Subject: Re: spam delivery to list archives has been fixed

From: James M Galvin <[email-masked]>
Date: Tue, 03 Feb 2009 19:41:24 -0500

-- On February 3, 2009 5:04:42 PM -0500 Barry Leiba 
<[email-masked]> wrote regarding Re: spam delivery to list 
archives has been fixed --

> Thanks, Jim.
>
> But I presume that mailing lists hosted elsewhere still use the old
> archive mechanism and are still vulnerable to the spam problem we've
> been talking about. Have you done anything to deal with that?

Yes, they are still vulnerable, although it turns out they haven't been 
as much of a problem, yet.  It's odd but it can be partially explained 
if we guess that the spammers didn't scrape the entire IETF web site 
for addresses, just some places.

The solution here will be to create lists on the IETF site and then to 
get those externally hosted lists to change their archive alias to be 
the list on the IETF site.  This way everything uses the same 
mechanisms for authorization and spam control.

In terms of priority, getting the spam out of existing archives will be 
done next.  However, I suspect that if there's a list archive you see 
with a lot of spam in it that a note to ietf-action will get Steve to 
coordinate the change of the archive alias quickly.

By the way, I forgot to report some other good news with this change. 
One of the side benefits of the work that was done is that now the 
"listinfo" page for each mailing list will have the correct URL for the 
archive in the last sentence of the description.  This last sentence is 
added automatically by Mailman and it used to be set wrong.  The URL 
that was there would work, because the web server was configured to 
re-map it, but now that is no longer necessary.

Jim

---

From: Russ Housley <[email-masked]>
Date: Wed, 04 Feb 2009 09:28:46 -0500

>Yes, they are still vulnerable, although it turns out they haven't 
>been as much of a problem, yet.  It's odd but it can be partially 
>explained if we guess that the spammers didn't scrape the entire 
>IETF web site for addresses, just some places.
>
>The solution here will be to create lists on the IETF site and then 
>to get those externally hosted lists to change their archive alias 
>to be the list on the IETF site.  This way everything uses the same 

The other alternative is to move the WG mail list to ietf.org so that 
there is not an exposed email address for the archive 
collector.  Please consider this option.  In the past, we have had 
trouble with incomplete archives because this email address got 
suspended from the mail list membership, resulting in too little 
archive traffic, as opposed to the spammers currently giving us too 
much archive traffic.

Russ