SPAM from Usenet

F

F. Senault

Le 6 juin 2009 à 11:05, Ryan Davis a écrit :
I think it is an unfair assumption that we'll lose those people's
posts to the list if we drop the gateway. (most) People are adaptable.

Well, for my part, I don't think I could follow and participate to the
list with a mail client (event if I'm very satisfied of my client).

Not that I post that much, mind you, but... :)

Fred
 
F

F. Senault

Le 6 juin 2009 à 07:24, Eric Hodel a écrit :
Is it possible to include the usenet Received headers in gateway
messages? They don't seem to be there now. (maybe I'm mis-remembering
Usenet.)

There's a path header instead, and a bunch of relevant headers, notably
for the web-news gateways (i.e. google groups) ; here's a sample of the
headers usenet-side for one of the last spams :

| Path: talisker.lacave.net!lacave.net!feeder.erje.net!news2.arglkargh.de!news.glorb.com!news2.glorb.com!postnews.google.com!g20g2000vba.googlegroups.com!not-for-mail
| From: "(e-mail address removed)" <[email protected]>
| Newsgroups: comp.lang.ruby
| Subject: http://kh-luxuriescar.blogspot.com
| Date: Fri, 5 Jun 2009 12:30:27 -0700 (PDT)
| Organization: http://groups.google.com
| Lines: 4
| Message-ID: <0f56e7b8-caa1-43b2-9369-0379637ac1e9@g20g2000vba.googlegroups.com>
| NNTP-Posting-Host: 116.71.7.204
| Mime-Version: 1.0
| Content-Type: text/plain; charset=ISO-8859-1
| Content-Transfer-Encoding: 7bit
| X-Trace: posting.google.com 1244230227 25805 127.0.0.1 (5 Jun 2009 19:30:27 GMT)
| X-Complaints-To: (e-mail address removed)
| NNTP-Posting-Date: Fri, 5 Jun 2009 19:30:27 +0000 (UTC)
| Complaints-To: (e-mail address removed)
| Injection-Info: g20g2000vba.googlegroups.com; posting-host=116.71.7.204; posting-account=rqGG2woAAABMByqenh5rRwTgLM5dCy-7
| User-Agent: G2/1.0
| X-HTTP-Via: 1.1 STAR
| X-HTTP-UserAgent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/525.19 (KHTML, like Gecko) Chrome/1.0.154.53 Safari/525.19,gzip(gfe),gzip(gfe)
| Xref: talisker.lacave.net comp.lang.ruby:242475
This might help my spam filter block these messages for me.

Note that, recently, I thought that it would be a good idea to include
the _mail_ received headers Usenet side, quite for the same reasons...
:)

Fred
 
J

James Gray

I think it is an unfair assumption that we'll lose those people's
posts to the list if we drop the gateway. (most) People are adaptable.

Hmm, my experience has been that the email vs. Usenet discussion is a
religious issue on part with vi vs. emacs. People just like what they
like and I think we're unlikely to alter that too much.

James Edward Gray II
 
J

James Gray

Is it possible to include the usenet Received headers in gateway
messages? They don't seem to be there now. (maybe I'm mis-
remembering Usenet.) This might help my spam filter block these
messages for me.

Yeah, it looks like the gateway filters them out for some pseudo-
Received headers it adds. It has always done this and I've just never
touched that part. I'm not sure if there's a reason for it, like
Usenet headers allowing different content. I would need to look into
that to say for sure if it could be changed.

James Edward Gray II
 
T

trans

Yeah, it looks like the gateway filters them out for some pseudo-
Received headers it adds. =A0It has always done this and I've just never = =A0
touched that part. =A0I'm not sure if there's a reason for it, like =A0
Usenet headers allowing different content. =A0I would need to look into = =A0
that to say for sure if it could be changed.

An interesting aspect of the Google Group is that in order to post to
the list via the group you still have to sign up as a member of the
actual ruby-talk mailing list (which means taking the time to turn off
email delivery). Yes it can be initially annoying, but it has the
advantage of making the Google Group much more immune to SPAM
delivery.

Can the Usenet gateway be setup in a similar fashion?

T.
 
R

Rick DeNatale

An interesting aspect of the Google Group is that in order to post to
the list via the group you still have to sign up as a member of the
actual ruby-talk mailing list (which means taking the time to turn off
email delivery). Yes it can be initially annoying, but it has the
advantage of making the Google Group much more immune to SPAM
delivery.

I don't think so.
http://groups.google.com/group/comp.lang.ruby/about

The google group is really just a proxy to the usenet group
comp.lang.ruby it just slurps up everything posted there.

--=20
Rick DeNatale

Blog: http://talklikeaduck.denhaven2.com/
Twitter: http://twitter.com/RickDeNatale
WWR: http://www.workingwithrails.com/person/9021-rick-denatale
LinkedIn: http://www.linkedin.com/in/rickdenatale
 
E

Eric Hodel

I think you can use the "Newsgroups: comp.lang.ruby" header, but
unfortunately, I can't get gmail to filter on misc headers. :(

Specifically, I meant the SPAM messages. I want to read Luis', etc.
messages
 
A

Aaron Turner

Hmm.

This is starting to sound partly like a gmail problem.

I'm not sure I follow. How is it gmail's fault that it is possible
for spammers to use the ruby-talk list? I just looked through the
first 500 messages in my spam folder and there wasn't a single spam
from any other list. All the other lists who don't want to require
people to subscribe before posting force their posts to go through a
moderator queue.

What does suck about gmail is I can't match against arbitrary headers.

I see in the headers that we're using SpamAssassin... maybe the
solution is to review it's configuration and make sure it's properly
learning?

--=20
Aaron Turner
http://synfin.net/
http://tcpreplay.synfin.net/ - Pcap editing and replay tools for Unix & Win=
dows
Those who would give up essential Liberty, to purchase a little temporary
Safety, deserve neither Liberty nor Safety.
-- Benjamin Franklin
 
B

Bill Kelly

From: "Robert Klemme said:
Actually, IMHO this is wrong for two reasons: first, you can read GMail
via POP or IMAP.

Oh. Didn't know that, thanks.
Second, GMail's spam filtering is pretty good and I
believe your spam marks train the filter. I believe at least in theory
a spam filter of a mail provider with web access can be much better than
a local filter because there is more training input.

Haha, yes. In theory.

But in practice why are gmailers complaining about spam
on ruby-talk?





:)

Regards,

Bill
 
B

Bill Kelly

From: "Aaron Turner said:
I'm not sure I follow. How is it gmail's fault that it is possible
for spammers to use the ruby-talk list? I just looked through the
first 500 messages in my spam folder and there wasn't a single spam
from any other list. All the other lists who don't want to require
people to subscribe before posting force their posts to go through a
moderator queue.

Sorry, I think I was in a snarky mood last night.

I'm hardly seeing any ruby-talk spam here.

(Thus it seemed plausible there was some room for
improvement in gmail's spam filtering. However, in
retrospect, I think my suggestion was probably
unhelpful. :)


Regards,

Bill
 
A

Aaron Turner

Oh. =A0Didn't know that, thanks.


Haha, yes. =A0In theory.

But in practice why are gmailers complaining about spam
on ruby-talk?

Not working for Google I can't but guess, but my belief is that it's
one or both of:

1) Gmail's spam filtering see's the spamassassin headers added by the
gateway and uses that to augment it's own ratings. Since SpamAssassin
marks it clean, gmail thinks it is clean too.

2) Gmail believes that mail sent via a mailing list has a lower
likelihood of being spam since most lists nowadays are closed and
spammers generally don't bother subscribing and this skews the ratings
sufficiently that it isn't marked as spam.

As for training gmail, yes I do that. I can't say it really helps.
I'd say 99% of the spam which reaches my inbox is via the ruby-talk
list even though ruby-talk spam is only 1-2% of the spam in my spam
folder. Also, earlier in the thread were were told NOT to do that
because it generates problems for the list maintainer... I'm not sure
why that is true though.

For those who want to read via NNTP, couldn't they subscribe and turn
off delivery? That way they can read via news and we'd still have a
way to authenticate their posts. Also, I know the svn users list is
open, but they have a pool of mods who approve messages to keep spam
off the lists.


--=20
Aaron Turner
http://synfin.net/
http://tcpreplay.synfin.net/ - Pcap editing and replay tools for Unix & Win=
dows
Those who would give up essential Liberty, to purchase a little temporary
Safety, deserve neither Liberty nor Safety.
-- Benjamin Franklin
 
C

Charles Calvert

I wonder how many people are using Usenet to interface with this list?

I am. I don't know how many others there are.
If it is few, I wonder if they might be encouraged to use another
service to do so. I know of at least three other interfaces besides
the standard email method, namely Google Groups, Gmane and Ruby Forum.

No offense intended to anyone, but I don't consider email, Google
Groups or web fora to be a good interface for discussions like this.
Usenet, for all of its flaws, has a number of advantages. I'd be very
disappointed to have to use one of the others.
Is there some advantage to using Usenet over these other methods?

Quite a number, actually.

1. Since Usenet is distributed, it is not dependent on a single server
or organization, unlike web fora.

2. One can download only headers for browsing, then download bodies of
interesting messages or threads.

3. The standards of Usenet were designed for public discussions.
Threading, for example, is part of the standard and has a high level
of standard compliance among clients. Email support for threading is
far more haphazard; even if I use a client with good support, someone
who doesn't can break threading unintentionally.

4. One has a choice of clients, unlike most web fora.

5. Any decent client supports killfiles, watch lists, and the like.
Some, but not all, of this functionality can be replicated with email
filters, but with a lot more effort.
I manage the Google Group and I try to delete all the SPAM I come
across, so anything that can reduce it is helpful to me.

On Usenet, there are some options:

1. Complain to the ISP of the offender.

2. Use killfiles to weed out identifiable spam.

3. Newsmasters can implement filtering for their servers.

4. Use a moderated group.
 
C

Charles Calvert

For those who want to read via NNTP, couldn't they subscribe and turn
off delivery? That way they can read via news and we'd still have a
way to authenticate their posts.

If I understand your suggest correctly, you're saying that I should
read on Usenet, but reply via email?
 
M

Michael Bruschkewitz

James Gray said:
Please never do this!

What will happen if some mad person reads this and tries to spoil the list?

My suggestion:
Mark spams by replies from some responsible persons which add [SPAMTHREAD]
in topic.
Most newsreaders should be able to hide a thread marked this way.
 
A

Aaron Turner

If I understand your suggest correctly, you're saying that I should
read on Usenet, but reply via email?

No. If you look above, your post via NNTP came as sent by
"(e-mail address removed)"- I'm assuming your actual email address (if not,
should be easy to change to a valid one). The list can thereby use
that to check to see if you're "subscribed".

In other words, your user experience wouldn't change one bit, other
then having to do a one-time subscription (with delivery turned off)
in order to post.

--=20
Aaron Turner
http://synfin.net/
http://tcpreplay.synfin.net/ - Pcap editing and replay tools for Unix & Win=
dows
Those who would give up essential Liberty, to purchase a little temporary
Safety, deserve neither Liberty nor Safety.
-- Benjamin Franklin
 
J

James Gray

As for training gmail, yes I do that. I can't say it really helps.
I'd say 99% of the spam which reaches my inbox is via the ruby-talk
list even though ruby-talk spam is only 1-2% of the spam in my spam
folder. Also, earlier in the thread were were told NOT to do that
because it generates problems for the list maintainer... I'm not sure
why that is true though.

I did not say don't train your filter. I said, please don't report
(my) gateway email address to my host as a spammer.

James Edward Gray II
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Members online

No members online now.

Forum statistics

Threads
473,770
Messages
2,569,583
Members
45,074
Latest member
StanleyFra

Latest Threads

Top