:[email-masked]]On
Behalf Of Werner Koch
Sent: Wednesday, January 05, 2000 3:35 AM
To: [email-masked]
Subject: Re: Recent Spam

---

From: James M Galvin <[email-masked]>
Date: Wed, 05 Jan 2000 08:38:41 -0500

"William H. Geiger III" <[email-masked]> said:

The problem is it's not a few unwanted messages.  In the context of this
elist, maybe it's only "a few".  But I subscribe to many elists and it's
never just a few.  Besides, it's already been shown this elist has
gotten more than few.

It is possible to deal with spam at choke points, for example where the
elist is expanded.  I know because I'm a service provider and I do it
for a living.  However, I also know it's not as easy as any of the
suggestions offered here.

All the elist management applications I know have very limited
capabilities for dealing with spam.  Worse, if you're a site like
IMC.ORG that manages many elists, the applications are even less
effective at providing per elist "knobs".

In my experience the single best thing you can do to prevent spam is
restrict submissions to be from subscribers only.  But to do this you
need to moderate the submissions that bounce.  Few people have time for
this, and as Paul Hoffman pointed out, it is required for IETF elists.

It is possible to write/programs to manage the moderation, but let me
just say that I've thousands of lines of perl code to do this, and a
specialized channel for my mail system.  And I still have to do 5-15% by
hand, mostly because false positives are unacceptable.

My point is the problem is endemic to email, not any particular elist.
It's always possible to solve the problem with a reasonable set of
resources for one elist.  It's very hard to do in general.  Paul, the
manager of this elist, has the general problem.

Jim
--
James M. Galvin                                  <[email-masked]>

To the optimist, the glass is half full.  To the pessimist, the glass is
half empty.  To the engineer, the glass is twice as big as it needs to be.

Subject: Re: Recent Spam
From: "William H. Geiger III" <[email-masked]>
To: [email-masked]
Cc: [email-masked]
Date: Tue, 04 Jan 2000 13:11:05 -0600
List-Id: <ietf-open-pgp.imc.org>

---

From: Paul Koning <[email-masked]>
Date: Wed, 5 Jan 2000 10:52:09 -0500

>>>>> "Werner" == Werner Koch <[email-masked]> writes:

 Werner> On Tue, Jan 04, 2000 at 08:24:43PM -0800 Tom Rushworth wrote:

 >> (1) blocking certain addresses (2) restricting posters to
 >> subscriber addresses (or some such) (3) changing the list name to
 >> temporarily dodge the spam.

 Werner> (4) Do only allow RFC822 compliant messages.

 Werner> I have noticed that most of these junk mails (frankly I don't
 Werner> know whether it is really junk as I am not able to read
 Werner> chinese(?)) are not RC822 compliant.  In most cases the mail
 Werner> headers do contain characters with bit 7 set - which is never
 Werner> allowed in the headers.

It isn't?  Weird.  That seems like a spec bug that's bound to get
fixed at some point, because of course it's an english-only
restriction that we aren't supposed to have anymore.  And perhaps my
memory is flaky, but I would have sworn that I've seen legit mail from 
Europe with Latin-1 characters in the headers.

	paul

---

From: Werner Koch <[email-masked]>
Date: Wed, 5 Jan 2000 19:40:34 +0100

> Europe with Latin-1 characters in the headers.

Something like this:

  From: =?ISO-8859-1?Q?Olle_J=E4rnefors?= <[email-masked]>

A modern MUA will display it more comfortable.  RFC2047 defines this
and still keeps RFC822 valid.

---

From: Michael Elkins <[email-masked]>
Date: Wed, 5 Jan 2000 10:51:22 -0800

On Wed, Jan 05, 2000 at 10:52:09AM -0500, Paul Koning wrote:
[8-bit in message header fields is not allowed by RFC822]
> Europe with Latin-1 characters in the headers.

I doubt this will change since you can't tell what character set the 8-bit
characters belong to.  The only way to pass that information is to use the
proper MIME encoding to translate everything to 7-bit.  This is not a question
of being US-centric.

me

---

From: [email-masked] (Lutz Donnerhacke)
Date: 7 Jan 2000 16:40:14 GMT

>(a) limit postings to this list to subscribers and

No. I would not be able to send messages.