I know this is offtopic, but the spam problem is getting worse, could the linux-kernel mail guy/gal, do something, the nigerian scams are actually dangerous..
From: <[email protected]>
Date: Mon, 12 Aug 2002 02:44:14 +0100
I know this is offtopic, but the spam problem is getting worse,
could the linux-kernel mail guy/gal, do something, the nigerian
scams are actually dangerous.
They never make it to the lists, if they are sending these
spams to you privately that is your problem to resolve :-)
Look we simply cannot control what web site archives of these
lists choose to do with the sender's email address. If you
post here, you will almost certainly get on a spam list.
There is zero we as postmasters can do about this.
David S. Miller wrote:
> They never make it to the lists, if they are sending these
Incorrect - they frequently make it to the list, I have the headers to
prove it.
Unfortunately, unless the LKML maintainers wish to either filter the
list against Spamcop|Spamhaus|MAPS, or unless they are willing to
require non-registered individuals to confirm an email (i.e.
non-registered individual sends a mail, LKML sends a "you aren't
registered, so please reply to this email to confirm you aren't a
spammer" message), there is little they can do about it.
From: "David D. Hagood" <[email protected]>
Date: Sun, 11 Aug 2002 21:22:45 -0500
David S. Miller wrote:
> They never make it to the lists, if they are sending these
Incorrect - they frequently make it to the list, I have the headers to
prove it.
And within 24 to 48 hours we add a filter for it.
That is how it has always worked and this is how it
will continue to work.
David S. Miller wrote:
> And within 24 to 48 hours we add a filter for it.
> That is how it has always worked and this is how it
> will continue to work.
Peace, sir - I was not criticising the way the list is run. However, you
stated "they never make it to the list" and implied the spam problem was
within the email account of the poster, which you just admitted was
incorrect.
I *wasn't* suggesting the list be filtered more aggressively - I was
saying that removing the spam from the list would require more
aggressive (read: more prone to false positives) filtering. The cure
would in many ways be worse than the disease (at least at it's current
level).
Unfortunately, until they make a legal hunting season for spammers, we
must all simply put up with it. I suggest forwarding all the spams over
to Spamcop to attempt to shut the spammers down (just make sure you ding
the spammer's servers and not LMKL's!)
From: [email protected]
Date: Mon, 12 Aug 2002 04:04:10 +0100
They are dangerous, they have gotten people KILLED.
If people actually reply to and act upon those "here is how to make
168 million dollars please help me in Nigeria!" emails, frankly that's
Darwin at work.
If you want to talk about this further, please don't do it here.
YES THEY ARE SENT TO THE LIST, WOULD YOU LIKE COPIES? T hey are dangerous, they have gotten people KILLED.
On Sun, 11 Aug 2002 18:36:21 -0700 (PDT) "David S. Miller" <[email protected]> wrote:
[email protected] wrote:
> YES THEY ARE SENT TO THE LIST, WOULD YOU LIKE COPIES? T hey are dangerous, they have gotten people KILLED.
I would suggest that anyone stupid enough to respond to a Nigerian spam
(or any spam, for that matter) sent to a mailing list like LKML
1) Shouldn't be reading LKML
2) Should make an appointment at the local family planning clinic.
3) If they have already reproduced, they should take their kids along.
I am as ardent an anti-spam warrior as the next guy, but let us not
waste bandwidth on LKML over this - forward the spams to Spamcop and
move on. The risk of blocking a legitimate email relative the (actually
quite small) number of spams the list receives is considered unwarrented
by the folks who run the list, and personally I agree with them - the
number of spams the list receives is pretty small, all things considered.
If you feel so strongly about it, rather than writing LKML, why not
write your (Congressdrones|MP...) and try to get some truely effective
antispam legislation passed (gak! saying that leaves a bad taste in my
basically libertarian mouth).
Once again, until we can hunt spammers like the vermin they are, this is
part of the unfortunate state of affairs - shouting about it won't help.
On Sun, 11 Aug 2002, David D. Hagood wrote:
> Unfortunately, until they make a legal hunting season for spammers, we
> must all simply put up with it. I suggest forwarding all the spams over
> to Spamcop to attempt to shut the spammers down (just make sure you ding
> the spammer's servers and not LMKL's!)
OK, a few links and addresses for the people who are
interested in fighting the spam they see:
419/Nigeria scams should be forwarded (with complete headers) to
the US secret service, who are very interested because these scams
have indeed gotten people killed:
United States Secret Service <[email protected]>
Stock pump&dump scams are often very effectively handled by
sending them to:
[email protected]
What might also help for these is sending the spam to the
legal staff of the company, in addition to the SEC address.
Reminding the legal staff of the fact that the SEC might
suspend trading in their stock for a few days often gets
them moving against the spammer fairly quickly ;)
If you live in Washington state (and some other states too,
I believe) hunting season for spammers is literally open all
year. I think you can get up to $500/spam in Washington state:
http://www.suespammers.org/
Now, please stop bothering Matti and DaveM about it and
take action yourself ;)
cheers,
Rik
--
Bravely reimplemented by the knights who say "NIH".
http://www.surriel.com/ http://distro.conectiva.com/
The Nigerian stuff is a scam to take your money from the bank account you
give them and for them to steal your identity. NEVER EVER give someone your
personal information over the internet or phone.
I want to suggest to the listserver admin (again) that this list and others
on vger.kernel.org be restricted so that you can only post to the list if
you are a member. Anyone can read it, but you have to sign up to post to
the list. At least then, the spammers/scammers have to go thru an extra
step that can have their mail server blocked from posting on this list. I'm
getting damn tired of getting 50-75 spams per day in my inbox and I don't
even use my email address on websites to post.
----- Original Message -----
From: <[email protected]>
To: <[email protected]>
Sent: Sunday, August 11, 2002 8:44 PM
Subject: The spam problem.
> I know this is offtopic, but the spam problem is getting worse, could the
linux-kernel mail guy/gal, do something, the nigerian scams are actually
dangerous..
>
>
> -
> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> the body of a message to [email protected]
> More majordomo info at http://vger.kernel.org/majordomo-info.html
> Please read the FAQ at http://www.tux.org/lkml/
>
Why would this kill bug reports?
----- Original Message -----
From: "Mike Galbraith" <[email protected]>
To: "Jim Roland" <[email protected]>
Sent: Sunday, August 11, 2002 11:44 PM
Subject: Re: The spam problem.
> At 11:41 PM 8/11/2002 -0500, you wrote:
>
> >I want to suggest to the listserver admin (again) that this list and
others
> >on vger.kernel.org be restricted so that you can only post to the list if
> >you are a member.
>
> That would kill too many valuable bug reports. This (bad idea) has been
> suggested and rejected several times in the past.
>
> -Mike
>
>
>
>
>
>
On Sun, 11 Aug 2002, Jim Roland wrote:
> I want to suggest to the listserver admin (again) that this list and
> others on vger.kernel.org be restricted so that you can only post to the
> list if you are a member.
That's a sure way to cut down on the number of bug reports ;)
Not to mention that it makes cross-posts between various lists
pretty much impossible.
Also, considering the amount of spam I've received "from myself"
and "from" linux-kernel regulars it's pretty obvious that restricting
the posting to list members just isn't going to work any more to
prevent spam. It might still work for the next few months, but
the trend of spammers harvesting from/to address _pairs_ to get
around people's spam filters is definately getting explosively
more popular...
regards,
Rik
--
Bravely reimplemented by the knights who say "NIH".
http://www.surriel.com/ http://distro.conectiva.com/
cause there would be many non-members who wanna post bugs but can't because
they dont have access maybe?
I suggest too block every email adres wich sends crap, easy done.
Niek van alphen
[email protected]
----- Original Message -----
From: "Jim Roland" <[email protected]>
To: "Mike Galbraith" <[email protected]>
Cc: <[email protected]>
Sent: Monday, August 12, 2002 6:48 AM
Subject: Re: The spam problem.
> Why would this kill bug reports?
>
>
>
> ----- Original Message -----
> From: "Mike Galbraith" <[email protected]>
> To: "Jim Roland" <[email protected]>
> Sent: Sunday, August 11, 2002 11:44 PM
> Subject: Re: The spam problem.
>
>
> > At 11:41 PM 8/11/2002 -0500, you wrote:
> >
> > >I want to suggest to the listserver admin (again) that this list and
> others
> > >on vger.kernel.org be restricted so that you can only post to the list
if
> > >you are a member.
> >
> > That would kill too many valuable bug reports. This (bad idea) has been
> > suggested and rejected several times in the past.
> >
> > -Mike
> >
> >
> >
> >
> >
> >
>
> -
> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> the body of a message to [email protected]
> More majordomo info at http://vger.kernel.org/majordomo-info.html
> Please read the FAQ at http://www.tux.org/lkml/
>
what about just asking them to confirm that would cut out mass spam
On Mon, 12 Aug 2002 01:50:12 -0300 (BRT) Rik van Riel <[email protected]> wrote:
Now there's a good thought! Post, Confirm, gets posted. If member, no
confirmation necessary.
----- Original Message -----
From: <[email protected]>
To: <[email protected]>; <[email protected]>;
<[email protected]>
Sent: Monday, August 12, 2002 12:01 AM
Subject: RE:Re: The spam problem.
> what about just asking them to confirm that would cut out mass spam
>
>
>
> On Mon, 12 Aug 2002 01:50:12 -0300 (BRT) Rik van Riel
<[email protected]> wrote:
>
From: "Jim Roland" <[email protected]>
Date: Sun, 11 Aug 2002 23:41:52 -0500
I want to suggest to the listserver admin (again) that this list and others
on vger.kernel.org be restricted so that you can only post to the list if
you are a member.
Absolutely not and this has been discussed a thousand times
and nothing has changes wrt. the reasons we have for making
this decision.
From: "Jim Roland" <[email protected]>
Date: Sun, 11 Aug 2002 23:48:30 -0500
Why would this kill bug reports?
Because people who aren't subscribed couldn't then
send OOPS reports here. Lots of people do this and
it's invaluable data.
On Mon, 12 Aug 2002 00:15:53 -0500, Jim Roland wrote:
>Now there's a good thought! Post, Confirm, gets posted. If member, no
>confirmation necessary.
You could also put them in a manual hold queue. Give a large number of
people ability to approve posts from that queue so latency would be
reasonable.
The problem with confirmation is that a person might fire off a bug report
where they happen to be, via something like
dmesg > foo
joe foo
cat foo + mail -s "Bug report blah blah" [email protected]
A confirmation sent to the source address of that might not be noticed until
the next time they happen to log into that account on that machine.
You could do both, I guess. A hold queue that can be manually processed with
confirmation posting the message and removing it from the hold queue.
DS
Nobody has mentioned the fact that spammers can forge the
From: field just like anyone else can.
If you enforce that the first sender at the Received: headers
have to match the From: or some rule like that, then I could
not post to these lists for example.
This is why enforcing that subscribers only can post to the lists is
totally unacceptablt. It doesn't stop spam, it's merely a deterrant
and it serves mostly to piss off legitimate users of these lists.
Good morning,
Please refrain from fights on email issues while I am asleep..
DaveM is in California, I am in Finland. About 9-10 hours
time difference there. (depending on our personal rythms, also.)
On Mon, Aug 12, 2002 at 07:00:46AM +0200, Dhr N. Van Alphen wrote:
> cause there would be many non-members who wanna post bugs but can't because
> they dont have access maybe?
>
> I suggest too block every email adres wich sends crap, easy done.
Consider:
- Number of faked source addresses
- Number of cases using somebody's address
- Number of throw-away addresses
- How many times they use HOTMAIL/YAHOO/EMAIL/MAIL/... addresses ?
I think I will stick to the (weakish) method of matching texts in
message body (and sometimes on headers)..
I just reviewed Majordomo's BOUNCE log. It is bouncing (into oblivion)
practically every posting from HOTMAIL (because of Received: header
text: "from mail pickup service", which appears also in a number of
looped messages..)
Over past 3 days Majordomo has trapped ONE of those money-scam
letters. A lot more of various other spams have been blocked.
Messages with HTML content don't make it into VGER at all, which
should give a very big clue to legitimate posters making a mistake
of posting such.
I am very worried of trapping too much. A bit of leakage is (to me)
accptable, but similar amounts of falsely trapped ones I don't like.
I also receive so much spam directly, that I don't always detect every
instance when it is leaking thru VGER's lists. If you want to raise
the attention of VGERs postmasters, I suggest you forward it to:
[email protected]
with subject: "leaked spam"
Also, in case of non-english spam, I would like to receive suggestions
for PERL RE patterns matching juicy keywords in the messages.
(To me Chinese or Russian texts are just line noise...)
> Niek van alphen
> [email protected]
/Matti Aarnio
Hello !
On Sun, Aug 11, 2002 at 11:41:52PM -0500, Jim Roland wrote:
> I'm getting damn tired of getting 50-75 spams per day in my inbox and I
> don't even use my email address on websites to post.
I don't receive 50 spams/day from lkml, and I have no filter. So some of the
ones you receive may be addressed to you directly. BTW, nothing prevents you
to filter the mails you receive from LKML to reduce the (IMHO) very little
number of spams that get through. And if you're still so much bothered about
the remaining ones, you still have the choice to unsubscribe and read them
from marc.theaimsgroup.com or other archives.
I personaly am quite happy about Matti and DaveM's work on the list, because
I receive far less spam from LKML than on my personal accounts. Moreover, spams
in the list are easily identifiable by their off-topic subjects, so most of the
time, you don't even have to read them. So I'd prefer to keep this list open
and get most bug reports than closing it, still receiving some spams and not
getting bug reports. Nobody should fall to self-DoS because of spam.
Regards,
Willy
On Mon, 12 Aug 2002 [email protected] wrote:
> I know this is offtopic, but the spam problem is getting worse,
> could the linux-kernel mail guy/gal, do something,
> the nigerian scams are actually dangerous..
> ^^^^^^^^^^^
Really? That's how I made my first 32-million dollars. Some poor
lady need my back account information so she could wire her dead
husband's money. Works everytime.
Cheers,
Dick Johnson
Penguin : Linux version 2.4.18 on an i686 machine (797.90 BogoMips).
The US military has given us many words, FUBAR, SNAFU, now ENRON.
Yes, top management were graduates of West Point and Annapolis.
On Mon, 12 Aug 2002, David S. Miller wrote:
> Nobody has mentioned the fact that spammers can forge the
> From: field just like anyone else can.
It's already happening. You have no idea how much spam I've
received "from" Ingo Molnar, Bill Davidsen, Stephen Tweedie
and you ...
You probably also have no idea from which countries the spam
with you in the From: address has been sent ;)
Recently an anti-spam mailinglist (with members-only posting)
got flooded by a spammer who wanted to take revenge for his
N-th cancelled account. Of course he used From: headers with
the addresses of many of the list regulars.
cheers,
Rik
--
Bravely reimplemented by the knights who say "NIH".
http://www.surriel.com/ http://distro.conectiva.com/
Hi,
On Mon, 12 Aug 2002, David S. Miller wrote:
> If you enforce that the first sender at the Received: headers
> have to match the From: or some rule like that, then I could
> not post to these lists for example.
This is quite a bad idea.
If we go after the hostname, things like Puretec or our Hawkeye will be
shot. Imagine the domain ngforever.de. It's hosted on kundenserver.de, and
the smtp host is smtp.kundenserver.de. How can we guess?!
If we go after MX entries, most people will be shot. T-Online, Yahoo,
Netscape... all have different smarthosts for users and incoming mail.
T-Online, for example, has mailin00 through mailin07.sul.t-online.de for
the incoming messages, while users use fwd00 through
fwd07.sul.t-online.com in order to send mail.
We'll break things either way. I send mail via hawkeye.lightweight.adm
(not an internet address, but the realname, and yes, it's a large
network.) for the domain lightweight.ods.org, where's the connection? In
order to find out that hawkeye.lightweight.adm is the mail host of
lightweight.ods.org you'll have to ask a domain server on our side.
However, Hawkeye signs things with his realname.
Thunder
--
--./../...-/. -.--/---/..-/.-./..././.-../..-. .---/..-/.../- .-
--/../-./..-/-/./--..-- ../.----./.-../.-.. --./../...-/. -.--/---/..-
.- -/---/--/---/.-./.-./---/.--/.-.-.-
--./.-/-.../.-./.././.-../.-.-.-
>>>>> "Jim" == Jim Roland <[email protected]> writes:
Jim> Now there's a good thought! Post, Confirm, gets posted. If
Jim> member, no confirmation necessary.
It'd be impractical because you'd need to merge not only the people
directly on the list as members, but also the people who get LKML as
digest via Dell, as news, or via a mail exploder.
Peter C
> directly on the list as members, but also the people who get LKML as
> digest via Dell, as news, or via a mail exploder.
The digests on lists.us.dell.com are run through SpamAssassin upon receipt
from vger. It's caught an amazingly small number of spams (2 this month) -
thanks to Matti and DaveM's efforts.
Thanks,
Matt
--
Matt Domsch
Sr. Software Engineer, Lead Engineer, Architect
Dell Linux Solutions http://www.dell.com/linux
Linux on Dell mailing lists @ http://lists.us.dell.com
#1 US Linux Server provider for 2001 and Q1/2002! (IDC May 2002)
On Mon, 12 Aug 2002 [email protected] wrote:
> YES THEY ARE SENT TO THE LIST, WOULD YOU LIKE COPIES? T hey are
> dangerous, they have gotten people KILLED.
Oh? Do you mean they will come and get you if you don't take their money,
or that someone has found a way to be removed from their mailing list?
--
bill davidsen <[email protected]>
CTO, TMR Associates, Inc
Doing interesting things with little computers since 1979.
At 04:09 PM 8/12/2002 -0500, [email protected] wrote:
> > directly on the list as members, but also the people who get LKML as
> > digest via Dell, as news, or via a mail exploder.
>
>The digests on lists.us.dell.com are run through SpamAssassin upon receipt
>from vger. It's caught an amazingly small number of spams (2 this month) -
>thanks to Matti and DaveM's efforts.
It would be interesting to see a count of spam posts vs posts talking about
spam
over the last couple years. Even more interesting would be to see the spam
count
compared to what was blocked. I bet we'd all be impressed :)))
-Mike
(cutting down the recipient list..)
On Mon, Aug 12, 2002 at 04:09:17PM -0500, [email protected] wrote:
> > directly on the list as members, but also the people who get LKML as
> > digest via Dell, as news, or via a mail exploder.
>
> The digests on lists.us.dell.com are run through SpamAssassin upon receipt
> from vger. It's caught an amazingly small number of spams (2 this month) -
> thanks to Matti and DaveM's efforts.
Quite so. We don't aim for 100% blocking, we can tolerate a few
leaking thru each month. A few each day would be too much.
I have been monitoring what our filters do catch; sometimes
there are things I prefer not to be captured, which means we
have to fine-tune the filters a bit.. I am also sometimes
(rarely) sending a note to the message originators that their
traffic is being captured.
Lately I have been hammering problems with HOTMAIL - which
internally uses some software telling "from mail pickup service"
(or something like that), which appears also in a number of
LOOPED messages. I have now removed that loop-signature
from being blocked, but I am worried...
> Thanks,
> Matt
> --
> Matt Domsch
/Matti Aarnio
In article <[email protected]>,
Matti Aarnio <[email protected]> wrote:
| Quite so. We don't aim for 100% blocking, we can tolerate a few
| leaking thru each month. A few each day would be too much.
|
| I have been monitoring what our filters do catch; sometimes
| there are things I prefer not to be captured, which means we
| have to fine-tune the filters a bit.. I am also sometimes
| (rarely) sending a note to the message originators that their
| traffic is being captured.
If you have a human to do a little of the work, you can build filters to
do a three category triage; pass, fail, and human review. This allows
the filters to be be MUCH tighter, but assumes 7*24 moderation of some
sort.
Not a recommendation, just a thought. I have this set up on lists and
posting hosts, and it works reasonably well, taking about five minutes a
few times a day on the weekend.
--
bill davidsen <[email protected]>
CTO, TMR Associates, Inc
Doing interesting things with little computers since 1979.
On Mon, Aug 12, 2002 at 10:50:35AM -0300, Rik van Riel wrote:
> It's already happening. You have no idea how much spam I've
> received "from" Ingo Molnar, Bill Davidsen, Stephen Tweedie
> and you ...
>
> You probably also have no idea from which countries the spam
> with you in the From: address has been sent ;)
>
> Recently an anti-spam mailinglist (with members-only posting)
> got flooded by a spammer who wanted to take revenge for his
> N-th cancelled account. Of course he used From: headers with
> the addresses of many of the list regulars.
The problem requires action on a wider scale where the IETF needs to
propose a new standard that enforces crypto signatures of message
content and From: that is tied into DNS. The current mail standards
do not have any means to prevent forgeries, even for those organizations
that want to avoid such abuses.
-ben
--
"You will be reincarnated as a toad; and you will be much happier."
On 12 August 2002 18:32, Peter Chubb wrote:
> >>>>> "Jim" == Jim Roland <[email protected]> writes:
>
> Jim> Now there's a good thought! Post, Confirm, gets posted. If
> Jim> member, no confirmation necessary.
>
> It'd be impractical because you'd need to merge not only the people
> directly on the list as members, but also the people who get LKML as
> digest via Dell, as news, or via a mail exploder.
It may be very nice to ask confirmation for suspicious posts only.
Filter can discriminate messages into:
1.Obvious spam: drop on the floor
2.Possible spam: ask sender to confirm
(with reason why robot thinks it may be a spam)
3.Not a spam: post without confirmation
This avoids problems with good messages being lost
and does not require human admins to read the messages.
--
vda
One trick is to get the person to travel there with passport, steal it and blackmail their family, go research 419 scams..
On Mon, 12 Aug 2002 23:19:38 -0400 (EDT) Bill Davidsen <[email protected]> wrote: