Hi,
i just received a message from the list server that my mail provider
GMX has rejected a spam message which the Debian list allowed to pass
by a tiny not-spam margin.
From this quite unsuspicious situation the automat of Debian
Listmaster Team derived the threat to unsubscribe me.
I see the potential for a bounce troll, like we had a few years ago. (Whenever one of us posted to the list, the troll faked a bounce from
our mail providers.)
Do other experience the same ?
(I would propose that list server shall please refrain from
unsubscription threads if the mail in question gets a near-spam score
in the Debian list system.)
--------------------------------------------------------------------- Details:
The list server quotes a reply from the GMX mail servers.
https://lists.debian.org/bounces/FVOZui8Ui2aBD+8obfofFQ
shows
"For explanation visit
https://postmaster.gmx.net/de/case?c=r0701&i=ip&v=82.195.75.100&r=1MY cpl-1siPQU12EF-00K6HO" ...
X-Spam-Status: No, score=3.9 required=4.0
...,DATE_IN_FUTURE_06_12,... ...
Received: from mail-wr1-x443.google.com ...
by bendel.debian.org (Postfix) with ESMTPS id 2121E2049B
for <[email protected]>;
Sun, 11 Aug 2024 10:21:41 +0000 (UTC)
Received: by mail-wr1-x443.google.com ...
for <[email protected]>; Sun, 11 Aug 2024 03:21:41
-0700 (PDT) ...
Date: Sun, 11 Aug 2024 11:21:27 -0700
The web says that DATE_IN_FUTURE_06_12 from Spamassassin means that
the mail's Date is 6 to 12 hours in the future relative to the time it
was received.
My provider takes more offense:
https://postmaster.gmx.net/de/case?c=r0701&i=ip&v=82.195.75.100&r=1MY cpl-1siPQU12EF-00K6HO "Die Zeitangabe im Date-Header weicht zu stark
von der tats�chlichen Zeit ab."
= "The time stamp of the Date header deviates too much from the
actual time."
Have a nice day :)
Thomas
From this quite unsuspicious situation the automat of Debian Listmaster
Team derived the threat to unsubscribe me.
I see the potential for a bounce troll, like we had a few years ago. (Whenever one of us posted to the list, the troll faked a bounce from
our mail providers.)
i just received a message from the list server that my mail provider
GMX has rejected a spam message which the Debian list allowed to pass
by a tiny not-spam margin.
From this quite unsuspicious situation the automat of Debian Listmaster
Team derived the threat to unsubscribe me.
(I would propose that list server shall please refrain from
unsubscription threads if the mail in question gets a near-spam score in
the Debian list system.)
What you have interpreted as "a threat" was simply a procedural
warning that if your address continues to be undeliverable then you
will be automatically unsubscribed.
we can assume it will be rare that GMX and Debian will disagree over
spam score
Personally what I do is silently discard spammy emails from known
list servers instead of rejecting them at SMTP time (which is
otherwise and usually desirable). Doing that does require running
your own mail server though, which almost no one does.
Andy Smith wrote:
What you have interpreted as "a threat" was simply a procedural
warning that if your address continues to be undeliverable then you
will be automatically unsubscribed.
It is a threat
because debian-user is the only mailing list where i ever
witnessed that a troll exploited the unscubscription habits to
throw out multiple users.
So i want to prepare for possible real problems by first asking how many
mail providers differ slightly from the list servers assessment and
reaction.
we can assume it will be rare that GMX and Debian will disagree over
spam score
I refrain from developing a proof-of-concept how to exploit the current behavior. But i am quite sure it is possible to do so.
debian-user is the only mailing list where i ever
witnessed that a troll exploited the unscubscription habits to
throw out multiple users.
I was here when those events occurred and that is not what happened.
[...]
It was just a bug in Debian's list software combined with a
badly-behaving subscriber system. Some subscriber was bouncing mails
back to the actual list address.
Personally what I do is silently discard spammy emails from known
list servers instead of rejecting them at SMTP time (which is
otherwise and usually desirable). Doing that does require running
your own mail server though, which almost no one does.
How do you then explain that it lasted 2 days until i got affected
exactly after i challenged the (potential) troll by stating:
"although i seem not to be worth to be targeted by our bounce assassin,"
Between the first report by Greg Wooledge and this challenge i had posted half a dozen mails. No problems were to see. Many others posted and did
not report unsubscriptions.
So why did this bug not affect everybody ?
My theory is that it was exploited in a targeted way.
Normally GMX puts spam into a separate box where i can unjail it if
i deem it not guilty. (Happens often enough.)
* they do actually filter some extreme stuff out that I believe is
required by law or somesuch. I never see it, so I don't know exactly
what it is.
The mail in question was not put into any mail box. I only became
aware when i was informed by the Debian list automat that bad things
would happen if ...
Well, the advantage of GMX is that it is big and well integrated in the
mail server community.
The disadvantage is that it is big and thus the preferences of a single
user don't matter.
You don't need to run a mailserver to do something similar. I simply
told my ISP (Zen) not to filter spam out of my mail.
* they do actually filter some extreme stuff out that I believe is
required by law or somesuch. I never see it, so I don't know exactly
what it is.
I suppose you do have to have a 'sensible' ISP.
Hello,
On Sun, Aug 11, 2024 at 08:25:09PM +0200, Thomas Schmitt wrote:
How do you then explain that it lasted 2 days until i got affected
exactly after i challenged the (potential) troll by stating:
"although i seem not to be worth to be targeted by our bounce assassin," >>
Between the first report by Greg Wooledge and this challenge i had posted
half a dozen mails. No problems were to see. Many others posted and did
not report unsubscriptions.
So why did this bug not affect everybody ?
I think it was either random sampling or threshold based on how many
bounce replicas were seen.
Note that anyone anywhere can send mails to this list pretending to
be from anyone, so if it were malicious then there is actually no
reason why it would have stopped. I think the broken subscriber was
simply removed from the list based on complaints to listmaster.
My theory is that it was exploited in a targeted way.
I can see I can't convince you that it wasn't a malicious attack on
you and a small group of others.
Nevertheless it's a fact that your most recent interaction with the
mailing list software was by a different route than the 2021
incident and caused by a different mechanism, namely GMX rejecting a connection from the list software, and not anything to worry about.
Thanks,
Andy
--
https://bitfolk.com/ -- No-nonsense VPS hosting
As a side note..I got the message, assuming you mean the one indicating it was from new service with account statement or some such.
Naturally, I did not so much as open the item.
Hi Thomas,
On Sun, 11 Aug 2024, Thomas Schmitt wrote:
From this quite unsuspicious situation the automat of Debian ListmasterThere is no threat. the mail is an information that - if there are
Team derived the threat to unsubscribe me.
more bounces (and there is a number and a total number in x days _and_
a number in percent) that if the threshold is surpassed you will be unsubscribed.
There is no threat. Only an information.
Hi,
i just received a message from the list server that my mail provider
GMX has rejected a spam message which the Debian list allowed to pass
by a tiny not-spam margin.
From this quite unsuspicious situation the automat of Debian Listmaster
Team derived the threat to unsubscribe me.
I see the potential for a bounce troll, like we had a few years ago. (Whenever one of us posted to the list, the troll faked a bounce from
our mail providers.)
Do other experience the same ?
(I would propose that list server shall please refrain from
unsubscription threads if the mail in question gets a near-spam score in
the Debian list system.)
--------------------------------------------------------------------- Details:
The list server quotes a reply from the GMX mail servers.
https://lists.debian.org/bounces/FVOZui8Ui2aBD+8obfofFQ
shows
"For explanation visit
https://postmaster.gmx.net/de/case?c=r0701&i=ip&v=82.195.75.100&r=1MYcpl-1siPQU12EF-00K6HO"
...
X-Spam-Status: No, score=3.9 required=4.0 ...,DATE_IN_FUTURE_06_12,...
...
Received: from mail-wr1-x443.google.com ...
by bendel.debian.org (Postfix) with ESMTPS id 2121E2049B
for <[email protected]>;
Sun, 11 Aug 2024 10:21:41 +0000 (UTC)
Received: by mail-wr1-x443.google.com ...
for <[email protected]>; Sun, 11 Aug 2024 03:21:41 -0700 (PDT)
...
Date: Sun, 11 Aug 2024 11:21:27 -0700
The web says that DATE_IN_FUTURE_06_12 from Spamassassin means that
the mail's Date is 6 to 12 hours in the future relative to the time it
was received.
My provider takes more offense:
https://postmaster.gmx.net/de/case?c=r0701&i=ip&v=82.195.75.100&r=1MYcpl-1siPQU12EF-00K6HO
"Die Zeitangabe im Date-Header weicht zu stark von der tatsächlichen
Zeit ab."
= "The time stamp of the Date header deviates too much from the
actual time."
Have a nice day :)
Thomas
Hi Thomas,
Same here, I am on GMX mailbox too, received a warning recently that I
will be unsubscribed forcibly because my e-mail provider GMX rejected
spam Debian list is sending towards me. LOL. Maybe Debian e-mail server
could improve filtering so I don't receive any spam in the first place?
It's so easy to spot this spam, IDK why server is not trained to
recognize typical spam words in these e-mails.
| Sysop: | Keyop |
|---|---|
| Location: | Huddersfield, West Yorkshire, UK |
| Users: | 716 |
| Nodes: | 16 (2 / 14) |
| Uptime: | 48:46:16 |
| Calls: | 12,114 |
| Calls today: | 5 |
| Files: | 15,010 |
| Messages: | 6,518,528 |