From testlist-bounces@mail.ietf.org Fri Sep 5 11:49:48 2008 Return-Path: X-Original-To: testlist-archive@ietf.org Delivered-To: ietfarch-testlist-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id EC95A3A68CE; Fri, 5 Sep 2008 11:49:47 -0700 (PDT) X-Original-To: testlist@core3.amsl.com Delivered-To: testlist@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 449C03A68D5 for ; Fri, 5 Sep 2008 11:49:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 2.519 X-Spam-Level: ** X-Spam-Status: No, score=2.519 tagged_above=-999 required=5 tests=[AWL=-1.807, BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, HTML_MESSAGE=0.001, MIME_HTML_MOSTLY=0.001, RDNS_NONE=0.1, TVD_SPACE_RATIO=2.219] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LX2fTxK1lUHi for ; Fri, 5 Sep 2008 11:49:45 -0700 (PDT) Received: from mail.amsl.com (mail.amsl.com [IPv6:2001:1890:1112:1::14]) by core3.amsl.com (Postfix) with ESMTP id 7C24C3A68CE for ; Fri, 5 Sep 2008 11:49:42 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by thunder2.amsl.com (Postfix) with ESMTP id 489C048249 for ; Fri, 5 Sep 2008 11:50:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com Received: from mail.amsl.com ([64.170.98.20]) by localhost (thunder2.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9Pcwrg3iP-mE for ; Fri, 5 Sep 2008 11:50:25 -0700 (PDT) Received: from steveyPC (steve [64.170.98.61]) by thunder2.amsl.com (Postfix) with ESMTP id 1B01348247 for ; Fri, 5 Sep 2008 11:50:25 -0700 (PDT) From: "Steve Young" To: Date: Fri, 5 Sep 2008 11:49:36 -0700 Message-ID: <008901c90f88$24e2c4e0$6ea84ea0$@com> MIME-Version: 1.0 X-Mailer: Microsoft Office Outlook 12.0 Thread-Index: AckPiCTNLhjChQAbSGSyZysCI7FsWA== Content-Language: en-us Subject: [testlist] test X-BeenThere: testlist@mail.ietf.org X-Mailman-Version: 2.1.9 Precedence: list Reply-To: testlist@mail.ietf.org List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============0667050110==" Sender: testlist-bounces@mail.ietf.org Errors-To: testlist-bounces@mail.ietf.org This is a multipart message in MIME format. --===============0667050110== Content-Type: multipart/alternative; boundary="----=_NextPart_000_008A_01C90F4D.7883ECE0" Content-Language: en-us This is a multipart message in MIME format. ------=_NextPart_000_008A_01C90F4D.7883ECE0 Content-Type: text/plain; charset="US-ASCII" Content-Transfer-Encoding: 7bit ------=_NextPart_000_008A_01C90F4D.7883ECE0 Content-Type: text/html; charset="US-ASCII" Content-Transfer-Encoding: quoted-printable

 

------=_NextPart_000_008A_01C90F4D.7883ECE0-- --===============0667050110== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Testlist mailing list Testlist@mail.ietf.org https://mail.ietf.org/mailman/listinfo/testlist --===============0667050110==-- From testlist-bounces@mail.ietf.org Mon Sep 22 12:40:51 2008 Return-Path: X-Original-To: testlist-archive@ietf.org Delivered-To: ietfarch-testlist-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 8C80C3A69BE; Mon, 22 Sep 2008 12:40:51 -0700 (PDT) X-Original-To: testlist@core3.amsl.com Delivered-To: testlist@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B218E3A69BE for ; Mon, 22 Sep 2008 12:40:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -99.696 X-Spam-Level: X-Spam-Status: No, score=-99.696 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1, SARE_SUB_RAND_LETTRS4=0.799, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id y1hma+EuLMdQ for ; Mon, 22 Sep 2008 12:40:44 -0700 (PDT) Received: from mail.amsl.com (mail.amsl.com [IPv6:2001:1890:1112:1::14]) by core3.amsl.com (Postfix) with ESMTP id DDAA328C12A for ; Mon, 22 Sep 2008 12:40:41 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by thunder2.amsl.com (Postfix) with ESMTP id 9964F4807D; Mon, 22 Sep 2008 12:40:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com Received: from mail.amsl.com ([64.170.98.20]) by localhost (thunder2.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4LQUiN-0txtQ; Mon, 22 Sep 2008 12:40:42 -0700 (PDT) Received: from [64.170.98.103] (dv2500r1.c5i.net [64.170.98.103]) by thunder2.amsl.com (Postfix) with ESMTP id 6CED347F07; Mon, 22 Sep 2008 12:40:42 -0700 (PDT) Message-ID: <48D7F4BF.4000101@amsl.com> Date: Mon, 22 Sep 2008 12:40:47 -0700 From: Glen User-Agent: Thunderbird 2.0.0.16 (Windows/20080708) MIME-Version: 1.0 To: testlist@mail.ietf.org, Aaron Falk , Karen Moreland , Alexa Morris , Ray Pelletier , Russ Housley X-Enigmail-Version: 0.95.7 Subject: [testlist] Move of the IRTF Website X-BeenThere: testlist@mail.ietf.org X-Mailman-Version: 2.1.9 Precedence: list Reply-To: testlist@mail.ietf.org List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: testlist-bounces@mail.ietf.org Errors-To: testlist-bounces@mail.ietf.org All - It is proposed that we take over web hosting for the IRTF, and move the website www.irtf.org from its current host to the AMS central server network. To that end, we have staged the site on our servers, and, using hostfile overrides, Aaron Falk, the IRTF caretaker, has checked the site and given his blessing. If anyone else has any commentary or objections, please let me know now. Absent any other communication, I will make this change in about 24 hours from the time of this email. Thanks, Glen _______________________________________________ Testlist mailing list Testlist@mail.ietf.org https://mail.ietf.org/mailman/listinfo/testlist From testlist-bounces@mail.ietf.org Mon Sep 22 14:14:18 2008 Return-Path: X-Original-To: testlist-archive@ietf.org Delivered-To: ietfarch-testlist-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 5FBD63A6930; Mon, 22 Sep 2008 14:14:18 -0700 (PDT) X-Original-To: testlist@core3.amsl.com Delivered-To: testlist@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 56C183A6A26 for ; Mon, 22 Sep 2008 14:14:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.8 X-Spam-Level: X-Spam-Status: No, score=-1.8 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, SARE_SUB_RAND_LETTRS4=0.799] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bOHMowvbpLmu for ; Mon, 22 Sep 2008 14:14:12 -0700 (PDT) Received: from rv-out-0708.google.com (rv-out-0708.google.com [209.85.198.249]) by core3.amsl.com (Postfix) with ESMTP id 06D373A6930 for ; Mon, 22 Sep 2008 14:14:12 -0700 (PDT) Received: by rv-out-0708.google.com with SMTP id b17so1615243rvf.36 for ; Mon, 22 Sep 2008 14:13:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from :organization:user-agent:mime-version:to:cc:subject:references :in-reply-to:content-type:content-transfer-encoding; bh=PUVC/guf6A9igrWbWtLcjjvUsqmOk0qe3K/pIWAqCvQ=; b=FuzDkhE6Ek7ljxMT4l5DcuxNK9k1I1Hjt/CDn72OXD0hROufqdzz1p8ROudo1daBOh 0uzwE4pyz1/KpTKwBDchzBAlAjjmE6yBHUY2T6HQ+CEdlPouWIp2hqZnlxIGek/+l4LA 0C1y5ejhUGtxq8n7sftHZqK7Ew7bpmnHe6Nhg= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:organization:user-agent:mime-version:to:cc :subject:references:in-reply-to:content-type :content-transfer-encoding; b=PWxWDVoYWj6SYwAQnQ2usIHskbNME9VWqOiDitQl/2KHfT5pQG5pMLZaK8t7/CWsSw KDoZdutmkZ214xOx+9eLyKi2rd+3f608oy/HzYKnVyoicnfCz5XvNUGbGW6WEtq2Pb2T xjWR32g43bcleIMJvieLkZMuaYzpIdxcNegeA= Received: by 10.141.79.12 with SMTP id g12mr2277457rvl.182.1222118005101; Mon, 22 Sep 2008 14:13:25 -0700 (PDT) Received: from ?130.216.38.124? (stf-brian.sfac.auckland.ac.nz [130.216.38.124]) by mx.google.com with ESMTPS id b8sm1027148rvf.4.2008.09.22.14.13.22 (version=SSLv3 cipher=RC4-MD5); Mon, 22 Sep 2008 14:13:24 -0700 (PDT) Message-ID: <48D80A6C.2000603@gmail.com> Date: Tue, 23 Sep 2008 09:13:16 +1200 From: Brian E Carpenter Organization: University of Auckland User-Agent: Thunderbird 2.0.0.6 (Windows/20070728) MIME-Version: 1.0 To: testlist@mail.ietf.org References: <48D7F4BF.4000101@amsl.com> In-Reply-To: <48D7F4BF.4000101@amsl.com> Cc: Ray Pelletier , Alexa Morris , Aaron Falk Subject: Re: [testlist] Move of the IRTF Website X-BeenThere: testlist@mail.ietf.org X-Mailman-Version: 2.1.9 Precedence: list Reply-To: testlist@mail.ietf.org List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: testlist-bounces@mail.ietf.org Errors-To: testlist-bounces@mail.ietf.org I tried the etc/hosts override myself, and it looks fine to me too, viewed from across the Pacific. Brian On 2008-09-23 07:40, Glen wrote: > All - > > It is proposed that we take over web hosting for the IRTF, and move the > website www.irtf.org from its current host to the AMS central server > network. > > To that end, we have staged the site on our servers, and, using hostfile > overrides, Aaron Falk, the IRTF caretaker, has checked the site and > given his blessing. > > If anyone else has any commentary or objections, please let me know now. > Absent any other communication, I will make this change in about 24 > hours from the time of this email. > > Thanks, > Glen > _______________________________________________ > Testlist mailing list > Testlist@mail.ietf.org > https://mail.ietf.org/mailman/listinfo/testlist > _______________________________________________ Testlist mailing list Testlist@mail.ietf.org https://mail.ietf.org/mailman/listinfo/testlist From testlist-bounces@mail.ietf.org Tue Sep 23 17:52:24 2008 Return-Path: X-Original-To: testlist-archive@ietf.org Delivered-To: ietfarch-testlist-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 6F51528C163; Tue, 23 Sep 2008 17:52:24 -0700 (PDT) X-Original-To: testlist@core3.amsl.com Delivered-To: testlist@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D059E28C2B9 for ; Tue, 23 Sep 2008 17:52:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -99.696 X-Spam-Level: X-Spam-Status: No, score=-99.696 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1, SARE_SUB_RAND_LETTRS4=0.799, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yZT1E-Sn13Cj for ; Tue, 23 Sep 2008 17:52:22 -0700 (PDT) Received: from mail.amsl.com (mail.amsl.com [IPv6:2001:1890:1112:1::14]) by core3.amsl.com (Postfix) with ESMTP id 3E7B928C2B8 for ; Tue, 23 Sep 2008 17:52:19 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by thunder2.amsl.com (Postfix) with ESMTP id 8FC11481E9; Tue, 23 Sep 2008 17:52:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com Received: from mail.amsl.com ([64.170.98.20]) by localhost (thunder2.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vxNuxt9Ul45r; Tue, 23 Sep 2008 17:52:22 -0700 (PDT) Received: from [192.168.1.101] (unknown [173.8.133.94]) by thunder2.amsl.com (Postfix) with ESMTP id 3988C481E7; Tue, 23 Sep 2008 17:52:22 -0700 (PDT) Message-ID: <48D98F47.9080606@amsl.com> Date: Tue, 23 Sep 2008 17:52:23 -0700 From: Glen User-Agent: Thunderbird 2.0.0.16 (Windows/20080708) MIME-Version: 1.0 To: testlist@mail.ietf.org References: <48D7F4BF.4000101@amsl.com> <48D80A6C.2000603@gmail.com> In-Reply-To: <48D80A6C.2000603@gmail.com> X-Enigmail-Version: 0.95.7 Subject: Re: [testlist] Move of the IRTF Website X-BeenThere: testlist@mail.ietf.org X-Mailman-Version: 2.1.9 Precedence: list Reply-To: testlist@mail.ietf.org List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: testlist-bounces@mail.ietf.org Errors-To: testlist-bounces@mail.ietf.org Brian E Carpenter wrote: > I tried the etc/hosts override myself, and it looks fine to me too, > viewed from across the Pacific. Brian - Thank you for testing. All - There having been no objections, I have now "thrown the switch", and the IRTF website is now hosted by AMS. Welcome aboard, IRTF! Aaron - Please let me know whatever you need in terms of access setup, list configuration changes, etc. I will work with you directly to finish up whatever details remain for the conversion. Thanks to all for your help! Glen _______________________________________________ Testlist mailing list Testlist@mail.ietf.org https://mail.ietf.org/mailman/listinfo/testlist From testlist-bounces@mail.ietf.org Wed Sep 24 16:41:19 2008 Return-Path: X-Original-To: testlist-archive@ietf.org Delivered-To: ietfarch-testlist-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D6A543A6888; Wed, 24 Sep 2008 16:41:19 -0700 (PDT) X-Original-To: testlist@core3.amsl.com Delivered-To: testlist@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id DA5763A69C5 for ; Wed, 24 Sep 2008 16:41:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -100.096 X-Spam-Level: X-Spam-Status: No, score=-100.096 tagged_above=-999 required=5 tests=[AWL=0.399, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mHDD-q2Fcp4Y for ; Wed, 24 Sep 2008 16:41:18 -0700 (PDT) Received: from mail.amsl.com (mail.amsl.com [IPv6:2001:1890:1112:1::14]) by core3.amsl.com (Postfix) with ESMTP id 33EF13A6888 for ; Wed, 24 Sep 2008 16:41:18 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by thunder2.amsl.com (Postfix) with ESMTP id 61AF17FDE; Wed, 24 Sep 2008 16:41:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com Received: from mail.amsl.com ([64.170.98.20]) by localhost (thunder2.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yq1Df9-IVriA; Wed, 24 Sep 2008 16:41:24 -0700 (PDT) Received: from [192.168.1.101] (unknown [173.8.133.94]) by thunder2.amsl.com (Postfix) with ESMTP id 2480D48067; Wed, 24 Sep 2008 16:41:24 -0700 (PDT) Message-ID: <48DAD01E.6060403@amsl.com> Date: Wed, 24 Sep 2008 16:41:18 -0700 From: Glen User-Agent: Thunderbird 2.0.0.16 (Windows/20080708) MIME-Version: 1.0 To: 'AMS IETF Mail List' , testlist@mail.ietf.org, Russ Housley , Ray Pelletier X-Enigmail-Version: 0.95.7 Subject: [testlist] Alleged spam complaint / RT Ticket 10775 X-BeenThere: testlist@mail.ietf.org X-Mailman-Version: 2.1.9 Precedence: list Reply-To: testlist@mail.ietf.org List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: testlist-bounces@mail.ietf.org Errors-To: testlist-bounces@mail.ietf.org All - We got the following ticket, which was sent to the IETF discussion list: > Wed Sep 24 16:25:42 2008 dotis@mail-abuse.org - Ticket created [Reply] [Comment] > Subject: IETF mail-lists outbound server being exploited > Date: Wed, 24 Sep 2008 16:25:19 -0700 > To: ietf@ietf.org > From: Douglas Otis > Download (untitled) [text/plain 580b] > There is a growing stream of spam being emitted from 64.170.98.32. > This appears to be the outbound server for IETF mailing-lists. Some > of the spam has had headers added that indicate the message was > originally received from an open relay or an IP address on several > block-lists (with much of it encoded unicode). The messages > identified as spam have included the original message content. This > is creating a problem where receiving messages from the IETF is less > reliable. > Postmaster@ has been copied. Redacted examples are available upon > request. > -Doug I don't know who "Doug" is, mail-abuse.org appears to redirect to mail-abuse.com, which has a statement saying they were bought out by Trend Micro, no example mail was provided, and I see no evidence that we're being exploited whatsoever. At this stage, I consider this mail message to be frivolous. As everyone knows, because it has been the subject of much discussion and argument in the past, we run very aggressive anti-spam measures on the IETF servers, and ALL AMS servers. Those measures are still in place, and still working. If anyone wishes to comment or ask questions, or has further information about please feel free to contact me directly. Thanks, Glen _______________________________________________ Testlist mailing list Testlist@mail.ietf.org https://mail.ietf.org/mailman/listinfo/testlist From testlist-bounces@mail.ietf.org Wed Sep 24 19:44:29 2008 Return-Path: X-Original-To: testlist-archive@ietf.org Delivered-To: ietfarch-testlist-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id DA9593A67F1; Wed, 24 Sep 2008 19:44:29 -0700 (PDT) X-Original-To: testlist@core3.amsl.com Delivered-To: testlist@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A50243A697F for ; Wed, 24 Sep 2008 19:44:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.399 X-Spam-Level: X-Spam-Status: No, score=-2.399 tagged_above=-999 required=5 tests=[AWL=0.200, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NEl9A8EOaJdS for ; Wed, 24 Sep 2008 19:44:27 -0700 (PDT) Received: from wf-out-1314.google.com (wf-out-1314.google.com [209.85.200.172]) by core3.amsl.com (Postfix) with ESMTP id 9F3153A67F1 for ; Wed, 24 Sep 2008 19:44:27 -0700 (PDT) Received: by wf-out-1314.google.com with SMTP id 29so282822wff.3 for ; Wed, 24 Sep 2008 19:44:35 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from :organization:user-agent:mime-version:to:cc:subject:references :in-reply-to:content-type:content-transfer-encoding; bh=26TXimjQQSjJOf7OwkWBOfuhMICM23o9ZoVOZPwVaL8=; b=yHcbFI6bG/FOfYjRPL9UxYwASLFQpUdvLwWu/aT7NPguGjz533+7JfMR9K75GAQeBn 01asY7ZSKI9IE9b11Cp9Dj5wgh1NFKcrYkugFMGQqPWlbUcLr4CykgtfjDMVkcFn1K6e jyAxaZmrlIHzkxxxbERnKMrVh630tNyjK1n8Q= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:organization:user-agent:mime-version:to:cc :subject:references:in-reply-to:content-type :content-transfer-encoding; b=drEb38mW1veaoVI+uBEwlsexYdUHccVQFem9qTSHzuUtreoYY1iUbpTXtINlN4Xy4M WsJOvRNH+06tygbMUlsffBnLSzQVsmeKU2ufUF4OF7EFGA2pym0EQ/UWVNx1SUy3A88H WrPV6jLVXvRiRJgxlPv6sus/NRahTVrPHwuE8= Received: by 10.142.173.8 with SMTP id v8mr2868406wfe.266.1222310674522; Wed, 24 Sep 2008 19:44:34 -0700 (PDT) Received: from ?130.216.38.124? ( [130.216.38.124]) by mx.google.com with ESMTPS id 22sm50307wfi.14.2008.09.24.19.44.32 (version=SSLv3 cipher=RC4-MD5); Wed, 24 Sep 2008 19:44:33 -0700 (PDT) Message-ID: <48DAFB19.70409@gmail.com> Date: Thu, 25 Sep 2008 14:44:41 +1200 From: Brian E Carpenter Organization: University of Auckland User-Agent: Thunderbird 2.0.0.6 (Windows/20070728) MIME-Version: 1.0 To: testlist@mail.ietf.org References: <48DAD01E.6060403@amsl.com> In-Reply-To: <48DAD01E.6060403@amsl.com> Cc: 'AMS IETF Mail List' , Ray Pelletier Subject: Re: [testlist] Alleged spam complaint / RT Ticket 10775 X-BeenThere: testlist@mail.ietf.org X-Mailman-Version: 2.1.9 Precedence: list Reply-To: testlist@mail.ietf.org List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: testlist-bounces@mail.ietf.org Errors-To: testlist-bounces@mail.ietf.org Doug is a genuine IETF participant who's been using that email address since 2005 at least. I think you can write to him privately asking for the evidence. Brian On 2008-09-25 11:41, Glen wrote: > All - > > We got the following ticket, which was sent to the IETF discussion list: > >> Wed Sep 24 16:25:42 2008 dotis@mail-abuse.org - Ticket created [Reply] [Comment] >> Subject: IETF mail-lists outbound server being exploited >> Date: Wed, 24 Sep 2008 16:25:19 -0700 >> To: ietf@ietf.org >> From: Douglas Otis >> Download (untitled) [text/plain 580b] >> There is a growing stream of spam being emitted from 64.170.98.32. >> This appears to be the outbound server for IETF mailing-lists. Some >> of the spam has had headers added that indicate the message was >> originally received from an open relay or an IP address on several >> block-lists (with much of it encoded unicode). The messages >> identified as spam have included the original message content. This >> is creating a problem where receiving messages from the IETF is less >> reliable. >> Postmaster@ has been copied. Redacted examples are available upon >> request. >> -Doug > > I don't know who "Doug" is, mail-abuse.org appears to redirect to > mail-abuse.com, which has a statement saying they were bought out by > Trend Micro, no example mail was provided, and I see no evidence that > we're being exploited whatsoever. At this stage, I consider this mail > message to be frivolous. > > As everyone knows, because it has been the subject of much discussion > and argument in the past, we run very aggressive anti-spam measures on > the IETF servers, and ALL AMS servers. Those measures are still in > place, and still working. > > If anyone wishes to comment or ask questions, or has further information > about please feel free to contact me directly. > > Thanks, > Glen > _______________________________________________ > Testlist mailing list > Testlist@mail.ietf.org > https://mail.ietf.org/mailman/listinfo/testlist > _______________________________________________ Testlist mailing list Testlist@mail.ietf.org https://mail.ietf.org/mailman/listinfo/testlist From testlist-bounces@mail.ietf.org Wed Sep 24 20:54:07 2008 Return-Path: X-Original-To: testlist-archive@ietf.org Delivered-To: ietfarch-testlist-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E74813A67FB; Wed, 24 Sep 2008 20:54:07 -0700 (PDT) X-Original-To: testlist@core3.amsl.com Delivered-To: testlist@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 61C993A6C3A for ; Wed, 24 Sep 2008 20:54:06 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -101.151 X-Spam-Level: X-Spam-Status: No, score=-101.151 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, MSGID_MULTIPLE_AT=1.449, NO_RELAYS=-0.001, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id BOfjF2AR1uut for ; Wed, 24 Sep 2008 20:54:05 -0700 (PDT) Received: from mail.amsl.com (mail.amsl.com [IPv6:2001:1890:1112:1::14]) by core3.amsl.com (Postfix) with ESMTP id 5BF753A6C44 for ; Wed, 24 Sep 2008 20:54:05 -0700 (PDT) Received: by thunder2.amsl.com (Postfix, from userid 1000) id 3B2547FC6; Wed, 24 Sep 2008 20:54:13 -0700 (PDT) Date: Wed, 24 Sep 2008 20:54:13 -0700 From: Glen To: Brian E Carpenter Message-ID: <20080925035413.GA27440@glen@amsl.com> References: <48DAD01E.6060403@amsl.com> <48DAFB19.70409@gmail.com> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <48DAFB19.70409@gmail.com> User-Agent: Mutt/1.5.16 (2007-06-09) Cc: 'AMS IETF Mail List' , testlist@mail.ietf.org, Ray Pelletier Subject: Re: [testlist] [IETF] Re: Alleged spam complaint / RT Ticket 10775 X-BeenThere: testlist@mail.ietf.org X-Mailman-Version: 2.1.9 Precedence: list Reply-To: testlist@mail.ietf.org List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: testlist-bounces@mail.ietf.org Errors-To: testlist-bounces@mail.ietf.org On Thu, Sep 25, 2008 at 02:44:41PM +1200, Brian E Carpenter wrote: > Doug is a genuine IETF participant who's been using that > email address since 2005 at least. I think you can write > to him privately asking for the evidence. > Brian Brian - Thank you so much for that clarification. I have done as you suggest, and this is the message I sent him. (I sent it from my GMAIL account to ensure he receives it, since he is blocking all email from us right now - he won't see any list or other mail from us at that account! - so I'm just pasting the message in here for everyone's reference. Thanks for identifying and vouching for him. That makes my job MUCH easier! :-) Warm regards, Glen Here is what I sent: >> There is a growing stream of spam being emitted from 64.170.98.32. >> This appears to be the outbound server for IETF mailing-lists. Some >> of the spam has had headers added that indicate the message was >> originally received from an open relay or an IP address on several >> block-lists (with much of it encoded unicode). The messages >> identified as spam have included the original message content. This >> is creating a problem where receiving messages from the IETF is less >> reliable. Mr. Otis: My name is Glen Barney, and I am the IT Director for AMS, the company providing secretariat and system management services to the IETF. I am emailing you from GMail, because you are clearly unable to receive email from the IETF. I am unaware of a growing stream of spam emanating from the IETF servers. The IETF mail servers are not open relays, they are closed, secure, properly-registered servers running aggressive anti-spam measures specified by the IETF leadership and implemented by us. The only outbound mail from the systems is in the form of mailing list mail, to which individuals subscribe, or in the form of preset messages sent in response to web actions.. The ultimate arbiter of which messages are sent through to a list is the list owner/administrator, typically the working group chair. The IETF has determined that they do NOT want any blacklist services such as mail-abuse.org to be used on the servers; therefore, we do not check any RBL-style services in the processing of email, and the presence of IP addresses that your particular RBL may consider significant does not mean that a message will automatically be refused by the IETF. With those facts in mind, if you have messages you wish to have us review, we will be happy to do so. Please direct them to my attention, and not to the entire IETF discussion list. My direct email address is glen@amsl.com, and I suggest you copy this address, gdmgmt@gmail.com, to ensure that I receive the email, since my corporate spam filters are extremely aggressive. As for receiving mail, I see that someone has listed us in mail-abuse.org. However, a scan of the mail queue shows that, of all the recipients of all of the email processed through the IETF servers each day, yours is the only address using or being blocked by mail-abuse.org at this time. Since your email address suggests you are employed by this firm, we refer you to your IT department and suggest you ask them to whitelist this server so that you can receive mail. Alternatively, free email accounts such as GMail might provide a clearer path through which to receive mail. I hope this information answers your questions and resolves your concerns. In the future, you are always welcome to email me directly, and all of our contact information is also available online at http://www.ietf.org/secretariat/ . Please let me know if you have further concerns. Glen Barney IT Director Association Management Solutions _______________________________________________ Testlist mailing list Testlist@mail.ietf.org https://mail.ietf.org/mailman/listinfo/testlist From testlist-bounces@mail.ietf.org Thu Sep 25 05:25:24 2008 Return-Path: X-Original-To: testlist-archive@ietf.org Delivered-To: ietfarch-testlist-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 648823A6767; Thu, 25 Sep 2008 05:25:24 -0700 (PDT) X-Original-To: testlist@core3.amsl.com Delivered-To: testlist@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 24F623A6767 for ; Thu, 25 Sep 2008 05:25:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -103.055 X-Spam-Level: X-Spam-Status: No, score=-103.055 tagged_above=-999 required=5 tests=[AWL=0.544, BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vOMrLBNHHcis for ; Thu, 25 Sep 2008 05:25:20 -0700 (PDT) Received: from multicasttech.com (lennon.multicasttech.com [63.105.122.7]) by core3.amsl.com (Postfix) with ESMTP id DCEDA3A687A for ; Thu, 25 Sep 2008 05:25:11 -0700 (PDT) Received: from [63.105.122.7] (account marshall_eubanks HELO [IPv6:::1]) by multicasttech.com (CommuniGate Pro SMTP 3.4.8) with ESMTP-TLS id 13122872; Thu, 25 Sep 2008 08:24:13 -0400 Message-Id: <185739D2-4218-49C1-BEED-AF3C22485680@multicasttech.com> From: Marshall Eubanks To: testlist@mail.ietf.org In-Reply-To: <48DAD01E.6060403@amsl.com> Mime-Version: 1.0 (Apple Message framework v926) Date: Thu, 25 Sep 2008 08:24:12 -0400 References: <48DAD01E.6060403@amsl.com> X-Mailer: Apple Mail (2.926) Cc: 'AMS IETF Mail List' , Ray Pelletier Subject: Re: [testlist] Alleged spam complaint / RT Ticket 10775 X-BeenThere: testlist@mail.ietf.org X-Mailman-Version: 2.1.9 Precedence: list Reply-To: testlist@mail.ietf.org List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="us-ascii"; Format="flowed"; DelSp="yes" Sender: testlist-bounces@mail.ietf.org Errors-To: testlist-bounces@mail.ietf.org Glen; Did you see the email I sent to action about the same issue ? I am getting spam from IETF servers, and it doesn't appear to be either through-list or backscatter traffic. It might be, but it doesn't appear to be. My ticket is [rt.amsl.com #10769] Marshall On Sep 24, 2008, at 7:41 PM, Glen wrote: > All - > > We got the following ticket, which was sent to the IETF discussion > list: > >> Wed Sep 24 16:25:42 2008 dotis@mail-abuse.org - Ticket created >> [Reply] [Comment] >> Subject: IETF mail-lists outbound server being exploited >> Date: Wed, 24 Sep 2008 16:25:19 -0700 >> To: ietf@ietf.org >> From: Douglas Otis >> Download (untitled) [text/plain 580b] >> There is a growing stream of spam being emitted from 64.170.98.32. >> This appears to be the outbound server for IETF mailing-lists. Some >> of the spam has had headers added that indicate the message was >> originally received from an open relay or an IP address on several >> block-lists (with much of it encoded unicode). The messages >> identified as spam have included the original message content. This >> is creating a problem where receiving messages from the IETF is less >> reliable. >> Postmaster@ has been copied. Redacted examples are available upon >> request. >> -Doug > > I don't know who "Doug" is, mail-abuse.org appears to redirect to > mail-abuse.com, which has a statement saying they were bought out by > Trend Micro, no example mail was provided, and I see no evidence that > we're being exploited whatsoever. At this stage, I consider this mail > message to be frivolous. > > As everyone knows, because it has been the subject of much discussion > and argument in the past, we run very aggressive anti-spam measures on > the IETF servers, and ALL AMS servers. Those measures are still in > place, and still working. > > If anyone wishes to comment or ask questions, or has further > information > about please feel free to contact me directly. > > Thanks, > Glen > _______________________________________________ > Testlist mailing list > Testlist@mail.ietf.org > https://mail.ietf.org/mailman/listinfo/testlist _______________________________________________ Testlist mailing list Testlist@mail.ietf.org https://mail.ietf.org/mailman/listinfo/testlist From testlist-bounces@mail.ietf.org Thu Sep 25 06:56:37 2008 Return-Path: X-Original-To: testlist-archive@ietf.org Delivered-To: ietfarch-testlist-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 859D03A6767; Thu, 25 Sep 2008 06:56:37 -0700 (PDT) X-Original-To: testlist@core3.amsl.com Delivered-To: testlist@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 8AEA73A6878 for ; Thu, 25 Sep 2008 06:56:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.265 X-Spam-Level: X-Spam-Status: No, score=-102.265 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, IP_NOT_FRIENDLY=0.334, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1+kcWs2nte72 for ; Thu, 25 Sep 2008 06:56:35 -0700 (PDT) Received: from ee01.elistx.com (ee01.elistx.com [67.154.239.222]) by core3.amsl.com (Postfix) with ESMTP id 5B11E3A6767 for ; Thu, 25 Sep 2008 06:56:35 -0700 (PDT) Received: from CONVERSION-DAEMON.elistx.com by elistx.com (PMDF V6.3-2x2 #31546) id <0K7R00G0180T7G@elistx.com> for testlist@mail.ietf.org; Thu, 25 Sep 2008 09:55:41 -0400 (EDT) Received: from localhost (localhost.localdomain [127.0.0.1]) by elistx.com (PMDF V6.3-2x2 #31546) with ESMTP id <0K7R0087W80SYR@elistx.com>; Thu, 25 Sep 2008 09:55:40 -0400 (EDT) Date: Thu, 25 Sep 2008 09:55:53 -0400 From: James M Galvin In-reply-to: <185739D2-4218-49C1-BEED-AF3C22485680@multicasttech.com> To: testlist@mail.ietf.org Message-id: MIME-version: 1.0 X-Mailer: Mulberry/4.0.8 (Mac OS X) Content-disposition: inline References: <48DAD01E.6060403@amsl.com> <185739D2-4218-49C1-BEED-AF3C22485680@multicasttech.com> Cc: 'AMS IETF Mail List' , Ray Pelletier Subject: Re: [testlist] Alleged spam complaint / RT Ticket 10775 X-BeenThere: testlist@mail.ietf.org X-Mailman-Version: 2.1.9 Precedence: list Reply-To: testlist@mail.ietf.org List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="us-ascii"; Format="flowed" Sender: testlist-bounces@mail.ietf.org Errors-To: testlist-bounces@mail.ietf.org Marshall, I looked at your ticket. The message is really passing through the IETF servers at AMS to Henrik's tools machine and being distributed from there. I suspect there is an issue here. Glen and Henrik will have to look at the configuration. I don't know if things are the same as they were during the transition, but there was an access control issue back then. Your message was destined to ops-chairs. All the "chairs" aliases are expanded on the tools machine. It used to be that the IETF servers just forwarded all those messages to the tools server. Previously I would have said that the problem is there is no spam filtering in that path. I don't know if that's still the case. If there isn't, then that's the problem. Alternatively, perhaps the spam filtering needs some tweaking. In any case, I'm sure Glen and Henrik can track down what's happening. Jim -- On September 25, 2008 8:24:12 AM -0400 Marshall Eubanks wrote regarding Re: [testlist] Alleged spam complaint / RT Ticket 10775 -- > Glen; > > Did you see the email I sent to action about the same issue ? > > I am getting spam from IETF servers, and it doesn't appear to be > either through-list or > backscatter traffic. It might be, but it doesn't appear to be. > > My ticket is [rt.amsl.com #10769] > > Marshall > > On Sep 24, 2008, at 7:41 PM, Glen wrote: > > > All - > > > > We got the following ticket, which was sent to the IETF discussion > > list: > > > >> Wed Sep 24 16:25:42 2008 dotis@mail-abuse.org - Ticket created > >> [Reply] [Comment] > >> Subject: IETF mail-lists outbound server being exploited > >> Date: Wed, 24 Sep 2008 16:25:19 -0700 > >> To: ietf@ietf.org > >> From: Douglas Otis > >> Download (untitled) [text/plain 580b] > >> There is a growing stream of spam being emitted from 64.170.98.32. > >> This appears to be the outbound server for IETF mailing-lists. Some > >> of the spam has had headers added that indicate the message was > >> originally received from an open relay or an IP address on several > >> block-lists (with much of it encoded unicode). The messages > >> identified as spam have included the original message content. This > >> is creating a problem where receiving messages from the IETF is > >> less reliable. > >> Postmaster@ has been copied. Redacted examples are available upon > >> request. > >> -Doug > > > > I don't know who "Doug" is, mail-abuse.org appears to redirect to > > mail-abuse.com, which has a statement saying they were bought out by > > Trend Micro, no example mail was provided, and I see no evidence > > that we're being exploited whatsoever. At this stage, I consider > > this mail message to be frivolous. > > > > As everyone knows, because it has been the subject of much > > discussion and argument in the past, we run very aggressive > > anti-spam measures on the IETF servers, and ALL AMS servers. Those > > measures are still in place, and still working. > > > > If anyone wishes to comment or ask questions, or has further > > information > > about please feel free to contact me directly. > > > > Thanks, > > Glen > > _______________________________________________ > > Testlist mailing list > > Testlist@mail.ietf.org > > https://mail.ietf.org/mailman/listinfo/testlist > > _______________________________________________ > Testlist mailing list > Testlist@mail.ietf.org > https://mail.ietf.org/mailman/listinfo/testlist _______________________________________________ Testlist mailing list Testlist@mail.ietf.org https://mail.ietf.org/mailman/listinfo/testlist From testlist-bounces@mail.ietf.org Thu Sep 25 07:34:36 2008 Return-Path: X-Original-To: testlist-archive@ietf.org Delivered-To: ietfarch-testlist-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 124D93A659A; Thu, 25 Sep 2008 07:34:36 -0700 (PDT) X-Original-To: testlist@core3.amsl.com Delivered-To: testlist@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 8E5FA3A6837 for ; Thu, 25 Sep 2008 07:34:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.599 X-Spam-Level: X-Spam-Status: No, score=-102.599 tagged_above=-999 required=5 tests=[AWL=0.000, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jMMb1ifMoUOZ for ; Thu, 25 Sep 2008 07:34:34 -0700 (PDT) Received: from woodstock.binhost.com (woodstock.binhost.com [8.8.40.152]) by core3.amsl.com (Postfix) with SMTP id 8072A3A659A for ; Thu, 25 Sep 2008 07:34:34 -0700 (PDT) Received: (qmail 25265 invoked by uid 0); 25 Sep 2008 14:29:16 -0000 Received: from unknown (HELO THINKPADR52.vigilsec.com) (96.255.143.50) by woodstock.binhost.com with SMTP; 25 Sep 2008 14:29:16 -0000 X-Mailer: QUALCOMM Windows Eudora Version 7.1.0.9 Date: Thu, 25 Sep 2008 10:23:33 -0400 To: Glen ,'AMS IETF Mail List' , testlist@mail.ietf.org,Ray Pelletier From: Russ Housley In-Reply-To: <48DAD01E.6060403@amsl.com> References: <48DAD01E.6060403@amsl.com> Mime-Version: 1.0 Message-Id: <20080925143434.8072A3A659A@core3.amsl.com> Subject: Re: [testlist] Alleged spam complaint / RT Ticket 10775 X-BeenThere: testlist@mail.ietf.org X-Mailman-Version: 2.1.9 Precedence: list Reply-To: testlist@mail.ietf.org List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="us-ascii"; Format="flowed" Sender: testlist-bounces@mail.ietf.org Errors-To: testlist-bounces@mail.ietf.org Doug is an active IETF participant. Please ask him for an example message. Russ At 07:41 PM 9/24/2008, Glen wrote: >All - > >We got the following ticket, which was sent to the IETF discussion list: > > > Wed Sep 24 16:25:42 2008 dotis@mail-abuse.org - Ticket > created [Reply] [Comment] > > Subject: IETF mail-lists outbound server being exploited > > Date: Wed, 24 Sep 2008 16:25:19 -0700 > > To: ietf@ietf.org > > From: Douglas Otis > > Download (untitled) [text/plain 580b] > > There is a growing stream of spam being emitted from 64.170.98.32. > > This appears to be the outbound server for IETF mailing-lists. Some > > of the spam has had headers added that indicate the message was > > originally received from an open relay or an IP address on several > > block-lists (with much of it encoded unicode). The messages > > identified as spam have included the original message content. This > > is creating a problem where receiving messages from the IETF is less > > reliable. > > Postmaster@ has been copied. Redacted examples are available upon > > request. > > -Doug > >I don't know who "Doug" is, mail-abuse.org appears to redirect to >mail-abuse.com, which has a statement saying they were bought out by >Trend Micro, no example mail was provided, and I see no evidence that >we're being exploited whatsoever. At this stage, I consider this mail >message to be frivolous. > >As everyone knows, because it has been the subject of much discussion >and argument in the past, we run very aggressive anti-spam measures on >the IETF servers, and ALL AMS servers. Those measures are still in >place, and still working. > >If anyone wishes to comment or ask questions, or has further information >about please feel free to contact me directly. > >Thanks, >Glen _______________________________________________ Testlist mailing list Testlist@mail.ietf.org https://mail.ietf.org/mailman/listinfo/testlist From testlist-bounces@mail.ietf.org Thu Sep 25 08:16:54 2008 Return-Path: X-Original-To: testlist-archive@ietf.org Delivered-To: ietfarch-testlist-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A0FCC3A6767; Thu, 25 Sep 2008 08:16:54 -0700 (PDT) X-Original-To: testlist@core3.amsl.com Delivered-To: testlist@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 69B9F3A68BD for ; Thu, 25 Sep 2008 08:13:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -99.57 X-Spam-Level: X-Spam-Status: No, score=-99.57 tagged_above=-999 required=5 tests=[AWL=-0.431, BAYES_00=-2.599, FAKE_REPLY_C=2.012, MSGID_MULTIPLE_AT=1.449, NO_RELAYS=-0.001, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cHwfPk7Sm+pi for ; Thu, 25 Sep 2008 08:13:34 -0700 (PDT) Received: from mail.amsl.com (mail.amsl.com [IPv6:2001:1890:1112:1::14]) by core3.amsl.com (Postfix) with ESMTP id 71CA93A687F for ; Thu, 25 Sep 2008 08:13:34 -0700 (PDT) Received: by thunder2.amsl.com (Postfix, from userid 1000) id 73B487FC6; Thu, 25 Sep 2008 08:13:41 -0700 (PDT) Date: Thu, 25 Sep 2008 08:13:42 -0700 From: Glen To: Fred Baker , IAOC Jabberr , Henrik Levkowetz , Olaf Kolkman , Marshall Eubanks , Ray Pelletier , Russ Housley , James M Galvin , testlist@mail.ietf.org, ams-ietf@amsl.com Message-ID: <20080925151342.GA5585@glen@amsl.com> MIME-Version: 1.0 Content-Disposition: inline User-Agent: Mutt/1.5.16 (2007-06-09) X-Mailman-Approved-At: Thu, 25 Sep 2008 08:16:53 -0700 Subject: Re: [testlist] Alleged spam complaint X-BeenThere: testlist@mail.ietf.org X-Mailman-Version: 2.1.9 Precedence: list Reply-To: testlist@mail.ietf.org List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: testlist-bounces@mail.ietf.org Errors-To: testlist-bounces@mail.ietf.org Lots of catching up here this morning: Fred said: > Ack. I just wanted to be sure you did. Fred - Understood, and THANK YOU for watching my back! And thank you ALL for watching my back, for that matter! Olaf said: > Doug knows his stuff so I assume that his assessment that spams originate > from 64.170.98.32. is true. Good. Establishing the legitimacy is always helpful. > Glen knows his stuff too, so I assume that his assessment that spam does > not originate from 64.170.98.32. is true too. Ha! I'm glad someone thinks so! Of course, I'm just as fallible as the next person, and have made my share of mistakes. > Are there any other explanations for which both Doug and Glen make the > correct assessments? Jim points out one possibility (and an example of my mistakes!) below... Marshall said: > I am getting spam from IETF servers, and it doesn't appear to be either > through-list or backscatter traffic. It might be, but it doesn't appear to be. Yup. As Jim points out: > Your message was destined to ops-chairs. All the "chairs" aliases are > expanded on the tools machine. It used to be that the IETF servers just > forwarded all those messages to the tools server. And that, Olaf, is the answer to the question. There actually is a third kind of outbound email we process - the "chairs" aliases... which are in fact just aliases, and nothing more (meaning, they are not lists, and so they contain no moderation queue or anything like that), and they do all forward to Henrik's machine for expansion and delivery, I assume using similar methods. Jim continues: > Previously I would have said that the problem is there is no spam filtering > in that path. I don't know if that's still the case. If there isn't, then > that's the problem. Alternatively, perhaps the spam filtering needs some > tweaking. By way of refresher, here is how spam is handled on the IETF servers: 1. Connection is opened to SMTPD port. HELO, MAIL FROM, and RCVD TO occurs. A number of immediate tests (access control lists, DNS resolution tests, address validity tests) are run, and failures cause an immediate reject. If these tests are passed, the message is accepted in to the system... 2. Virus scan. Infected messages are discarded. 3. Spam scan. All messages get reported. Messages scoring 5.0 or higher get tagged. ALL EMAIL GETS PASSED ALONG. That last point is key here. IETF policy requires that we not discard any spam that gets this far. We just tag it. Here, the path diverges. For RT tickets we have: 4. Postconfirm scan. Henrik's excellent challenge/response system checks for a confirmed sender, passing through only mail that has been confirmed, and holding other mail for a few days, then discarding it. For mailing lists we have: 4. Postconfirm scan. Henrik's excellent challenge/response system checks for a confirmed sender, passing through only mail that has been confirmed, and holding other mail for a few days, then discarding it. 5. Mailman filtering. The various rules set up for each mailing list become the final arbiter. Generally, tagged spam (5.0 and higher) is sent to moderation. Various permitted and rejected senders are evaluated. Rules are followed. All of the items in this step are configurable per-list. For aliases - which I hadn't remembered until Jim pointed them out - we have: ... nothing further. Tagged mail is passed through the alias chain out to Henrik's server or in a few other cases, to the direct destination of the alias ... ... where, I assume, responsible end-users have their own further spam filtering rules and actions in place. At the moment there are 161 aliases forwarding to tools. There are also 54 direct aliases of one form or another (Olaf, Ray and Russ have aliases, for example) in the system. Because these are just aliases, the messages get tagged, but not filtered. In my mind, this is the desired behavior, because it should be up to the receipient to do the actual filtering... and it's in line with what the IETF has repeatedly hashed out as its policy, generally. I assume that Doug must be on one of these aliases, although I haven't heard back from him yet, and I assume he's getting spam through that alias just as Marshall did (Marshall - I did get your ticket, I'm going to resolve it in reference to this discussion). So as far as I can see, the options are: 1. Educate the people on these aliases about the process above, and encourage them to use their own spam filtering. 2. Somehow modify the 200 aliases to go through postconfirm, or a spam evaluation system to discard tagged spam. 3. Convert all of these aliases to mailing lists, and allow those lists to distribute and/or filter the email. 4. Eliminate the aliases altogether, and use some other mechanism. Item 1 seems the most easily done, in light of the current structure. Items 2 and 3 would be huge undertakings, taking a significant amount of time, as each alias would have to be handled individually somehow. And I suspect item 4 isn't feasible, although it would eliminate the problem. And, of course, in Marshall's case, items 2 and 3 wouldn't have helped, because the message he cited in his ticket got a spam score of 0.3. Hardly high enough to trigger ANY automated processes, including his own. I understand that spam is a pain, and unacceptable. But speaking from the point of view of a system administrator, it is IMPOSSIBLE to FULLY ELIMINATE all spam. Marshall's spam is one example. We've had others. We've even had spammers actually manually confirm themselves to postconfirm, and then flood us with spam (fortunately only the RT queues were flooded, but still...) I assume that anyone on one of these aliases is in a position of some importance in the IETF. Regardless of anything else we do, I'd personally really like to see those people briefed on the current spam filtering system in place, how it relates to their aliases, and what to expect (and I wouldn't mind a request added in that they contact us directly, and NOT send their complaint to the entire IETF discussion list, but that's just me). That being said, if anyone has commentary or ideas, or would like some significant change made, your commentary is all most welcome! BY THE WAY: If any of you are not on the testlist (testlist@mail.ietf.org) and want to be, please let me know and I will add you. That list contains all the people who so kindly helped test during the transition, and represent, to me, the best of the best at the IETF. It is to that list primarily that I direct questions and commentary about issues like this, it is to me, like having the IETF collective intelligence in my back pocket. :-) If you would like to join the list, you would be welcome. Please let me know. Thanks, Glen _______________________________________________ Testlist mailing list Testlist@mail.ietf.org https://mail.ietf.org/mailman/listinfo/testlist From testlist-bounces@mail.ietf.org Thu Sep 25 08:54:44 2008 Return-Path: X-Original-To: testlist-archive@ietf.org Delivered-To: ietfarch-testlist-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 369723A68D7; Thu, 25 Sep 2008 08:54:44 -0700 (PDT) X-Original-To: testlist@core3.amsl.com Delivered-To: testlist@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 8EB2D3A6909 for ; Thu, 25 Sep 2008 08:52:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.265 X-Spam-Level: X-Spam-Status: No, score=-102.265 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, IP_NOT_FRIENDLY=0.334, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id b5bm1OBCzAAQ for ; Thu, 25 Sep 2008 08:52:54 -0700 (PDT) Received: from ee01.elistx.com (ee01.elistx.com [67.154.239.222]) by core3.amsl.com (Postfix) with ESMTP id 53B0D3A6901 for ; Thu, 25 Sep 2008 08:52:54 -0700 (PDT) Received: from CONVERSION-DAEMON.elistx.com by elistx.com (PMDF V6.3-2x2 #31546) id <0K7R00J01DET3I@elistx.com> for testlist@mail.ietf.org; Thu, 25 Sep 2008 11:52:05 -0400 (EDT) Received: from localhost (localhost.localdomain [127.0.0.1]) by elistx.com (PMDF V6.3-2x2 #31546) with ESMTP id <0K7R00HIZDES2H@elistx.com>; Thu, 25 Sep 2008 11:52:05 -0400 (EDT) Date: Thu, 25 Sep 2008 11:52:17 -0400 From: James M Galvin In-reply-to: <20080925151342.GA5585%glen@amsl.com> To: Glen , Fred Baker , IAOC Jabberr , Henrik Levkowetz , Olaf Kolkman , Marshall Eubanks , Ray Pelletier , Russ Housley , testlist@mail.ietf.org, ams-ietf@amsl.com Message-id: <84A7C65C30294F8E1A8D8707@eList-eXpress-LLC.local> MIME-version: 1.0 X-Mailer: Mulberry/4.0.8 (Mac OS X) Content-disposition: inline References: <20080925151342.GA5585%glen@amsl.com> X-Mailman-Approved-At: Thu, 25 Sep 2008 08:54:42 -0700 Subject: Re: [testlist] Alleged spam complaint X-BeenThere: testlist@mail.ietf.org X-Mailman-Version: 2.1.9 Precedence: list Reply-To: testlist@mail.ietf.org List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="us-ascii"; Format="flowed" Sender: testlist-bounces@mail.ietf.org Errors-To: testlist-bounces@mail.ietf.org -- On September 25, 2008 8:13:42 AM -0700 Glen wrote regarding Re: Alleged spam complaint -- > 1. Educate the people on these aliases about the process above, and > encourage them to use their own spam filtering. > 2. Somehow modify the 200 aliases to go through postconfirm, or a spam > evaluation system to discard tagged spam. > 3. Convert all of these aliases to mailing lists, and allow those > lists to distribute and/or filter the email. > 4. Eliminate the aliases altogether, and use some other mechanism. At the time of transition, my general philosophy was to make things as similar as possible to reduce the special cases. We got rid of quite a few but clearly not all. In this category of special cases were the "direct aliases". There are two types of these. There are those that are handled by the IETF servers at AMS and there are those handled by the tools server. We converted many of the IETF server aliases to lists (the important ones :-), for example, the ietf chair, iab chair, and iaoc chair aliases. However, there were quite a few leftover, many of which are probably OBE and useless (i.e., there's a fair amount of Neustar artifact in my opinion). The rest of these should be reviewed and either eliminated or made into a list so the can be handled like everything else. The issue with the tools aliases is that they expand based on information in the database. The tools team has done a great service here, at a time when there was no other way to get the job done. There are chair aliases for every working group and there are AD aliases for every area. It is these aliases that I think need some kind of solution. I don't think we want to eliminate them, which takes #4 off the table. We can't make them lists unless we're prepared to keep the subscriber lists up-to-date with what's in the database, which sounds a bit like a cart without a horse to me. This would be option #3. As to whether "education" is enough or actually doing something, given how things went with the mailing lists I think we need to do something. I would recommend putting the postconfirm system in front of these aliases. The one thing to be careful of is that I recall there are automated scripts that generate messages to these aliases so we'll need to make sure that the appropriate From addresses are all preconfirmed. There may be other access control tests that would be helpful, e.g., making sure that the From addresses used by automated scripts never arrive from an external source. Clearly this will be work, as Glen points out. But I don't think the IETF wants to risk be identified or labeled as a source of spam. That would be bad for everyone concerned. Jim _______________________________________________ Testlist mailing list Testlist@mail.ietf.org https://mail.ietf.org/mailman/listinfo/testlist From testlist-bounces@mail.ietf.org Thu Sep 25 14:11:24 2008 Return-Path: X-Original-To: testlist-archive@ietf.org Delivered-To: ietfarch-testlist-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1C54E3A687A; Thu, 25 Sep 2008 14:11:24 -0700 (PDT) X-Original-To: testlist@core3.amsl.com Delivered-To: testlist@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 5EC263A63EC for ; Thu, 25 Sep 2008 09:26:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.672 X-Spam-Level: X-Spam-Status: No, score=-102.672 tagged_above=-999 required=5 tests=[AWL=-0.073, BAYES_00=-2.599, GB_PHARMACY=1, RCVD_IN_DNSWL_LOW=-1, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 447AVnjUi+PK for ; Thu, 25 Sep 2008 09:26:40 -0700 (PDT) Received: from multicasttech.com (lennon.multicasttech.com [63.105.122.7]) by core3.amsl.com (Postfix) with ESMTP id 0244E3A6774 for ; Thu, 25 Sep 2008 09:26:39 -0700 (PDT) Received: from [63.105.122.7] (account marshall_eubanks HELO [IPv6:::1]) by multicasttech.com (CommuniGate Pro SMTP 3.4.8) with ESMTP-TLS id 13125328; Thu, 25 Sep 2008 11:55:11 -0400 Message-Id: <40E63A83-C1C2-455B-AB9D-AEF01FAC1FDD@multicasttech.com> From: Marshall Eubanks To: Glen In-Reply-To: <20080925151342.GA5585@glen@amsl.com> Mime-Version: 1.0 (Apple Message framework v926) Date: Thu, 25 Sep 2008 11:55:10 -0400 References: <20080925151342.GA5585@glen@amsl.com> X-Mailer: Apple Mail (2.926) X-Mailman-Approved-At: Thu, 25 Sep 2008 14:11:23 -0700 Cc: Olaf Kolkman , ams-ietf@amsl.com, testlist@mail.ietf.org, IAOC Jabberr , Ray Pelletier Subject: Re: [testlist] Alleged spam complaint X-BeenThere: testlist@mail.ietf.org X-Mailman-Version: 2.1.9 Precedence: list Reply-To: testlist@mail.ietf.org List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="us-ascii"; Format="flowed"; DelSp="yes" Sender: testlist-bounces@mail.ietf.org Errors-To: testlist-bounces@mail.ietf.org Hello all; In line. On Sep 25, 2008, at 11:13 AM, Glen wrote: > Lots of catching up here this morning: > > Fred said: >> Ack. I just wanted to be sure you did. > > Fred - Understood, and THANK YOU for watching my back! > > And thank you ALL for watching my back, for that matter! > > Olaf said: > >> Doug knows his stuff so I assume that his assessment that spams >> originate >> from 64.170.98.32. is true. > > Good. Establishing the legitimacy is always helpful. > >> Glen knows his stuff too, so I assume that his assessment that spam >> does >> not originate from 64.170.98.32. is true too. > > Ha! I'm glad someone thinks so! Of course, I'm just as fallible as > the > next person, and have made my share of mistakes. > >> Are there any other explanations for which both Doug and Glen make >> the >> correct assessments? > > Jim points out one possibility (and an example of my mistakes!) > below... > > Marshall said: > >> I am getting spam from IETF servers, and it doesn't appear to be >> either >> through-list or backscatter traffic. It might be, but it doesn't >> appear to be. > > Yup. As Jim points out: > >> Your message was destined to ops-chairs. All the "chairs" aliases >> are >> expanded on the tools machine. It used to be that the IETF servers >> just >> forwarded all those messages to the tools server. > > And that, Olaf, is the answer to the question. There actually is a > third > kind of outbound email we process - the "chairs" aliases... which > are in > fact just aliases, and nothing more (meaning, they are not lists, > and so > they contain no moderation queue or anything like that), and they do > all > forward to Henrik's machine for expansion and delivery, I assume using > similar methods. > > Jim continues: > >> Previously I would have said that the problem is there is no spam >> filtering >> in that path. I don't know if that's still the case. If there >> isn't, then >> that's the problem. Alternatively, perhaps the spam filtering >> needs some >> tweaking. > > By way of refresher, here is how spam is handled on the IETF servers: > > 1. Connection is opened to SMTPD port. HELO, MAIL FROM, and RCVD TO > occurs. > A number of immediate tests (access control lists, DNS resolution > tests, > address validity tests) are run, and failures cause an immediate > reject. > If these tests are passed, the message is accepted in to the > system... > 2. Virus scan. Infected messages are discarded. > 3. Spam scan. All messages get reported. Messages scoring 5.0 or > higher > get tagged. ALL EMAIL GETS PASSED ALONG. > > That last point is key here. IETF policy requires that we not > discard any > spam that gets this far. We just tag it. > > Here, the path diverges. For RT tickets we have: > > 4. Postconfirm scan. Henrik's excellent challenge/response system > checks > for a confirmed sender, passing through only mail that has been > confirmed, > and holding other mail for a few days, then discarding it. > > For mailing lists we have: > > 4. Postconfirm scan. Henrik's excellent challenge/response system > checks > for a confirmed sender, passing through only mail that has been > confirmed, > and holding other mail for a few days, then discarding it. > 5. Mailman filtering. The various rules set up for each mailing > list become > the final arbiter. Generally, tagged spam (5.0 and higher) is > sent to > moderation. Various permitted and rejected senders are > evaluated. Rules > are followed. All of the items in this step are configurable per- > list. > > For aliases - which I hadn't remembered until Jim pointed them out - > we have: > > ... nothing further. Tagged mail is passed through the alias chain > out to > Henrik's server or in a few other cases, to the direct destination > of the > alias ... > > ... where, I assume, responsible end-users have their own further spam > filtering rules and actions in place. > > At the moment there are 161 aliases forwarding to tools. There are > also 54 > direct aliases of one form or another (Olaf, Ray and Russ have > aliases, for > example) in the system. Because these are just aliases, the > messages get > tagged, but not filtered. In my mind, this is the desired behavior, > because > it should be up to the receipient to do the actual filtering... and > it's in > line with what the IETF has repeatedly hashed out as its policy, > generally. > > I assume that Doug must be on one of these aliases, although I haven't > heard back from him yet, and I assume he's getting spam through that > alias > just as Marshall did (Marshall - I did get your ticket, I'm going to > resolve > it in reference to this discussion). > > So as far as I can see, the options are: > > 1. Educate the people on these aliases about the process above, and > encourage them to use their own spam filtering. > 2. Somehow modify the 200 aliases to go through postconfirm, or a spam > evaluation system to discard tagged spam. > 3. Convert all of these aliases to mailing lists, and allow those > lists > to distribute and/or filter the email. > 4. Eliminate the aliases altogether, and use some other mechanism. Wouldn't the obvious solution be to have Henrik's servers implement postconfirm for this incoming traffic ? It is his solution, after all. > > > Item 1 seems the most easily done, in light of the current > structure. Items > 2 and 3 would be huge undertakings, taking a significant amount of > time, as > each alias would have to be handled individually somehow. And I > suspect > item 4 isn't feasible, although it would eliminate the problem. > > And, of course, in Marshall's case, items 2 and 3 wouldn't have > helped, > because the message he cited in his ticket got a spam score of 0.3. > Hardly > high enough to trigger ANY automated processes, including his own. > > I understand that spam is a pain, and unacceptable. But speaking > from the > point of view of a system administrator, it is IMPOSSIBLE to FULLY > ELIMINATE > all spam. Marshall's spam is one example. We've had others. We've > even > had spammers actually manually confirm themselves to postconfirm, > and then > flood us with spam (fortunately only the RT queues were flooded, but > still...) > I have had others... 24 in the last week. Here is a sample : 95% discount Patients can access Our pharmacy via the Internet 24 / 7 C A zN A DzAN P z rH A RM A mCY Do European Union Drugs not refuse you in plesure Forget failures in bedroom for 3 month porno dvd Full for ops-chairs If these all scored low, then there is something wrong with your scoring system ! (As is is, I wonder if these headers will cause this email to bounce.) And, they are indeed all to IETF aliases. The trouble with the above is that it may be acceptable if there are 24 bad messages, but it is definitely not if there are 24 million. And experience shows that spammers will eventually catch onto and utilize any security hole in industrial quantities. Regards Marshall > I assume that anyone on one of these aliases is in a position of some > importance in the IETF. Regardless of anything else we do, I'd > personally > really like to see those people briefed on the current spam filtering > system in place, how it relates to their aliases, and what to expect > (and > I wouldn't mind a request added in that they contact us directly, > and NOT > send their complaint to the entire IETF discussion list, but that's > just me). > > That being said, if anyone has commentary or ideas, or would like some > significant change made, your commentary is all most welcome! > > BY THE WAY: > > If any of you are not on the testlist (testlist@mail.ietf.org) and > want to > be, please let me know and I will add you. That list contains all the > people who so kindly helped test during the transition, and > represent, to > me, the best of the best at the IETF. It is to that list primarily > that I > direct questions and commentary about issues like this, it is to me, > like > having the IETF collective intelligence in my back pocket. :-) If > you > would like to join the list, you would be welcome. Please let me > know. > > Thanks, > Glen _______________________________________________ Testlist mailing list Testlist@mail.ietf.org https://mail.ietf.org/mailman/listinfo/testlist From testlist-bounces@mail.ietf.org Thu Sep 25 14:11:24 2008 Return-Path: X-Original-To: testlist-archive@ietf.org Delivered-To: ietfarch-testlist-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 324DC3A691C; Thu, 25 Sep 2008 14:11:24 -0700 (PDT) X-Original-To: testlist@core3.amsl.com Delivered-To: testlist@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 10FEF3A6858 for ; Thu, 25 Sep 2008 14:09:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -99.919 X-Spam-Level: X-Spam-Status: No, score=-99.919 tagged_above=-999 required=5 tests=[AWL=0.232, BAYES_00=-2.599, GB_PHARMACY=1, MSGID_MULTIPLE_AT=1.449, NO_RELAYS=-0.001, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SCSx6uQ-V97t for ; Thu, 25 Sep 2008 14:09:18 -0700 (PDT) Received: from mail.amsl.com (mail.amsl.com [IPv6:2001:1890:1112:1::14]) by core3.amsl.com (Postfix) with ESMTP id C1BD83A68E7 for ; Thu, 25 Sep 2008 14:09:18 -0700 (PDT) Received: by thunder2.amsl.com (Postfix, from userid 1000) id 472F17FDE; Thu, 25 Sep 2008 14:09:28 -0700 (PDT) Date: Thu, 25 Sep 2008 14:09:28 -0700 From: Glen To: Marshall Eubanks Message-ID: <20080925210928.GC10687@glen@amsl.com> References: <40E63A83-C1C2-455B-AB9D-AEF01FAC1FDD@multicasttech.com> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <40E63A83-C1C2-455B-AB9D-AEF01FAC1FDD@multicasttech.com> User-Agent: Mutt/1.5.16 (2007-06-09) X-Mailman-Approved-At: Thu, 25 Sep 2008 14:11:23 -0700 Cc: Olaf Kolkman , ams-ietf@amsl.com, testlist@mail.ietf.org, IAOC Jabberr , Ray Pelletier Subject: Re: [testlist] Alleged spam complaint X-BeenThere: testlist@mail.ietf.org X-Mailman-Version: 2.1.9 Precedence: list Reply-To: testlist@mail.ietf.org List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: testlist-bounces@mail.ietf.org Errors-To: testlist-bounces@mail.ietf.org Catching up here... Jim Galvin wrote: > I would recommend putting the postconfirm system in front of these aliases. > The one thing to be careful of is that I recall there are automated > scripts that generate messages to these aliases so we'll need to make sure > that the appropriate From addresses are all preconfirmed. There may be > other access control tests that would be helpful, e.g., making sure that > the From addresses used by automated scripts never arrive from an external > source. > Clearly this will be work, as Glen points out. I have no problem with this in theory; however, it will represent quite a bit of labor. First, Henrik will need to evaluate and/or modify postconfirm to support this particular configuration (it may already, I don't know.) Then, we'll have to rework and remap each of the 200 aliases, possibly creating additional support infrastructure, etc., around them (maybe turning them into accounts, or mailing lists, I don't know - Henrik will know) to ensure that they go through postconfirm. If I made a conservative guess of 4 mintues per alias for configuration and testing, you're still looking at a good 12-16 hours of labor here to engineer that... assuming it's that easy. And I'm just speaking off the top of my head. > But I don't think the IETF > wants to risk be identified or labeled as a source of spam. That would be > bad for everyone concerned. I think that this is what is totally annoying me about this situation. I know what you mean, Jim, and I know you understand this already, and I am not in any way directing this at you, but your wording illustrates an incorrect perception that is getting everyone riled here, and give me, happily, the opportunity to comment. The IETF servers ARE NOT A SOURCE OF SPAM. We are passing email to in-the- organization individuals through email aliases requested (at least implicitly BY those individuals) We are not "passing spam through", because the only people "receiving" on these aliases are IETF members or leaders of some type. Hence it is true that we are "receiving" spam, but I take strong exception to the statement may by the original complainant that we are "passing through" an "ever increasing stream of spam". We're not technically passing through anything, IMO. If the recipients of these aliases had POP accounts on the IETF server instead of forwarding aliases, this conversation would be vastly different. Then it would be a matter of putting spamassassin on their POP boxes... which would already have them... and adjusting their rulesets and blacklists, and calling it done. The fact that they're choosing aliases instead of POP boxes should not suddenly implicate our servers as being "a source of spam." That is, IMO, absolutely ridiculous. Okay, I'm done ranting. But I felt I needed to make that point. On Thu, Sep 25, 2008 at 11:55:10AM -0400, Marshall Eubanks wrote: > Wouldn't the obvious solution be to have Henrik's servers implement > postconfirm for this incoming traffic ? > It is his solution, after all. I haven't seen Henrik chime in on this, but I know he has been extremely busy recently. I am standing by for his word and ideas on this. Doubtless he will make some comment that cuts through to clarity and makes the solution seem simple, as he always does. I look forward with hope to that. > I have had others... 24 in the last week. Here is a sample : > 95% discount > Patients can access Our pharmacy via the Internet 24 / 7 > C A zN A DzAN P z rH A RM A mCY > Do European Union Drugs not refuse you in plesure > Forget failures in bedroom for 3 month > porno dvd Full for ops-chairs > If these all scored low, then there is something wrong with your scoring > system ! (As is is, I wonder if these headers will cause this email to > bounce.) And, they are indeed all to IETF aliases. Ha! Yes. Something wrong indeed. We're using SpamAssassin, of course, with every available ruleset from sa-update and openprotect; however, even those rulesets are, IMO, extremely weak in their default scoring. Even the most aggresive rules only default around 1.8-2.4; but almost all the "normal" rules add only 0.1 to 0.2 to the score. Reaching 5.0 is difficult. OTOH, I'm surprised at the sheer volume of spam we're already trapping. Spam scoring in the 20s - 40s - 80s and 90s is not uncommon (and quite humorous to read!). I myself run much more aggressive scoring on my personal accounts, and I get NO spam. But that's just for me. The problem we'll quickly run into if we try to tamper with default scoring is the same one we ran into when we talked about gateway rule checks - we will erupt into a huge debate about which test is "worthy" of what scoring - and that's just more than I can take on right now. So in order to not "rock the boat", I keep the rulesets updated, but at their default levels - even though I personally would LOVE to "up the weight" a bit. :-) > The trouble with the above is that it may be acceptable if there are 24 bad > messages, but it is definitely not if there are 24 million. And experience > shows that spammers will eventually catch onto and utilize any > security hole in industrial quantities. Agreed. When we took over the management of the IETF, we were told repeatedly that the IETF was interested, in principle, in "cleanup" of legacy systems that were no longer relevant or useful. So what *I'm* wondering is - maybe now is the time to look at these aliases, and why they exist, and perhaps *gasp* do something more than just put postconfirm in front of them? Maybe it's time to look at eliminating some or all of them? Changing some? Moving to web forms instead of publishing email addresses on the website in plain text for every pathetic little robot to pick up? Maybe set up POP accounts for key players, rather than using aliases, which will give each user more options for spam handling? I don't know... but it makes me wonder. Since no solution is perfect, and since, as Jim points out, there will be work and effort involved in dealing with this, I REALLY want to do "the right thing" at the highest level, and find a solution, rather than just one more band-aid. Glen _______________________________________________ Testlist mailing list Testlist@mail.ietf.org https://mail.ietf.org/mailman/listinfo/testlist From testlist-bounces@mail.ietf.org Thu Sep 25 14:39:10 2008 Return-Path: X-Original-To: testlist-archive@ietf.org Delivered-To: ietfarch-testlist-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 7410C3A682E; Thu, 25 Sep 2008 14:39:10 -0700 (PDT) X-Original-To: testlist@core3.amsl.com Delivered-To: testlist@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 6C4813A6858 for ; Thu, 25 Sep 2008 14:39:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.466 X-Spam-Level: X-Spam-Status: No, score=-2.466 tagged_above=-999 required=5 tests=[AWL=0.133, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QC5SiiGTbI3z for ; Thu, 25 Sep 2008 14:39:09 -0700 (PDT) Received: from rv-out-0708.google.com (rv-out-0708.google.com [209.85.198.247]) by core3.amsl.com (Postfix) with ESMTP id 4A8463A67A4 for ; Thu, 25 Sep 2008 14:39:09 -0700 (PDT) Received: by rv-out-0708.google.com with SMTP id b17so584742rvf.36 for ; Thu, 25 Sep 2008 14:38:35 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from :organization:user-agent:mime-version:to:cc:subject:references :in-reply-to:content-type:content-transfer-encoding; bh=chEu1PG/7hVVxnxQjY5R9gkojWNK52dwhI7gax1NyZM=; b=guNrqQyY0e9Sl+csUweDS/jKalqUyjmNAFg1ZzvRuJZzdOk7dax0iuylY3vtqEIoud mxFNapmAsg4I94jq4AH78CiX8V3sEYEpNZ7Tf8derm0CfwjAcOF3vK46DnWmi6P3X7nu JUFDnI7Nu8DAkYPNa/sNKeFTyXz2n+wmlmB2c= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:organization:user-agent:mime-version:to:cc :subject:references:in-reply-to:content-type :content-transfer-encoding; b=UWwUdSLkHwPFBpqyX0n4vsWfJ/yHR+sp0wPKUVRem8kfP9JdsJawfkEChhN6elshqC Q/LFSjnD+ex9fbyveM3LIZ1XvKEdlU7UC9i1+8mOxB+Wt/inDH9T6L35SDwMHG6P2s/D 79M+1lh7QPQkAX6STuJj8q0uAOMHhv20YKFDQ= Received: by 10.141.29.21 with SMTP id g21mr142016rvj.225.1222378715157; Thu, 25 Sep 2008 14:38:35 -0700 (PDT) Received: from ?130.216.38.124? ( [130.216.38.124]) by mx.google.com with ESMTPS id f21sm1631699rvb.5.2008.09.25.14.38.32 (version=SSLv3 cipher=RC4-MD5); Thu, 25 Sep 2008 14:38:34 -0700 (PDT) Message-ID: <48DC04D6.2060602@gmail.com> Date: Fri, 26 Sep 2008 09:38:30 +1200 From: Brian E Carpenter Organization: University of Auckland User-Agent: Thunderbird 2.0.0.6 (Windows/20070728) MIME-Version: 1.0 To: testlist@mail.ietf.org References: <40E63A83-C1C2-455B-AB9D-AEF01FAC1FDD@multicasttech.com> <20080925210928.GC10687@glen@amsl.com> In-Reply-To: <20080925210928.GC10687@glen@amsl.com> Cc: Olaf Kolkman , ams-ietf@amsl.com, iaoc@ietf.org, Ray Pelletier Subject: Re: [testlist] Alleged spam complaint X-BeenThere: testlist@mail.ietf.org X-Mailman-Version: 2.1.9 Precedence: list Reply-To: testlist@mail.ietf.org List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: testlist-bounces@mail.ietf.org Errors-To: testlist-bounces@mail.ietf.org > If I made a conservative guess of 4 mintues per alias for configuration > and testing, you're still looking at a good 12-16 hours of labor here to > engineer that... assuming it's that easy. And I'm just speaking off the > top of my head. It's for Henrik to say, but I think it's a bit more delicate, since these aliases are regenerated automagically at some frequency. You realise there is one for every I-D? For example, draft-otis-dkim-adsp tools.ietf.org and draft-otis-dkim-adsp-sec-issues tools.ietf.org both lead to Doug Otis, and that's only his 2008 drafts. He has at least 24 drafts in Henrik's database, although I don't know if the aliases exist for the older ones. Every I-D author is automatically the beneficiary of one of these. If they're not spam-proofed, oh dear. Brian _______________________________________________ Testlist mailing list Testlist@mail.ietf.org https://mail.ietf.org/mailman/listinfo/testlist From testlist-bounces@mail.ietf.org Thu Sep 25 14:46:10 2008 Return-Path: X-Original-To: testlist-archive@ietf.org Delivered-To: ietfarch-testlist-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 6676B3A67A4; Thu, 25 Sep 2008 14:46:10 -0700 (PDT) X-Original-To: testlist@core3.amsl.com Delivered-To: testlist@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 28DA53A69B7; Thu, 25 Sep 2008 14:22:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.599 X-Spam-Level: X-Spam-Status: No, score=-102.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id T7Sw3ovIIA3e; Thu, 25 Sep 2008 14:22:23 -0700 (PDT) Received: from merlot.tools.ietf.org (unknown [IPv6:2a01:3f0:0:31:214:22ff:fe21:bb]) by core3.amsl.com (Postfix) with ESMTP id E70F23A69BA; Thu, 25 Sep 2008 14:22:22 -0700 (PDT) Received: from localhost ([127.0.0.1]:59856 helo=chardonnay.local) by merlot.tools.ietf.org with esmtp (Exim 4.69) (envelope-from ) id 1KiyI6-000385-JR; Thu, 25 Sep 2008 23:22:26 +0200 Message-ID: <48DC0112.3000007@levkowetz.com> Date: Thu, 25 Sep 2008 23:22:26 +0200 From: Henrik Levkowetz User-Agent: Thunderbird 2.0.0.16 (Macintosh/20080707) MIME-Version: 1.0 To: Marshall Eubanks References: <20080925151342.GA5585@glen@amsl.com> <40E63A83-C1C2-455B-AB9D-AEF01FAC1FDD@multicasttech.com> In-Reply-To: <40E63A83-C1C2-455B-AB9D-AEF01FAC1FDD@multicasttech.com> X-Enigmail-Version: 0.95.7 X-SA-Exim-Connect-IP: 127.0.0.1 X-SA-Exim-Rcpt-To: tme@multicasttech.com, glen@amsl.com, fred@cisco.com, iaoc@ietf.org, olaf@NLnetLabs.nl, rpelletier@isoc.org, housley@vigilsec.com, galvin@elistx.com, testlist@mail.ietf.org, ams-ietf@amsl.com, henrik-sent@levkowetz.com X-SA-Exim-Mail-From: henrik@levkowetz.com X-SA-Exim-Scanned: No (on merlot.tools.ietf.org); SAEximRunCond expanded to false X-Mailman-Approved-At: Thu, 25 Sep 2008 14:46:09 -0700 Cc: Olaf Kolkman , ams-ietf@amsl.com, testlist@mail.ietf.org, IAOC Jabberr , Ray Pelletier Subject: Re: [testlist] Alleged spam complaint X-BeenThere: testlist@mail.ietf.org X-Mailman-Version: 2.1.9 Precedence: list Reply-To: testlist@mail.ietf.org List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: testlist-bounces@mail.ietf.org Errors-To: testlist-bounces@mail.ietf.org Reducing to what I believe is the essential points below (sorry for coming late to this discussion -- I've been away from mail for some 6 hours now, and you've sorted this all out in the meantime ,;-) : On 2008-09-25 17:55 Marshall Eubanks said the following: .. >> 1. Educate the people on these aliases about the process above, and >> encourage them to use their own spam filtering. >> 2. Somehow modify the 200 aliases to go through postconfirm, or a spam >> evaluation system to discard tagged spam. >> 3. Convert all of these aliases to mailing lists, and allow those >> lists >> to distribute and/or filter the email. >> 4. Eliminate the aliases altogether, and use some other mechanism. > > Wouldn't the obvious solution be to have Henrik's servers implement > postconfirm for this incoming traffic ? > It is his solution, after all. Yes and no. I'd prefer to put postconfirm in front of the aliases on the @ietf.org addresses; that will make the confirmation requests (where needed) come from the original addressee, and it will avoid a daily transfer of updated subscriber whitelists from mail.ietf.org to tools.ietf.org. This has also been something I've desired all along; I have anti-spam measures in effect at tools.ietf.org too, but I already know that these are much less effective against spam forwarded through mail.ietf.org, and thus have looked forward to putting something like postconfirm in front of the aliases. Unless this turns out to be impossible for some reason, I'd like to move forward with this solution. Henrik _______________________________________________ Testlist mailing list Testlist@mail.ietf.org https://mail.ietf.org/mailman/listinfo/testlist From testlist-bounces@mail.ietf.org Thu Sep 25 14:46:10 2008 Return-Path: X-Original-To: testlist-archive@ietf.org Delivered-To: ietfarch-testlist-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 900C43A68DE; Thu, 25 Sep 2008 14:46:10 -0700 (PDT) X-Original-To: testlist@core3.amsl.com Delivered-To: testlist@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1BA6D3A682E; Thu, 25 Sep 2008 14:36:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.599 X-Spam-Level: X-Spam-Status: No, score=-102.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id E0yvpMbvvm9L; Thu, 25 Sep 2008 14:36:22 -0700 (PDT) Received: from merlot.tools.ietf.org (unknown [IPv6:2a01:3f0:0:31:214:22ff:fe21:bb]) by core3.amsl.com (Postfix) with ESMTP id D078D3A67A4; Thu, 25 Sep 2008 14:36:21 -0700 (PDT) Received: from localhost ([127.0.0.1]:52023 helo=chardonnay.local) by merlot.tools.ietf.org with esmtp (Exim 4.69) (envelope-from ) id 1KiyVe-0003QC-PY; Thu, 25 Sep 2008 23:36:27 +0200 Message-ID: <48DC045A.2020109@levkowetz.com> Date: Thu, 25 Sep 2008 23:36:26 +0200 From: Henrik Levkowetz User-Agent: Thunderbird 2.0.0.16 (Macintosh/20080707) MIME-Version: 1.0 To: Glen References: <40E63A83-C1C2-455B-AB9D-AEF01FAC1FDD@multicasttech.com> <20080925210928.GC10687@glen@amsl.com> In-Reply-To: <20080925210928.GC10687@glen@amsl.com> X-Enigmail-Version: 0.95.7 X-SA-Exim-Connect-IP: 127.0.0.1 X-SA-Exim-Rcpt-To: glen@amsl.com, tme@multicasttech.com, fred@cisco.com, iaoc@ietf.org, olaf@NLnetLabs.nl, rpelletier@isoc.org, housley@vigilsec.com, galvin@elistx.com, testlist@mail.ietf.org, ams-ietf@amsl.com, henrik-sent@levkowetz.com X-SA-Exim-Mail-From: henrik@levkowetz.com X-SA-Exim-Scanned: No (on merlot.tools.ietf.org); SAEximRunCond expanded to false X-Mailman-Approved-At: Thu, 25 Sep 2008 14:46:09 -0700 Cc: Olaf Kolkman , ams-ietf@amsl.com, testlist@mail.ietf.org, IAOC Jabberr , Ray Pelletier Subject: Re: [testlist] Alleged spam complaint X-BeenThere: testlist@mail.ietf.org X-Mailman-Version: 2.1.9 Precedence: list Reply-To: testlist@mail.ietf.org List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: testlist-bounces@mail.ietf.org Errors-To: testlist-bounces@mail.ietf.org Hi Glen, all; Commenting on one particular point below: On 2008-09-25 23:09 Glen said the following: > So what *I'm* wondering is - maybe now is the time to look at these aliases, > and why they exist, and perhaps *gasp* do something more than just put > postconfirm in front of them? Maybe it's time to look at eliminating some > or all of them? Changing some? Moving to web forms instead of publishing > email addresses on the website in plain text for every pathetic little > robot to pick up? Maybe set up POP accounts for key players, rather than > using aliases, which will give each user more options for spam handling? The thing with these aliases is that they provide a very useful service in a manner which (if we can fix the spam issue) costs both the senders and receivers very little. The fact that for e.g. the sip WG the addresses sip-chairs@ietf.org and sip-ads@ietf.org are stable across changes of chairs and ADs, and continue to work without the need of any manual intervention or additional work by senders, chairs, ADs or secretariat make them hard to beat... Now, regarding the solution which I think would be worth-while to pursue here, which several people already suggested, of putting postconfirm in front of the aliases; I think (and hope) that this will prove fairly straight- forward. I think that if Glen and I talk over how postfix handles aliases, we'll find the right place to slot postconfirm in. Regards, Henrik _______________________________________________ Testlist mailing list Testlist@mail.ietf.org https://mail.ietf.org/mailman/listinfo/testlist From testlist-bounces@mail.ietf.org Thu Sep 25 14:51:54 2008 Return-Path: X-Original-To: testlist-archive@ietf.org Delivered-To: ietfarch-testlist-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 5CF413A67A3; Thu, 25 Sep 2008 14:51:54 -0700 (PDT) X-Original-To: testlist@core3.amsl.com Delivered-To: testlist@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 026D73A67AE for ; Thu, 25 Sep 2008 14:51:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -100.631 X-Spam-Level: X-Spam-Status: No, score=-100.631 tagged_above=-999 required=5 tests=[AWL=0.520, BAYES_00=-2.599, MSGID_MULTIPLE_AT=1.449, NO_RELAYS=-0.001, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IXPd-ndeOBmy for ; Thu, 25 Sep 2008 14:51:52 -0700 (PDT) Received: from mail.amsl.com (mail.amsl.com [IPv6:2001:1890:1112:1::14]) by core3.amsl.com (Postfix) with ESMTP id 4EA1E3A6858 for ; Thu, 25 Sep 2008 14:51:52 -0700 (PDT) Received: by thunder2.amsl.com (Postfix, from userid 1000) id D42A77FDE; Thu, 25 Sep 2008 14:52:01 -0700 (PDT) Date: Thu, 25 Sep 2008 14:52:01 -0700 From: Glen To: testlist@mail.ietf.org Message-ID: <20080925215201.GJ10687@glen@amsl.com> References: <40E63A83-C1C2-455B-AB9D-AEF01FAC1FDD@multicasttech.com> <48DC04D6.2060602@gmail.com> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <48DC04D6.2060602@gmail.com> User-Agent: Mutt/1.5.16 (2007-06-09) Cc: Olaf Kolkman , ams-ietf@amsl.com, Ray Pelletier , iaoc@ietf.org Subject: Re: [testlist] Alleged spam complaint X-BeenThere: testlist@mail.ietf.org X-Mailman-Version: 2.1.9 Precedence: list Reply-To: testlist@mail.ietf.org List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: testlist-bounces@mail.ietf.org Errors-To: testlist-bounces@mail.ietf.org On Fri, Sep 26, 2008 at 09:38:30AM +1200, Brian E Carpenter wrote: > It's for Henrik to say, but I think it's a bit more delicate, since these > aliases are regenerated automagically at some frequency. You realise > there is one for every I-D? > For example, draft-otis-dkim-adsp tools.ietf.org and > draft-otis-dkim-adsp-sec-issues tools.ietf.org both lead to > Doug Otis, and that's only his 2008 drafts. He has at least 24 > drafts in Henrik's database, although I don't know if the aliases > exist for the older ones. > Every I-D author is automatically the beneficiary > of one of these. If they're not spam-proofed, oh dear. These are a separate issue - since those aliases exist ONLY on the tools server, which Henrik manages, I will have to defer to him entirely on that. For the stuff on the AMS IETF servers, Henrik and I will implement his solution! :-) Glen _______________________________________________ Testlist mailing list Testlist@mail.ietf.org https://mail.ietf.org/mailman/listinfo/testlist From testlist-bounces@mail.ietf.org Thu Sep 25 14:52:17 2008 Return-Path: X-Original-To: testlist-archive@ietf.org Delivered-To: ietfarch-testlist-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 8A5D73A67A3; Thu, 25 Sep 2008 14:52:17 -0700 (PDT) X-Original-To: testlist@core3.amsl.com Delivered-To: testlist@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id EE8963A67AE for ; Thu, 25 Sep 2008 14:51:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -100.556 X-Spam-Level: X-Spam-Status: No, score=-100.556 tagged_above=-999 required=5 tests=[AWL=0.595, BAYES_00=-2.599, MSGID_MULTIPLE_AT=1.449, NO_RELAYS=-0.001, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XViBM9cuevX7 for ; Thu, 25 Sep 2008 14:51:03 -0700 (PDT) Received: from mail.amsl.com (mail.amsl.com [IPv6:2001:1890:1112:1::14]) by core3.amsl.com (Postfix) with ESMTP id 62C133A682E for ; Thu, 25 Sep 2008 14:51:03 -0700 (PDT) Received: by thunder2.amsl.com (Postfix, from userid 1000) id 9FA744810C; Thu, 25 Sep 2008 14:51:12 -0700 (PDT) Date: Thu, 25 Sep 2008 14:51:12 -0700 From: Glen To: Henrik Levkowetz Message-ID: <20080925215112.GI10687@glen@amsl.com> References: <40E63A83-C1C2-455B-AB9D-AEF01FAC1FDD@multicasttech.com> <48DC045A.2020109@levkowetz.com> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <48DC045A.2020109@levkowetz.com> User-Agent: Mutt/1.5.16 (2007-06-09) X-Mailman-Approved-At: Thu, 25 Sep 2008 14:52:16 -0700 Cc: Olaf Kolkman , ams-ietf@amsl.com, testlist@mail.ietf.org, IAOC Jabberr , Ray Pelletier Subject: Re: [testlist] Alleged spam complaint X-BeenThere: testlist@mail.ietf.org X-Mailman-Version: 2.1.9 Precedence: list Reply-To: testlist@mail.ietf.org List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: testlist-bounces@mail.ietf.org Errors-To: testlist-bounces@mail.ietf.org On Thu, Sep 25, 2008 at 11:36:26PM +0200, Henrik Levkowetz wrote: > Now, regarding the solution which I think would be worth-while to pursue > here, which several people already suggested, of putting postconfirm in > front of the aliases; I think (and hope) that this will prove fairly straight- > forward. I think that if Glen and I talk over how postfix handles aliases, > we'll find the right place to slot postconfirm in. I am at your service, as always, as you know. Email me directly and we'll get it moving! To the rest of you: THANK YOU for participating. As I predicted, Henrik will work some magic and I will assist as the apprentice (no Mickey Mouse jokes, plaese! ;-) Thank you Jim for the original suggestion as well! Glen _______________________________________________ Testlist mailing list Testlist@mail.ietf.org https://mail.ietf.org/mailman/listinfo/testlist From testlist-bounces@mail.ietf.org Thu Sep 25 16:41:18 2008 Return-Path: X-Original-To: testlist-archive@ietf.org Delivered-To: ietfarch-testlist-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D1FB13A6884; Thu, 25 Sep 2008 16:41:18 -0700 (PDT) X-Original-To: testlist@core3.amsl.com Delivered-To: testlist@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id C0D923A682E for ; Thu, 25 Sep 2008 15:31:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.645 X-Spam-Level: X-Spam-Status: No, score=-102.645 tagged_above=-999 required=5 tests=[AWL=-0.046, BAYES_00=-2.599, GB_PHARMACY=1, RCVD_IN_DNSWL_LOW=-1, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YhGLoc51jEfR for ; Thu, 25 Sep 2008 15:31:57 -0700 (PDT) Received: from multicasttech.com (lennon.multicasttech.com [63.105.122.7]) by core3.amsl.com (Postfix) with ESMTP id 8D6A83A67AE for ; Thu, 25 Sep 2008 15:31:57 -0700 (PDT) Received: from [63.105.122.7] (account marshall_eubanks HELO [IPv6:::1]) by multicasttech.com (CommuniGate Pro SMTP 3.4.8) with ESMTP-TLS id 13129268; Thu, 25 Sep 2008 18:00:35 -0400 Message-Id: <3BAB4969-0B97-4EED-9126-9A53544C3960@multicasttech.com> From: Marshall Eubanks To: Glen In-Reply-To: <20080925210928.GC10687@glen@amsl.com> Mime-Version: 1.0 (Apple Message framework v926) Date: Thu, 25 Sep 2008 18:00:32 -0400 References: <40E63A83-C1C2-455B-AB9D-AEF01FAC1FDD@multicasttech.com> <20080925210928.GC10687@glen@amsl.com> X-Mailer: Apple Mail (2.926) X-Mailman-Approved-At: Thu, 25 Sep 2008 16:41:18 -0700 Cc: Olaf Kolkman , ams-ietf@amsl.com, testlist@mail.ietf.org, IAOC Jabberr , Ray Pelletier Subject: Re: [testlist] [IAOC] Alleged spam complaint X-BeenThere: testlist@mail.ietf.org X-Mailman-Version: 2.1.9 Precedence: list Reply-To: testlist@mail.ietf.org List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="us-ascii"; Format="flowed"; DelSp="yes" Sender: testlist-bounces@mail.ietf.org Errors-To: testlist-bounces@mail.ietf.org I may be speaking out of turn here, but I think that all of the aliases should be mailing lists, with the possible exception of ietf-chair, irtf-chair and iab-chair (and those could be actual accounts). Simplicity ! Marshall On Sep 25, 2008, at 5:09 PM, Glen wrote: > Catching up here... > > Jim Galvin wrote: >> I would recommend putting the postconfirm system in front of these >> aliases. >> The one thing to be careful of is that I recall there are automated >> scripts that generate messages to these aliases so we'll need to >> make sure >> that the appropriate From addresses are all preconfirmed. There may >> be >> other access control tests that would be helpful, e.g., making sure >> that >> the From addresses used by automated scripts never arrive from an >> external >> source. >> Clearly this will be work, as Glen points out. > > I have no problem with this in theory; however, it will represent > quite a > bit of labor. First, Henrik will need to evaluate and/or modify > postconfirm > to support this particular configuration (it may already, I don't > know.) > > Then, we'll have to rework and remap each of the 200 aliases, possibly > creating additional support infrastructure, etc., around them (maybe > turning them into accounts, or mailing lists, I don't know - Henrik > will > know) to ensure that they go through postconfirm. > > If I made a conservative guess of 4 mintues per alias for > configuration > and testing, you're still looking at a good 12-16 hours of labor > here to > engineer that... assuming it's that easy. And I'm just speaking off > the > top of my head. > >> But I don't think the IETF >> wants to risk be identified or labeled as a source of spam. That >> would be >> bad for everyone concerned. > > I think that this is what is totally annoying me about this > situation. I > know what you mean, Jim, and I know you understand this already, and > I am > not in any way directing this at you, but your wording illustrates an > incorrect perception that is getting everyone riled here, and give me, > happily, the opportunity to comment. > > The IETF servers ARE NOT A SOURCE OF SPAM. We are passing email to > in-the- > organization individuals through email aliases requested (at least > implicitly > BY those individuals) We are not "passing spam through", because > the only > people "receiving" on these aliases are IETF members or leaders of > some > type. Hence it is true that we are "receiving" spam, but I take > strong > exception to the statement may by the original complainant that we are > "passing through" an "ever increasing stream of spam". We're not > technically > passing through anything, IMO. > > If the recipients of these aliases had POP accounts on the IETF server > instead of forwarding aliases, this conversation would be vastly > different. > Then it would be a matter of putting spamassassin on their POP > boxes... > which would already have them... and adjusting their rulesets and > blacklists, > and calling it done. The fact that they're choosing aliases instead > of POP > boxes should not suddenly implicate our servers as being "a source > of spam." > That is, IMO, absolutely ridiculous. > > Okay, I'm done ranting. But I felt I needed to make that point. > > On Thu, Sep 25, 2008 at 11:55:10AM -0400, Marshall Eubanks wrote: >> Wouldn't the obvious solution be to have Henrik's servers implement >> postconfirm for this incoming traffic ? >> It is his solution, after all. > > I haven't seen Henrik chime in on this, but I know he has been > extremely > busy recently. I am standing by for his word and ideas on this. > Doubtless > he will make some comment that cuts through to clarity and makes the > solution seem simple, as he always does. I look forward with hope > to that. > >> I have had others... 24 in the last week. Here is a sample : >> 95% discount >> Patients can access Our pharmacy via the Internet 24 / 7 >> C A zN A DzAN P z rH A RM A mCY >> Do European Union Drugs not refuse you in plesure >> Forget failures in bedroom for 3 month >> porno dvd Full for ops-chairs >> If these all scored low, then there is something wrong with your >> scoring >> system ! (As is is, I wonder if these headers will cause this email >> to >> bounce.) And, they are indeed all to IETF aliases. > > Ha! Yes. Something wrong indeed. We're using SpamAssassin, of > course, > with every available ruleset from sa-update and openprotect; > however, even > those rulesets are, IMO, extremely weak in their default scoring. > Even > the most aggresive rules only default around 1.8-2.4; but almost all > the > "normal" rules add only 0.1 to 0.2 to the score. Reaching 5.0 is > difficult. > > OTOH, I'm surprised at the sheer volume of spam we're already > trapping. > Spam scoring in the 20s - 40s - 80s and 90s is not uncommon (and quite > humorous to read!). > > I myself run much more aggressive scoring on my personal accounts, > and I > get NO spam. But that's just for me. > > The problem we'll quickly run into if we try to tamper with default > scoring > is the same one we ran into when we talked about gateway rule checks > - we > will erupt into a huge debate about which test is "worthy" of what > scoring - > and that's just more than I can take on right now. So in order to > not "rock > the boat", I keep the rulesets updated, but at their default levels > - even > though I personally would LOVE to "up the weight" a bit. :-) > >> The trouble with the above is that it may be acceptable if there >> are 24 bad >> messages, but it is definitely not if there are 24 million. And >> experience >> shows that spammers will eventually catch onto and utilize any >> security hole in industrial quantities. > > Agreed. > > When we took over the management of the IETF, we were told > repeatedly that > the IETF was interested, in principle, in "cleanup" of legacy > systems that > were no longer relevant or useful. > > So what *I'm* wondering is - maybe now is the time to look at these > aliases, > and why they exist, and perhaps *gasp* do something more than just put > postconfirm in front of them? Maybe it's time to look at > eliminating some > or all of them? Changing some? Moving to web forms instead of > publishing > email addresses on the website in plain text for every pathetic little > robot to pick up? Maybe set up POP accounts for key players, rather > than > using aliases, which will give each user more options for spam > handling? > > I don't know... but it makes me wonder. Since no solution is > perfect, and > since, as Jim points out, there will be work and effort involved in > dealing > with this, I REALLY want to do "the right thing" at the highest > level, and > find a solution, rather than just one more band-aid. > > Glen > _______________________________________________ > IAOC mailing list > IAOC@ietf.org > https://www.ietf.org/mailman/listinfo/iaoc _______________________________________________ Testlist mailing list Testlist@mail.ietf.org https://mail.ietf.org/mailman/listinfo/testlist From testlist-bounces@mail.ietf.org Thu Sep 25 16:41:18 2008 Return-Path: X-Original-To: testlist-archive@ietf.org Delivered-To: ietfarch-testlist-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id DF7B23A691D; Thu, 25 Sep 2008 16:41:18 -0700 (PDT) X-Original-To: testlist@core3.amsl.com Delivered-To: testlist@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 32CF83A67AE for ; Thu, 25 Sep 2008 15:31:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.64 X-Spam-Level: X-Spam-Status: No, score=-102.64 tagged_above=-999 required=5 tests=[AWL=-0.041, BAYES_00=-2.599, GB_PHARMACY=1, RCVD_IN_DNSWL_LOW=-1, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1kYBzhOF+8y4 for ; Thu, 25 Sep 2008 15:31:58 -0700 (PDT) Received: from multicasttech.com (lennon.multicasttech.com [63.105.122.7]) by core3.amsl.com (Postfix) with ESMTP id 0C80A3A67C0 for ; Thu, 25 Sep 2008 15:31:57 -0700 (PDT) Received: from [63.105.122.7] (account marshall_eubanks HELO [IPv6:::1]) by multicasttech.com (CommuniGate Pro SMTP 3.4.8) with ESMTP-TLS id 13129346; Thu, 25 Sep 2008 18:10:49 -0400 Message-Id: <6A50AB8E-C5B1-420D-B5AB-FD8311B62FA0@multicasttech.com> From: Marshall Eubanks To: Marshall Eubanks In-Reply-To: <3BAB4969-0B97-4EED-9126-9A53544C3960@multicasttech.com> Mime-Version: 1.0 (Apple Message framework v926) Date: Thu, 25 Sep 2008 18:10:46 -0400 References: <40E63A83-C1C2-455B-AB9D-AEF01FAC1FDD@multicasttech.com> <20080925210928.GC10687@glen@amsl.com> <3BAB4969-0B97-4EED-9126-9A53544C3960@multicasttech.com> X-Mailer: Apple Mail (2.926) X-Mailman-Approved-At: Thu, 25 Sep 2008 16:41:18 -0700 Cc: Olaf Kolkman , ams-ietf@amsl.com, testlist@mail.ietf.org, IAOC Jabberr , Ray Pelletier Subject: Re: [testlist] [IAOC] Alleged spam complaint X-BeenThere: testlist@mail.ietf.org X-Mailman-Version: 2.1.9 Precedence: list Reply-To: testlist@mail.ietf.org List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="us-ascii"; Format="flowed"; DelSp="yes" Sender: testlist-bounces@mail.ietf.org Errors-To: testlist-bounces@mail.ietf.org Having caught up with the entire email thread, I see the point of Henrik's statements re alias stability under personnel changes and withdraw this. I hope that applying postfix is not too hard ! Marshall On Sep 25, 2008, at 6:00 PM, Marshall Eubanks wrote: > I may be speaking out of turn here, but I think that all of the > aliases should be > mailing lists, with the possible exception of ietf-chair, irtf-chair > and iab-chair (and those could > be actual accounts). > > Simplicity ! > > Marshall > > > On Sep 25, 2008, at 5:09 PM, Glen wrote: > >> Catching up here... >> >> Jim Galvin wrote: >>> I would recommend putting the postconfirm system in front of these >>> aliases. >>> The one thing to be careful of is that I recall there are automated >>> scripts that generate messages to these aliases so we'll need to >>> make sure >>> that the appropriate From addresses are all preconfirmed. There >>> may be >>> other access control tests that would be helpful, e.g., making >>> sure that >>> the From addresses used by automated scripts never arrive from an >>> external >>> source. >>> Clearly this will be work, as Glen points out. >> >> I have no problem with this in theory; however, it will represent >> quite a >> bit of labor. First, Henrik will need to evaluate and/or modify >> postconfirm >> to support this particular configuration (it may already, I don't >> know.) >> >> Then, we'll have to rework and remap each of the 200 aliases, >> possibly >> creating additional support infrastructure, etc., around them (maybe >> turning them into accounts, or mailing lists, I don't know - Henrik >> will >> know) to ensure that they go through postconfirm. >> >> If I made a conservative guess of 4 mintues per alias for >> configuration >> and testing, you're still looking at a good 12-16 hours of labor >> here to >> engineer that... assuming it's that easy. And I'm just speaking >> off the >> top of my head. >> >>> But I don't think the IETF >>> wants to risk be identified or labeled as a source of spam. That >>> would be >>> bad for everyone concerned. >> >> I think that this is what is totally annoying me about this >> situation. I >> know what you mean, Jim, and I know you understand this already, >> and I am >> not in any way directing this at you, but your wording illustrates an >> incorrect perception that is getting everyone riled here, and give >> me, >> happily, the opportunity to comment. >> >> The IETF servers ARE NOT A SOURCE OF SPAM. We are passing email to >> in-the- >> organization individuals through email aliases requested (at least >> implicitly >> BY those individuals) We are not "passing spam through", because >> the only >> people "receiving" on these aliases are IETF members or leaders of >> some >> type. Hence it is true that we are "receiving" spam, but I take >> strong >> exception to the statement may by the original complainant that we >> are >> "passing through" an "ever increasing stream of spam". We're not >> technically >> passing through anything, IMO. >> >> If the recipients of these aliases had POP accounts on the IETF >> server >> instead of forwarding aliases, this conversation would be vastly >> different. >> Then it would be a matter of putting spamassassin on their POP >> boxes... >> which would already have them... and adjusting their rulesets and >> blacklists, >> and calling it done. The fact that they're choosing aliases >> instead of POP >> boxes should not suddenly implicate our servers as being "a source >> of spam." >> That is, IMO, absolutely ridiculous. >> >> Okay, I'm done ranting. But I felt I needed to make that point. >> >> On Thu, Sep 25, 2008 at 11:55:10AM -0400, Marshall Eubanks wrote: >>> Wouldn't the obvious solution be to have Henrik's servers implement >>> postconfirm for this incoming traffic ? >>> It is his solution, after all. >> >> I haven't seen Henrik chime in on this, but I know he has been >> extremely >> busy recently. I am standing by for his word and ideas on this. >> Doubtless >> he will make some comment that cuts through to clarity and makes the >> solution seem simple, as he always does. I look forward with hope >> to that. >> >>> I have had others... 24 in the last week. Here is a sample : >>> 95% discount >>> Patients can access Our pharmacy via the Internet 24 / 7 >>> C A zN A DzAN P z rH A RM A mCY >>> Do European Union Drugs not refuse you in plesure >>> Forget failures in bedroom for 3 month >>> porno dvd Full for ops-chairs >>> If these all scored low, then there is something wrong with your >>> scoring >>> system ! (As is is, I wonder if these headers will cause this >>> email to >>> bounce.) And, they are indeed all to IETF aliases. >> >> Ha! Yes. Something wrong indeed. We're using SpamAssassin, of >> course, >> with every available ruleset from sa-update and openprotect; >> however, even >> those rulesets are, IMO, extremely weak in their default scoring. >> Even >> the most aggresive rules only default around 1.8-2.4; but almost >> all the >> "normal" rules add only 0.1 to 0.2 to the score. Reaching 5.0 is >> difficult. >> >> OTOH, I'm surprised at the sheer volume of spam we're already >> trapping. >> Spam scoring in the 20s - 40s - 80s and 90s is not uncommon (and >> quite >> humorous to read!). >> >> I myself run much more aggressive scoring on my personal accounts, >> and I >> get NO spam. But that's just for me. >> >> The problem we'll quickly run into if we try to tamper with default >> scoring >> is the same one we ran into when we talked about gateway rule >> checks - we >> will erupt into a huge debate about which test is "worthy" of what >> scoring - >> and that's just more than I can take on right now. So in order to >> not "rock >> the boat", I keep the rulesets updated, but at their default levels >> - even >> though I personally would LOVE to "up the weight" a bit. :-) >> >>> The trouble with the above is that it may be acceptable if there >>> are 24 bad >>> messages, but it is definitely not if there are 24 million. And >>> experience >>> shows that spammers will eventually catch onto and utilize any >>> security hole in industrial quantities. >> >> Agreed. >> >> When we took over the management of the IETF, we were told >> repeatedly that >> the IETF was interested, in principle, in "cleanup" of legacy >> systems that >> were no longer relevant or useful. >> >> So what *I'm* wondering is - maybe now is the time to look at these >> aliases, >> and why they exist, and perhaps *gasp* do something more than just >> put >> postconfirm in front of them? Maybe it's time to look at >> eliminating some >> or all of them? Changing some? Moving to web forms instead of >> publishing >> email addresses on the website in plain text for every pathetic >> little >> robot to pick up? Maybe set up POP accounts for key players, >> rather than >> using aliases, which will give each user more options for spam >> handling? >> >> I don't know... but it makes me wonder. Since no solution is >> perfect, and >> since, as Jim points out, there will be work and effort involved in >> dealing >> with this, I REALLY want to do "the right thing" at the highest >> level, and >> find a solution, rather than just one more band-aid. >> >> Glen >> _______________________________________________ >> IAOC mailing list >> IAOC@ietf.org >> https://www.ietf.org/mailman/listinfo/iaoc > > _______________________________________________ > IAOC mailing list > IAOC@ietf.org > https://www.ietf.org/mailman/listinfo/iaoc _______________________________________________ Testlist mailing list Testlist@mail.ietf.org https://mail.ietf.org/mailman/listinfo/testlist From testlist-bounces@mail.ietf.org Thu Sep 25 20:55:28 2008 Return-Path: X-Original-To: testlist-archive@ietf.org Delivered-To: ietfarch-testlist-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id DF0753A68BB for ; Thu, 25 Sep 2008 20:55:28 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Subject: You have been unsubscribed from the Testlist mailing list From: testlist-bounces@mail.ietf.org To: testlist-archive@ietf.org Message-ID: Date: Thu, 25 Sep 2008 20:55:28 -0700 Precedence: bulk X-BeenThere: testlist@mail.ietf.org X-Mailman-Version: 2.1.9 List-Id: X-List-Administrivia: yes Sender: testlist-bounces@mail.ietf.org Errors-To: testlist-bounces@mail.ietf.org