Hi all,
For whatever reason, we're seeing a fair number of complaints that people are being spammed by subscription requests. It looks like there's some sort of script hitting a number of mailman installations and sending subscribe requests for a variety of email addresses.
I have no idea what this accomplishes for the person(s) behind the bot(s) but it's annoying people and AFAIK we don't have a good way of blocking it.
We could cut this off at the pass by turning off the ability to subscribe, but that means we'd have to process subscription requests manually and some folks might not subscribe if they have to jump through additional hoops. But I don't think the subscription rate is particularly high for this list - so that may be a minor issue.
Thoughts? I hate to make things more complicated, but I also would like our list software not be abused.
Best,
jzb
It comes with the territory of being a list admin IMO.
On Mon, Mar 23, 2015 at 9:42 AM, Joe Brockmeier jzb@redhat.com wrote:
Hi all,
For whatever reason, we're seeing a fair number of complaints that people are being spammed by subscription requests. It looks like there's some sort of script hitting a number of mailman installations and sending subscribe requests for a variety of email addresses.
I have no idea what this accomplishes for the person(s) behind the bot(s) but it's annoying people and AFAIK we don't have a good way of blocking it.
We could cut this off at the pass by turning off the ability to subscribe, but that means we'd have to process subscription requests manually and some folks might not subscribe if they have to jump through additional hoops. But I don't think the subscription rate is particularly high for this list - so that may be a minor issue.
Thoughts? I hate to make things more complicated, but I also would like our list software not be abused.
Best,
jzb
Joe Brockmeier | Principal Cloud & Storage Analyst jzb@redhat.com | http://community.redhat.com/ Twitter: @jzb | http://dissociatedpress.net/
-- marketing mailing list marketing@lists.fedoraproject.org List info or to change your subscription: https://admin.fedoraproject.org/mailman/listinfo/marketing
On 03/23/2015 11:31 AM, Robert 'Bob' Jensen wrote:
It comes with the territory of being a list admin IMO.
I admin several lists - this one is getting a much higher than usual rate of requests. Not the usual smattering - more of a firehose.
Best,
jzb
On 23 March 2015 at 15:46, Joe Brockmeier jzb@redhat.com wrote:
On 03/23/2015 11:31 AM, Robert 'Bob' Jensen wrote:
It comes with the territory of being a list admin IMO.
I admin several lists - this one is getting a much higher than usual rate of requests. Not the usual smattering - more of a firehose.
Best,
We are going to put in a fix hopefully soon. It may cause some issues. I can get you a list of the thousands of accounts spammed in case we need to write an apology to them. [MOst of them get subscribed 1000 times each]
On 03/23/2015 05:54 PM, Stephen John Smoogen wrote:
On 23 March 2015 at 15:46, Joe Brockmeier <jzb@redhat.com mailto:jzb@redhat.com> wrote:
On 03/23/2015 11:31 AM, Robert 'Bob' Jensen wrote: > It comes with the territory of being a list admin IMO. I admin several lists - this one is getting a much higher than usual rate of requests. Not the usual smattering - more of a firehose. Best,
We are going to put in a fix hopefully soon. It may cause some issues. I can get you a list of the thousands of accounts spammed in case we need to write an apology to them. [MOst of them get subscribed 1000 times each]
Thanks much! I'm debating whether another email is a good idea :-) But please do let me know if you have a list of accounts. Thanks!
On Mon, 2015-03-23 at 21:44 -0400, Joe Brockmeier wrote:
Thanks much! I'm debating whether another email is a good idea :-) But please do let me know if you have a list of accounts. Thanks!
I found this in the mailman commit list:
http://bazaar.launchpad.net/~mailman-coders/mailman/2.1/revision/1371
It's meant to tackle bots. I can't figure out how to use it, though (or they've figured out how to get around this too).
On Mon, 2015-03-23 at 10:42 -0400, Joe Brockmeier wrote:
For whatever reason, we're seeing a fair number of complaints that people are being spammed by subscription requests. It looks like there's some sort of script hitting a number of mailman installations and sending subscribe requests for a variety of email addresses.
I don't think we can do much about this. If it's possible, maybe add a message to the subscription confirmation e-mail that says:
"If you did not request to subscribe to this mailing list, it's probably a spam bot that is submitting your e-mail address to different mailing lists. Please disregard this e-mail and keep an eye on where you give out your e-mail address."
I see an old thread upstream that discusses the issue, but I didn't see a solution. A suggested solution is to set up iptables filters and things like spamassassin, but we'll have to speak to the infra team about that.
If they dont want let them unsubscribe theres not much that can actually be done. On Monday 23 March 2015, Ankur Sinha sanjay.ankur@gmail.com wrote:
On Mon, 2015-03-23 at 10:42 -0400, Joe Brockmeier wrote:
For whatever reason, we're seeing a fair number of complaints that people are being spammed by subscription requests. It looks like there's some sort of script hitting a number of mailman installations and sending subscribe requests for a variety of email addresses.
I don't think we can do much about this. If it's possible, maybe add a message to the subscription confirmation e-mail that says:
"If you did not request to subscribe to this mailing list, it's probably a spam bot that is submitting your e-mail address to different mailing lists. Please disregard this e-mail and keep an eye on where you give out your e-mail address."
I see an old thread upstream that discusses the issue, but I didn't see a solution. A suggested solution is to set up iptables filters and things like spamassassin, but we'll have to speak to the infra team about that. -- Thanks, Regards, Ankur Sinha "FranciscoD"
On 03/23/2015 12:26 PM, beta tester wrote:
If they dont want let them unsubscribe theres not much that can actually be done.
They're not subscribed. There's some bot or something that's auto-filling the form to request a subscription - so they don't actually subscribe, they just get the confirmation.
Problem is, it looks like anybody getting this from us is also getting sent to a bunch of other mailman lists - so the effect is a bunch of (what seems to them to be) spam.
The other reason I think we might consider turning this off for a while - if enough people are getting this, it means there's some percentage just clicking some variation of "mark as spam" -- which could result in traffic from our lists getting a higher spam score.
Best,
jzb
+1 to jzb's idea of turning it off. The only thing I would like to add is that we add to to marketing join wiki page for the mailing list that there is a manual approval process so there might be delays. Just so we don't deter future contributors.
Chris
Sent via the Samsung Galaxy Note® 3, an AT&T 4G LTE smartphone
-------- Original message -------- From: Joe Brockmeier jzb@redhat.com Date:03/23/2015 2:10 PM (GMT-05:00) To: marketing@lists.fedoraproject.org Cc: Subject: Re: Turning off List Subscription?
On 03/23/2015 12:26 PM, beta tester wrote:
If they dont want let them unsubscribe theres not much that can actually be done.
They're not subscribed. There's some bot or something that's auto-filling the form to request a subscription - so they don't actually subscribe, they just get the confirmation.
Problem is, it looks like anybody getting this from us is also getting sent to a bunch of other mailman lists - so the effect is a bunch of (what seems to them to be) spam.
The other reason I think we might consider turning this off for a while - if enough people are getting this, it means there's some percentage just clicking some variation of "mark as spam" -- which could result in traffic from our lists getting a higher spam score.
Best,
jzb -- Joe Brockmeier | Principal Cloud & Storage Analyst jzb@redhat.com | http://community.redhat.com/ Twitter: @jzb | http://dissociatedpress.net/
To the* autocorrect and fat fingers--
Sent via the Samsung Galaxy Note® 3, an AT&T 4G LTE smartphone
-------- Original message -------- From: Chris Roberts chris.roberts@croberts.org Date:03/23/2015 2:17 PM (GMT-05:00) To: jzb@redhat.com, Fedora Marketing team marketing@lists.fedoraproject.org Cc: Subject: RE: Turning off List Subscription?
+1 to jzb's idea of turning it off. The only thing I would like to add is that we add to to marketing join wiki page for the mailing list that there is a manual approval process so there might be delays. Just so we don't deter future contributors.
Chris
Sent via the Samsung Galaxy Note® 3, an AT&T 4G LTE smartphone
-------- Original message -------- From: Joe Brockmeier jzb@redhat.com Date:03/23/2015 2:10 PM (GMT-05:00) To: marketing@lists.fedoraproject.org Cc: Subject: Re: Turning off List Subscription?
On 03/23/2015 12:26 PM, beta tester wrote:
If they dont want let them unsubscribe theres not much that can actually be done.
They're not subscribed. There's some bot or something that's auto-filling the form to request a subscription - so they don't actually subscribe, they just get the confirmation.
Problem is, it looks like anybody getting this from us is also getting sent to a bunch of other mailman lists - so the effect is a bunch of (what seems to them to be) spam.
The other reason I think we might consider turning this off for a while - if enough people are getting this, it means there's some percentage just clicking some variation of "mark as spam" -- which could result in traffic from our lists getting a higher spam score.
Best,
jzb -- Joe Brockmeier | Principal Cloud & Storage Analyst jzb@redhat.com | http://community.redhat.com/ Twitter: @jzb | http://dissociatedpress.net/
In data lunedì 23 marzo 2015 18:17:19, Chris Roberts ha scritto:
we add to to marketing join wiki page for the mailing list that there is a manual approval process so there might be delays. Just so we
don't
deter future contributors.
Chris
I can do that as soon as you've turned off the list subscriptions, filing a ticket.
There are several pages reminding mktg ML:
http://fedoraproject.org/wiki/Marketing http://fedoraproject.org/wiki/Joining_the_Fedora_marketing_project http://fedoraproject.org/wiki/Marketing/Tasks_and_roles
Are there any others?
I'm looking at http://fedoraproject.org/wiki/Category:Marketing.
Gabri
On 23 March 2015 at 08:42, Joe Brockmeier jzb@redhat.com wrote:
Hi all,
For whatever reason, we're seeing a fair number of complaints that people are being spammed by subscription requests. It looks like there's some sort of script hitting a number of mailman installations and sending subscribe requests for a variety of email addresses.
I have no idea what this accomplishes for the person(s) behind the bot(s) but it's annoying people and AFAIK we don't have a good way of blocking it.
We could cut this off at the pass by turning off the ability to subscribe, but that means we'd have to process subscription requests manually and some folks might not subscribe if they have to jump through additional hoops. But I don't think the subscription rate is particularly high for this list - so that may be a minor issue.
Thoughts? I hate to make things more complicated, but I also would like our list software not be abused.
So it looks like someone has decided to use a botnet to subscribe 4000+ addresses to marketing over and over again. The ips are all over the world so it is not going to be easy to block so I am guessing it will be best to turn off subscribe until we can find a better solution. This might be multiple ones as someone seems to be doing every person in @qq.com and another set is doing other email sites.
On 03/23/2015 04:19 PM, Stephen John Smoogen wrote:
So it looks like someone has decided to use a botnet to subscribe 4000+ addresses to marketing over and over again. The ips are all over the world so it is not going to be easy to block so I am guessing it will be best to turn off subscribe until we can find a better solution. This might be multiple ones as someone seems to be doing every person in @qq.com http://qq.com and another set is doing other email sites.
Well, that's it. They're definitely off my Christmas card list.
Hmmm. After looking, I'm wondering if we can turn off subscriptions via the Mailman interface. The Googles suggest you have to remove the page(?!) entirely.
Anybody with stronger Mailman-fu know how to shut off the firehose?
Best,
jzb
Ty for pointing this out. Your point about spam is well taken.
It's great seeing this team gel :)
-MD
On Mar 23, 2015, at 1:27 PM, Joe Brockmeier jzb@redhat.com wrote:
On 03/23/2015 04:19 PM, Stephen John Smoogen wrote:
So it looks like someone has decided to use a botnet to subscribe 4000+ addresses to marketing over and over again. The ips are all over the world so it is not going to be easy to block so I am guessing it will be best to turn off subscribe until we can find a better solution. This might be multiple ones as someone seems to be doing every person in @qq.com http://qq.com and another set is doing other email sites.
Well, that's it. They're definitely off my Christmas card list.
Hmmm. After looking, I'm wondering if we can turn off subscriptions via the Mailman interface. The Googles suggest you have to remove the page(?!) entirely.
Anybody with stronger Mailman-fu know how to shut off the firehose?
Best,
jzb
Joe Brockmeier | Principal Cloud & Storage Analyst jzb@redhat.com | http://community.redhat.com/ Twitter: @jzb | http://dissociatedpress.net/
-- marketing mailing list marketing@lists.fedoraproject.org List info or to change your subscription: https://admin.fedoraproject.org/mailman/listinfo/marketing
marketing@lists.fedoraproject.org