Cygwin lists spam filters

Cygwin lists spam filters

[Corinna Vinschen]

[-- Attachment #1: Type: text/plain, Size: 669 bytes --]

Hi overseers,


There's a spam filter for the Cygwin mailing lists which filters out all
(or better: most) mails which have raw email addresses in their body.
This filter doesn't seem to be activated on other mailing lists on
sourceware, at least I see raw email addresses from some of the regulars
on the GDB list happile float by.

Can we please disable this filter for the Cygwin lists as well?  It hits
people with their email address in the signature, which, maybe, isn't a
good idea, but also doesn't deserve a bounce mail with a "552 spam score
exceeded threshold" message.


Thanks,
Corinna

-- 
Corinna Vinschen
Cygwin Maintainer
Red Hat

[-- Attachment #2: Type: application/pgp-signature, Size: 819 bytes --]

Re: Cygwin lists spam filters

[Christopher Faylor]

As previously explained, the block was for email addresses which might
be mailing list addresses.  For instance, this was not blocked:

https://cygwin.com/ml/cygwin/2014-08/msg00598.html

Nevertheless, I've removed this and all other cygwin-specific
spam/mailing-list related filters.

Re: Cygwin lists spam filters

[Corinna Vinschen]

[-- Attachment #1: Type: text/plain, Size: 783 bytes --]

On Sep  2 10:49, Christopher Faylor wrote:
> As previously explained, the block was for email addresses which might
> be mailing list addresses.  For instance, this was not blocked:
> 
> https://cygwin.com/ml/cygwin/2014-08/msg00598.html

I have two guys of which I got copies of their emails in private mail
which were bounced with the "spam threshold exceeded" message.
Content-wise, they were entirely unsuspicious, apart from their own 
raw email address in the signature.

Would it help if I forward their mails to find out why they were
refused?  Maybe there's something else going on?

> Nevertheless, I've removed this and all other cygwin-specific
> spam/mailing-list related filters.

Thanks,
Corinna

-- 
Corinna Vinschen
Cygwin Maintainer
Red Hat

[-- Attachment #2: Type: application/pgp-signature, Size: 819 bytes --]

Re: Cygwin lists spam filters

[Christopher Faylor]

On Tue, Sep 02, 2014 at 05:34:57PM +0200, Corinna Vinschen wrote:
>On Sep  2 10:49, Christopher Faylor wrote:
>> As previously explained, the block was for email addresses which might
>> be mailing list addresses.  For instance, this was not blocked:
>> 
>> https://cygwin.com/ml/cygwin/2014-08/msg00598.html
>
>I have two guys of which I got copies of their emails in private mail
>which were bounced with the "spam threshold exceeded" message.
>Content-wise, they were entirely unsuspicious, apart from their own 
>raw email address in the signature.

<Insert cliche about assume here>

>Would it help if I forward their mails to find out why they were
>refused?  Maybe there's something else going on?

Wow, you apparently weren't paying attention to the 1342 times I
responded to email whiners in the cygwin list.  Have them follow the
directions in the bounce rather than contacting you directly.  There is
nothing new here.

I suspect that one of the people already contacted postmaster and isn't
reading his inbox.

Re: Cygwin lists spam filters

[Corinna Vinschen]

[-- Attachment #1: Type: text/plain, Size: 1658 bytes --]

On Sep  2 13:42, Christopher Faylor wrote:
> On Tue, Sep 02, 2014 at 05:34:57PM +0200, Corinna Vinschen wrote:
> >On Sep  2 10:49, Christopher Faylor wrote:
> >> As previously explained, the block was for email addresses which might
> >> be mailing list addresses.  For instance, this was not blocked:
> >> 
> >> https://cygwin.com/ml/cygwin/2014-08/msg00598.html
> >
> >I have two guys of which I got copies of their emails in private mail
> >which were bounced with the "spam threshold exceeded" message.
> >Content-wise, they were entirely unsuspicious, apart from their own 
> >raw email address in the signature.
> 
> <Insert cliche about assume here>
> 
> >Would it help if I forward their mails to find out why they were
> >refused?  Maybe there's something else going on?
> 
> Wow, you apparently weren't paying attention to the 1342 times I
> responded to email whiners in the cygwin list.  Have them follow the
> directions in the bounce rather than contacting you directly.  There is
> nothing new here.
> 
> I suspect that one of the people already contacted postmaster and isn't
> reading his inbox.

Can you please stop being hostile?  Thank you.

There are no directions in the bounce.

I copied an example of this bounce to sourceware.org:~/corinna/Message01.eml

What was the problem with this mail, if it wasn't the raw email address
in the sig?

Btw., Yesterday I sent this mail with the message text inlined, then an
hour later with the message text attached.  Both of my mails to
overseers simply disappeared, without even a bounce.


Corinna

-- 
Corinna Vinschen
Cygwin Maintainer
Red Hat

[-- Attachment #2: Type: application/pgp-signature, Size: 819 bytes --]

Re: Cygwin lists spam filters

[Frank Ch. Eigler]

Hi -

> There are no directions in the bounce.

Right, in this case the message was rejected upon receipt by sourceware,
so the bounce message was generated from his MTA, not sourceware.

> I copied an example of this bounce to sourceware.org:~/corinna/Message01.eml
> 
> What was the problem with this mail, if it wasn't the raw email address
> in the sig?

/var/log/maillog says:

Aug 30 17:14:51 sourceware spamd[28769]: spamd: checking message <102829035.20140830211503@mail.ru> for qpsmtpd:89
Aug 30 17:14:53 sourceware spamd[28769]: spamd: identified spam (11.3/5.0) for qpsmtpd:89 in 2.4 seconds, 2121 bytes.
Aug 30 17:14:53 sourceware spamd[28769]: spamd: result: Y 11 - AWL,BAYES_60,FREEMAIL_FROM,RCVD_IN_DNSWL_NONE,SPAM_BODY,SPF_PASS,UNSUBSCRIBE_BODY scantime=2.4,size=2121,user=qpsmtpd,uid=89,required_score=5.0,rhost=localhost,raddr=127.0.0.1,rport=/var/run/spamd,mid=<102829035.20140830211503@mail.ru>,bayes=0.659891,autolearn=spam

% spamassassin -t < $MESSAGE_FILE

gives more info (but the bayes state has changed since Aug. 30):

Content analysis details:   (32.0 points, 5.0 required)

 pts rule name              description
---- ---------------------- --------------------------------------------------
 2.0 UNSUBSCRIBE_BODY       BODY: UNSUBSCRIBE_BODY
 6.5 GARBLED_SUBJECT        GARBLED_SUBJECT
 1.5 GARBLED_FROM           GARBLED_FROM
-0.0 NO_RELAYS              Informational: message was not relayed via SMTP
 6.5 GARBLED_BODY           BODY: GARBLED_BODY
  10 SPAM_BODY              BODY: SPAM_BODY
 2.0 BAYES_80               BODY: Bayes spam probability is 80 to 95%
                            [score: 0.9277]
 1.5 BODY_8BITS             BODY: Body includes 8 consecutive 8-bit characters
 2.0 DSN_NO_MIMEVERSION     Return-Path <> and no MIME-Version: header


> Btw., Yesterday I sent this mail with the message text inlined, then
> an hour later with the message text attached.  Both of my mails to
> overseers simply disappeared, without even a bounce.

If you have the message-id, I could investigate.  (Which "this"?)

- FChE

Re: Cygwin lists spam filters

[Corinna Vinschen]

[-- Attachment #1: Type: text/plain, Size: 3308 bytes --]

Hi Frank,

On Sep  3 08:05, Frank Ch. Eigler wrote:
> Hi -
> 
> > There are no directions in the bounce.
> 
> Right, in this case the message was rejected upon receipt by sourceware,
> so the bounce message was generated from his MTA, not sourceware.
> 
> > I copied an example of this bounce to sourceware.org:~/corinna/Message01.eml
> > 
> > What was the problem with this mail, if it wasn't the raw email address
> > in the sig?
> 
> /var/log/maillog says:
> 
> Aug 30 17:14:51 sourceware spamd[28769]: spamd: checking message <102829035.20140830211503@mail.ru> for qpsmtpd:89
> Aug 30 17:14:53 sourceware spamd[28769]: spamd: identified spam (11.3/5.0) for qpsmtpd:89 in 2.4 seconds, 2121 bytes.
> Aug 30 17:14:53 sourceware spamd[28769]: spamd: result: Y 11 - AWL,BAYES_60,FREEMAIL_FROM,RCVD_IN_DNSWL_NONE,SPAM_BODY,SPF_PASS,UNSUBSCRIBE_BODY scantime=2.4,size=2121,user=qpsmtpd,uid=89,required_score=5.0,rhost=localhost,raddr=127.0.0.1,rport=/var/run/spamd,mid=<102829035.20140830211503@mail.ru>,bayes=0.659891,autolearn=spam
> 
> % spamassassin -t < $MESSAGE_FILE

Erm... was that the entire message file, including the bounce message
from his mail server?  If so, you should probably rerun this with
only the original message part, which is part of the file I uploaded
to ~/corinna/Message01.eml.

> gives more info (but the bayes state has changed since Aug. 30):
> 
> Content analysis details:   (32.0 points, 5.0 required)
> 
>  pts rule name              description
> ---- ---------------------- --------------------------------------------------
>  2.0 UNSUBSCRIBE_BODY       BODY: UNSUBSCRIBE_BODY

Adding the unsubscribe footer was invented for the cygwin-announce
mailing list many many years ago.  We actually asked our maintainers
to add it.  And here spamassassin turns that against them :}

>  6.5 GARBLED_SUBJECT        GARBLED_SUBJECT
>  1.5 GARBLED_FROM           GARBLED_FROM
> -0.0 NO_RELAYS              Informational: message was not relayed via SMTP

This ^^^^^^^^^ is only in the bounce message, not in the copy of the
original message.

>  6.5 GARBLED_BODY           BODY: GARBLED_BODY
>   10 SPAM_BODY              BODY: SPAM_BODY
>  2.0 BAYES_80               BODY: Bayes spam probability is 80 to 95%
>                             [score: 0.9277]
>  1.5 BODY_8BITS             BODY: Body includes 8 consecutive 8-bit characters

This is a weird rule.  So if somebody uses UTF-8 and, say, cyrillic
characters in the SIG, it gets 2 extra score points.  Wow.  This is
kind of unfriendly to non-latin language users...

>  2.0 DSN_NO_MIMEVERSION     Return-Path <> and no MIME-Version: header
> 
> 
> > Btw., Yesterday I sent this mail with the message text inlined, then
> > an hour later with the message text attached.  Both of my mails to
> > overseers simply disappeared, without even a bounce.
> 
> If you have the message-id, I could investigate.  (Which "this"?)

This in the sense of, I tried to send this here message you've just
replied to, first with inline, then with attached bounce message to
overseers.  The message ids are

  20140902185845.GA16455@calimero.vinschen.de
  20140902201727.GH6056@calimero.vinschen.de


Thanks,
Corinna

-- 
Corinna Vinschen
Cygwin Maintainer
Red Hat

[-- Attachment #2: Type: application/pgp-signature, Size: 819 bytes --]

Re: Cygwin lists spam filters

[Frank Ch. Eigler]

Hi -

> [...]
> I copied an example of this bounce to sourceware.org:~/corinna/Message01.eml

I am looking into it a little deeper; it looks as though the bayes
database is inclined to recognize even the embedded english
announcement email as spam for some reason.

- FChE

Re: Cygwin lists spam filters

[Frank Ch. Eigler]

Hi -

> [...]
> I copied an example of this bounce to sourceware.org:~/corinna/Message01.eml
> [...]

In this case, it appears that the sa-update automatically-downloaded
spam fingerprint regexps are misfiring, something about the presence
of the word "replacement" in the body.  Chris, can we make do without
sa-update etc.?

- FChE

Re: Cygwin lists spam filters

[Christopher Faylor]

On Wed, Sep 03, 2014 at 08:35:58AM -0400, Frank Ch. Eigler wrote:
>> [...]
>> I copied an example of this bounce to sourceware.org:~/corinna/Message01.eml
>> [...]
>
>In this case, it appears that the sa-update automatically-downloaded
>spam fingerprint regexps are misfiring, something about the presence
>of the word "replacement" in the body.  Chris, can we make do without
>sa-update etc.?

No.  FYI, GARBLED_SUBJECT, GARBLED_FROM, and SPAM_BODY are three of a
vast array of custom rules.  This isn't an issue with sa-update
misfiring.

At the risk of sounding hostile, I want to again stress, as I used to
repeatedly in the cygwin list, that if there are email problems they
should go to postmaster not overseers and they should include, if
possible, at a minimum a (possibly encoded) copy of the email.  Cygwin
mailing lists are not different than any other mailing list sponsored by
this site.  There is no need to engage the overseers community when
there is a problem.

I deal with email issues several times a week.  It's important to deal
with them as close to when they occur as possible.  Sending second-hand
email here rather than to sourceware asking for changes to be made in
what might be the problem adds delay to the process.

I haven't stopped being a sysadmin on sourceware so I continue to deal
with mailing list issues regardless of whether they relate to the Red
Hat Cygwin project or the free foftware gcc project.  So, I'll look into
correcting the issues found in these email messages like I always do.