[MAILER-DAEMON@sourceware.cygnus.com: failure notice]

[MAILER-DAEMON@sourceware.cygnus.com: failure notice]

[Ian Lance Taylor]

I sent this message to Jeff Blaine.

Ian

------- Start of forwarded message -------
Return-Path: <ian@airs.com>
Received: (qmail 14386 invoked from network); 7 Nov 2000 18:02:09 -0000
Received: from foghorn.airs.com (qmailr@63.201.54.26)
  by sourceware.cygnus.com with SMTP; 7 Nov 2000 18:02:09 -0000
Received: (qmail 7137 invoked by uid 10); 7 Nov 2000 18:02:07 -0000
Received: (qmail 29881 invoked by uid 269); 7 Nov 2000 18:02:01 -0000
Message-ID: <20001107180201.29880.qmail@daffy.airs.com>
Date: 7 Nov 2000 10:02:00 -0800
From: Ian Lance Taylor <ian@zembu.com>
To: jeffblaine@mediaone.net
CC: cgf@redhat.com
In-reply-to: < 20001107114647.A9339@redhat.com > (message from Christopher
	Faylor on Tue, 7 Nov 2000 11:46:47 -0500)
Subject: Re: YA ORBS complaint
References:  < 20001107114647.A9339@redhat.com >

   On Tue, Nov 07, 2000 at 10:12:41AM -0500, Jeff Blaine <jeffblaine@mediaone.net> wrote:

   >>So, this should work:
   >>
   >> http://www.orbs.org/verify.php3?address=24.147.1.156
   >
   >It doesn't.  Document contains no data.

Hi, Chris Faylor forwarded your note.

I tried that web address, and I see a notice from ORBS that that IP
address is relaying mail injected at 24.218.13.68.

   >But that's not the point, and I'm not the person losing out on this
   >deal.  Am I going to open a trouble ticket with MediaOne and take on the
   >herculean task of trying to get a gigantic corporation to change how
   >their mail server is configured so that I can offer help to some open
   >source project?
   >
   >Absolutely freaking not.
   >
   >It certainly sounds to me like somebody's overactive personal agenda
   >against spam e-mail is interfering with progress.
   >
   >The solution you have in place for dealing with spam e-mail is completely
   >bogus.  You're punishing the people who are reaching out to you.
   >
   >It's like having a fund raiser for charity and demanding that people
   >fill out a 3-page form and bring their donation in the form of a money
   >order only.

I'm sorry that this is not working for you.  If I were in your
position, I would be quite upset.

Consider it from our perspective for a moment.  The sources.redhat.com
site hosts very large mailing lists.  When spam mail gets sent to
those lists, we get dozens of complaints.  Before we had spam blocking
on the mailing lists, we got multiple spam messages every day.
Because people react badly to spam, that seriously interfered with the
ability to use those mailing lists to do useful work.

ORBS is a very effective spam blocking service.  They detect cases
where third parties can relay mail through other systems.  That is a
very common mechanism used to distribute spam.  Using ORBS on the
sources site permits us to eliminate a great deal of spam, and thus a
large number of complaints.

So our choices are: 1) permit spam to the mailing lists, in which case
we get regular complaints and some people unsubscribe, or 2) prohibit
spam to the mailing lists, in which case some people are unfairly
denied access, and must send their mail to somebody else in order to
get it onto the mailing list.

I wish there was a third option, but in the present state of the
Internet we unfortunately do not see one.

Ian Taylor
ian@zembu.com
------- End of forwarded message -------

Re: [MAILER-DAEMON@sourceware.cygnus.com: failure notice]

[Jason Molenda]

On Tue, Nov 07, 2000 at 10:10:14AM -0800, Ian Lance Taylor wrote:
> I sent this message to Jeff Blaine.

Wow, you're really diplomatic.  As everyone on overseers knows by now :-),
there are times when I have little patience.

One note:

> So our choices are: 1) permit spam to the mailing lists, in which case
> we get regular complaints and some people unsubscribe, or 2) prohibit
> spam to the mailing lists, in which case some people are unfairly
> denied access, and must send their mail to somebody else in order to
> get it onto the mailing list.
> 
> I wish there was a third option, but in the present state of the
> Internet we unfortunately do not see one.


A third option is to get their mail server fixed.  The complaintant
in this instance is probably not going to see this happen, but it's
not impossible in most cases.

Another option is to use a free e-mail service like, oh I don't
know, Yahoo Mail.  Set up a Yahoo Mail account and you can send
your outgoing mail through them, and you can even retrieve any
Yahoo Mail via POP3.  I'm sure Hotmail and other free mail services
on the net provide similar services.


Jason

Re: [MAILER-DAEMON@sources.redhat.com: failure notice]

[Christopher Faylor]

I agree that Ian was amazing diplomatic in his response.  It's
nice to know who I can send all of the angry email to in the future.

:-)

On Tue, Nov 07, 2000 at 03:21:51PM -0800, Jason Molenda wrote:
>Another option is to use a free e-mail service like, oh I don't
>know, Yahoo Mail.  Set up a Yahoo Mail account and you can send
>your outgoing mail through them, and you can even retrieve any
>Yahoo Mail via POP3.  I'm sure Hotmail and other free mail services
>on the net provide similar services.

This is what I usually suggest.

What about his idea of allowing anyone who was a subscriber to the
mailing list in question through?  That would be easy to implement.

Do we want to do this?

cgf

Re: [MAILER-DAEMON@sources.redhat.com: failure notice]

[Jason Molenda]

On Tue, Nov 07, 2000 at 07:46:25PM -0500, Christopher Faylor wrote:

> What about his idea of allowing anyone who was a subscriber to the
> mailing list in question through?  That would be easy to implement.

It should work - the userid in the DIR/editor file should be alias,
so you could run ezmlm-list if a message was going to be RBL'ed.
I'd only do the ezmlm-list check if the RBL matched true - it's a
pretty expensive operation for every message to go through.

There is also an 'allow' list of users (akin to the digest users)
for each mailing list.  It's only used for lists like libc-hacker
and cygwin-developer which restrict posts to list members.  It
allows you to have multiple accepted addresses, but only receive
e-mail at one.

For instance, I might subscribe as 'jason-libc-spam@molenda.com'
but I sometimes post as jsm@cygnus.com and jsm@redhat.com, so I'd
subscribe jsm@cygnus.com and jsm@redhat.com to the allow list.

With lists that restrict posts to subscribed people, these allow
list additions have to be approved by the moderator (along with
subscriptions).

I suspect the same allow lists (ezmlm-list DIR/allow) exist even
for lists that don't restrict posts in this manner, so someone who
was RBL'ed and was coming in from multiple locations could list
them all here.

I wouldn't worry much about spammers who are RBL'ed getting clever
enough to subscribe to a list before spamming.  That seems pretty
unlikely for now.

Jason

Re: [MAILER-DAEMON@sources.redhat.com: failure notice]

[Christopher Faylor]

On Tue, Nov 07, 2000 at 05:24:10PM -0800, Jason Molenda wrote:
>I wouldn't worry much about spammers who are RBL'ed getting clever
>enough to subscribe to a list before spamming.  That seems pretty
>unlikely for now.

I agree.  So this could be the best of all possible worlds, then, isn't
it?  We could get the benefit of spam blocking without impacting our
mailing list users.

This probably means that we can get rid of the whitelist, too.  People
could put themselves on the whitelist just by subscribing.

cgf

Re: [MAILER-DAEMON@sources.redhat.com: failure notice]

[Jason Molenda]

On Tue, Nov 07, 2000 at 10:38:44PM -0500, Christopher Faylor wrote:

> 
> This probably means that we can get rid of the whitelist, too.  People
> could put themselves on the whitelist just by subscribing.
> 


I'd keep it around.  If you had a list participant who read the list
on the web, but wanted to post, they'd get grumpy if we didn't have a
whitelist capability.

I'd expect the whitelist functionality to become largely unused if
the list subscriber check were added, though.


J

[MAILER-DAEMON@sourceware.cygnus.com: failure notice]

[Ian Lance Taylor]

I sent this message to Jeff Blaine.

Ian

------- Start of forwarded message -------
Return-Path: <ian@airs.com>
Received: (qmail 14386 invoked from network); 7 Nov 2000 18:02:09 -0000
Received: from foghorn.airs.com (qmailr@63.201.54.26)
  by sourceware.cygnus.com with SMTP; 7 Nov 2000 18:02:09 -0000
Received: (qmail 7137 invoked by uid 10); 7 Nov 2000 18:02:07 -0000
Received: (qmail 29881 invoked by uid 269); 7 Nov 2000 18:02:01 -0000
Message-ID: <20001107180201.29880.qmail@daffy.airs.com>
Date: 7 Nov 2000 10:02:00 -0800
From: Ian Lance Taylor <ian@zembu.com>
To: jeffblaine@mediaone.net
CC: cgf@redhat.com
In-reply-to: < 20001107114647.A9339@redhat.com > (message from Christopher
	Faylor on Tue, 7 Nov 2000 11:46:47 -0500)
Subject: Re: YA ORBS complaint
References:  < 20001107114647.A9339@redhat.com >

   On Tue, Nov 07, 2000 at 10:12:41AM -0500, Jeff Blaine <jeffblaine@mediaone.net> wrote:

   >>So, this should work:
   >>
   >> http://www.orbs.org/verify.php3?address=24.147.1.156
   >
   >It doesn't.  Document contains no data.

Hi, Chris Faylor forwarded your note.

I tried that web address, and I see a notice from ORBS that that IP
address is relaying mail injected at 24.218.13.68.

   >But that's not the point, and I'm not the person losing out on this
   >deal.  Am I going to open a trouble ticket with MediaOne and take on the
   >herculean task of trying to get a gigantic corporation to change how
   >their mail server is configured so that I can offer help to some open
   >source project?
   >
   >Absolutely freaking not.
   >
   >It certainly sounds to me like somebody's overactive personal agenda
   >against spam e-mail is interfering with progress.
   >
   >The solution you have in place for dealing with spam e-mail is completely
   >bogus.  You're punishing the people who are reaching out to you.
   >
   >It's like having a fund raiser for charity and demanding that people
   >fill out a 3-page form and bring their donation in the form of a money
   >order only.

I'm sorry that this is not working for you.  If I were in your
position, I would be quite upset.

Consider it from our perspective for a moment.  The sources.redhat.com
site hosts very large mailing lists.  When spam mail gets sent to
those lists, we get dozens of complaints.  Before we had spam blocking
on the mailing lists, we got multiple spam messages every day.
Because people react badly to spam, that seriously interfered with the
ability to use those mailing lists to do useful work.

ORBS is a very effective spam blocking service.  They detect cases
where third parties can relay mail through other systems.  That is a
very common mechanism used to distribute spam.  Using ORBS on the
sources site permits us to eliminate a great deal of spam, and thus a
large number of complaints.

So our choices are: 1) permit spam to the mailing lists, in which case
we get regular complaints and some people unsubscribe, or 2) prohibit
spam to the mailing lists, in which case some people are unfairly
denied access, and must send their mail to somebody else in order to
get it onto the mailing list.

I wish there was a third option, but in the present state of the
Internet we unfortunately do not see one.

Ian Taylor
ian@zembu.com
------- End of forwarded message -------

Re: [MAILER-DAEMON@sourceware.cygnus.com: failure notice]

[Jason Molenda]

On Tue, Nov 07, 2000 at 10:10:14AM -0800, Ian Lance Taylor wrote:
> I sent this message to Jeff Blaine.

Wow, you're really diplomatic.  As everyone on overseers knows by now :-),
there are times when I have little patience.

One note:

> So our choices are: 1) permit spam to the mailing lists, in which case
> we get regular complaints and some people unsubscribe, or 2) prohibit
> spam to the mailing lists, in which case some people are unfairly
> denied access, and must send their mail to somebody else in order to
> get it onto the mailing list.
> 
> I wish there was a third option, but in the present state of the
> Internet we unfortunately do not see one.


A third option is to get their mail server fixed.  The complaintant
in this instance is probably not going to see this happen, but it's
not impossible in most cases.

Another option is to use a free e-mail service like, oh I don't
know, Yahoo Mail.  Set up a Yahoo Mail account and you can send
your outgoing mail through them, and you can even retrieve any
Yahoo Mail via POP3.  I'm sure Hotmail and other free mail services
on the net provide similar services.


Jason

Re: [MAILER-DAEMON@sources.redhat.com: failure notice]

[Christopher Faylor]

On Tue, Nov 07, 2000 at 05:24:10PM -0800, Jason Molenda wrote:
>I wouldn't worry much about spammers who are RBL'ed getting clever
>enough to subscribe to a list before spamming.  That seems pretty
>unlikely for now.

I agree.  So this could be the best of all possible worlds, then, isn't
it?  We could get the benefit of spam blocking without impacting our
mailing list users.

This probably means that we can get rid of the whitelist, too.  People
could put themselves on the whitelist just by subscribing.

cgf

Re: [MAILER-DAEMON@sources.redhat.com: failure notice]

[Christopher Faylor]

I agree that Ian was amazing diplomatic in his response.  It's
nice to know who I can send all of the angry email to in the future.

:-)

On Tue, Nov 07, 2000 at 03:21:51PM -0800, Jason Molenda wrote:
>Another option is to use a free e-mail service like, oh I don't
>know, Yahoo Mail.  Set up a Yahoo Mail account and you can send
>your outgoing mail through them, and you can even retrieve any
>Yahoo Mail via POP3.  I'm sure Hotmail and other free mail services
>on the net provide similar services.

This is what I usually suggest.

What about his idea of allowing anyone who was a subscriber to the
mailing list in question through?  That would be easy to implement.

Do we want to do this?

cgf

Re: [MAILER-DAEMON@sources.redhat.com: failure notice]

[Jason Molenda]

On Tue, Nov 07, 2000 at 07:46:25PM -0500, Christopher Faylor wrote:

> What about his idea of allowing anyone who was a subscriber to the
> mailing list in question through?  That would be easy to implement.

It should work - the userid in the DIR/editor file should be alias,
so you could run ezmlm-list if a message was going to be RBL'ed.
I'd only do the ezmlm-list check if the RBL matched true - it's a
pretty expensive operation for every message to go through.

There is also an 'allow' list of users (akin to the digest users)
for each mailing list.  It's only used for lists like libc-hacker
and cygwin-developer which restrict posts to list members.  It
allows you to have multiple accepted addresses, but only receive
e-mail at one.

For instance, I might subscribe as 'jason-libc-spam@molenda.com'
but I sometimes post as jsm@cygnus.com and jsm@redhat.com, so I'd
subscribe jsm@cygnus.com and jsm@redhat.com to the allow list.

With lists that restrict posts to subscribed people, these allow
list additions have to be approved by the moderator (along with
subscriptions).

I suspect the same allow lists (ezmlm-list DIR/allow) exist even
for lists that don't restrict posts in this manner, so someone who
was RBL'ed and was coming in from multiple locations could list
them all here.

I wouldn't worry much about spammers who are RBL'ed getting clever
enough to subscribe to a list before spamming.  That seems pretty
unlikely for now.

Jason

Re: [MAILER-DAEMON@sources.redhat.com: failure notice]

[Jason Molenda]

On Tue, Nov 07, 2000 at 10:38:44PM -0500, Christopher Faylor wrote:

> 
> This probably means that we can get rid of the whitelist, too.  People
> could put themselves on the whitelist just by subscribing.
> 


I'd keep it around.  If you had a list participant who read the list
on the web, but wanted to post, they'd get grumpy if we didn't have a
whitelist capability.

I'd expect the whitelist functionality to become largely unused if
the list subscriber check were added, though.


J