Subject: Fwd: MBONED post from [email-masked] requires approval

From: Marshall Eubanks <[email-masked]>
Date: Thu, 22 May 2008 22:55:13 -0400

Couldn't this second-order backscatter get squelched ? Is there ever  
any reason for one IETF list to join another ?

Marshall

Begin forwarded message:

> From: [email-masked]
> Date: May 22, 2008 10:34:50 PM EDT
> To: [email-masked]
> Subject: MBONED post from [email-masked] requires approval
>
> As list administrator, your authorization is requested for the
> following mailing list posting:
>
>    List:    [email-masked]
>    From:    [email-masked]
>    Subject: Your message to Megaco awaits moderator approval
>    Reason:  Post by non-member to a members-only list
>
> At your convenience, visit:
>
>    https://www.ietf.org/mailman/admindb/mboned
>
> to approve or deny the request.
>
> From: [email-masked]
> Date: May 22, 2008 10:34:49 PM EDT
> To: [email-masked]
> Subject: Your message to Megaco awaits moderator approval
>
>
> Your mail to 'Megaco' with the subject
>
>    Save 80% on Brand name replica watches
>
> Is being held until the list moderator can review it for approval.
>
> The reason it is being held:
>
>    Post by non-member to a members-only list
>
> Either the message will get posted to the list, or you will receive
> notification of the moderator's decision.  If you would like to cancel
> this posting, please visit the following URL:
>
>    https://www.ietf.org/mailman/confirm/megaco/7e40fc6d40d064d7a2639154dc8c1e21a3197c63
>
>
>
>
> From: [email-masked]
> Subject: confirm 173efea348a92108cdc99584612b6f53ebfd62f6
>
>
> If you reply to this message, keeping the Subject: header intact,
> Mailman will discard the held message.  Do this if the message is
> spam.  If you reply to this message and include an Approved: header
> with the list password in it, the message will be approved for posting
> to the list.  The Approved: header can also appear in the first line
> of the body of the reply.
>

---

From: Glen <[email-masked]>
Date: Fri, 23 May 2008 07:31:48 -0700

On Thu, May 22, 2008 at 10:55:13PM -0400, Marshall Eubanks wrote:
> Couldn't this second-order backscatter get squelched ? Is there ever any 
> reason for one IETF list to join another ?
> Marshall

Hi Marshall -

Absolutely.

As you no doubt see, this is just a deal where the spammer is using a 
forged "From" address in an attempt to get their spam through.

I'd expect that, once TMDA service is restored, this will go away 
completely.

If not, we could look into developing some type of filtering script that
looks at the list of lists and squelches based on those patterns.

Glen

---

From: James M Galvin <[email-masked]>
Date: Fri, 23 May 2008 11:04:04 -0400

-- On Thursday, May 22, 2008 10:55 PM -0400 Marshall Eubanks 
<[email-masked]> wrote regarding Fwd: MBONED post from 
[email-masked] requires approval --

> Couldn't this second-order backscatter get squelched ? Is there
> ever any reason for one IETF list to join another ?

Marshall,

As Glen said, this stuff will probably be squelched quite handily 
by TMDA when it's back in place.

However, for information, it's trivial to get Mailman to reject 
messages with From addresses of this form, or in fact to reject 
messages with arbitrary headers with any form that can be described 
with a regular expression.

>From the main admin page on a mailing list, select Privacy Options 
and then select Spam Filters.

Add a new item that looks like this:

    From: .*\-bounces@ietf\.org

Of course, one could argue that no bounces address should ever send 
messages to the list so perhaps the following is appropriate:

    From: .*\-bounces@.*

This presumes, of course, that no real person would ever have 
"-bounces" in their email address, since this regular expression is 
indiscriminate in that respect.

If you're concerned about case sensitivity you might want something 
like this:

    [Ff]rom: .*\-bounces@.*

Note that by adding a header filter you can get the message 
discarded.  You could add a similar line to the "Legacy anti-spam 
filters" section on the same page, which would make the entire 
comparison case-insensitive, but the only action here is to "hold" 
the message.  The message is already being held because the source 
is not a subscriber so this is only marginally helpful.

Jim