Re: [tlug] Sub: best thing on the internet

["Stephen J. Turnbull" <stephen@example.com>]

>>>>> "Godwin" == Godwin Stewart <gstewart@example.com> writes:

    Godwin> On Fri, 27 Aug 2004 21:53:00 -0700, Jonathan Byrne
    Godwin> <jq@example.com>
    Godwin> wrote:

    >> Someone please, please, please tell me that Smartlist can't be
    >> fooled into letting a post through by addressing it to
    >> listmaster.

    Godwin> What I assume happened is that the spammer used the From:
    Godwin> address of someone who *is* subscribed to the TLUG mailing
    Godwin> list in order to jump over that particular hurdle, and
    Godwin> that the SMTP "RCPT TO:" address differed from the DATA
    Godwin> "To:" address. So, in effect, the mail *was* sent to
    Godwin> tlug@example.com by Bcc: (typical spammer trick, as you know).

In fact, it was the (fake?) spammer address that was subscribed
according to Jim Tittsler on tlug-admin.

However, the particular trick you are talking about has been used to
fool at least emacs-devel, python-dev, and mailman-developers into
accepting spam from the head maintainers (rms, Barry Warsaw, and Guido
van Rossum respectively).  I haven't seen any to XEmacs from me, yet.
I guess that means I'm not famous enough.  :-)  Both auto-subscribes
and stealing subscriber identities are easily automated if the lists
are googlable/searchable from the home page.  Auto-subscribe can be
done blind since most lists use the $LIST-request and/or
$LIST-subscribe aliases for such requests.

I'm told that the most effective way to stop spam on python-dev (based
on Bayesian learning scores) was to have the word "python" in the body
of the message.  Maybe if we don't allow any posts that don't mention
"Tokyo" and "linux"?  :-)

-- 
Institute of Policy and Planning Sciences     http://turnbull.sk.tsukuba.ac.jp
University of Tsukuba                    Tennodai 1-1-1 Tsukuba 305-8573 JAPAN
               Ask not how you can "do" free software business;
              ask what your business can "do for" free software.