[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Asrg] Please critique my anti-spam system



On 2005-01-10 02:17:53 +1000, Laird Breyer wrote:
> On Jan 09 2005, Peter J. Holzer wrote:
> > > There's also the fact that list messages (such as your own to this
> > > list) often arrive twice, once through the list and once directly.  If
> > > I used your system, I would be sending you a CAPTCHA bounce which
> > > would be clogging your inbox.
> > 
> > No, you wouldn't, unless you had the subaddress already disabled, in
> > which case you wouldn't receive mails from the mailinglist either
> > (unless you explicitely whitelisted the mailinglist).
> 
> Either you're confused or I am. Michael sends me two messages, once as
> Michael (which is unsolicited, and he's not whitelisted, so gets a CAPTCHA),
> and once as asrg at ietf.org, which is whitelisted since I've subscribed to 
> the list. 

But both messages are sent to an active subaddress, so they are
accepted without a CAPTCHA. See
http://home.nyc.rr.com/spamsolution/An%20Effective%20Solution%20for%20Spam.htm

| Zack now has a completely functional and unique email address for Joe
| (e.g. Joe.mcj9z at domain.com). Zack can share this fully functional
| email address with other friends. These other friends now send email
| to Joe using the address (Joe.mcj9z at domain.com) given to them by Zack.

| Zack can pass on Joe.mcj9z at domain.com to Bud. Bud successfully mails
| Joe using Joe.mcj9z at domain.com, but when Joe replies his return
| address will appear as Joe.72wmt at domain.com. Bud now has two separate
| addresses that he can use to communicate with Joe, but in time he will
| become more likely to use Joe.72wmt at domain.com as this will always
| appear as the return address whenever he receives email from Joe.

Only when you deactivate the the subaddress (because some spammer has
harvested the ASRG mailing list archive and is spamming that address),
CAPTCHAs will be generated in response to mails from non-whitelisted
senders. So at that point you would have to decide whether you want to
whitelist asrg-bounce at ietf.org (which would lead to your scenario of
sending out lots of CAPTCHAs and being thrown off the list) or
resubscribe with a new subaddress (which is a bit of a hassle,
especially if you are subscribed to lots of mailing lists). In both
cases you have to remember that your subaddress <laird.ghqwr at ...> was
the one you used to subscribe to the ASRG before deactivating it
(Hopefully your software gives you an easy way to look up the usage of a
subaddress).


("Deactivating" the subaddress seems to be a misnomer. AFAICS Michael's
proposal doesn't allow a subaddress to be really deactivated once it is
created. It is only put into "Accept mails only from whitelisted
addresses and send a CAPTCHA to everybody else" mode)

	hp

-- 
   _  | Peter J. Holzer    | Je höher der Norden, desto weniger wird
|_|_) | Sysadmin WSR       | überhaupt gesprochen, also auch kein Dialekt.
| |   | hjp at hjp.at         | Hallig Gröde ist fast gänzlich dialektfrei.
__/   | http://www.hjp.at/ |   -- Hannes Petersen in desd

Attachment: pgphRCCYHgBqy.pgp
Description: PGP signature

_______________________________________________
Asrg mailing list
Asrg at ietf.org
https://www1.ietf.org/mailman/listinfo/asrg