|
|
| Author |
Message |
| 25 new of 248 responses total. |
keesan
|
|
response 193 of 248:
| 
Dec 10 22:31 UTC 2002 |
Is it possible to change things so that mail cannot be forwarded through grex,
or would that interfere with normal use of grex mail?
|
mdw
|
|
response 194 of 248:
|
Dec 10 22:36 UTC 2002 |
Well, a lot of people, including me, forward mail from grex. So yes, it
would interfere with "normal" use of grex mail. It could be argued that
grex shouldn't be in the mail forwarding business.
|
cross
|
|
response 195 of 248:
|
Dec 10 22:52 UTC 2002 |
This response has been erased.
|
carson
|
|
response 196 of 248:
|
Dec 11 06:00 UTC 2002 |
resp:192 (wrong, wrong, wrong.)
(1. SpamCop reports for 216.93.104.34 are currently sent
to abuse@voyager.net. see http://spamcop.net/sc?track=216.93.10
4.34
for details.)
(2. if I receive spam at my Grex address, which forwards to my
Chinet account, and file a SpamCop report, I regularly forward
a copy of that report to uce@grex. this is likely what you are
seeing in the uce inbox.)
(3. there was no SpamCop block on Grex on November 6. you
either must be subconsciously combining the two separate dates
of November 10 and December 7 or not reading carefully. either
way, keesan already cited the two spams sent from Grex that
caused those blocks in an earlier response. you can see them
for yourself at
http://spamcop.net/w3m?action=checkblock&ip=216.93.104.34
I've checked my report #s and can verify that I did *not*
submit either report. of course, I didn't get the spam,
either.) ;)
(re: misinformation keesan is spreading over in coop: Grex was delisted
on the 9th of December. two days is not a week.)
(I concur with all earlier responses regarding the use of SpamCop's
blacklist, namely that it's Not A Good Idea to use it.)
|
keesan
|
|
response 197 of 248:
|
Dec 11 16:56 UTC 2002 |
Thanks for the delisting information. I will now go back to using grex for
sending email to places that use spamcop's list. (I discovered along the way
that the free webmail service I was forwarding through instead converts all
text attachments to MIME, that my intended recipient's Netscape mail cannot
handle MIME attachments, and that my ISP's webmail not only cannot forward
attachments but cannot read MIME attachments either!!!!!). Pine is great!
Spamcop said they automatically delist sites in a week - I did not understand
the details of when they sometimes delist in less time than this. Can you
explain that?
|
remmers
|
|
response 198 of 248:
|
Dec 11 17:23 UTC 2002 |
Hmm.... Never heard of a version of Netscape mail that didn't handle
MIME attachments.
|
mcnally
|
|
response 199 of 248:
|
Dec 11 19:40 UTC 2002 |
Possibly she means the "My Netscape"-portal web-based e-mail, not the
GUI mail client that comes bundled with Navigator?
|
keesan
|
|
response 200 of 248:
|
Dec 11 19:44 UTC 2002 |
My intended recipient only said 'Netscape'. I asked for more info.
My ISP's web-based email does not handle MIME. I have not checked if Yahoo
mail does so (probably it does) but I am about to check Pine 3.96 at grex
because I think it had trouble with this same mail when I forwarded it back.
Pine 3.96 is the latest version of pine that does not render HTML. Pine is
now up to version 4.50. Grex might want to consider switching. Just about
everyone we have taught to use grex mail phones or emails asking what to do
about html mail - their usual solution is to ignore it. If the sender
included text as well you can do a Reply to read the text part, but our
beginners cannot handle View, Save, Exit, Quit, view with Lynx, print to text,
exit lynx, return to pine, go back to the mail, do a reply, and import the
text output from lynx. Should I bring this up in co-op?
|
keesan
|
|
response 201 of 248:
|
Dec 11 19:59 UTC 2002 |
I forwarded the email with text attachment (which I could read with Pine 3.96)
from grex to the free webmail service (where I could read the attachment) and
then back to Grex. I cannot read the attachment with Pine after forwarding
it there and back - View gives me the message [Can't display missing text
segment]. The free webmail service converts the text attachment to a MIME
encoded attachment. If they have done this properly, should Pine be able to
decode and display it as text? The ISP webmail service simply did not display
any attachment at all - I don't think it can handle MIME encoding, but
possibly there is something wrong with the encoded version. This ISP webmail
service received the attachment - I can see the upper-case ASCII when I view
the HTML version of the page - just does not display it. It says there is
1 attachment.
|
keesan
|
|
response 202 of 248:
|
Dec 11 20:25 UTC 2002 |
I opened a new account at m-net and they have Pine 4.44 which has the new
feature 'Export as plain text file' to deal with html messages, but still
cannot read the MIME-encoded attachment from the free webmail service. I
wonder if they encoded it improperly.
|
mdw
|
|
response 203 of 248:
|
Dec 11 20:36 UTC 2002 |
Here is the message I found in uce@. I'm afraid I botched the date
above; so shoot me, I'm human. Note date: Dec 7: note it was sent from
spamcop not Carson: note this is the *only* message I found from
julianhaight.com going to any administrative account on grex for the
past 2 weeks. I suppose it's possible this isn't the actual message
that triggered the block, if so, then we've received *no* notification
for the block. I don't blame Carson for any of this - I believe spamcop
fails in an unfortunate way, and did so here:
From 131441976@bounces.spamcop.net Sat Dec 7 00:24:48 2002$
Received: from saruman.julianhaight.com (saruman.julianhaight.com
[216.127.43.87]) by grex.cyberspace.org (8.6.13/8.6.12) with SMTP id
AAA07159 for <uce@grex.org>; Sat, 7 Dec 2002 00:24:46 -0500$ Received:
(qmail 11842 invoked from network); 7 Dec 2002 05:16:28 -0000$
Received: from localhost (HELO spamcop.net) (127.0.0.1)$
by saruman.julianhaight.com with SMTP; 7 Dec 2002 05:16:28 -0000$
Received: from [204.38.207.130] by spamcop.net$
^Iwith HTTP; Sat, 07 Dec 2002 05:16:28 GMT$
From: "Carson" <131441976@reports.spamcop.net>$
To: uce@grex.org$
Subject: [SpamCop (Forwarded Spam) id:131441976]*****SPAM***** Try a
FREE 30 Day Sample of HGH !$ Precedence: list$ Message-ID:
<131441976@spamcop.net>$ Date: Sat, 7 Dec 2002 12:40:40 +0900$
X-SpamCop-sourceip: 203.145.15.153$ X-Mailer: Mozilla/4.0
(compatible; MSIE 6.0; Windows NT 5.1; NMU; .NET CLR 1.0.3705)$ ^Ivia
http://spamcop.net/ v1.3.3$ $ - SpamCop V1.3.3 -$ This message is
brief for your comfort. Please follow links for details.$ $ http:/
/spamcop.net/w3m?i=z131441976z3568a9fae07466db073765233c498529z$ User-targeted
report, see notes, if any.$ $ Offending message:$ Received: from
grex.cyberspace.org (grex.cyberspace.org [216.93.104.34])$ ^Iby
chinet.chinet.com (8.12.3/8.12.3/SuSE Linux 0.6) with SMTP id
gB73gtZ4020503$ ^Ifor <x>; Fri, 6 Dec 2002 21:42:56 -0600$ Received:
from www.kocomnet.com ([210.205.61.9]) by grex.cyberspace.org
(8.6.13/8.6.12) with ESMTP id WAA26182; Fri, 6 Dec 2002 22:44:12 -0500$
Received: from email-com.mr.outblaze.com ([203.145.15.153])$
^Iby www.kocomnet.com (8.9.3/8.9.3) with ESMTP id MAA24893;$ ^ISat,
7 Dec 2002 12:40:40 +0900$ Message-ID:
<0000______________________2f96@email-com.mr.outblaze.com>$ To: <x>$
From: "dustin ketchum" <>$ Subject: *****SPAM***** Try a FREE 30
Day Sample of HGH !$ Date: Sat, 07 Dec 2002 10:40:22 -0500$
MIME-Version: 1.0$ Content-Type: text/plain$
Content-Transfer-Encoding: 7bit$ Reply-To: fmaperezr@email.com$
X-Mailer: Microsoft Outlook, Build 10.0.2616$ X-Spam-Status: Yes,
hits=11.6 required=5.0
tests=FAKED_UNDISC_RECIPS,PLING,GAPPY_TEXT,CLICK_BELOW,ONE_HUNDRED_PC_GU
AR,GUARANTEE,SUPERLONG_LINE,RCVD_IN_ORBS,RCVD_IN_RFCI version=2.20$
X-Spam-Flag: YES$ X-Spam-Level: ***********$
X-Spam-Checker-Version: SpamAssassin 2.20 (devel $Id:
SpamAssassin.pm,v 1.77 2002/04/06 19:28:30 hughescr Exp $)$
X-Spam-Prev-Content-Type: text/plain;$ ^Icharset="Windows-1252"$
X-Spam-Prev-Content-Transfer-Encoding: 7bit$ $ $ SPAM:
-------------------- Start SpamAssassin results ----------------------$
SPAM: This mail is probably spam. The original message has been
altered$ SPAM: so you can recognise or block similar unwanted mail in
future.$ SPAM: See http://spamassassin.org/tag/ for more details.$
SPAM: $ SPAM: Content analysis details: (11.6 hits, 5
required)$ SPAM: Hit! (3.4 points) Faked To "Undisclosed-Recipients"$
SPAM: Hit! (0.5 points) Subject has an exclamation mark$ SPAM:
Hit! (-1.2 points) BODY: Contains 'G.a.p.p.y-T.e.x.t'$ SPAM: Hit! (1.5
points) BODY: Asks you to click below$ SPAM: Hit! (4.4 points) BODY:
One hundred percent guaranteed$ SPAM: Hit! (1.9 points) BODY: Contains
word 'guarantee' in all-caps$ SPAM: Hit! (-0.4 points) BODY: Contains a
line >=199 characters long$ SPAM: Hit! (1.0 point) Received via a
relay in orbs.dorkslayers.com$ SPAM: [RBL check:
found 9.61.205.210.orbs.dorkslayers.com.]$ SPAM: Hit! (0.5 points)
Received via a relay in ipwhois.rfc-ignorant.org$ SPAM:
[RBL check: found 9.61.205.210.ipwhois.rfc-ignorant.org., type:
127.0.0.6]$ SPAM: $ SPAM: -------------------- End of SpamAssassin
results ---------------------$ $ $ $ Younger and healthier with
ULTIMATE-hGH: all-natural human growth hormone supplement designed to
stimulate own production of growth hormone (hgh)!$ $ As seen on N.B.C.,
C.B.S., C.N.N., and even OpRah!! The health discovery that
actuallyreverses aging while burning fat, without dieting or exercise!
This provendiscovery has even been reported on by the New England
Journal of Medicine.Forget aging and dieting forever! And it's
Guaranteed! $ $ Click below to enter our web site:$ http://www.game
towncastle.com/hgh/$ $ Would you like to lose weight while you sleep!$ No
dieting!$ No hunger pains!$ No Cravings!$ No strenuous exercise!$
Change your life forever! $ $ 100% GUARANTEED!$ $ 1.Body Fat Loss 82%
improvement.$ 2.Wrinkle Reduction 61% improvement.$ 3.Energy Level 84%
improvement.$ 4.Muscle Strength 88% improvement.$ 5.Sexual Potency 75%
improvement.$ 6.Emotional Stability 67% improvement.$ 7.Memory 62%
improvement.$ $ Click below to enter our web site:$ http://www.game
towncastle.com/hgh/$ $ $ **************************************************$ If
you want to get removed$ from our list please visit - http://www.ga
metowncastle.com/rm/rm.html$
**************************************************$ $ $ $
|
carson
|
|
response 204 of 248:
|
Dec 11 22:00 UTC 2002 |
(yep, that's a report I forwarded to uce because the original message
was sent to me here. I suppose that begs the question of whether the
information in the report is at all useful; the reason that I forward
them is because Marcus had asked for examples of spam sent to Grex.
anyway, I've already gone over where SpamCop sends reports for Grex
[they go upstream to abuse@voyager, not to Grex]; for that reason, I
highly doubt that any such reports would have been forwarded to Grex.)
(http://spamcop.net/fom-serve/cache/94.html explains how to go about
getting those reports sent to Grex. there's a form to fill out at
http://spamcop.net/w3m?action=routeform that may require assent from
someone at Voyager.)
(re: delisting: SpamCop automatically delists an address if there are no
reports against it within the past 48 hours. for whatever reason, that's
not in the FAQ, but it is explained on the query page.)
(it looks like Grex is particularly vulnerable to SpamCop blocking because
of a low spam threshold [0.020 spam per non-spam] and because we aren't
sending enough legitimate e-mail to systems that use the blocking list
[catch-22?]. perhaps this whole thing deserves its own item...)
|
carson
|
|
response 205 of 248:
|
Dec 11 22:03 UTC 2002 |
(both "tmobile" and "admin9" have existing accounts on Grex. I find
the "last login" dates amusing, for obvious reasons.)
|
aruba
|
|
response 206 of 248:
|
Dec 11 22:25 UTC 2002 |
Not bvious to me, I'm afraid.
|
carson
|
|
response 207 of 248:
|
Dec 12 04:23 UTC 2002 |
(the "last login" dates are when the accounts sent the spam that put
Grex on SpamCop's blacklist, i.e., they've likely only been used once.)
|
gull
|
|
response 208 of 248:
|
Dec 12 14:11 UTC 2002 |
The report wouldn't have appeared to come from carson. Spamcop
deliberately munges the addresses, to prevent spammers from retaliating
or reselling them.
|
aruba
|
|
response 209 of 248:
|
Dec 12 15:24 UTC 2002 |
Re #207: Ah. Thanks.
|
dpc
|
|
response 210 of 248:
|
Dec 12 16:38 UTC 2002 |
Over the past month or so, e-mail to me from non-Grex
sources is often *seriously* delayed.
This morning's collection has an e-mail sent to me from
umich.edu on Dec. 10 at 3:06 p.m. which did not arrive
at Grex until Dec. 12 (today) at 4:27 a.m.
My wife and I frequently get duplicate e-mails from
the same sender(s). She has a Comcast account.
Her e-mails arrive almost immediately after they
are sent. Mine are delayed for up to a day!
What is happening here?
|
remmers
|
|
response 211 of 248:
|
Dec 12 16:46 UTC 2002 |
Marcus talked about that problem a bit at last night's board meeting.
He's not sure but thinks it might be a (possibly inadvertent) form of
denial-of-service attack. He's investigating. I'll let him explain
more fully if he wishes.
|
gull
|
|
response 212 of 248:
|
Dec 12 20:46 UTC 2002 |
Re #211: Thanks. I don't know about other people here, but mostly I just
wanted to know that the problem was being taken seriously and investigated.
:)
|
dpc
|
|
response 213 of 248:
|
Dec 13 14:56 UTC 2002 |
Thanx! The problem is quite annoying. An e-mail was sent to
me from aadl.org (the Library) on Wednesday, Dec. 11 at 5:36 p.m.
and I didn't receive it until today, Dec. 13, at 3:32 a.m.
|
dang
|
|
response 214 of 248:
|
Dec 14 00:46 UTC 2002 |
It's causing havok on the Grex staff list as staffers answer questions
multiple times because the answers cross each other in flight by hours.
|
mdw
|
|
response 215 of 248:
|
Dec 14 11:29 UTC 2002 |
I think I better understand why mail got slow. We apparently have at
least 3 different spammers trying to connect to grex, but failing to do
so. Presumably there's a firewall, possibly at their end, perhaps in
the middle, that drops packets from grex to the spammers. The half-open
connections occupy slots in the input queue, and there are only a
limited number of such connections that are permitted to exist. After
those slots fill up, other connection attempts are silently ignored.
Since the 3 spammers have at least 20 IP addresses between them, they're
doing a pretty good job of keeping those slots full. And, since we
never actually get any connections from them, let alone mail, they don't
appear in our logs at all. This is certainly going to be "interesting"
to fix. So far, a few simple things I tried haven't been useful, but
there are certainly any number of not so simple fixes we can do.
I suppose we should be thankful that we don't get the spam.
|
mcnally
|
|
response 216 of 248:
|
Dec 14 13:43 UTC 2002 |
Are we running any sort of IP filtering SW that can simply block those
IP addresses completely or don't we have the horsepower for that?
|
keesan
|
|
response 217 of 248:
|
Dec 14 16:11 UTC 2002 |
Can you simply write to these spammers, point out to them that the mail is
not getting through to grex anyway but they are disabling our system, and ask
them to 'delist' us (stop sending things in our direction)?
|
