[Mailman-Users] RE: Mailman-Users digest, Vol 1 #169 - 13 msgs

[Ken Manheimer]

On monday, Ray Everett-Church <ray at everett.org> wrote:

> I'm curious... are the anti-spam features (such as restricted posting)
> for this list turned off? I've not had a spammer attack any of my
lists
> yet <wood knock="on">... If they aren't, could I suggest they be
> turned on so we can see if the Kuppler crooks make it through again?

As barry indicated, there's a lot of spam you haven't seen, because it
was caught.

Most is caught by a rule which prohibits holds postings which do not
explicitly mention the name of the list among the destination addresses
for the message.  A smaller portion after that catches postings which do
explicitly mention the list name, among too numerous other destinations.
The kuppler garbage made it through because it used a labor-intensive
sending process which explicitly targets every destination individually
- you may have noticed "<mailman-users at python.org>" as the sole
destination on the offending message.

It may be that such efforts will have "Re: Ad:" or some such on them,
but we can't tell on just one occurrance.  When/if we see one or two
more, we'll be able to infer a pattern, and then tailor one of the
pinpoint filters (per-address prohibition, or subject-line match as you
suggest, or whatever...)  

The not-so-nice thing is that restricting postings to list-members-only
is a rather extreme measure, because it can entail some maintenance
overhead.  Ie, it restricts the list members to posting from one sending
address, and even there the smart-matching is tricky, and can require
maintenance of the posters option.

The nice thing is, the explicit-destination constraint catches a _lot_
of the garbage, and we can handle the smallish remainder in a
proportional way.  It seems (he says, with some satisfaction) to be
working.-)  (I say this quietly because i don't want to "declare war on
spammers" - declaring war is like asking for people to hit you, which
doesn't seem like a smart thing to do.)

ken
klm at digicool.com