Subject: Mailing list policy

From: Andy Fletcher <[email-masked]>
Date: Sun, 20 May 2001 10:31:38 +0100

There appears to be a lot of spam on this list at the moment. Most of it 
appears to be coming from addresses which probably are not subscribed to the 
list.

If the list posting policy is 'open' can it be changed to 'subscribed 
addresses' only?  This won't stop legitimate posts as there is no reason to 
post to the ietf list unless you are subscribed to it, but will stop the bulk 
of the spammers.

I am suffering the same problem with the Linux Beer Hike mailing list and am 
about to make the same change, it was fine for the last couple of years up to 
about 2 months ago when the spambots got hold of the address.

Andy

---

From: "Perry E. Metzger" <[email-masked]>
Date: 20 May 2001 12:23:56 -0400

Andy Fletcher <[email-masked]> writes:
> post to the ietf list unless you are subscribed to it, but will stop
> the bulk of the spammers.

I've run a lot of lists that way, including some IETF mailing lists,
and it has worked out fine. It stops most spam but does not
inconvenience most subscribers.

Perry

---

From: Keith Moore <[email-masked]>
Date: Sun, 20 May 2001 14:24:22 -0400

> This won't stop legitimate posts as there is no reason to
> post to the ietf list unless you are subscribed to it

where did you get that idea?

---

From: Lloyd Wood <[email-masked]>
Date: Sun, 20 May 2001 21:50:31 +0100 (BST)

> > post to the ietf list unless you are subscribed to it

That assumption crops up a lot.

In the IETF, there's often reason to cross-post to WG lists that you
aren't subscribed to, when discussion veers that way. The IESG
does that a lot, and 'subscriber only' policies will hold up IESG
business as a result.

(Recent example: UDLR advanced to proposed standard. IESG mail on same
got held up for several days. See Poisson and UDLR list archives.)

If spam on this list bothers you, subscribed to ietf-censored instead.

If spam in general bothers you, install some mail filters to protect
your sensitive eyes.

> > but will stop the bulk of the spammers.
> 

Quite a few IETFers have more than one email address.

L.

<[email-masked]>PGP<http://www.ee.surrey.ac.uk/Personal/L.Wood/>

---

From: "Perry E. Metzger" <[email-masked]>
Date: 20 May 2001 16:54:14 -0400

> does that a lot, and 'subscriber only' policies will hold up IESG

When you are the maintainer of a list, you can approve postings that
get held up because of non-subscriber origins. I do this
routinely. Works just fine.

If need be, we can just have as policy that the IESG and several other
key addresses are always on the "auto-approve" list. Majordomo and
other packages make it easy to do that.

> If spam in general bothers you, install some mail filters to protect

It is easiest to filter spam through mechanisms like non-subscriber
blocks and such. Trying to filter it when it gets to your mailbox is
much harder.

> Quite a few IETFers have more than one email address.

Which is why Majordomo lets you have a seperate list of addresses that
can post but don't get the mail. Works beautifully.

Perry

--
Perry E. Metzger		[email-masked]
--
Quality NetBSD CDs, Support & Service. http://www.wasabisystems.com/

---

From: Lloyd Wood <[email-masked]>
Date: Sun, 20 May 2001 22:18:52 +0100 (BST)

> routinely. Works just fine.

then you're no longer just the maintainer, but doing moderation.
Moderators go on vacation or are otherwise indisposed.

Personally speaking, moderation of IETF lists makes me uncomfortable.

> can post but don't get the mail. Works beautifully.

and it's something I've yet to see described in a list welcome
message.

L.

---

From: Keith Moore <[email-masked]>
Date: Sun, 20 May 2001 18:55:07 -0400

Perry,

a substantial subset of the readers of the ietf list subscribe to the 
list via some other means - whether ietf-censored or some other sub-list
or a web archive.  so a list of subscribers to the main ietf list doesn't 
make a very good filter.

personally, I like the ietf-censored filtering model -   
both because it doesn't place much burden on the secretariat and also
because it doesn't invite accusations of censorship toward IETF.

Keith

---

From: Paul Hoffman / IMC <[email-masked]>
Date: Mon, 21 May 2001 08:49:18 -0700

At 4:54 PM -0400 5/20/01, Perry E. Metzger wrote:
>When you are the maintainer of a list

That assumes that someone is the maintainer of the IETF mailing list. 
At this moment, that is not the case. You are asking that an 
additional  task be put on one of the IETF Secretariat folks. That's 
a reasonable request (and one that I would second), but it is not 
based in current reality.

>can post but don't get the mail. Works beautifully.

No, it works clumsily. It requires that someone who wants to post 
from a different address than the one they are subscribed to must 
somehow register the alternate address with the list maintainer. Or 
that the list maintainer must write custom software that enhances the 
list of allowed-to-post addresses with guesses like "if there is a 
subscription for [email-masked], also allow [email-masked]; if 
there is a subscription for [email-masked], also allow 
[email-masked]". But that will still miss people who are subscribed 
from [email-masked] but posting from [email-masked].

(And, yes, I've written such code for the lists IMC and VPNC runs; it 
is available on request.)

--Paul Hoffman, Director
--Internet Mail Consortium

---

From: Michael Richardson <[email-masked]>
Date: Mon, 21 May 2001 16:00:06 -0400

>>>>> "Lloyd" == Lloyd Wood <[email-masked]> writes:
    Lloyd> That assumption crops up a lot.

    Lloyd> In the IETF, there's often reason to cross-post to WG lists that you
    Lloyd> aren't subscribed to, when discussion veers that way. The IESG
    Lloyd> does that a lot, and 'subscriber only' policies will hold up IESG
    Lloyd> business as a result.

  Yes, and if one does:

  foreach ietfwgmailhost {
       cd ~mailprogram/lists
       cat | sort -u >>ietf-nomail
  }

  and take ietf-nomail as the "subscription list", then things work really
well. The list of people on all of the various WG lists may be 10,000
entries, but it is relatively well known. I run 50+ lists this way, and it
works very well.

  See 3.13 of the majordomo FAQ.
  This "list of lists", alas, would become a spammer/head-hunter target if
made too easily accessible, but we already have that problem. I would
certainly like to have this on ietf-censored :-)

    Lloyd> Quite a few IETFers have more than one email address.

  Yes.

Canadian Commuter Challenge Project -- GNU Potato Caboose 
Michael Richardson, Sandelman Software Works, Ottawa, ON  
EMAIL: [email-masked]
for help, email or page at 1-866-231-8608

---

From: John Stracke <[email-masked]>
Date: Mon, 21 May 2001 16:35:51 -0400

Michael Richardson wrote:

> made too easily accessible, but we already have that problem.

In addition, it would mean that anybody subscribed to one IETF list could spam all
of them, which would weaken the protection.  Today, if you want to spam all of
them, you have to subscribe to all of them, which is impractical.

--
/==============================================================\
|John Stracke    | http://www.ecal.com |My opinions are my own.|
|Chief Scientist |=============================================|
|eCal Corp.      |"Baldric, how did you manage to find a turnip|
[email-masked]|that cost 400,000 pounds?" "Well, I had to   |
|                |haggle." --Blackadder III                    |
\==============================================================/

---

From: Kevin Farley <[email-masked]>
Date: Mon, 21 May 2001 13:48:50 -0700 (PDT)

> them, you have to subscribe to all of them, which is impractical.

Impractical, but through software, not impossible. Could readily be
automated.

__________________________________________________
Do You Yahoo!?
Yahoo! Auctions - buy the things you want at great prices
http://auctions.yahoo.com/

---

From: "Spencer Dawkins" <[email-masked]>
Date: Mon, 21 May 2001 23:55:41 -0500

Speaking as an IETF WG co-chair, I know the PILC list has gotten spammed by
people who also hit every other IETF WG list I was subscribed to. Whether
automated or not, it's not as impractical to spam IETF lists as I wish it
was.

The special thrill I get is when some bonehead does this two weeks before an
IETF meeting, of course. Why isn't RUN standing-room-only?

Spencer

----- Original Message -----
From: "Kevin Farley" <[email-masked]>
To: <[email-masked]>
Sent: Monday, May 21, 2001 3:48 PM
Subject: Re: Mailing list policy

> automated

---

From: John Stracke <[email-masked]>
Date: Tue, 22 May 2001 09:45:35 -0400

Kevin Farley wrote:

> > Today, if you want to
> > spam all of

(I spoke sloppily, by the way.  For "today", read "with separate filters
on every list".)

> Impractical, but through software, not impossible. Could readily be

If that's so, then subscriber filters won't work; as soon as it becomes
profitable to do so, the spamware vendors will include automated
subscription features.

--
/===============================================================\
|John Stracke    | http://www.ecal.com |My opinions are my own. |
|Chief Scientist |==============================================|
|eCal Corp.      |Whose cruel idea was it for the word "lisp" to|
[email-masked]|have an "S" in it?                            |
\===============================================================/

---

From: Kevin Farley <[email-masked]>
Date: Tue, 22 May 2001 07:54:52 -0700 (PDT)

> profitable to do so, the spamware vendors will include automated

Exactly. Someone will realize how to make a profit of both sides of the
issue.

---

From: "Rahmat M. Samik-Ibrahim" <[email-masked]>
Date: Mon, 28 May 2001 21:22:51 +0700

Hello:

Well, it was yet another burst of suggestions.
But, what was the problem? And, whose problem?

> based in current reality.

Well, then it is about time that a system/ organization with an 
annual turnaround of millions of dollars has (a) mailing list
maintainer(s). But, to whom do the IETFS folks reporting anyway?
To the IESG? CNRI? IAB? ISOC? Or, directly to the goddess of
confusion herself?

Robert Elz wrote:
> A supposed technological fix to a non-technological problem that just
> made things worse, not better.

Why? I agree with what ned.freed wrote:
> In general, I agree with this assessment. But that doesn't mean that 
> some point fixes don't help in some cases.

-- 
Rahmat M. Samik-Ibrahim - VLSM-TJT - http://rms46.vlsm.org
Tarlumobi di hamu Raja ni Hula-Hula dohot Tulang nami,bah!