Re: [h-e-w] Spam?

[David Vanderschel]

On Thursday, June 06, "Peter Davis" <address@hidden> wrote:
>This is at least the third time I've seen a blatent spam message go out to
>this list in the last few weeks.  Are there any defensive measures we can
>take?  Can non-members post to the list?  Can people join the list without
>valid e-mail addresses?

At present the list is configured to accept posting
from anyone.  As an administrator of the list, I can
configure the list to refuse messages unless they come
from a subscribed address.  Regarding this very issue,
I checked with address@hidden (Mark Weaver)
about a month ago, and I received the appended reply.
Basically, it is discouraged for GNU lists.  However,
a list which plays in the Windows environment may
constitute a special case in the GNU world; so I'd be
willing to consider some debate on this topic.  To
this end, I created a poll at YahooGroups for this
issue.  To vote, go to

   http://groups.yahoo.com/group/ntemacs-users/polls

The poll closes June 20.

The simplified version of the question would be
"Should we change?".  Personally, I voted "No" because
of tradition and because I think it would
inconvenience some folks who occasionally post from an
address different from that at which they receive.
The SPAM will have to get worse than it has been for
me to get too worried about it.  Another argument
against it is that this list can be read on the Web at
YahooGroups (where the 'group' is called
"ntemacs-users"); and, thus, it makes sense to post
without actually being subscribed at gnu.org.
(Actually, you can even get digests emailed from
YahooGroups.) 

I will be interested to see what other folks think,
and I will post the results of the poll in two weeks.
If there is overwhelming support to restrict posters
to subscribers, I think we can change it.

I suspect that the comprehensive solution to which
Mark refers at the end of his message is not in place
yet.  When that is working, this whole question may
become moot.

Regards,
  David V.


----- Original Message ----- 
From: "Mark H. Weaver" <address@hidden>
To: <address@hidden>
Cc: <address@hidden>
Sent: Monday, May 06, 2002 12:35 AM
Subject: Re: SPAM problem


"help-emacs-windows-admin" <address@hidden> wrote:

> Take a look at the attached message posted to help-emacs-windows.
> Its headers include the following:

>     X-RBL-Warning: (relays.ordb.org) Your server is an open relay - see
> <http://ORDB.org/lookup/?host=195.96.146.75>

> What server appended that?  I am inclined to think that it was the
> gnu.org one.

That is correct.

> But if it knows that, why did this message get posted directly (as opposed to
> going in the queue for administrator approval).  If it is not the gnu server,
> then could not the mailman list server be configured to pay attention to such 
> a
> header?

We at GNU do not wish to block messages based on centralized
blacklists, because such centralized power could be abused.
Therefore, we merely add a header which individual users can filter
on if they wish.

> This sort of abuse could be limited somewhat by configuring the list so that
> only subscribers may post.  That would probably inconvenience a number of
> current subscribers who may occasionally post from an address different from
> that at which they receive, but it may be preferable to the SPAM attacks.  Are
> any of the gnu lists configured to allow posting only by
> subscribers?

Some of them may currently be, but we discourage this for most lists.

I realize that SPAM is a serious problem, and a number of folks have
recently started implementing a comprehensive SPAM filtering system.
Basically, it'll consult spamassassin -- if that tags it as spam, then
a confirmation request will be sent to the return path.  If they
reply, they'll be whitelisted and their messages henceforth passed.

We hope to have this system up and running within four weeks, so
please bear with us for a little while longer.

        Mark