Subject: Flood of subscription requests to IETF mailing lists

From: Suresh Krishnan <[email-masked]>
Date: Tue, 25 Aug 2015 22:20:03 +0000

Hi all,
   One of the lists I moderate was inundated with a flood of subscribe 
messages from emails of the pattern

[email-masked]
[email-masked]
[email-masked]

Two other moderators and I cleared up about 60 of these requests by 
discarding manually but they kept coming. Looking for a better solution 
to the problem, we found a ban_list in the Privacy options for the 
mailman lists. This ban_list allows a regex for people who will 
automatically be banned from joining. I added the following emails to 
the ban_list and the flood stopped.

^kemo\[email-masked]
[email-masked]
[email-masked]

I heard there are other lists that are having the same problems. Hope 
this can help.

Thanks
Suresh

---

From: Alia Atlas <[email-masked]>
Date: Tue, 25 Aug 2015 18:31:46 -0400

Thanks!  This is hitting one of the lists I see too.

Alia
On Aug 25, 2015 6:20 PM, "Suresh Krishnan" <[email-masked]>

---

From: "Andrew G. Malis" <[email-masked]>
Date: Tue, 25 Aug 2015 19:01:20 -0400

Suresh,

Thanks!

I hadn't yet seen a problem with the PALS list, but I just added those
entries to its ban_list just in case.

Cheers,
Andy

---

From: Kathleen Moriarty <[email-masked]>
Date: Tue, 25 Aug 2015 19:07:47 -0400

We were having the same problem with the same set of addresses on another list, so my co-list manager changed the subscription to confirm then approve.  It seems to be working.

Thanks,
Kathleen 

Sent from my iPhone

> On Aug 25, 2015, at 7:01 PM, Andrew G. Malis <[email-masked]> wrote:
> 
> Suresh,
> 
> Thanks!
> 
> I hadn't yet seen a problem with the PALS list, but I just added those entries to its ban_list just in case.
> 
> Cheers,
> Andy
> 
>> On Tue, Aug 25, 2015 at 6:20 PM, Suresh Krishnan <[email-masked]> wrote:
>> Hi all,

---

From: Wesley Eddy <[email-masked]>
Date: Wed, 26 Aug 2015 20:55:06 -0400

> [email-masked]

Thanks, these were helpful!

Once I added filters for these, we started getting them today for
[email-masked]
[email-masked]

Has anyone gotten AMS or someone to look into these yet?  I don't
really want to play a game of finding new regexes every day or two.

-- 
Wes Eddy
MTI Systems

---

From: Kathleen Moriarty <[email-masked]>
Date: Wed, 26 Aug 2015 21:11:30 -0400

Yes, Brian Campbell and I worked with Robert Sparks and Glen.

We planned to use the same option Suresh described if changing the subscription to something like confirm (email address) and approve.  That seems to be working on our list.

Good luck!
Kathleen 

Sent from my iPhone

> On Aug 26, 2015, at 8:55 PM, Wesley Eddy <[email-masked]> wrote:
>

---

From: Suresh Krishnan <[email-masked]>
Date: Thu, 27 Aug 2015 02:59:33 +0000

Hi Wes/Kathleen,
   Yes. This is turning into a game of whack-a-mole. We can probably 
move to a more generic regular expression but that might end up causing 
some collateral damage.

Thanks
Suresh

---

From: Derek Atkins <[email-masked]>
Date: Thu, 27 Aug 2015 09:03:36 -0400

> move to a more generic regular expression but that might end up causing 

I recommend banning .*\+.*@.*

We can whitelist known exceptions on a case-by-case basis, maybe by
allowing people to use their datatracker ID to add themselves to the
global whitelist registry.

:)

> Suresh

-derek

-- 
       Derek Atkins                 617-623-3745
       [email-masked]             www.ihtfp.com
       Computer and Internet Security Consultant

---

From: Brian Rosen <[email-masked]>
Date: Thu, 27 Aug 2015 09:17:06 -0400

No, that will really not work.  MANY valid subscriptions have something like [email-masked] <mailto:[email-masked]>, which the subscriber uses as a filter to route all IETF mail a particular place.

> On Aug 27, 2015, at 9:03 AM, Derek Atkins <[email-masked]> wrote:
>

---

From: Kathleen Moriarty <[email-masked]>
Date: Thu, 27 Aug 2015 09:22:22 -0400

The fix I mentioned is still working... and doesn't require explicit filtering.

On Thu, Aug 27, 2015 at 9:17 AM, Brian Rosen <[email-masked]> wrote:
> No, that will really not work.  MANY valid subscriptions have something like
> [email-masked], which the subscriber uses as a filter to route all
> IETF mail a particular place.
>
>

-- 

Best regards,
Kathleen

---

From: Jeffrey Haas <[email-masked]>
Date: Thu, 27 Aug 2015 11:30:43 -0400

> move to a more generic regular expression but that might end up causing 

FWIW, this is a regular problem with any large mailing list.

The thing I miss about majordomo is the ability to handle such issues by
running a shell script over the subscription info.  Mailman's webui is a bit
clunky - does anyone know how to manage such things via email?

Things that helped reduce my personal spam from this is to set
admin_immed_notify to No, so that I only get the admin requests once a day.

-- Jeff

---

From: Jeffrey Haas <[email-masked]>
Date: Thu, 27 Aug 2015 11:32:19 -0400

> global whitelist registry.

Let's not.  I've already been rather tempted to write a terse RFC that is
titled "The plus symbol is valid for email addresses".  While obviously
covered by the old RFC 8* stuff, people keep getting their validators wrong.
(Including Apple, as I found out earlier this week while dealing with a
dying desktop.)

-- Jeff

---

From: Benoit Claise <[email-masked]>
Date: Mon, 31 Aug 2015 10:16:09 +0200

On 26/08/2015 01:07, Kathleen Moriarty wrote:
> We were having the same problem with the same set of addresses on 
> another list, so my co-list manager changed the subscription to 
> confirm then approve.  It seems to be working.
Thanks. I see 100 new requests / day on my directorate lists.
I will apply your proposed trick.

Regards, Benoit
>
> Thanks,
> Kathleen
>
> Sent from my iPhone
>
> On Aug 25, 2015, at 7:01 PM, Andrew G. Malis <[email-masked] 
> <mailto:[email-masked]>> wrote:
>
>> Suresh,
>>
>> Thanks!
>>
>> I hadn't yet seen a problem with the PALS list, but I just added 
>> those entries to its ban_list just in case.
>>
>> Cheers,
>> Andy
>>
>> On Tue, Aug 25, 2015 at 6:20 PM, Suresh Krishnan 
>> <[email-masked] <mailto:[email-masked]>> 
>> wrote:
>>
>>     Hi all,
>>     [email-masked] <mailto:[email-masked]>
>>     [email-masked] <mailto:[email-masked]>
>>     <mailto:[email-masked]>
>>
>>     ^kemo\[email-masked] <http://gmail.com>
>>     [email-masked] <http://gmail.com>
>>     [email-masked] <http://gmail.com>
>>

---

From: Loa Andersson <[email-masked]>
Date: Mon, 31 Aug 2015 11:55:08 +0200

Benoit,

Yes, it works. As long as they keep sending from the same mail address.
We just got the first 50 from a new set of addresses.

And there is no pattern (other than gmail) that I can detect that would
really help. I think that for the list we have under attack we could ban
"gmail" without any real problem, but for a wg mailing list that would
not work.

/Loa

On 2015-08-31 10:16, Benoit Claise wrote:
>> On Aug 25, 2015, at 7:01 PM, Andrew G. Malis
>> <<mailto:[email-masked]>[email-masked]> wrote:
>>
>>> Suresh,
>>>
>>> Thanks!
>>>
>>> <<mailto:[email-masked]>[email-masked]>
>>> wrote:
>>>
>>>     Hi all,

---

From: Kathleen Moriarty <[email-masked]>
Date: Mon, 31 Aug 2015 07:48:25 -0400

Loa,

FYI - The filters Suresh posted suffer from the changing address issue, changing the subscription policy does not and is still working.

Best regards,
Kathleen 

Sent from my iPhone

> On Aug 31, 2015, at 5:55 AM, Loa Andersson <[email-masked]> wrote:
> 
> Benoit,
>

---

From: "Bradner, Scott" <[email-masked]>
Date: Mon, 31 Aug 2015 12:21:18 +0000

what do you do to change the subscription policy? (i.e. what are the major buttons)

Scott

> On Aug 31, 2015, at 7:48 AM, Kathleen Moriarty <[email-masked]> wrote:
> 
> Loa,
>

---

From: Kathleen Moriarty <[email-masked]>
Date: Mon, 31 Aug 2015 09:03:32 -0400

You just need to change subscribe_policy from "Require approval" to
"Confirm and approve".

Hopefully it keeps working once we all are doing the same thing :-)

-- 

Best regards,
Kathleen

---

From: "Bradner, Scott" <[email-masked]>
Date: Mon, 31 Aug 2015 13:17:29 +0000

oh, there it is under privacy options "What steps are required for subscription?”

thanks

Scott

> On Aug 31, 2015, at 9:03 AM, Kathleen Moriarty <[email-masked]> wrote:
>