Re: Anti-SPAM Suggestion...

Mitchell Blank Jr (mitch@sfgoth.com)
Thu, 19 Aug 1999 07:38:46 -0700


OK, here's how to *really* fix this problem:

1. Allow posting to a vger list only if the user is subscribed to
SOME mailing list at vger. For instance, if you are subscribed to
linux-scsi, then you can also post to linux-kernel. That way
its easy for threads to be crossposted.
2. For people that need to post regularly but are not subscribed to
a vger mailing list (they read the mailing list through some
exploder/gateway; they're subscribed at a different address; they
participate in a non-vger mailing list that often has crossposted
threads) start a new mailing list "zerotraffic@vger". This
mailing list will have NO postings (the address won't even really
exist), but will be there just to allow a user to subscribe to
a vger list.
3. When a user not on a vger list posts to vger they'll get a bounce
message like the following:

| Your posting to linux-foo@vger.rutgers.edu could NOT be processed
| because the email address it came from (user@domain.com) is not
| subscribed to a mailing list at this site. There are several
| methods of fixing this however:
|
| o Resend your posting to:
| linux-foo-auth-a0d0cd4f8a237f9cb5caf806c83d471f@vger.rutgers.edu
| The message will then be accepted. You can use this address to
| send postings in the future, but note that it will only work
| for messages sent from this email address.
|
| o Subscribe to this mailing list by sending a message with
| the command "subscribe linux-foo" to majordomo@vger.rutgers.edu
| and follow the instructions that will be mailed back to you.
|
| o Add your email address to our list of unsubscribed addresses
| which are allowed to post here by sending the command
| "subscribe zerotraffic" to majordomo@vger.rutgers.edu.
| This is not a real mailing list - it receives no traffic - it
| is only used to keep a list of people not subscribed to
| a mailing list here who want to post. Again, follow the
| instructions that will be mailed back to you to complete
| your subscription.
|
| We apologize for this inconvenience in handling your mail, and look forward
| to your re-submission. Also, remember to read the frequently-asked-questions
| list for this mailing list at:
| http://www.example.edu/FAQs/linux-foo/
| There is a very good chance that your question is answered there, and it
| contains helpful tips on what information to include in your posting if
| you are reporting a problem.
|
| For your reference, here is the mail you tried to send that did not
| go through:
[...]

The "a0d0cd4f8a237f9cb5caf806c83d471f" is a MD5 hash of the user's
envelope sender and a secret string only known to vger. Thus, in order
to send to the mailing list you must have completed some form of
three-way-handshake -- either a verified subscribe (we do these now,
don't we?) or by receiving the above email.

Note that to allow easy replying, the mailing list should strip any
reference to "-auth-......" in the headers.

Advantages:
* Still mostly-open posting. There's only a small inconvenience for those
who want to post a bug report. Also, there's a mechanism for
people who aren't subscribed to post easily.
* Essentially impossible to subscribe a vger mailing list to any other
mailing list.
* Gives a good chance to send back a "read the FAQ" message to people
reporting bugs. Should improve the quality of bug reports sent
by non-subscribers (which is obviously a big problem here).
* NO HUMAN MODERATORS. (It's hard to make that work right anyway)

Disadvantages:
* User's can't post from a envelope-sender-address that they can't receive
mail at. This is obviously unavoidable, since that's the crux of the
problem. The only person I remember who does this is Mr. Parsons.

Comments?

-Mitch

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/