Subject: RE: q: [email-masked] subscribing to multiple lists?

From: "David Mitton" <[email-masked]>
Date: Mon, 26 Sep 2005 09:02:31 -0500

Moderators of group lists on Yahoo Groups find themselves doing this kind of thing as standard practice.

New members are put on moderate status until they generate a couple messages on-topic.
Too much work for spammers.

Another tactic is to have new members answer some simple topic related questions before they can join.
...now there's a fun area...
 
Dave.

----- Original Message -----
From: [email-masked]
To: [email-masked]
Subject: RE: q: [email-masked] subscribing to multiple lists?
Date: Mon, 26 Sep 2005 09:18:52 -0400

> 
> Looks that way - I have it on both ips and rddp.  I just set
> the mod[erate all posts] bit for this address on both lists
> just in case ... looks like we may need a Mailman mode that
> defaults to moderation for all new members, because if this
> had been a real spam attack, the spam would already have been
> sent ...
> 
> thanks,
> --David
> 
> > -----Original Message-----
> > From: [email-masked] [mailto:[email-masked]] On Behalf 
> > Of [email-masked]
> > Sent: Saturday, September 24, 2005 12:29 PM
> > To: Matthew J Zekauskas
> > Cc: [email-masked]
> > Subject: Re: q: [email-masked] subscribing to multiple lists?
> >
> > > I just had an email address, [email-masked], sub to
> > > both of the lists I manage.  I wonder if it's subscribed to a
> > > bunch more...  possibly for a little bulk email or address
> > > harvesting.
> > >
> > > I suppose it could be some new archiver (or otherwise legit),
> > > but when it subscribes quickly, with a odd yahoo address, and
> > > with two different real names ("robert moore" and "dfsdsdf dfsdfd")
> > > I get a bit suspicious...
> > >
> > > Did anyone else just get a subscription?  Reply to me directly so
> > > we don't storm the list, and I'll summarize the replies.
> > >
> > > --Matt
> > >
> > > (lists were ippm and pmtud for what it's worth)
> > >
> > >
> > >
> > Maybe getting them all - I have him on IPoIB
> >
> > dfsdsdf dfsdfd <[email-masked]> has been successfully
> > subscribed to IPoverIB.
> >
> > I know there is nothing to do - but if this does turn out to be a spam
> > attack - how long will it take to get  him banned from all lists ?
> >
> > For now I am assuming it is someone signing up for a LOT of lists
> >
> >

---

From: James Carlson <[email-masked]>
Date: Mon, 26 Sep 2005 10:18:44 -0400

> ...now there's a fun area...

If I have any doubt about the subscriber (and for
[email-masked], I clearly do), I send a private email
message to the requestor asking for clarification of the request, and
noting that they can read the archives to stay up to date in the
meantime, and that I'll happily approve the request immediately if I
see an on-topic posting or some intelligible response.  Spammers seem
to be either unable to reply or reply only with garbage.

-- 
James Carlson, KISS Network                    <[email-masked]>
Sun Microsystems / 1 Network Drive         71.232W   Vox +1 781 442 2084
MS UBUR02-212 / Burlington MA 01803-2757   42.496N   Fax +1 781 442 1677

---

From: "Tom-PT Taylor" <[email-masked]>
Date: Mon, 26 Sep 2005 12:55:56 -0400

Moderate doesn't do much good if all they're doing is lurking to collect 
addresses.  Recall that recently I brought up the matter of superbig@...
That address drew attention to itself by the autoreplies it generated. 
I set the moderate bit early on, but there was never anything out of 
that address.

---

From: Rohan Mahy <[email-masked]>
Date: Tue, 27 Sep 2005 09:39:33 -0400

> ...now there's a fun area...

For the SIP and SIPPING mailing lists, I would be happy if they just 
had to paste the mailing list footer into their first message (its 
about the scope of the mailing list and what kind of discussion is 
appropriate).

thanks,
-rohan

---

From: Dean Willis <[email-masked]>
Date: Wed, 28 Sep 2005 14:08:59 -0500

On Sep 26, 2005, at 11:55 AM, Tom-PT Taylor wrote:

> Moderate doesn't do much good if all they're doing is lurking to  
> collect addresses.  Recall that recently I brought up the matter of  
> superbig@...
> That address drew attention to itself by the autoreplies it  
> generated. I set the moderate bit early on, but there was never  
> anything out of that address.
>
>

This is why I suggested several years ago that IETF deploy a  
credential system for list participation, with a requirement for a  
"credentialed introducer" and some traceability so that introducers  
who repeatedly introduce villains can get slapped about.

This gives us a central place to withdraw credentials, opens all of  
our lists to posting from credentialed parties without moderation,  
and some "minimal but necessary" check that there has been human  
interaction with any party requesting participation. By no means  
perfect security, but better than what we have, and it might teach us  
something about actually using the identity mechanisms we spend so  
much effort inventing and writing up but that for some obscure reason  
(like, maybe they're too hard to use) don't seem to survive in the wild.

--
Dean

---

From: Brian E Carpenter <[email-masked]>
Date: Thu, 29 Sep 2005 11:49:59 +0200

We have a principle of being open to anybody.

There's a price to pay for that principle. For
example, I don't think the notion of credentialled
introducer is compatible. If a high school student
with no contacts wants to join our lists, that must
be allowed.

I've asked whether TMDA can be put in front of
mailman. Since it was put in front of the ticketing
system ([email-masked]) the spam load there has
vanished. Of course, that doesn't prevent passive
address collection, but that's a lost battle anyway.

     Brian

Dean Willis wrote:
> This is why I suggested several years ago that IETF deploy a  credential 
> system for list participation, with a requirement for a  "credentialed 
> introducer" and some traceability so that introducers  who repeatedly 
> introduce villains can get slapped about.
> 
> This gives us a central place to withdraw credentials, opens all of  our 
> lists to posting from credentialed parties without moderation,  and some 
> "minimal but necessary" check that there has been human  interaction 
> with any party requesting participation. By no means  perfect security, 
> but better than what we have, and it might teach us  something about 
> actually using the identity mechanisms we spend so  much effort 
> inventing and writing up but that for some obscure reason  (like, maybe 
> they're too hard to use) don't seem to survive in the wild.
> 
> -- 
> Dean
> 
>

---

From: Rohan Mahy <[email-masked]>
Date: Thu, 29 Sep 2005 09:32:13 -0700

> with no contacts wants to join our lists, that must

I don't see why a high school student, or someone in a poor country, or 
even someone who wants to participate with a pseudonym would be 
prevented from using IETF mailing lists under the terms that Dean 
mentioned.

There are only two properties we are looking for.  1. We can prevent 
forgery on the list for folks that are already enrolled.  2. We provide 
some test that someone trying to subscribe is a human and can answer a 
trivial question related to content (ex: "What's the first name of the 
editor of draft-ietf-foo-bar-mumble") that would be difficult to answer 
automatically.

It seems clear to me that Dean is not proposing any sort of strong 
assertion of identity.

thanks,
-rohan

---

From: Dean Willis <[email-masked]>
Date: Thu, 29 Sep 2005 16:44:50 -0500

> with no contacts wants to join our lists, that must

Then the high-school student emails a WG chair or other responsible  
party, and the WG chair makes his best guess and probably credentials  
him. Then the WG chair watches a while, and if the student seems  
legit, the wg-chair stops worrying. If the high-school student  
suddenly starts dropping spam with his new creds, the WG chair has  
the creds pulled and learns a little more about spotting spammers.

> address collection, but that's a lost battle anyway.

The approach I suggested at least prevents passive address collection  
by most players who don't seem real to a reasonable person (which,  
despite notions to the contrary from many people, most WG chairs are).

Security is never absolute. It's about making your car harder to  
steal than the next guy's.

--
Dean

---

From: [email-masked]
Date: Thu, 29 Sep 2005 14:52:20 -0700 (PDT)

The problem is:

It is now arbitrary - is [email-masked] a valid college student ?

I don't know - but I certainly don't want to be bothered trying to find out.

I think this is one of those problems like the legal system in the US.  It
is almost impossible to "solve" a crime before it happens - and I am not
sure I would want to live in a country that tried (ie. police state).

Freedom is seldom free - and I would not want to sacrifice the freedom for
random people to participate in important work because of some percieved
spam problem (we all run spam filters today - I don't get to see most of
it anyway, except for non-posters to my WG Mailing list, that I have to
manually delete)

Bill

---

From: Dean Willis <[email-masked]>
Date: Thu, 29 Sep 2005 18:38:23 -0500

> I don't know - but I certainly don't want to be bothered trying to  

You have to now, if you're moderating list membership.  And not just  
you, but every moderator of every list that [email-masked]  
tries to join has to make the same validation.

The "credentialed introducer" model lets that work be done just one  
time, instead of once per list. And with a little tools support, it  
lets somebody kick [email-masked] off of every @IETF.ORG list  
if he turns out to be a spambot, And although we don't need  
credentials to automate "the boot", we do need something like that to  
keep the spambot from automatically rejoining.

And we haven't even begun to talk about the possibility of  
impersonation that a credential mechanism could reduce.
But I should point out that this approach doesn't prevent "sock  
puppets", so you can still create aliases from which to agree with  
yourself as needed. I've considered using some to argue with myself  
on-list so I could pretend other people don't know I'm crazy, which  
they figure out rapidly when I argue with myself using my own name ;-).

--
Dean

---

From: James Carlson <[email-masked]>
Date: Fri, 30 Sep 2005 08:28:42 -0400

> I don't know - but I certainly don't want to be bothered trying to find out.

Really?  How many subscription requests do you see?

I do send mail to every single one that looks at all questionable.
The only test I have is that the sender fogs a mirror -- if I get back
some sort of response, then I accept it.  If a week or more goes by
with nothing, I reject it.

That gives the purported "person" two chances: once on the private
message I send, a second on the reject notice he'll get from the
system.  That ought to be plenty.

> sure I would want to live in a country that tried (ie. police state).

Good grief.  I think that's taking it to extremes.

The pattern here is that there are "subscribers" that are nothing more
than an email address harvesting script on some 'bot running some
unnamed vendor's software.  The subscriber isn't real at all, so just
asking, "hello, who's calling please?" is enough to solve the problem.

I certainly don't ask for "proof of credentials" (whatever that might
possibly mean), and I hope that others here aren't suggesting anything
anywhere near that draconian.

---

From: [email-masked]
Date: Fri, 30 Sep 2005 09:03:18 -0700 (PDT)

> system.  That ought to be plenty.
I am not all to certain that this level of scrutiny is actually allowed -
I am afraid that if someone were to subscribe a distribution list (I want
to keep internal records for some reason), subscribe and for some reason
had you blocked by a spam filter and didn't get your message(the
hypothetical Dell employee in your case - I am SO kidding here)

I guess my mailing list is quite small so I haven't run across the problem
yet - maybe I will have to change my tune one of these days.

> asking, "hello, who's calling please?" is enough to solve the problem.

What are we protecting from - an e-mail harvesting bot that could just go
to the list archives and get all the e-mails anyway ?

Not sure that I really need the additional bandaide over the gapping chest
wound...

But again - I would not feel comfortable kicking someone off the list
until either they start actively spamming the list OR their mail starts
bouncing and I get a bunch of bounce messages (yeah the last one was this
guy [email-masked] - why didn't he just unsubscribe from the list
<G>)

> anywhere near that draconian.

Thanks for letting me express a different point of view.

Bill

---

From: James Carlson <[email-masked]>
Date: Fri, 30 Sep 2005 12:23:39 -0400

> I am not all to certain that this level of scrutiny is actually allowed -

That's a good question, but I do not believe that I'm actually out of
compliance here.

The user can *always* post on-topic and get subscribed that way.  And
he can *always* send me mail, even from some other address, and say
"please get this added."  And the archives are open.

And, of course, he can always complain up the chain and have someone
clout me, if that's what's needed.

There's neither intent nor effect of shutting any reasonable
contributor out.

> to keep internal records for some reason), subscribe and for some reason

But in that case, the only thing the hypothetical list would ever get
is two messages: my query (dropped, perhaps) and the one from ietf.org
showing the rejection (no reason to believe that'd be dropped).

If a list falls apart and there's nobody there to notice, does it make
a difference?  If you can't see the rejection, how would you ever have
seen the normal postings?

> hypothetical Dell employee in your case - I am SO kidding here)

Ha!

> to the list archives and get all the e-mails anyway ?

In effect, yes.

> Not sure that I really need the additional bandaide over the gapping chest

I suppose I agree with that.  I just don't feel the need to splash
salt into the wound by approving lame subscriptions.

If the "fog a mirror" test is itself inappropriate (though I don't
agree that it is), then I think it'd probably be a good idea to rope
it off in the mailman administrative interface on ietf.org.  We
probably shouldn't make "illegal" features readily available.

---

From: Rohan Mahy <[email-masked]>
Date: Fri, 30 Sep 2005 09:31:55 -0700

Bill,

FYI: The mailman hosted ietf.org mailing list archives all obfuscate 
the domain name of the sender.  While someone can try to spam harvest 
from these archives, its not as easy or as automatic as subscribing to 
a mailing list.  We could make harvesting from the archives much harder 
by using the Javascript trick that Steve Bellovin suggested.

For a list like SIP which has thousands of subscribers, "moderating" 
spam is a huge task and the list of subs is a juicy target.

thanks,
-rohan

On Sep 30, 2005, at 9:03, [email-masked] wrote:
>>> I don't know - but I certainly don't want to be bothered trying to 
>>> find
>>> out.
>>
>>> I think this is one of those problems like the legal system in the 
>>> US.
>>> It