|
Grex > Coop13 > #376: The problems with Grex, e-mail and spam | |
|
| Author |
Message |
| 25 new of 480 responses total. |
rcurl
|
|
response 142 of 480:
| 
Dec 7 20:04 UTC 2006 |
Given the spam load, a 1MB mailbox limit could be reached in one day - the
limit should be big enough to allow a week's worth of mail since not everone
can log in daily (like I usually do - but then, I will be away and possibly
out of touch over the holidays). What happens to mail when the limit is
reached?
This is another reason for a general Grex filter for the spam-of-the-day
variety.
|
cross
|
|
response 143 of 480:
|
Dec 7 21:00 UTC 2006 |
This is yet another reason for grex to adopt an ``opt-in'' email strategy.
The fact of the matter is that most grex users don't use grex email (and by
users, I'm referring to the vast, vast majority who never touch the BBS or
party). So their mailboxes just get full and sit on the disk, taking up
space, but full of useless spam.
A far better solution is to, by default, not to premit users to send *or
receive* email unless they specifically request it. Then set up an automatic,
and verifiable, way to determine who gets access (or allow some group of
people to ``sponsor'' email access).
The model could be this:
You login via newuser, create an account, and have no network or email access.
Say you want email access. You run some program that tells you to submit a
$1 one-time donation via PayPal; then you get access. If you cannot do that,
you can be told to ask a member to sponsor email access somewhow. E.g., send
a write message, run another program to request access that sends a message
on your behalf, etc.
There should be a program called ``sponsor'' that allows members to set up
accounts and email access for new users. So when Sindi donates some obsolete
computer to some random person, she can beforehand create that person an
account on grex. Then, once they get said computer, they can just dial in
as normal and be shown how to use, e.g., mutt for email access. *They* don't
need a PayPal account since we trust Sindi to vouch for them.
International users are by and large looking for Unix access, not email. They
can either use PayPal to verify their identity, or use ask someone to sponsor
them.
For that handful of users who *do* actually use email, a mixture of an
aggressive spam and virus filter coupled with subscribing to the various spam
detection services and blacklists would greatly reduce the amount of incoming
spam. Anyone who wanted to go further could do something like use Sindi's
filter.
|
edina
|
|
response 144 of 480:
|
Dec 7 21:07 UTC 2006 |
If someone wants to eliminate my email account, consider this
permission to do so.
|
keesan
|
|
response 145 of 480:
|
Dec 7 21:33 UTC 2006 |
How about emailing everyone asking if they want to keep their email account,
and if they don't reply and have not accessed the account for amonth, delete
it except for the 40 paying members. Limit everyone to 1MB and they can
forward mail some place else if they go on vacation away from a computer.
Make the spam filter optional, for people who like 1MB of spam in their box.
|
twenex
|
|
response 146 of 480:
|
Dec 7 21:41 UTC 2006 |
Emailing everyone to ask them something we could just as well ask them in bbs
would place a tremendous load on the system; then we'd get people asking
grexstaff to gun the job of the luser consuming unreasonable amounts of system
resources by emailing everyone to ask them if they wanted their email account
left open and do we really have to email everyone.
For the record, I have too many places on the net where I've given my grex
address to to even think about finding them all and redirecting email, so
unless grexemail becomes a paid-for service I'd like my email account to
remain open, please.
|
gull
|
|
response 147 of 480:
|
Dec 7 22:24 UTC 2006 |
Re resp:139: Well, for starters, remember when Grex's mail was blocked
by some sites because SpamCop had labelled us a spammer? Imagine how
much worse it would have been if SpamCop had instead launched some kind
of active attack against us to try to saturate our network connection
or shut us down. That's the sort of thing that can happen.
Lycos tried a screensaver that would bombard spam websites with
requests, but pulled it after a few days:
http://www.eweek.com/article2/0,1759,1735539,00.asp
|
mcnally
|
|
response 148 of 480:
|
Dec 7 22:51 UTC 2006 |
I think the idea of sending a system-wide e-mail to users asking them
to opt-in to e-mail before a certain deadline or be opted out has
potential but needs some further thought put in to how it will be
implemented.
But it would greatly reduce the strain on Grex's e-mail system if we
could eliminate the thousands of e-mail boxes that aren't being used.
I might recommend starting out small with this change -- for example,
identify a batch of, say, 200 users with large mail spool files but
who haven't logged in regularly and try it out with them. If the
approach proves workable, then start working one's way through the
password file. This should be implemented in conjunction with a new
opt-in system for e-mail and changes to newuser that give users the
option to decline e-mail on Grex or to set up automatic forwarding
to another site.
|
cross
|
|
response 149 of 480:
|
Dec 7 23:08 UTC 2006 |
Regarding #146; Well, for starters, the vast majority of grex users never
use BBS. At least not regularly. I don't think there's an intention to
delete the mailboxes of active users. I don't know that sending an email is
going to be a particularly efficient use of resources, either. I'd modify
the system login procedure to force a check on login for pre-existing users
and non-members. Or just make it the default for new accounts and run
expire for most of the old, stale accounts.
Regarding #148; I think you could grandfather existing users and use the
normal account expiration mechanism to weed out most of the idle accounts.
I wonder when the last time a reap was run....
One thing that I think is important is that, for users creating their own
accounts via logging in as newuser or using webnewuser, opting into email
should be a *separate process* that can only be done once they've created an
account on grex. It shouldn't be a part of newuser (though it should be a
part of the process by which members can sponsor other accounts). The only
two options when creating a new account should be forwarding mail offsite or
discarding email sent to that user, with instructions on how to opt into
mail after the account has been created.
I don't think any of this is particularly hard to implement; it just needs
to be done. It doesn't require an army of volunteers to process manual
requests, either; most of it could be automated.
|
keesan
|
|
response 150 of 480:
|
Dec 8 00:23 UTC 2006 |
Would a reap today keep incoming mail from bouncing for a while?
|
keesan
|
|
response 151 of 480:
|
Dec 8 01:17 UTC 2006 |
6 spams in 10 minutes x 6 x 24 is about 900/day.
|
rcurl
|
|
response 152 of 480:
|
Dec 8 06:23 UTC 2006 |
I suppose my problem is very much in the minority. I represent a non-profit
that has its e-mail address and website here, and is also a paying Grex
member (in part on the basis of nonprofits helping nonprofits). On behalf of
this nonprofit I would like Grex to keep email but operate a spam filter.
If they can't do this, then I'm afraid this nonprofit will seek email
support elsewhere. For myself, I can move my email off Grex, as I use it for
only one mailinglist membership at this point.
|
mcnally
|
|
response 153 of 480:
|
Dec 8 06:25 UTC 2006 |
Any number of people will be willing to tell you how to set up
spam filtering for the non-profit group you represent.
Continuing to provide reliable e-mail service, though, is a hard
problems and it's only going to get harder from here.
|
keesan
|
|
response 154 of 480:
|
Dec 8 15:11 UTC 2006 |
Rane, don't expect staff to do everything for you. Copy my .forward, which
forwards to procmail, and copy my procmail.simple or procmail.sample to
.procmailrc and change keesan to rcurl, and if you like change /*/*/*/*/* to
/*/*/* and you will have a spam filter that gets most of the spam. I got no
spam in my inbox or folders since yesterday, but 56 spams got dumped in 15
hours (they seem to be less dense at night). The *** has never given a false
positive. Spamassassin assigns points based on things like being on the
spamcop blacklist, having only HTML message, forged receive, etc. I have had
PINE mail from grex show up with a negative amount of points. You can also
set it to put anything blacklisted that made it through the filter into a spam
folder.
|
nharmon
|
|
response 155 of 480:
|
Dec 8 15:54 UTC 2006 |
> Rane, don't expect staff to do everything for you.
*PFFFFFFT* (the sound of coca cola streaming from my mouth)
BWAHAHAA!
|
rcurl
|
|
response 156 of 480:
|
Dec 8 18:08 UTC 2006 |
I've tried diy spam filters, and they require regular maintenance, as well
as a lot of thought on what to filter on. I'm not interested in spending that
time on it, especially as I consider it a system problem more than a personal
problem.
|
jep
|
|
response 157 of 480:
|
Dec 8 18:12 UTC 2006 |
I forward all my e-mail here to my Comcast address. The spam filters
there are good enough I almost never see any unwanted messages at all.
I understand other e-mail providers can do that, too. Spam at work is
so rare I can't remember when I got one the last time. Let companies
other than Grex, with the resources to handle the problem, take care of
it. It works for me.
|
cmcgee
|
|
response 158 of 480:
|
Dec 8 19:03 UTC 2006 |
Technical question: If var/mail/ is full, will emails sent to a Grex account
with email forwarding be forwarded or bounced?
|
cross
|
|
response 159 of 480:
|
Dec 8 19:51 UTC 2006 |
Regarding #158; No.
|
krj
|
|
response 160 of 480:
|
Dec 8 22:31 UTC 2006 |
Here's an article from the computer trade press about the current
explosion in spam:
http://www.informationweek.com/hardware/showArticle.jhtml?articleID=1966024
63
Some highlight quotes:
> Spam volume is up 73% in the last three months, Postini reported,
> thanks to a one-two-three punch of a huge increase in the number
> of spam botnets and a major jump in the use of both image- and
> document-based spam. For the year, spam quantity is up 143%.
...
> "The combination of the [high] volume and the type of spam now
> coming in is what's causing companies' defenses to melt down,"
> Druker says. "They just can't keep up with the rising tide."
...
> While the war against spam may not be lost, as other experts have
> claimed, Druker paints an ugly picture for 2007. "The more high-speed
> connections and the more Windows PCs there are gives spammers that
> much more raw material," he says. "Until home PCs get locked down,
> I don't see attacks going down. Only when [consumers] start
> locking down their computers will we see a big difference."
|
gull
|
|
response 161 of 480:
|
Dec 8 23:31 UTC 2006 |
Re resp:152: If Grex isn't meeting your needs, it may indeed be time to
move to another provider. No hard feelings.
Re resp:158: I believe mail that's forwarded without being stored
locally will still go through. I don't think Exim checks for disk
space in the mailbox directory unless it actually has to do a local
delivery.
|
keesan
|
|
response 162 of 480:
|
Dec 9 00:29 UTC 2006 |
Rane, spamassassin does not need any maintenance, and you don't even need to
keep a log in case it is too much trouble to look at a few pages a day listing
where your mail went (/dev/null, a spam folder, or inbox). Without adding
a few other filters that change once in a while, 10% of spam might slip
through.
|
cyklone
|
|
response 163 of 480:
|
Dec 9 05:03 UTC 2006 |
Listen to keesan, rane. If you don't want to change email addresses then
you should put in the effort, not expect grex staff to do it for you.
|
rcurl
|
|
response 164 of 480:
|
Dec 9 06:03 UTC 2006 |
Applied to everyone, it is an enormous total waste of time. It should be
as much of an ISP service as maintaining all the other aspects of the
system.
I guess my days on Grex are numbered, if that is the best Grex can do.
|
cmcgee
|
|
response 165 of 480:
|
Dec 9 12:39 UTC 2006 |
Rane, I have used my grex account as my email address for over 10 years. I
have nowhere near the spam rate that you do, and it's certainly not from
"hiding" that address.
Perhaps your personal experience is different, but "applied to everyone" is
a gross overstatement. I actually have 3 grex accounts, one of which is my
give-it-freely address, and none of them are having the level of problems
you're reporting.
Yes, I routinely get spam and I just as routinely spend the
less-than-thirty-seconds it takes to delete it before I read the rest. Sindi
is correct that a smart spam filter would probably take care of most of it,
since it's pretty obvious from the subject line that it's spam.
She prefers to fiddle with a spam filter several times a day, I simply delete
the unwanted mail. Take your pick. Or quit using Grex for email. As a
retired professor, Grex is certainly not your only "free" option.
Or, you could make it a retirement project. Sounds like you don't think it's
worth your time, or anyone elses, to delete the stuff. So, perhaps you could
perfect personal spam filters and share them as Sindi does. Perhaps this is
another service you could perform for your not-for-profit.
In any case, all of us are coping, using various strategies, with the overall
spam problem. Some of us have higher thresholds than others for the nuisances
that come with belonging to a community. If Grex email is the most important
part of your membership here, then perhaps it IS time for you to start using
your UM account instead, and quit participating in the bbs. Somehow, from your
activities, I doubt that Grex = email for you.
|
remmers
|
|
response 166 of 480:
|
Dec 9 14:59 UTC 2006 |
I'm still working on a simple interface that will make enabling of spam
filtering simpler for users. I think that *is* a reasonable thing for the
staff to try to provide. But as I stated in an earlier response, I'm a
little pessimistic about how effective Grex-based spam filtering will be,
given the huge volume of spam nowadays. I'll take a look at Sindi's
sample procmailrc files, which employ some additional strategies.
By the way, my spam volume is, I suspect, comparable to Rane's -- well
over a hundred per day on Grex, plus several times more than that on my
primary mail server. The latter offers SpamAssassin-based spam filtering,
and nowadays it's pretty ineffective, despite being hosted at Pair
Networks, a major hosting service.
|