Subject: More spam

From: Yoav Nir <[email-masked]>
Date: Tue, 29 Oct 2013 15:07:04 +0000

Hi.

Over on the http-auth list I'm getting attempts by a  [email-masked]<mailto:[email-masked]>  to post spam with subject "The SDN, NFV & Network Virtualization Bible: 2014 - 2020".

Are others seeing this as well?

Yoav

---

From: Peter Saint-Andre <[email-masked]>
Date: Tue, 29 Oct 2013 09:08:41 -0600

On 10/29/13 9:07 AM, Yoav Nir wrote:
> Hi.
> 
> Over on the http-auth list I'm getting attempts by a 
> [email-masked] <mailto:[email-masked]>  to post spam
> with subject "The SDN, NFV & Network Virtualization Bible: 2014 -
> 2020".
> 

Yes. I discarded it from the jcardcal list.

Peter

- -- 
Peter Saint-Andre
https://stpeter.im/

---

From: Russ Housley <[email-masked]>
Date: Tue, 29 Oct 2013 11:09:44 -0400

Yes.  I'm not letting it through to my WG.

Russ

On Oct 29, 2013, at 11:07 AM, Yoav Nir wrote:

> Hi.
> 
> Over on the http-auth list I'm getting attempts by a  [email-masked]  to post spam with subject "The SDN, NFV & Network Virtualization Bible: 2014 - 2020".
>

---

From: Brian Trammell <[email-masked]>
Date: Tue, 29 Oct 2013 16:10:26 +0100

hi Yoav,

Yep. Hit IPPM and MILE as well.

Cheers,

Brian

> Yoav Nir <mailto:[email-masked]>
> 29 October 2013 16:07
> Hi.
>
> [email-masked] <mailto:[email-masked]> to post spam with 
> subject "The SDN, NFV & Network Virtualization Bible: 2014 - 2020".
>

---

From: Ari Keränen <[email-masked]>
Date: Tue, 29 Oct 2013 17:10:49 +0200

Hi,

> Are others seeing this as well?

Yeah, blocked that sender already for MMUSIC.

I was thinking that some black list spanning over all WG lists could be 
useful so that only one of us needs to do the screening for such 
spammers targeting many WGs.

Cheers,
Ari

---

From: "Romascanu, Dan (Dan)" <[email-masked]>
Date: Tue, 29 Oct 2013 15:11:07 +0000

Yes, and I discarded it.

Dan

From: [email-masked] [mailto:[email-masked]] On Behalf Of Yoav Nir
Sent: Tuesday, October 29, 2013 5:07 PM
To: [email-masked] Chairs
Subject: More spam

Hi.

Yoav

---

From: Warren Kumari <[email-masked]>
Date: Tue, 29 Oct 2013 08:13:47 -0700

> Yeah, blocked that sender already for MMUSIC.

Yeah. I tossed it (and figured I wouldn't bother telling my WGs that I did so). I did not blacklist the sender because I didn't want to be viewed as consoling their ability to post on something useful in the future.

> 
> I was thinking that some black list spanning over all WG lists could be useful so that only one of us needs to do the screening for such spammers targeting many WGs.

Great idea.
W

--
What our ancestors would really be thinking, if they were alive today, is: "Why is it so dark in here?"

    -- (Terry Pratchett, Pyramids)

---

From: Dave Crocker <[email-masked]>
Date: Tue, 29 Oct 2013 08:20:19 -0700

> spammers targeting many WGs.

So...

Blacklists have some operational challenges.  They are fine when 
carefully maintained and for continuing "attacks".  But their value 
typically doesn't outweigh their false-positive and personal effort 
downsides otherwise.

Most of the spam we get on IETF is multicast bursts.  Hit a bunch of 
lists over a short period of time.  I'm suggesting this is less amenable 
to blacklisting, absent a very active and skilled anti-spam operations 
team (which the IETF doesn't have.)

Note that the sort being proposed here is likely to be designed so that 
anyone  (or any list moderator, or... name a set of folk) can blacklist 
anyone else.  The members of that enabled set won't be coordinated and 
typically won't be anti-spam ops experts.  The likelihood of eventually 
having false positives or other synchronization problems amongst the 
group is high.

d/

-- 
Dave Crocker
Brandenburg InternetWorking
bbiw.net

---

From: "Andrew G. Malis" <[email-masked]>
Date: Tue, 29 Oct 2013 11:28:09 -0400

I also just rejected it (and the sender) for pwe3.

Cheers,
Andy

On Tue, Oct 29, 2013 at 11:10 AM, Ari Keränen <[email-masked]>wrote:

> useful so that only one of us needs to do the screening for such spammers
> targeting many WGs.
>
>
> Cheers,
> Ari
>
>

---

From: Yaakov Stein <[email-masked]>
Date: Tue, 29 Oct 2013 15:32:15 +0000

and one man's spam is another man's meat.

I can imagine some I*TF mailing lists being interested in this announcement (e.g., SDNRG).

Y(J)S

---

From: joel jaeggli <[email-masked]>
Date: Tue, 29 Oct 2013 09:41:18 -0700

they shotguned that marketing message out to dozens of IETF mailing lists unrelated to SDN, I have no trouble calling them a spammer.

I’ve discarded 4 of them from my moderator queues already.

joel

---

From: Dave Crocker <[email-masked]>
Date: Tue, 29 Oct 2013 09:59:27 -0700

>> and one man's spam is another man's meat.

As I understand it, the messages in question were clearly and 
substantially outside what is permitted for IETF discussion lists.  And 
they have marketing content and they are sent in bulk and the sender 
really doesn't have any relationship with the recipients.

Spam is a term of art, with an entire anti-spam industry behind it; it's 
not a "Through the Looking Glass", means-whatever-you-want term. 
Specific industry definitions vary a bit, but the above covers the 
common criteria.

The issue is how to deal with spam on IETF lists, not what to define 
spam as.

d/

---

From: "Bert Wijnen (IETF)" <[email-masked]>
Date: Tue, 29 Oct 2013 18:09:54 +0100

I did same for netconf list.

And completeley blocking (i.e. automatic reject) for the sender seems more
and more justified seeing how many mlists he has targeted.

Does anyone know if this person (amail adress) has ever made a serious
contribution on any IETF mailing list? Probably not, cause he/she seems to
ignore the "note well" and "net etiquette" rules completely.

Bert

On 10/29/13 4:28 PM, Andrew G. Malis wrote:
> On Tue, Oct 29, 2013 at 11:10 AM, Ari Keränen <[email-masked] <mailto:[email-masked]>> wrote:
>
>     Hi,
>
>
>         [email-masked] <mailto:[email-masked]> <mailto:[email-masked] <mailto:[email-masked]>> to post
>         spam with
>

---

From: Yaakov Stein <[email-masked]>
Date: Tue, 29 Oct 2013 17:19:20 +0000

As I see it, the email was advertising a paper containing 
market analysis relating to a subject of sufficient interest to the IETF
that an IAB technical plenary was devoted to it.

Although it is indeed being offered for sale (at a hefty price)
it also appears to be available free-of-charge for academic purposes.

However, it is quite true that the sender did not choose the mailing lists to which the message was sent,
but apparently sent to all IETF lists.

However, I am not defending this particular email.

I am simply saying that I do not believe that the moderator of any single IETF list
should be able to decide that an email should be rejected from all IETF lists.

Y(J)S

-----Original Message-----
From: Dave Crocker [mailto:[email-masked]] 
Sent: 29 October, 2013 18:59
To: joel jaeggli; Yaakov Stein
Cc: Ari Keränen; Yoav Nir; [email-masked] Chairs
Subject: Re: More spam

On 10/29/2013 9:41 AM, joel jaeggli wrote:
> I've discarded 4 of them from my moderator queues already.
>
> joel
>

As I understand it, the messages in question were clearly and substantially outside what is permitted for IETF discussion lists.  And they have marketing content and they are sent in bulk and the sender really doesn't have any relationship with the recipients.

Spam is a term of art, with an entire anti-spam industry behind it; it's not a "Through the Looking Glass", means-whatever-you-want term. 
Specific industry definitions vary a bit, but the above covers the common criteria.

The issue is how to deal with spam on IETF lists, not what to define spam as.

d/

---

From: Stephen Farrell <[email-masked]>
Date: Tue, 29 Oct 2013 17:20:48 +0000

Probably pointlessly, when I saw a couple of these, I sent
'em an email asking 'em to stop.

S.

On 10/29/2013 05:09 PM, Bert Wijnen (IETF) wrote:
>> On Tue, Oct 29, 2013 at 11:10 AM, Ari Keränen
>> <[email-masked] <mailto:[email-masked]>> wrote:
>>
>>     Hi,
>>
>>
>>         [email-masked] <mailto:[email-masked]>
>> <mailto:[email-masked] <mailto:[email-masked]>> to post
>>         spam with
>>
>>     I was thinking that some black list spanning over all WG lists
>> could be useful so that only one of us needs to do the screening
>>     for such spammers targeting many WGs.
>>
>>
>>     Cheers,
>>     Ari
>>
>>
> 
>

---

From: Dave Crocker <[email-masked]>
Date: Tue, 29 Oct 2013 10:22:56 -0700

> should be able to decide that an email should be rejected from all IETF lists.

I agree.  The obvious alternative is to have someone take requests for 
the common list and choose whether to add an address to it.

An my point about short-term spamming bursts is that such a list 
maintenance model won't be responsive enough.

d/

---

From: Ray Bellis <[email-masked]>
Date: Tue, 29 Oct 2013 17:24:23 +0000

> and more justified seeing how many mlists he has targeted.

I discarded the message sent to the Homenet WG, and then added him to the auto-reject too when I got the same spam sent to me as an individual.

Ray

---

From: Stephen Kent <[email-masked]>
Date: Tue, 29 Oct 2013 14:00:46 -0400

Yes, I saw the message submitted to PKIX.

I killed it.

It felt good :-).

Steve

---

From: Adam Roach <[email-masked]>
Date: Tue, 29 Oct 2013 13:22:35 -0500

> maintenance model won't be responsive enough. 

But an automated filter that detected substantially identical messages 
being sent to more than a small number of lists and blocked subsequent 
messages matching the pattern could be.

Of course, the problem isn't bad enough to warrant such countermeasures. 
At least, not yet.

/a

---

From: Dave Crocker <[email-masked]>
Date: Tue, 29 Oct 2013 11:41:38 -0700

> messages matching the pattern could be.

For real spam, this sort of mechanism is notoriously difficult to get to 
work well and the spammers are notoriously good at working around the 
detection algorithms.

However I think the current concerns is indiscreet posters rather than 
professional spammers.  And indeed, their messages seem to be identical.

So I could imagine reasonably good results from a moderately simple 
mechanism like this, as long as it is biased towards false negatives 
rather than false positives.  That is, sometimes accepting a bad 
message, rather than sometimes rejecting a good one...

d/

---

From: Andrew Sullivan <[email-masked]>
Date: Tue, 29 Oct 2013 14:49:45 -0400

On Tue, Oct 29, 2013 at 01:22:35PM -0500, Adam Roach wrote:
> Of course, the problem isn't bad enough to warrant such
> countermeasures. At least, not yet.

Indeed, I would say that I've invested considerably more time in
handling messages about the problem than had to be invested in
rejecting the posting.

Best,

A

-- 
Andrew Sullivan
[email-masked]

---

From: Benoit Claise <[email-masked]>
Date: Tue, 29 Oct 2013 20:21:45 +0100

> handling messages about the problem than had to be invested in
+1

Regards, Benoit

---

From: Ted Lemon <[email-masked]>
Date: Tue, 29 Oct 2013 19:22:39 +0000

On Oct 29, 2013, at 2:22 PM, Adam Roach <[email-masked]> wrote:
> But an automated filter that detected substantially identical messages being sent to more than a small number of lists and blocked subsequent messages matching the pattern could be.

It would be much easier to just automatically moderate the first message anyone sends to any IETF mailing list.   If it's inappropriate, they get blocked.   Huge efforts spent developing tools to block stupid spam are not worthwhile.

---

From: "Moriarty, Kathleen" <[email-masked]>
Date: Tue, 29 Oct 2013 15:40:58 -0400

Why not report the spam using ARF from the MARF working group?

Tools exist and we would be leveraging IETF standards for reporting spam.  This should help stop it at the source and make it a little harder for the offender.  

Best regards,
Kathleen 

Sent from my iPhone

---

From: "Cao Zhen \(CZ\)" <[email-masked]>
Date: Wed, 30 Oct 2013 10:08:20 +0800

It seems to be a pretty strong spam, and I received it on the ietf wg list, my company box and my gmail box. 

From: [email-masked] [mailto:[email-masked]] On Behalf Of Yoav Nir
Sent: Tuesday, October 29, 2013 11:07 PM
To: [email-masked] Chairs
Subject: More spam

Hi. 

Over on the http-auth list I'm getting attempts by a   <mailto:[email-masked]> [email-masked]  to post spam with subject "The SDN, NFV & Network Virtualization Bible: 2014 - 2020".

Yoav