Subject: spam on TMDA lists?

From: Lars Eggert <[email-masked]>
Date: Sun, 3 Feb 2008 11:17:10 +0200

Hi,

is anyone else seeing increasing spam levels on lists that have TMDA  
enabled? Can this be related to moving the servers?

(A few of my TMDA lists again have spam stuck in the moderation queue,  
which hasn't occurred ever since TMDA was enabled for them.)

Lars

([email-masked] BCC'ed)

---

From: "Dan Wing" <[email-masked]>
Date: Sun, 3 Feb 2008 10:55:50 -0800

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Lars Eggert
> Sent: Sunday, February 03, 2008 1:17 AM
> To: Working Group Chairs
> Cc: Ray Pelletier
> Subject: spam on TMDA lists?
> 
> Hi,
> 
> enabled?

Yes.

> Can this be related to moving the servers?

I expect it is, and figured it would be addressed by
someone else complaining.  Thanks for doing that.  :-)

> which hasn't occurred ever since TMDA was enabled for them.)

Yep, same here.

I used to run http://www.waider.ie/hacks/workshop/perl/mailman.pl against my
mailing lists, and still use that script on mailman-hosted, non-IETF mailing
lists I own.  It uses spamassassin to score each (moderated) post, and removes
the message if the spam score is too high.  This effectively removes much of
the burden of spam in the moderator queue.

I am hoping TMDA is re-enabled for my lists, though.

-d

---

From: Marshall Eubanks <[email-masked]>
Date: Sun, 3 Feb 2008 16:14:56 -0500

On Feb 3, 2008, at 1:55 PM, Dan Wing wrote:

>> [[email-masked]] On Behalf Of Lars Eggert

Please report such messages (with full headers) to

[email-masked]

so that the transition team is aware of them.

Regards
Marshall

---

From: "Dan Wing" <[email-masked]>
Date: Sun, 3 Feb 2008 13:30:16 -0800

Thanks.  Done.

-d

> [mailto:[email-masked]] On Behalf Of Marshall Eubanks
> Sent: Sunday, February 03, 2008 1:15 PM
> To: Dan Wing
> Cc: 'Working Group Chairs'; 'Ray Pelletier'
> Subject: Re: spam on TMDA lists?
> 
> 
>

---

From: Lars Eggert <[email-masked]>
Date: Mon, 4 Feb 2008 10:01:03 +0200

> so that the transition team is aware of them.

Will do, as soon as I find the admin password again. (Haven't needed  
it in months thanks to TMDA.)

By the way, I got the following reply from AMS - looks like TMDA is no  
longer being used: "TMDA is no longer a part of any of the working  
group chairs list.  Instead, a spam algorithm has been added to the  
mailman configuration for each list. Please contact Jim Galvin ([email-masked] 
) for details on how this works and how you can modify it."

I'm CC'ing Jim - Jim, please let us know how the TMDA replacement works.

Thanks,
Lars

---

From: Henrik Levkowetz <[email-masked]>
Date: Mon, 04 Feb 2008 10:06:59 +0100

On 2008-02-04 09:01 Lars Eggert said the following:
...
> I'm CC'ing Jim - Jim, please let us know how the TMDA replacement works.

Umm -- I'm not happy about this.  We've ascertained over a number of years
that non-TMDA spam filtering never works 100% right -- there's both spam
that slip through, and valid messages erroneously marked as spam.  As far
as I have seen on my WG list, TMDA has, for this use, worked extraordinary
well.  If there hasn't been an explicit decision from the IETF to stop using
TMDA, I would like to see it reinstated by AMS.

I can understand that there was *a lot* to take care of during the transition,
and it's no big deal if this has to wait a little while, but long-term, I'd
like it back (if it's indeed gone...).

	Henrik

---

From: Fred Baker <[email-masked]>
Date: Mon, 4 Feb 2008 11:29:16 +0200

the list of people testing the AMS site was TMDA-filtered. James/ 
Glen, this sounds like a temporary situation. Is it?

On Feb 4, 2008, at 11:06 AM, Henrik Levkowetz wrote:
>> By the way, I got the following reply from AMS - looks like TMDA  
>> is no  longer being used: "TMDA is no longer a part of any of the  
>> working  group chairs list.  Instead, a spam algorithm has been  
>> added to the  mailman configuration for each list. Please contact  
>> Jim Galvin ([email-masked] ) for details on how this works and  
>> how you can modify it."

---

From: [email-masked]
Date: Tue, 5 Feb 2008 16:52:07 -0500

> I can understand that there was *a lot* to take care of during
> the transition, and it's no big deal if this has to wait a little
> while, but long-term, I'd like it back (if it's indeed gone...). 

Allow me to be blunter.  I manage 3 IETF mailing lists.  TMDA made
it possible to manage those lists in a reasonable fashion because
it got rid of essentially all the spam.  With TMDA gone, the spam
is back, in quantity.

I want TMDA back and I want it NOW!!  If I don't get it, I *will*
set my lists to discard all posts from non-members and all
unrecognized bounces, as I do not have the time to scan the
quantities of inbound spam that are starting to show up.

FYI,
--David
----------------------------------------------------
David L. Black, Distinguished Engineer
EMC Corporation, 176 South St., Hopkinton, MA  01748
+1 (508) 293-7953             FAX: +1 (508) 293-7786
[email-masked]        Mobile: +1 (978) 394-7754
----------------------------------------------------

---

From: David R Oran <[email-masked]>
Date: Tue, 5 Feb 2008 19:47:30 -0500

> quantities of inbound spam that are starting to show up.
Well, I may be a bit more patient, but the speechsc list went from 1  
spam per week to 220 just today.
I sure don't want to wait more than a week or two.

---

From: "Romascanu, Dan (Dan)" <[email-masked]>
Date: Wed, 6 Feb 2008 11:13:18 +0100

I agree with David and David here. TMDA has been making the life of
administrators very reasonable, and allowed me to take admin
responsibilities for a whole bunch of lists in my area without going
through the pain of looking for volunteers to share the load. With tens
if not hundreds of messages to scan each day the pain is back and I will
not be able to continue doing it. Please, bring TMDA (or similar) back
as soon as possible. 

Dan

> From: [email-masked] [mailto:[email-masked]] On 
> Behalf Of David R Oran
> Sent: Wednesday, February 06, 2008 2:48 AM
> To: [email-masked]
> Cc: [email-masked]; [email-masked]
> Importance: High
> >> I can understand that there was *a lot* to take care of during the 
> >> transition, and it's no big deal if this has to wait a 
> little while, 
> >> but long-term, I'd like it back (if it's indeed gone...).
> >
> > Allow me to be blunter.  I manage 3 IETF mailing lists.  
> TMDA made it 
> > possible to manage those lists in a reasonable fashion 
> because it got 
> > rid of essentially all the spam.  With TMDA gone, the spam 
> is back, in 
> > quantity.
> >
> > I want TMDA back and I want it NOW!!  If I don't get it, I 
> *will* set 
> > my lists to discard all posts from non-members and all unrecognized 
> > bounces, as I do not have the time to scan the quantities 
> of inbound 
> > spam that are starting to show up.
> >
> Well, I may be a bit more patient, but the speechsc list went 
> from 1 spam per week to 220 just today.
> > David L. Black, Distinguished Engineer EMC Corporation, 176 
> South St., 
> > Hopkinton, MA  01748

---

From: "DRAGE, Keith \(Keith\)" <[email-masked]>
Date: Wed, 6 Feb 2008 11:57:35 +0100

Over 100 spam messages waiting in the moderation queue on the SIP list
since Monday night - and none of them valid.

We are back to the bad old days.

Also one message in the SIP archive for 5th February that is definitely
SPAM. A further one for the 1st February. Now about to start
investigating why all my valid incoming SIP messages are ending up in
the SPAM folders.

Whether TDMA was meant for the job or not, it was working. Now
apparently what we have is not.

Incoming post to the SIP list and other lists also seems to be way down
- I hope we are not losing valid messages before we get to the
moderation queues. I have no means of checking this except by sending
test messages.

Regards

Keith 

> [mailto:[email-masked]] On Behalf Of David R Oran
> Sent: Wednesday, February 06, 2008 12:48 AM
> To: [email-masked]
> Cc: [email-masked]; [email-masked]; [email-masked]

---

From: "Randy Presuhn" <[email-masked]>
Date: Wed, 6 Feb 2008 10:14:05 -0800

Hi -

> From: "DRAGE, Keith (Keith)" <[email-masked]>
> To: "David R Oran" <[email-masked]>; <[email-masked]>
> Cc: <[email-masked]>; <[email-masked]>; <[email-masked]>
> Sent: Wednesday, February 06, 2008 2:57 AM
> Subject: RE: spam on TMDA lists?
...
> We are back to the bad old days.

Same is true for the three IETF lists I manage.
Whether it was the "right" tool for the job or not,
what we had with TMDA was working quite well.

...
> moderation queues. I have no means of checking this except by sending

I have the same concern for one list I manage - it's normally *very* busy,
and I haven't seen anything in four days.  Time to send out that test.  :-)

Randy

---

From: [email-masked]
Date: Thu, 7 Feb 2008 10:05:01 -0500

Hmm - whatever let loose the spam barrage appears to have gone away,
after the initial burst of spam that had to be cleared, I haven't
seen any spam recently that needed mailman attention.

Are other IETF lists seeing similar behavior?

Thanks,
--David

> [mailto:[email-masked]] On Behalf Of [email-masked]
> Sent: Tuesday, February 05, 2008 4:52 PM
> To: [email-masked]; [email-masked]; [email-masked]
> Cc: [email-masked]; Black, David

---

From: David R Oran <[email-masked]>
Date: Thu, 7 Feb 2008 10:20:02 -0500

> Are other IETF lists seeing similar behavior?
Mine dropped back from >200 to about 5 today.

---

From: Menachem Dodge <[email-masked]>
Date: Thu, 7 Feb 2008 17:37:02 +0200

No spam on my list  today.

Thanks,
Menachem

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On
Behalf Of David R Oran
Sent: Thursday, February 07, 2008 5:20 PM
To: [email-masked]
Cc: [email-masked]; [email-masked]; [email-masked]
Subject: Re: spam on TMDA lists?

---

From: "Randy Presuhn" <[email-masked]>
Date: Thu, 7 Feb 2008 10:13:59 -0800

Hi -

Same here.  A big THANK YOU to whoever and/or whatever is
responsible!

Randy

----- Original Message ----- 
From: "Menachem Dodge" <[email-masked]>
To: "David R Oran" <[email-masked]>; <[email-masked]>
Cc: <[email-masked]>; <[email-masked]>; <[email-masked]>
Sent: Thursday, February 07, 2008 7:37 AM
Subject: RE: spam on TMDA lists?

Thanks,
Menachem

---

From: "DRAGE, Keith \(Keith\)" <[email-masked]>
Date: Thu, 7 Feb 2008 19:43:30 +0100

The flood in the mediation queue on the SIP list seems to have subsided
shortly before 11:15 am on the 5th by the timestamps, 2 SPAM messages
since then. No valid messages.

The archive seems to match my inbox (having moved the messages from the
list back there that are still ending up in my SPAM folder)

No notifications from SIP list subscribers of messages having
disappeared into nothing, though that is early days yet. Traffic seems
to now be a bit more like normal.

Regards

Keith

> Sent: Thursday, February 07, 2008 3:20 PM
> To: [email-masked]
> > after the initial burst of spam that had to be cleared, I 
> haven't seen 
> > any spam recently that needed mailman attention.
> >
> is back, 
> >> in quantity.
> >> David L. Black, Distinguished Engineer EMC Corporation, 176 South 
> >> St., Hopkinton, MA  01748

---

From: "Dan Wing" <[email-masked]>
Date: Thu, 7 Feb 2008 11:28:07 -0800

Same here on my lists (BEHAVE and SAFE).

I wonder what changed.

-d

> [mailto:[email-masked]] On Behalf Of DRAGE, Keith (Keith)
> Sent: Thursday, February 07, 2008 10:44 AM
> To: [email-masked]

---

From: "DRAGE, Keith \(Keith\)" <[email-masked]>
Date: Thu, 7 Feb 2008 21:10:48 +0100

Adding a question.

Anyone know what proposals there are for the *-owner addresses, where
obviously TMDA does not work, but from which we are receiving
significant SPAM?

Regards

Keith 

> Sent: Thursday, February 07, 2008 6:44 PM
> To: [email-masked]
> The flood in the mediation queue on the SIP list seems to 
> have subsided shortly before 11:15 am on the 5th by the 
> timestamps, 2 SPAM messages since then. No valid messages.
> 
> The archive seems to match my inbox (having moved the 
> messages from the list back there that are still ending up in 
> my SPAM folder)
> 
> disappeared into nothing, though that is early days yet. 
> Traffic seems to now be a bit more like normal.
> 
> Regards
> 
> Keith
>

---

From: Russ Housley <[email-masked]>
Date: Thu, 07 Feb 2008 17:51:42 -0500

There was a problem, but it does not seem that TMDA (or the lack of 
TMDA) was part of the problem.  At the moment, things seem to be much 
better.  Yet, the TMDA configuration has not changed.  I suggest that 
we let it run like this for a few days and then reevaluate.  No one wants spam.

Russ

---

From: Joe Abley <[email-masked]>
Date: Fri, 8 Feb 2008 10:06:31 -0500

> obviously TMDA does not work, but from which we are receiving

Surely you can auto-discard mail from/to *-owner@ in mailman, using  
the admin interface.

Joe