[BALUG-Admin] (forw) Re: Fwd: cooperation

[Rick Moen]

----- Forwarded message from Rick Moen <rick@linuxmafia.com> -----

Date: Sat, 21 Nov 2020 12:41:28 -0800
From: Rick Moen <rick@linuxmafia.com>
To: Al <aw009@sunnyside.com>
Cc: Michael Paoli <Michael.Paoli@cal.berkeley.edu>
Subject: Re: Fwd: cooperation

I'm going to also send this to balug-admin for collective knowledge.

Quoting Al Whaley (aw009@sunnyside.com):

> Rick,
> this one caught my eye... it seems to have gone through mailman on
> linuxmafia for the SFLUG mailing list.

_Sort_ of, but mostly not.  

You as a listadmin for the SF-LUG mailing list receive copies from
Mailman of outside mail addressed to the sf-lug-owner@linuxmafia.com 
alias (note -owner suffix).  If the initial MTA defences don't reject
the inbound mail to that role alias address, then it'll get out to the
listadmins, i.e., to you + me + Jim Stockford (the SF-LUG list's
three-person listadmin roster).

If you check full headers, you'll find that the 419 scam mail
originated from Microsoft Hotmail IP address 40.92.51.100.  See these
Received headers for that initial information:

 From mailman-bounces@linuxmafia.com Sat Nov 21 09: 9:52 2020
Return-path: <mailman-bounces@linuxmafia.com>
Envelope-to: rick@linuxmafia.com
Delivery-date: Sat, 21 Nov 2020 09:09:52 -0800
Received: from localhost ([127.0.0.1] helo=linuxmafia.com)
        by linuxmafia.com with esmtp (Exim 4.72)
        (envelope-from <mailman-bounces@linuxmafia.com>)
        id 1kgWOV-0005CC-Vj; Sat, 21 Nov 2020 09:09:52 -0800
Received: from mail-db8eur06olkn2100.outbound.protection.outlook.com
        ([40.92.51.100]
helo=EUR06-DB8-obe.outbound.protection.outlook.com)
        by linuxmafia.com with esmtp (Exim 4.72)
        (envelope-from <jmpumjzzjjsxssvvvzzz@hotmail.com>)
        id 1kgWOQ-0005C3-Vq; Sat, 21 Nov 2020 09:09:50 -0800

Grepping the MTA logs for that IP....

linuxmafia:/var/log/exim4# zgrep 40.92.51.100 mainlog*
mainlog:2020-11-21 09:09:50 1kgWOQ-0005C3-Vq SA: Action: scanned but message isn't spam: score=0.8 required=4.0 (scanned in 3/3 secs | Message-Id: 1kgWOQ-0005C3-Vq). From <jmpumjzzjjsxssvvvzzz@hotmail.com> (host=mail-db8eur06olkn2100.outbound.protection.outlook.com
[40.92.51.100]) for sf-lug-owner@linuxmafia.com, sf-lug@linuxmafia.com mainlog:2020-11-21 09:09:50 1kgWOQ-0005C3-Vq <= jmpumjzzjjsxssvvvzzz@hotmail.com H=mail-db8eur06olkn2100.outbound.protection.outlook.com (EUR06-DB8-obe.outbound.protection.outlook.com) [40.92.51.100] P=esmtp S=8365 id=AM6PR08MB424596EC3D85FB4BE09C3DD6CDFE0@AM6PR08MB4245.eurprd08.prod.outlook.com
linuxmafia:/var/log/exim4#

...you can see that the SMTP session, i.e., the SMTP envelope
information embodied in the SMTP delivery conversation, must have contained

MAIL FROM: <jmpumjzzjjsxssvvvzzz@hotmail.com>
RCPT TO: <sf-lug-owner@linuxmafia.com>
RCPT TO: <sf-lug@linuxmafia.com>

Measured spamicity (0.8) at receiving MTA level was nowhere near high
enough for my MTA to reject (4.0), because this really _was_ from a
Hotmail user, and the mail's body text was not sufficiently spammy to a
degree that automated MTA-level spamd scanning for garbage adjudged
processed meat, so this 419 scam mail got passed along to the Mailman
MLM.  Mailman passed through the copy _back_ to the MTA that was
addressed out to the listadmins, _but_ by contrast lodged the direct
mailing list copy in Mailman's admin queue for sf-lug@linuxmafia.com,
whence it will expire out in five days and then automatically get thrown
away.

Why in the MLM admin queue?  Two reasons:

1.  Since in this case the scam mail's internal SMTP headers were
'implicitly addressed', i.e., there were no To: or Cc: addresses
whatsoever inside the message proper, only SMTP envelope addressees
(outside the message proper), Mailman will never send such mail out to
subscribers, on account of Mailman's built-in filter blocking all
'implicitly addressed' mail.  I.e., Mailman requires that valid mail to
subscribers specify on either the internal To: header or the internal CC: 
header the mailing list's direct address or an alias the listadmins have
specified inside the admin WebUI.  If that header is _not_ present, the
message deterministically lodges in the admin queue, flagged as
'implicitly addressed'.

2.  Also, it didn't originate from a subscriber, hence would (for that
reason as well) have been intercepted and held as being from a
non-subscribed address.


> it's not in the archives so I'm assuming it didn't go out to
> everyone, unless you deleted it, and it wasn't marked
> as being sent for moderation...
> what am I missing here?

Naturally, I would love for inbound junkmail filtering to reject even
more than it already does, but, frankly, linuxmafia.com system-level
spam-rejection is already quite good.   Diminishing returns and false
positives rapidly become a problem as one tries to make MTA spam
immune response even better.  

Where I sit, it seems to me it's a fact of life that being a Mailman 
addressee on any [listname]-owner aliases _is_ going to get you
increased MLM-mediated spam because of being a member of that alias, as
additional protections covering MLM subscribers simply don't apply to
that admin-role alias address.

Speaking of that, I believe it's past time that I remove Jim Stockford 
(i.e., jim@well.com) from the sf-lug-owner@linuxmafia.com roster, and
I'm going to do that right now.  

It realised I probably needed to get around to that, about a year or so
ago, when he was _publicly_ claiming on the SF-LUG mailing list that
linuxmafia.com is an SMTP spam source, very likely because of having
received some amount of junkmail via the sf-lug-owner alias.  (His
public accusation was, however, _unbelievably_ vague, so I couldn't
investigate his claim.)  

You, by contrast, did exactly the right thing in asking me rather than
going on a public accusation campaign, so the comparison is night and
day.  That distinction having been made, to this day I resent Jim's
(false) public accusation, and the only thing that mitigates it is that,
for unclear personal reasons, Jim has been lately unable to discharge
his responsibilities.

I didn't want to delete him from the roster in haste, since Jim founded
the group, and supposedly solemnly committed to being _the_ listadmin
responsible for it, (but has never actually done the job, over the
entire 15-year period I've given SF-LUG temporary mailing list hosting,
pending them getting their server running again -- which never
happened).

Done.  jim@well.com is now omitted from the SF-LUG listadmin roster.

(Just for the record:  This means that the _sole_ requirement I insisted
on, before being willing to grant SF-LUG temporary mailing list hosting
to help after whatever mysterious failure destroyed SF-LUG's -own-
mailing list server in late 2005 -- the requirement that Jim shoulder
listadmin duties so I don't have my workload increased by SF-LUG's
presence on my server -- has been continuously in default from that day
in December 2005 to the present.)


----- End forwarded message -----