Subject: A plague of link spam ...

From: Tom Lane <[email-masked]>
Date: Fri, 15 Mar 2013 14:16:21 -0400

I've been seeing more and more link spam getting through on the PG
lists; this past week there's been about one a day.  It might or might
not be relevant that just about every single one of them is from
yahoo.com accounts.  (I am only about one or two more spams away from
summarily blocking all yahoo traffic from my own mail server, btw.
They account for easily a third of all the spam I'm seeing lately.)

Can't we adjust the spam filters to be a bit more wary of traffic like
the attached?  Single body line consisting of a URL is not legitimate
list traffic IMO.

			regards, tom lane

------- Forwarded Message

DomainKey-Signature:a=rsa-sha1; q=dns; c=nofws;
  s=s1024; d=yahoo.com;
  h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type;
  b=RTEwpKyuWjhSj627T6WJneVz9kZ7HblOAx5AwO3LFRBL5Zv65qdroxlUzjfWKHi4w5bKxCUupCvKOiJR1/B1iQiP65ktiOvtHfb28WSf7qN0mkPIA+qwcjD2eQ9YC5LBUPZuCwoIh8xZehZTROadWwNAJMZLW3OjtqMK9wSx7pA=;
Date: Fri, 15 Mar 2013 11:01:59 -0700 (PDT)
From: Bob Brown <[email-masked]>
Reply-To: Bob Brown <[email-masked]>
Subject: [GENERAL] link
To: jim <[email-masked]>, bob brown <[email-masked]>,
        ed mann <[email-masked]>,
        mwittekiend <[email-masked]>,
        lesa <[email-masked]>,
        pgsql general <[email-masked]>
Sender: [email-masked]

---1007318780-374093466-1363370519=:49230
Content-Type: text/plain; charset=us-ascii

http://staggeciktiricisprey.net/xsq/qqkzowzznmat
---1007318780-374093466-1363370519=:49230
Content-Type: text/html; charset=us-ascii

<html><body><div style="color:#000; background-color:#fff; font-family:tahoma, new york, times, serif;font-size:10pt"><div><span style="font-family: arial,helvetica,sans-serif;"><span class="tab"><span style="font-size: 18px;">&nbsp;&nbsp;&nbsp; </span></span></span><br><span style="font-size: 18px;"><a href="http://staggeciktiricisprey.net/xsq/qqkzowzznmat">http://staggeciktiricisprey.net/xsq/qqkzowzznmat</a></span></div></div></body></html>
---1007318780-374093466-1363370519=:49230--

------- End of Forwarded Message

-- 
Sent via pgsql-www mailing list ([email-masked])
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-www

---

From: Alvaro Herrera <[email-masked]>
Date: Fri, 15 Mar 2013 15:30:50 -0300

> They account for easily a third of all the spam I'm seeing lately.)

Yeah, I have removed the subscriptions for these addresses on sight.
Sadly, it seems unused Yahoo accounts are ripe for malfeasants to pick.
We removed hundreds of old, unused Yahoo and Hotmail addresses when we
moved the listserver, but evidently new ones keep popping up.  (It's a
bit funny that old addresses can be created anew.)

> the attached?  Single body line consisting of a URL is not legitimate

I'll let Stefan chime in on this.

-- 
Álvaro Herrera                http://www.2ndQuadrant.com/
PostgreSQL Development, 24x7 Support, Training & Services

---

From: Stefan Kaltenbrunner <[email-masked]>
Date: Fri, 15 Mar 2013 20:30:11 +0100

> They account for easily a third of all the spam I'm seeing lately.)

yeah abuse on yahoo accounts is really bad, but I don't think we can
block those in general...

> the attached?  Single body line consisting of a URL is not legitimate

I will see what I can do, alvaro and I have some ideas on how to improve
our current filtering but doing that without blocking (too much)
legimate mail requires careful testing and evaluation...

Stefan

---

From: Tom Lane <[email-masked]>
Date: Fri, 15 Mar 2013 16:46:36 -0400

Stefan Kaltenbrunner <[email-masked]> writes:
>> (I am only about one or two more spams away from

> block those in general...

TBH, I think Yahoo doesn't give a damn about their spam problem because
they think they're too big for anybody to block them.  It's not going to
get better until some people start to do so anyway.

			regards, tom lane

---

From: Stefan Kaltenbrunner <[email-masked]>
Date: Sat, 16 Mar 2013 19:34:12 +0100

> get better until some people start to do so anyway.

yeah yahoo seems to be unable to deal with them - there is tons of
discussions about the yahoo DKIM-signed-"only a link" spam on the
spamassassin lists for example and some people consider it the "#1 spam
problem" there...

However - I still don't think we can seriously consider blocking all of
yahoo inbound - what do others think about this?

Stefan

---

From: Dave Page <[email-masked]>
Date: Sat, 16 Mar 2013 18:48:33 +0000

> yahoo inbound - what do others think about this?

Sooner or later someone has to make a stand. 

Disclaimer: I'm with Devrim in London. And England just lost to Wales.

---

From: Raymond O'Donnell <[email-masked]>
Date: Sat, 16 Mar 2013 18:52:17 +0000

> Disclaimer: I'm with Devrim in London. And England just lost to Wales. 

And a cracker of a match it was too... and Wales was the only team that
Ireland managed to beat this year... :-)

Ray.

-- 
Raymond O'Donnell :: Galway :: Ireland
[email-masked]

---

From: Tom Lane <[email-masked]>
Date: Sat, 16 Mar 2013 14:56:04 -0400

> Sooner or later someone has to make a stand. 

TBH I wasn't (very) seriously suggesting we institute such a block on
the project's mailing lists, only remarking that I was about ready
to do so for my own mail.  But I'm well known for having draconian
filtering in place.

What I *would* like to see on the lists is some attempt at catching
link spam, because more and more of that has been getting through
lately.  I'm not sure all of it has been from yahoo accounts.

			regards, tom lane

---

From: Stefan Kaltenbrunner <[email-masked]>
Date: Sat, 16 Mar 2013 20:09:51 +0100

> lately.  I'm not sure all of it has been from yahoo accounts.

working on it, spent a few hours yesterday and today to work on our
filtering but it is not as easy as simply declaring "everything that is
a very short mail and has a url in it is bad".
We do have regular mailbox users (in the same namespaces as the list) as
do we have lists that want to receive such stuff (say the sysadmin list
getting an email about a failed http download from a cronjob with
basically just the url).

Stefan

---

From: Tom Lane <[email-masked]>
Date: Sat, 16 Mar 2013 15:33:26 -0400

> getting an email about a failed http download from a cronjob with

Maybe that could be dealt with by whitelisting the expected senders
of such traffic?  Or maybe we could get away with blacklisting url-only
mails from yahoo and anyplace else that proves to be a problem?

			regards, tom lane

---

From: Alvaro Herrera <[email-masked]>
Date: Sat, 16 Mar 2013 21:39:31 -0300

> to do so for my own mail.  But I'm well known for having draconian

The valid traffic from Yahoo is fairly low -- less than one a day.

It bothers me too that link spam is getting through.  We have a great
record of very clean traffic.  I'm happy to hear that Stefan is working
more on improving it, thanks.

---

From: Magnus Hagander <[email-masked]>
Date: Sun, 17 Mar 2013 10:30:37 +0100

> more on improving it, thanks.

If it's less than one per day, perhaps we can just auto moderate *all* mail
from yahoo, at least as a temporary measure?

/Magnus

---

From: "Joshua D. Drake" <[email-masked]>
Date: Sun, 17 Mar 2013 11:24:50 -0700

>> Sooner or later someone has to make a stand.

We would lose the occasional post for Jan.

JD

-- 
Command Prompt, Inc. - http://www.commandprompt.com/
PostgreSQL Support, Training, Professional Services and Development
High Availability, Oracle Conversion, Postgres-XC
@cmdpromptinc - 509-416-6579

---

From: Andres Freund <[email-masked]>
Date: Sat, 23 Mar 2013 14:28:12 +0100

> We would lose the occasional post for Jan.

Kevin seems to use some yahoo service as well, judging from the message-ids in
his mails.

Greetings,

Andres Freund

-- 
 Andres Freund	                   http://www.2ndQuadrant.com/
 PostgreSQL Development, 24x7 Support, Training & Services

---

From: "Greg Sabino Mullane" <[email-masked]>
Date: Sat, 23 Mar 2013 14:53:19 -0000

Stefan Kaltenbrunner asked:
> However - I still don't think we can seriously consider 
> blocking all of yahoo inbound - what do others think about this?

I think that is a bad idea. Many, many people still use yahoo.com 
accounts, and yahoo's behavior is certainly not bad enough to 
warrant punishing all of those people. pgsql-general alone has about 
50 subscribers using yahoo accounts. Too big of a hammer for the 
OP's problem, IMO. Why not have single URL posts get thrown in the 
moderation queue?

- -- 
Greg Sabino Mullane [email-masked]
PGP Key: 0x14964AC8 201303231051
http://biglumber.com/x/web?pk=2529DF6AB8F79407E94445B4BC9B906714964AC8