• Nearly-spam mail causes unsubscription threat

    From Thomas Schmitt@21:1/5 to All on Sun Aug 11 14:00:02 2024
    Hi,

    i just received a message from the list server that my mail provider
    GMX has rejected a spam message which the Debian list allowed to pass
    by a tiny not-spam margin.
    From this quite unsuspicious situation the automat of Debian Listmaster
    Team derived the threat to unsubscribe me.

    I see the potential for a bounce troll, like we had a few years ago.
    (Whenever one of us posted to the list, the troll faked a bounce from
    our mail providers.)

    Do other experience the same ?

    (I would propose that list server shall please refrain from
    unsubscription threads if the mail in question gets a near-spam score in
    the Debian list system.)


    ---------------------------------------------------------------------
    Details:

    The list server quotes a reply from the GMX mail servers.

    https://lists.debian.org/bounces/FVOZui8Ui2aBD+8obfofFQ
    shows
    "For explanation visit
    https://postmaster.gmx.net/de/case?c=r0701&i=ip&v=82.195.75.100&r=1MYcpl-1siPQU12EF-00K6HO"
    ...
    X-Spam-Status: No, score=3.9 required=4.0 ...,DATE_IN_FUTURE_06_12,...
    ...
    Received: from mail-wr1-x443.google.com ...
    by bendel.debian.org (Postfix) with ESMTPS id 2121E2049B
    for <[email protected]>;
    Sun, 11 Aug 2024 10:21:41 +0000 (UTC)
    Received: by mail-wr1-x443.google.com ...
    for <[email protected]>; Sun, 11 Aug 2024 03:21:41 -0700 (PDT)
    ...
    Date: Sun, 11 Aug 2024 11:21:27 -0700

    The web says that DATE_IN_FUTURE_06_12 from Spamassassin means that
    the mail's Date is 6 to 12 hours in the future relative to the time it
    was received.

    My provider takes more offense:

    https://postmaster.gmx.net/de/case?c=r0701&i=ip&v=82.195.75.100&r=1MYcpl-1siPQU12EF-00K6HO
    "Die Zeitangabe im Date-Header weicht zu stark von der tatsächlichen
    Zeit ab."
    = "The time stamp of the Date header deviates too much from the
    actual time."


    Have a nice day :)

    Thomas

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Eike Lantzsch ZP5CGE / KY4PZ@21:1/5 to All on Sun Aug 11 15:00:02 2024
    On Sunday, 11 August 2024 07:51:50 -04 Thomas Schmitt wrote:
    Hi,

    i just received a message from the list server that my mail provider
    GMX has rejected a spam message which the Debian list allowed to pass
    by a tiny not-spam margin.
    From this quite unsuspicious situation the automat of Debian
    Listmaster Team derived the threat to unsubscribe me.

    I see the potential for a bounce troll, like we had a few years ago. (Whenever one of us posted to the list, the troll faked a bounce from
    our mail providers.)

    Do other experience the same ?

    Yep, Thomas, same here, but it was just one bounce.

    vy 73 de Eike

    (I would propose that list server shall please refrain from
    unsubscription threads if the mail in question gets a near-spam score
    in the Debian list system.)


    --------------------------------------------------------------------- Details:

    The list server quotes a reply from the GMX mail servers.

    https://lists.debian.org/bounces/FVOZui8Ui2aBD+8obfofFQ
    shows
    "For explanation visit

    https://postmaster.gmx.net/de/case?c=r0701&i=ip&v=82.195.75.100&r=1MY cpl-1siPQU12EF-00K6HO" ...
    X-Spam-Status: No, score=3.9 required=4.0
    ...,DATE_IN_FUTURE_06_12,... ...
    Received: from mail-wr1-x443.google.com ...
    by bendel.debian.org (Postfix) with ESMTPS id 2121E2049B
    for <[email protected]>;
    Sun, 11 Aug 2024 10:21:41 +0000 (UTC)
    Received: by mail-wr1-x443.google.com ...
    for <[email protected]>; Sun, 11 Aug 2024 03:21:41
    -0700 (PDT) ...
    Date: Sun, 11 Aug 2024 11:21:27 -0700

    The web says that DATE_IN_FUTURE_06_12 from Spamassassin means that
    the mail's Date is 6 to 12 hours in the future relative to the time it
    was received.

    My provider takes more offense:


    https://postmaster.gmx.net/de/case?c=r0701&i=ip&v=82.195.75.100&r=1MY cpl-1siPQU12EF-00K6HO "Die Zeitangabe im Date-Header weicht zu stark
    von der tats�chlichen Zeit ab."
    = "The time stamp of the Date header deviates too much from the
    actual time."


    Have a nice day :)

    Thomas

    --
    Eike Lantzsch KY4PZ / ZP5CGE

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Hanno 'Rince' Wagner@21:1/5 to Thomas Schmitt on Sun Aug 11 18:10:04 2024
    Hi Thomas,

    On Sun, 11 Aug 2024, Thomas Schmitt wrote:

    From this quite unsuspicious situation the automat of Debian Listmaster
    Team derived the threat to unsubscribe me.

    There is no threat. the mail is an information that - if there are
    more bounces (and there is a number and a total number in x days _and_
    a number in percent) that if the threshold is surpassed you will be unsubscribed.

    There is no threat. Only an information.

    I see the potential for a bounce troll, like we had a few years ago. (Whenever one of us posted to the list, the troll faked a bounce from
    our mail providers.)

    that would need a lot of bounces which have to be unique.

    best regards, Hanno Wagner
    --
    | Hanno Wagner | Member of the HTML Writers Guild | Rince@IRC |
    | Eine gewerbliche Nutzung meiner Email-Adressen ist nicht gestattet! |
    | 74 a3 53 cc 0b 19 - we did it! | Generation @ |
    #... und dann bauen wir Heiko einen Laser an das rechte Ohr, damit er auch #sagen kann: "I am admin at fub. sendmail is useless. Maps are obsolete. #Prepare to be assimilated." -- smail 3.1 Commercial

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Andy Smith@21:1/5 to Thomas Schmitt on Sun Aug 11 18:10:04 2024
    Hi,

    On Sun, Aug 11, 2024 at 01:51:50PM +0200, Thomas Schmitt wrote:
    i just received a message from the list server that my mail provider
    GMX has rejected a spam message which the Debian list allowed to pass
    by a tiny not-spam margin.
    From this quite unsuspicious situation the automat of Debian Listmaster
    Team derived the threat to unsubscribe me.

    What you have interpreted as "a threat" was simply a procedural
    warning that if your address continues to be undeliverable then you
    will be automatically unsubscribed. Almost every single mailing list
    in the world works this way, but some do not warn you that your
    mail is bouncing.

    The difference between "a threat" and "a procedural warning" is
    semantic and subtle, but what you have experienced is commonplace
    and not a cause for concern - we can assume it will be rare that GMX
    and Debian will disagree over spam score and as soon as you receive
    a successful delivery, the list software will reset its bounce
    counter for you. Which will already have happened.

    (I would propose that list server shall please refrain from
    unsubscription threads if the mail in question gets a near-spam score in
    the Debian list system.)

    I suppose it would be possible and you could submit a wishlist bug
    to that effect, but to be honest I do not think it would receive
    much attention. However I could easily be wrong, perhaps it would
    grab the attention of a listmaster, so you'd have to submit it to
    find out.

    Personally what I do is silently discard spammy emails from known
    list servers instead of rejecting them at SMTP time (which is
    otherwise and usually desirable). Doing that does require running
    your own mail server though, which almost no one does.

    Thanks,
    Andy

    --
    https://bitfolk.com/ -- No-nonsense VPS hosting

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Thomas Schmitt@21:1/5 to Andy Smith on Sun Aug 11 19:00:01 2024
    Hi,

    Andy Smith wrote:
    What you have interpreted as "a threat" was simply a procedural
    warning that if your address continues to be undeliverable then you
    will be automatically unsubscribed.

    It is a threat, because debian-user is the only mailing list where i
    ever witnessed that a troll exploited the unscubscription habits to
    throw out multiple users.
    See the threads under
    https://lists.debian.org/debian-user/2021/10/msg00248.html
    https://lists.debian.org/debian-user/2021/10/msg00335.html
    https://lists.debian.org/debian-user/2021/10/msg00337.html

    I myself had to challenge the offender to get thrown out too.
    https://lists.debian.org/debian-user/2021/10/msg00434.html
    So it was a human or a very smart AI.

    It lasted a few days until a remedy was developed. I had to re-subscribe
    after each message i posted.

    So i want to prepare for possible real problems by first asking how many
    mail providers differ slightly from the list servers assessment and
    reaction.
    As next step i would ask the list masters to consider ignoring bounces
    if the mail has a nearly-spam score on the Debian list. In such a case
    it is likely that other servers see a barely-spam score and let bounce.

    (The usual attempts of spam catching are futile at best and really
    annoying when not only obvious spam comes through, but also legit mails
    are rejected or even unsubscriptions are enforced.
    It is easier for me to cope with all unfiltered spam than with
    half-working attempts to protect me from falling victim to social
    engineering.)


    we can assume it will be rare that GMX and Debian will disagree over
    spam score

    I refrain from developing a proof-of-concept how to exploit the current behavior. But i am quite sure it is possible to do so.


    Personally what I do is silently discard spammy emails from known
    list servers instead of rejecting them at SMTP time (which is
    otherwise and usually desirable). Doing that does require running
    your own mail server though, which almost no one does.

    This is hardly feasible for me in these days.
    DKIM, SPF, DMARC, ... not a problem for the spammers, but hard for the innocent, old, and clueless.


    Have a nice day :)

    Thomas

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Andy Smith@21:1/5 to Thomas Schmitt on Sun Aug 11 20:00:01 2024
    On Sun, Aug 11, 2024 at 06:49:26PM +0200, Thomas Schmitt wrote:
    Andy Smith wrote:
    What you have interpreted as "a threat" was simply a procedural
    warning that if your address continues to be undeliverable then you
    will be automatically unsubscribed.

    It is a threat

    You are assigning human motivations to an automated process.

    because debian-user is the only mailing list where i ever
    witnessed that a troll exploited the unscubscription habits to
    throw out multiple users.

    I was here when those events occurred and that is not what happened.

    It was just a bug in Debian's list software combined with a
    badly-behaving subscriber system. Some subscriber was bouncing mails
    back to the actual list address. The Debian list software was
    (correctly) detecting them as bounce messages and (correctly)
    avoiding to send these on to the list, but it was incorrectly
    parsing out the subscriber it thought they were coming from. The
    result was that it was accumulating bounce score for whoever sent
    the mail that was being bounced, not the system bouncing the email.
    I explained this in the thread you linked to:

    https://lists.debian.org/debian-user/2021/10/msg00524.html

    This was not some "troll campaign" to get people unsubscribed. There
    was no malicious action intended, it was just interaction of broken
    software. I don't know if it was fixed on the Debian side by
    tightening up the bounce handling or just locating the broken
    subscriber.

    I want to also stress that those events of 2021 also bear very
    little relation to what you have just experienced, as the former
    case was about the mishandling of actual bounce emails sent by a
    third party whereas this one now is the correct handling of a
    directly rejected SMTP conversation by your mail provider.

    So i want to prepare for possible real problems by first asking how many
    mail providers differ slightly from the list servers assessment and
    reaction.

    It is an overreaction because this case is not like the other case;
    as soon as the next mail is delivered to you correctly the bounce
    score resets, so it is quite hard to get unsubscribed for rejecting
    spam.

    we can assume it will be rare that GMX and Debian will disagree over
    spam score

    I refrain from developing a proof-of-concept how to exploit the current behavior. But i am quite sure it is possible to do so.

    When you are starting from a misunderstanding of how it actually
    works it seems unlikely but if I had to hazard a guess I'd say
    probably not much has been fixed for the case from 2021 and it might
    be possible to cause some small; degree of havoc by bouncing mails
    directly back to [email protected] as that misbehaving
    system did in 2021.

    This event you have experienced now though is run of the mill
    ordinary and I don't think has much scope for maliciousness as you
    have to be a party to the SMTP conversation to do it, i.e. you can
    only really do it to yourself by rejecting the SMTP conversation.

    To do it to others you'd have to craft an email that is sufficiently
    spammy that it *causes* subscribers to reject it but not spammy
    enough that Debian rejects it. You won't be able to guess which
    subscribers will reject it. And their scores will be reset the
    moment there is another successful mail.

    So in grand scheme of things it doesn't seem like a very efficient
    form of attack.

    Thanks,
    Andy

    --
    https://bitfolk.com/ -- No-nonsense VPS hosting

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Thomas Schmitt@21:1/5 to Andy Smith on Sun Aug 11 20:30:01 2024
    Hi,

    i wrote:
    debian-user is the only mailing list where i ever
    witnessed that a troll exploited the unscubscription habits to
    throw out multiple users.

    Andy Smith wrote:
    I was here when those events occurred and that is not what happened.
    [...]
    It was just a bug in Debian's list software combined with a
    badly-behaving subscriber system. Some subscriber was bouncing mails
    back to the actual list address.

    How do you then explain that it lasted 2 days until i got affected
    exactly after i challenged the (potential) troll by stating:
    "although i seem not to be worth to be targeted by our bounce assassin,"

    Between the first report by Greg Wooledge and this challenge i had posted
    half a dozen mails. No problems were to see. Many others posted and did
    not report unsubscriptions.

    So why did this bug not affect everybody ?
    My theory is that it was exploited in a targeted way.


    Have a nice day :)

    Thomas

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From [email protected]@21:1/5 to Andy Smith on Sun Aug 11 22:20:01 2024
    Andy Smith <[email protected]> wrote:

    Personally what I do is silently discard spammy emails from known
    list servers instead of rejecting them at SMTP time (which is
    otherwise and usually desirable). Doing that does require running
    your own mail server though, which almost no one does.

    You don't need to run a mailserver to do something similar. I simply
    told my ISP (Zen) not to filter spam out of my mail. They send it
    unfiltered* to me and my MUA filters it out using bogofilter. Works
    very well for me; I suppose you do have to have a 'sensible' ISP.

    * they do actually filter some extreme stuff out that I believe is
    required by law or somesuch. I never see it, so I don't know exactly
    what it is.

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Andy Smith@21:1/5 to Thomas Schmitt on Sun Aug 11 22:40:01 2024
    Hello,

    On Sun, Aug 11, 2024 at 08:25:09PM +0200, Thomas Schmitt wrote:
    How do you then explain that it lasted 2 days until i got affected
    exactly after i challenged the (potential) troll by stating:
    "although i seem not to be worth to be targeted by our bounce assassin,"

    Between the first report by Greg Wooledge and this challenge i had posted half a dozen mails. No problems were to see. Many others posted and did
    not report unsubscriptions.

    So why did this bug not affect everybody ?

    I think it was either random sampling or threshold based on how many
    bounce replicas were seen.

    Note that anyone anywhere can send mails to this list pretending to
    be from anyone, so if it were malicious then there is actually no
    reason why it would have stopped. I think the broken subscriber was
    simply removed from the list based on complaints to listmaster.

    My theory is that it was exploited in a targeted way.

    I can see I can't convince you that it wasn't a malicious attack on
    you and a small group of others.

    Nevertheless it's a fact that your most recent interaction with the
    mailing list software was by a different route than the 2021
    incident and caused by a different mechanism, namely GMX rejecting a
    connection from the list software, and not anything to worry about.

    Thanks,
    Andy

    --
    https://bitfolk.com/ -- No-nonsense VPS hosting

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From [email protected]@21:1/5 to Thomas Schmitt on Sun Aug 11 23:30:01 2024
    On 8/11/24 17:11, Thomas Schmitt wrote:

    Normally GMX puts spam into a separate box where i can unjail it if
    i deem it not guilty. (Happens often enough.)


    * they do actually filter some extreme stuff out that I believe is
    required by law or somesuch. I never see it, so I don't know exactly
    what it is.

    The mail in question was not put into any mail box. I only became
    aware when i was informed by the Debian list automat that bad things
    would happen if ...

    Yes, and not only can you not disable their anti-spam measures, you have to
    log into webmail each time to undo it. On the odd occasion where they catch something I'd rather not see, I leave it there. Frankly, I'd rather it be local rather than a web browser + login away. I mean, I didn't install spamassassin for practice using apt.

    Well, the advantage of GMX is that it is big and well integrated in the
    mail server community.
    The disadvantage is that it is big and thus the preferences of a single
    user don't matter.

    What you said.

    --
    A little rudeness and disrespect
    can elevate a meaningless interaction into a battle of wills
    and add drama to an otherwise dull day.
    -- Calvin discovers Usenet

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Thomas Schmitt@21:1/5 to [email protected] on Sun Aug 11 23:20:02 2024
    Hi,

    [email protected] wrote:
    You don't need to run a mailserver to do something similar. I simply
    told my ISP (Zen) not to filter spam out of my mail.

    Normally GMX puts spam into a separate box where i can unjail it if
    i deem it not guilty. (Happens often enough.)


    * they do actually filter some extreme stuff out that I believe is
    required by law or somesuch. I never see it, so I don't know exactly
    what it is.

    The mail in question was not put into any mail box. I only became
    aware when i was informed by the Debian list automat that bad things
    would happen if ...


    I suppose you do have to have a 'sensible' ISP.

    Well, the advantage of GMX is that it is big and well integrated in the
    mail server community.
    The disadvantage is that it is big and thus the preferences of a single
    user don't matter.


    Have a nice day :)

    Thomas

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Karen Lewellen@21:1/5 to Andy Smith on Mon Aug 12 01:50:01 2024
    As a side note..I got the message, assuming you mean the one indicating it
    was from new service with account statement or some such.
    Naturally, I did not so much as open the item.
    seems like a broad list attempt, assuming this is the post you are
    referencing of course.
    Kare



    On Sun, 11 Aug 2024, Andy Smith wrote:

    Hello,

    On Sun, Aug 11, 2024 at 08:25:09PM +0200, Thomas Schmitt wrote:
    How do you then explain that it lasted 2 days until i got affected
    exactly after i challenged the (potential) troll by stating:
    "although i seem not to be worth to be targeted by our bounce assassin," >>
    Between the first report by Greg Wooledge and this challenge i had posted
    half a dozen mails. No problems were to see. Many others posted and did
    not report unsubscriptions.

    So why did this bug not affect everybody ?

    I think it was either random sampling or threshold based on how many
    bounce replicas were seen.

    Note that anyone anywhere can send mails to this list pretending to
    be from anyone, so if it were malicious then there is actually no
    reason why it would have stopped. I think the broken subscriber was
    simply removed from the list based on complaints to listmaster.

    My theory is that it was exploited in a targeted way.

    I can see I can't convince you that it wasn't a malicious attack on
    you and a small group of others.

    Nevertheless it's a fact that your most recent interaction with the
    mailing list software was by a different route than the 2021
    incident and caused by a different mechanism, namely GMX rejecting a connection from the list software, and not anything to worry about.

    Thanks,
    Andy

    --
    https://bitfolk.com/ -- No-nonsense VPS hosting



    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Thomas Schmitt@21:1/5 to Karen Lewellen on Mon Aug 12 08:20:01 2024
    Hi,

    Karen Lewellen wrote:
    As a side note..I got the message, assuming you mean the one indicating it was from new service with account statement or some such.

    Yes. The message which was bounced by GMX is in the list archive as

    https://lists.debian.org/debian-user/2024/08/msg00366.html

    Obvious spam.


    Naturally, I did not so much as open the item.

    If i would trust in my web browser to protect me then i would look at
    what lurks behind the link "TERMS OF SERVICE" at docs.google.com.
    But i am not _that_ curious.


    Have a nice day :)

    Thomas

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Alex King@21:1/5 to Hanno 'Rince' Wagner on Wed Aug 14 03:50:01 2024
    I offer a reflection on keeping the list on track.

    On 12/08/24 03:58, Hanno 'Rince' Wagner wrote:
    Hi Thomas,

    On Sun, 11 Aug 2024, Thomas Schmitt wrote:

    From this quite unsuspicious situation the automat of Debian Listmaster
    Team derived the threat to unsubscribe me.
    There is no threat. the mail is an information that - if there are
    more bounces (and there is a number and a total number in x days _and_
    a number in percent) that if the threshold is surpassed you will be unsubscribed.

    There is no threat. Only an information.

    As a point of information, there was a threat.  The definition of threat
    from https://dictionary.cambridge.org/dictionary/english/threat includes
    "a suggestion that something unpleasant or violent will happen."  If
    Thomas finds being automatically unsubscribed from the list as
    unpleasant, then a threat was made.  Another definition of threat from
    the same page: "the possibility that something unwanted will happen."
    Again, if Thomas doesn't want to be unsubscribed, then a threat has been
    made.

    A threat (and a promise) are suggestions or notifications or information
    that a future action will be performed.  A notification of a future
    action is a threat if it is perceived as negative, and it is a promise
    if it is perceived as positive.

    Concepts (such as threat or promise) which rely on human subjectivity
    (e.g. Thomas finds this email threatening, Hanno does not) are most
    usefully evaluated in the frame of a particular person.  We sow the
    seeds for flame wars when we discuss subjective concepts as if they are facts.  When we assume or imply a universal "normal" frame of reference,
    not acknowledging that each person has a unique way of viewing things.

    To keep the signal-to-noise ratio on the list high, we could all benefit
    from using a "robust code" principle: accept a wide variety of (e.g. subjective) input (without taking offense, or objecting to another
    person's subjective assessment) and output clear (fact/observation
    based, not subjective) outputs.

    So Thomas could have phrased the initial contribution in non subjective
    terms:

    Triggered by this bounce situation the Debian List System told me it would unsubscribe me in future on certain conditions.

    Or Thomas could acknowledge his frame of reference:

    From this (to me) quite unsuspicious situation the automat of Debian Listmaster
    Team notified to unsubscribe me, which I perceive as a threat.

    Regardless of how Thomas has phrased it (subjective or observational,)
    Hanno can start the email acknowledging Thomas's point of view:

    I understand you perceive a threat, since you are being notified of possible unsubscription which you'd prefer didn't happen. The mail is an information that - ...


    As Andy did (acknowledge Thomas's view):

    What you have interpreted as "a threat" was

    although Andy then goes on to say Thomas was incorrect,  and tries to differentiate

    between "a threat" and "a procedural warning"

    when in fact the warning is well described as both a threat and a
    procedural warning.  Thomas's subjective point of view is of course not
    wrong, it is simply a point of view and as valid as anyone else's.

    Andy also offers:

    It is an overreaction because this case is not like the other case...

    Instead, Andy could acknowledge the subjective concept of overreaction:

    I see that as an overreaction because this case is not like the other case...

    Or leave out the subjective and (in my opinion) unnecessary overreaction concept without any (in my view) loss of meaning:

    This case is not like the other case...

    It all depends whether we're trying to discuss a technical subject (how
    the list handles bounces) and discuss requests for what might make
    things better for us (e.g. not count emails that score just below the
    spam threshold in the unsubscription algorithm), or whether we're
    (perhaps unconsciously) trying to play a game of who's right and wrong....

    Cheers,
    Alex

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From piorunz@21:1/5 to Thomas Schmitt on Wed Aug 14 20:00:01 2024
    Hi Thomas,

    Same here, I am on GMX mailbox too, received a warning recently that I
    will be unsubscribed forcibly because my e-mail provider GMX rejected
    spam Debian list is sending towards me. LOL. Maybe Debian e-mail server
    could improve filtering so I don't receive any spam in the first place?
    It's so easy to spot this spam, IDK why server is not trained to
    recognize typical spam words in these e-mails.

    On 11/08/2024 12:51, Thomas Schmitt wrote:
    Hi,

    i just received a message from the list server that my mail provider
    GMX has rejected a spam message which the Debian list allowed to pass
    by a tiny not-spam margin.
    From this quite unsuspicious situation the automat of Debian Listmaster
    Team derived the threat to unsubscribe me.

    I see the potential for a bounce troll, like we had a few years ago. (Whenever one of us posted to the list, the troll faked a bounce from
    our mail providers.)

    Do other experience the same ?

    (I would propose that list server shall please refrain from
    unsubscription threads if the mail in question gets a near-spam score in
    the Debian list system.)


    --------------------------------------------------------------------- Details:

    The list server quotes a reply from the GMX mail servers.

    https://lists.debian.org/bounces/FVOZui8Ui2aBD+8obfofFQ
    shows
    "For explanation visit
    https://postmaster.gmx.net/de/case?c=r0701&i=ip&v=82.195.75.100&r=1MYcpl-1siPQU12EF-00K6HO"
    ...
    X-Spam-Status: No, score=3.9 required=4.0 ...,DATE_IN_FUTURE_06_12,...
    ...
    Received: from mail-wr1-x443.google.com ...
    by bendel.debian.org (Postfix) with ESMTPS id 2121E2049B
    for <[email protected]>;
    Sun, 11 Aug 2024 10:21:41 +0000 (UTC)
    Received: by mail-wr1-x443.google.com ...
    for <[email protected]>; Sun, 11 Aug 2024 03:21:41 -0700 (PDT)
    ...
    Date: Sun, 11 Aug 2024 11:21:27 -0700

    The web says that DATE_IN_FUTURE_06_12 from Spamassassin means that
    the mail's Date is 6 to 12 hours in the future relative to the time it
    was received.

    My provider takes more offense:

    https://postmaster.gmx.net/de/case?c=r0701&i=ip&v=82.195.75.100&r=1MYcpl-1siPQU12EF-00K6HO
    "Die Zeitangabe im Date-Header weicht zu stark von der tatsächlichen
    Zeit ab."
    = "The time stamp of the Date header deviates too much from the
    actual time."


    Have a nice day :)

    Thomas


    --
    With kindest regards, Piotr.

    ⢀⣴⠾⠻⢶⣦⠀
    ⣾⠁⢠⠒⠀⣿⡁ Debian - The universal operating system ⢿⡄⠘⠷⠚⠋⠀ https://www.debian.org/
    ⠈⠳⣄⠀⠀⠀⠀

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From [email protected]@21:1/5 to piorunz on Thu Aug 15 06:40:01 2024
    On Wed, Aug 14, 2024 at 06:56:07PM +0100, piorunz wrote:
    Hi Thomas,

    Same here, I am on GMX mailbox too, received a warning recently that I
    will be unsubscribed forcibly because my e-mail provider GMX rejected
    spam Debian list is sending towards me. LOL. Maybe Debian e-mail server
    could improve filtering so I don't receive any spam in the first place?
    It's so easy to spot this spam, IDK why server is not trained to
    recognize typical spam words in these e-mails.

    Spam is... difficult [1]. And you can't expect the Debian mailing list
    server to agree with each and every one and their dog's mail provider's
    servers on what is spam. There will always bee disagreements.

    Moreover: mail providers are growing more and more hysterical about
    rejecting mails.

    I think it's OK to discuss possible improvements with the listmasters,
    but one would have to start with realistic premises. And "the list servers should have the same spam criteria as GMX" is not realistic.

    Cheers

    [1] especially its last 0.5%. More so when you define "spam" to include
    the recipient's parameters (which you have to start doing to catch
    the last 5%). More so when you let the definition to move over time
    (which you also have to do for those last 5%)

    --
    t

    -----BEGIN PGP SIGNATURE-----

    iF0EABECAB0WIQRp53liolZD6iXhAoIFyCz1etHaRgUCZr2E2QAKCRAFyCz1etHa RjZQAJ9gk6P5pJLuR5D6zmFvmAhxOuMR+wCeK8duVjvj5ZCOOHntxiyPmVpjWgs=
    =WFIw
    -----END PGP SIGNATURE-----

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)