Subject: Off-topic postings

From: Brant Knudson <[email-masked]>
Date: Wed, 21 Oct 1998 04:24:33 +0000

To my Esteemed Colleagues:

There has been a lot of discussion on this mailing list concerning
allowing spammers access to every mailbox.  This topic has been
addressed in other forums, for the reason that it is important to curb
spamming in order to keep the Internet running smoothly and
efficiently.  After a short time spent searching, I ran across this I-D
concerning the topic, put out by the Responsible Use of the Network
(run) WG (07/98).  Here is a quote from "DON'T SPEW : A Set of
Guidelines for Mass Unsolicited Mailings and Postings (spam*)"[1], page
10:
   If you are running a mailing-list, be sure to allow postings by
   subscribers only.  Make sure your charter forbids any off-topic
   posts.  There is another spam-related problem with mailing-lists

Here is a quote from the IETF mailing lists page[2] 
"The IETF discussion list is open, and therefore has a wide range of
topics."

The only off-topic subjects explicitly mentioned (on this page) are
"employment opportunities and advertsing (sic)" and
subscribe/unsubscribe requests.  I haven't found another page limiting
topics on this list any further.

[1] http://www.ietf.org./internet-drafts/draft-ietf-run-spew-06.txt
[2] http://www.ietf.org./maillist.html

Brant Knudson
[email-masked]

An advance transcript of the new TLD BOF:
"AAA?" "yes" "AAB?" "yes" "AAC?" "yes" ... "ZZZ?" "yes"

---

From: Andy Bierman <[email-masked]>
Date: Wed, 21 Oct 1998 14:07:52 -0700

Brant Knudson wrote:
>...

this doesn't work. Many IETF lists (including the 2 I run) contain
lots of exploder addresses (e.g. [email-masked]).
Filtering out all non-subscriber addresses breaks this desirable feature.
(e.g. [email-masked] would get dropped).

>...

> Brant Knudson

Andy

---

From: Andy Bierman <[email-masked]>
Date: Wed, 21 Oct 1998 14:07:52 -0700

Andy

---

From: "David W. Morris" <[email-masked]>
Date: Wed, 21 Oct 1998 14:11:44 -0700 (PDT)

> (e.g. [email-masked] would get dropped).

Not if the list server were to allow silent subscribes or some other
registration mechanism where they were known to the server but the server
didn't directly distribute to them.  The exploders could even be smart
enough to do remote registration if they were 'trusted' by the main
server...

Dave Morris

---

From: "David W. Morris" <[email-masked]>
Date: Wed, 21 Oct 1998 14:11:44 -0700 (PDT)

Dave Morris

---

From: Fred Baker <[email-masked]>
Date: Wed, 21 Oct 1998 14:57:44 -0700

This is so refreshing. A topic that has something to do with a technical
subject, and with the IETF. I'm going to enjoy this...

---

From: Fred Baker <[email-masked]>
Date: Wed, 21 Oct 1998 14:57:44 -0700

---

From: Andy Bierman <[email-masked]>
Date: Wed, 21 Oct 1998 16:14:55 -0700

> enough to do remote registration if they were 'trusted' by the main

This would couple the exploder located at the subscriber's site (e.g. foobar.com)
to the list-server exploder (e.g. [email-masked]).  You're suggesting a new 
protocol, such that the subscriber's server would send a special 
"posting-allowed-from" message to the list exploder whenever somebody subscribes to,
or unsubscribes from, the secondary list (e.g. [email-masked]).  
The list server would allow posts from this email address but not actually forward 
any mail to this address.  That seems like a lot of work.

I have someone here working on some SPAM filters for majordomo that will:
  - verify the "To:" field is really the list address (e.g. [email-masked])
  - verify the domain portion of the "From" field is really from a domain
    of a valid subscriber. (e.g. anything from foobar.com)
This closes some holes with very minimal deployment cost.

Andy

---

From: Andy Bierman <[email-masked]>
Date: Wed, 21 Oct 1998 16:14:55 -0700

Andy

---

From: "David W. Morris" <[email-masked]>
Date: Wed, 21 Oct 1998 17:01:23 -0700 (PDT)

> This closes some holes with very minimal deployment cost.

I'm actually proposing a two level change ....

  a.  Simple listserver update to allow submit registration which don't
      distribute ... this is needed anyway for folks who post from more
      than one ID.  It adds a burden to subscribers to exploders to do
      the extra work.
  b.  The much more complex new protocol which provides a distributed
      listserver.

I get very little spam from some popular lists which require subscription
so I'm trying to deal with the objection that exploders add value if
the base list requires subscription to post.

Dave Morris

---

From: "David W. Morris" <[email-masked]>
Date: Wed, 21 Oct 1998 17:01:23 -0700 (PDT)

Dave Morris

---

From: "Donald E. Eastlake 3rd" <[email-masked]>
Date: Wed, 21 Oct 1998 21:13:02 -0400

This is not a uniform problem.  Different working group mailing lists
have different conditions.  Many do, quite successfully, limit posting
to subscribers or those on a supplemental list allowed to post.  I
don't know off hand of any that strictly limit posting to subscribers
without having a mechanism to accomodate those who want to post from
multiple addresses or otherwise need to be able to post from an
address that isn't a subscriber.

Donald

From:  Andy Bierman <[email-masked]>
Sender:  [email-masked]
Message-ID:  <[email-masked]>
Date:  Wed, 21 Oct 1998 14:07:52 -0700
Organization:  Cisco Systems, Inc.
To:  Brant Knudson <[email-masked]>
CC:  [email-masked]
References:  <[email-masked]>

---

From: "Donald E. Eastlake 3rd" <[email-masked]>
Date: Wed, 21 Oct 1998 21:13:02 -0400

Donald

---

From: Keith Moore <[email-masked]>
Date: Wed, 21 Oct 1998 21:58:43 -0400

> to subscribers or those on a supplemental list allowed to post.  

Right.  What's not clear is whether this would actually help the
IETF list.  A lot of the 'noise' on the IETF list seems to come
from list subscribers (or people who could easily subscribe if
they had to), and further seems to be specifically targeted for 
the IETF list (at least in the sense that the sender thinks
that the IETF list is entitled to his/her opinion on the subject).  
This is in contrast to the typical spam which isn't targeted to 
any specific list or set of recipients.

Keith

p.s. Clearly, the "only from subscribers" posting policy isn't appropriate
for all lists.  It might be appropriate for the main IETF list, for
example, but it really gets in the way when applied to WG mailing lists
where conversations between multiple WGs are often desirable.

---

From: Keith Moore <[email-masked]>
Date: Wed, 21 Oct 1998 21:58:43 -0400

Keith

---

From: [email-masked]
Date: Wed, 21 Oct 1998 23:43:03 -0400

>       than one ID.  It adds a burden to subscribers to exploders to do

This is old hat.

>   b.  The much more complex new protocol which provides a distributed

Again, this is pretty well understood.  RFC1429 dates back to Feb '93,
and Listserv was dealing with "peered lists" at least 5-6 years
before that.

The *big* problem here is that often, there's an attitude of "Since
the list management software we use doesn't do XYZ, XYZ must be
intrinsically difficult or not well understood".  This is compounded
by the fact that often people like to be recompensed for their
efforts - Eric Thomas did a very nice job on the spam filters
in Listserv, but I doubt that we'll see an RFC on it, for obvious
reasons.. ;)

				Valdis Kletnieks
				Computer Systems Senior Engineer
				Virginia Tech

---

From: [email-masked]
Date: Wed, 21 Oct 1998 23:43:03 -0400

This is old hat.

				Valdis Kletnieks

---

From: Harald Tveit Alvestrand <[email-masked]>
Date: Thu, 22 Oct 1998 14:36:30 +0200

>enough to do remote registration if they were 'trusted' by the main

With the lists I run, I allow posting from anyone subscribed to the
list or to a list called "<listname>-submit" which it is not possible
to send mail to.

Bounces go to me for approval, not to the sender as a reject; when I approve
a message, I also add that person to the -submit list.

Works fine as long as I'm looking in the right place often enough; at least
nobody's complained yet.

                               Harald A

-- 
Harald Tveit Alvestrand, Maxware, Norway
[email-masked]

---

From: Harald Tveit Alvestrand <[email-masked]>
Date: Thu, 22 Oct 1998 14:36:30 +0200

Harald A