[gentoo-laptop] Listadmin speaks - Was: Re: Re: WHY

[Robin H. Johnson]

Dude,

Lay off the emo angst.

The only "solution" to being completely spam-free is going to moderation on
every list, which is a huge burden, and I've got enough other stuff to do.

I succinctly laid out the real problem on the mlmmj mailing list some months
ago, and also discovered at the time that it effects nearly every other mailing
list program.

Simply put, the spammer finds some auto-responder that ignores the 'Precedence:
Bulk' header and replies anyway, and forges mail from that address, to the
subscribe address. The auto-responder confirms itself and is then subscribed.

Now for pass two, the spammer forges a message from the auto-responder to the
list itself. The spam is now accepted to the list.

Normally, that would be the end of it, one forge, one spam, however there is a
worse case.

The Nero auto-responder was the most extreme example, because unlike most
auto-responders, it did NOT have any rate-limiter or loop detection. Thus after
a single forged mail, the auto-responder saw it's own messages, and replied to
them AGAIN. Our Gentoo systems can usually catch this as we have our own loop
detection, however the Nero auto-responder stripped those headers so it wasn't
detected until somebody reported the problem to me as the listadmin.

If you see a spam that has slipped through (and it's not a lot, I count 5 spams
for gentoo-laptop in the last 30 days), I highly encourage you to send me an
email, NOT containing the message itself, but containing a link to the spam in
archives.gentoo.org (or any other web archive). Do not send the spam itself, as
it will be caught by my own filters (I get thousands of spams a day to
postmaster@g.o).

-- 
Robin Hugh Johnson
Gentoo Linux Developer & Infra Guy
E-Mail     : robbat2@g.o
GnuPG FP   : 11AC BA4F 4778 E3F6 E4ED  F38E B27B 944E 3488 4E85