Subject: [Tools-discuss] Authenticating posts to IETF mailing list

From: Brian Haberman <[email-masked]>
Date: Fri, 01 Jun 2007 11:25:05 -0400

Hi,
     On one of my working group's mailing list, we have had to set the
moderate flag on my subscription due to my e-mail address having been
harvested (most likely off the charter page) and used to spam the list.
 It becomes quite the hassle to send an e-mail to the list, log on to
the admin interface, wade through all the spam messages, and approve my
own posting.

     Would it be possible to beta test a PGP-based authorization method
as described in

http://mail.python.org/pipermail/mailman-developers/2005-July/018153.html

Regards,
Brian

_______________________________________________
Tools-discuss mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tools-discuss

---

From: Joe Touch <[email-masked]>
Date: Fri, 01 Jun 2007 11:16:36 -0700

> http://mail.python.org/pipermail/mailman-developers/2005-July/018153.html

Why not write a filter to check mail sent from your address for a really
short cookie in the header or body?

It's a lot less heavyweight on the server side, and also supports
non-PGP posters, and need not be beta-tested. It would work for anyone
whose email was compromised.

Joe

---

From: Fred Baker <[email-masked]>
Date: Fri, 1 Jun 2007 11:37:44 -0700

> short cookie in the header or body?

I'm not sure that helps anyone else. [email-masked] is an address  
that is often found in spam as well, and I can certainly test for my  
own address, but nobody else would know that I'm inserting the  
envelope line.

---

From: Jeroen Massar <[email-masked]>
Date: Fri, 01 Jun 2007 21:07:10 +0100

Fred Baker wrote:
> I'm not sure that helps anyone else. [email-masked] is an address that
> is often found in spam as well, and I can certainly test for my own
> address, but nobody else would know that I'm inserting the envelope line.

In Brian's case it is quite a bit more nasty than spam. It seems that
virusses have picked up his address and are using it as a source, with
a target of the ipv6 mailinglist. I've deleted upto now, since
february 2006 when this started occurring. Then we, in agreement with
Brian moderated his mail address so that it would not end up in the
archives and of course not at all the subscribers.

The biggest problem with adminning a mailinglist now is simply that
there is about, I guess ~75 spams a day ending up in the moderator
queue. The problem with this is that one becomes lazy in checking the
queue, thus if there is a legit message it will take a few moments
longer for them to be approved. Or it might just happen accidentally
that you delete it, afaik that didn't happen yet though fortunately.

Having PGP signing option for a mailinglist would be very welcome.

It seems that the patch that Brian mentioned is from what I saw quite
fine, I have to test it a bit more, but the test run that I did went
fine for the 10k mails I spat through it (replaying mboxes is fun :)
Only thing was that most mail got entered in the modqueue as I didn't
sign them up and only few people actually PGP sign their mail. I guess
though that when there is an incentive and actual use that it will
become more widespread in usage to actually use PGP.

Of course, what we really should be looking at is DKIM, but getting
mailers to support that requires admin intervention. PGP is what
everbody can do for oneselves.

Of course, I am not saying "make it mandatory" (some people are forced
to use stupid mailers like eg Lotus Notes), but for a case like
Brian's it is a perfect solution.

Greets,
 Jeroen

---

From: Joe Touch <[email-masked]>
Date: Fri, 01 Jun 2007 14:52:13 -0700

> address, but nobody else would know that I'm inserting the envelope line.

It helps lists that want to cooperate with you; it's like inserting a
static PGP signature. It's not as automatic as the PGP solution, but it
doesn't require full buy-in from all subscribers either (the PGP one
appears to).

Joe

---

From: Joe Touch <[email-masked]>
Date: Fri, 01 Jun 2007 15:01:05 -0700

A few questions below...

Jeroen Massar wrote:
> a target of the ipv6 mailinglist.

That's spam, isn't it? The source isn't the issue.

> I've deleted upto now, since

Is the list closed to non-members too? I.e., are the spams coming just
from subscriber addresses?

> Having PGP signing option for a mailinglist would be very welcome.

Is this a per-subscriber option? (you hinted at this issue)

> become more widespread in usage to actually use PGP.

That's not under many user's control; some use systems that don't
support PGP, and others are required to use systems that aren't
configured to use PGP. I'd hate to require this of all subscribers, or
even those whose addresses have been compromised.

Joe

---

From: Jeroen Massar <[email-masked]>
Date: Sat, 02 Jun 2007 00:53:09 +0100

Joe Touch wrote:
[..]

> That's spam, isn't it? The source isn't the issue.

It is spam that is spreading viruses so that it can spread more spam.
"Worm.Stration.pac-1" is the current one that is trying to be Brian
from several IPv4 addresses, unfortunately quite random. Contacting
those ISP's is of no use it seems as they don't respond at all.
Most likely they don't know what to do with it. See below.

> from subscriber addresses?

Most of the stuff in the queue comes from non-subscriber addresses.
But for some reason Brian's address is being used as a from by this
strand of viruses and the couple of previous ones. I guess that at
some point somebody gets infected who has a message from him in
his/her mailbox, but it is hard to tell what it really is.

> Is this a per-subscriber option? (you hinted at this issue)

Yes, the user can in their regular mailman options add their own PGP
key like that they like to use. If they don't (default) then they
don't get this extra protection. If somebody spams from their address
then it gets through (just like the first virus from brian did)

One can set the full list to require PGP keys though, but that is what
for ietf lists atm is not acceptable.

[..]
> even those whose addresses have been compromised.

It is not required, so that is not a problem (IMHO). It is also what I
mentioned for DKIM, we can't require it as not everybody has the
ability to implement it.

The advantage of this concept thus becomes that the people who want
can make sure that they don't get spammed/virussed by this. Normally
this indeed does not happen, but it solves the problem in the cases
that it does.

Greets,
 Jeroen

--
* =
http://www.nabble.com/Virus-Found-in-message-%22Re%3A%22-tf1175276.html#a3089601
http://www.nabble.com/Virus-Found-in-message-%22Fwd%3A-Crazy-illegal-Sex%21%22-tf1175197.html#a3089367
http://www.nabble.com/Virus-Found-in-message-%22eBook.pdf%22-tf1175090.html#a3089046
etc etc etc... :(

---

From: Joe Touch <[email-masked]>
Date: Fri, 01 Jun 2007 19:59:58 -0700

Hi, Jeroen,

> It is spam that is spreading viruses so that it can spread more spam.

That's just still spam, though. I agree it's not useful to try to stop
it at the source, but it ought to be tagged by any reasonable
spam-stopping system (don't IETF lists have spam detection?)

Also, you should be able to configure a reasonable mailer to drop posts
with attachments. Given this is an IETF email list, that should be
acceptable.

> Most of the stuff in the queue comes from non-subscriber addresses.

Why not shut that down? i.e., require subscriber only posts? That
doesn't solve Brian's issue, but does solve the bulk of the rest of it.

...
> Yes, 
...
> for ietf lists atm is not acceptable.

Right. Thanks, that was what I was wondering.

...
> this indeed does not happen, but it solves the problem in the cases

Sure, provided everyone who is attacked this way is PGP-capable. ;-)
However, blocking non-member posts and attachments might go a long way
to reducing workload in list management; they work for my lists.

Joe

---

From: Jeroen Massar <[email-masked]>
Date: Sat, 02 Jun 2007 10:21:31 +0100

> spam-stopping system (don't IETF lists have spam detection?)

They do, but they don't drop messages (yet). There is also a
semi-useless interface which show the spam counters, but from the
subject line it is fairly obvious what is and what is not spam.

What should be done is that Neustar has Virus&Spam-check on SMTP-DATA.
That way they can reject messages and the sender would at least know
it gets rejected. This would reduce all of this a *lot*. This would be
the most useful solution IMHO.

To give a scary statistic from my single [email-masked] address,
last May it got 21724 mails, additionally 17316 where refused due to
mostly spam reasons. Viruses are not spread to wide nowadays as far as
I can see from my graphs. April was worse it seems from the history
graphs with spam >60%. Trick is also that my secondary MX's already
perform filtering too, so that junk that arrives there doesn't pop up
in these stats. Simple postfix rejections (hostname checks etc) btw
solve a lot of spam also as most spam software fortunately doesn't
know how to properly speak SMTP.

> with attachments. Given this is an IETF email list, that should be

Well, PGP signed messages look like attachments to most people ;)
It is quite hard to filter out messages that look like attachment,
because there are still also people who use HTML. As such filtering on
MIME type etc is not easily done, especially as Mailman only allows

Current List policies afaik also don't allow automatic filtering :(
It would be great to REJECT at SMTP DATA time as then senders who are
legit get a correct bounce about it.

Checking the mailman interface, we had this problem also with another
address, somebody at Microsoft also got bitten by this, we resolved
that in the same way.

> doesn't solve Brian's issue, but does solve the bulk of the rest of it.

It is configured as subscribe-only posting. Which means that
everything else comes into the moderator queue. And you do not want to
bounce that stuff back to unsuspecting senders by rejecting it in
mailman and you do not want to automatically discard it either, as it
might be a legit message. Which does happen quite often when there are
cross posts between working groups, as then people might not be
subscribed but do reply to the message. If the REJECT would be at SMTP
DATA time that would solve that part of the problem indeed, and we
would not have any spam/viruses any more in the queue.

Next to spam, there are a lot of Non-Delivery notifications too.
Especially the spammy "We found a virus, buy Symantec" are great.

> to reducing workload in list management; they work for my lists.

How exactly do you "block" these? Especially with an eye at the above
where people cross post and are not subscribed. Discarding, without
notification, these messages is a nono IMHO. Even legit messages being
sent from a non-subscriber address to the list should be able to get
through, that is where the moderator queue is for.

Greets,
 Jeroen

---

From: Joe Touch <[email-masked]>
Date: Sat, 02 Jun 2007 05:24:04 -0700

Jeroen Massar wrote:
...
> How exactly do you "block" these? 

Mailman can block file attachments by attachment type, e.g., by file
suffix and/or MIME type.

> especially with an eye at the above
> where people cross post and are not subscribed. 

On E2E, our policy is that you need to subscribe to post. Even to cross
post.

> Discarding, without
> notification, these messages is a nono IMHO. 

Email isn't a reliable system; things can get lost anywhere in the
chain, and there's no requirement to support positive ACK to the source
upon final delivery. IMO, anyone who posts should check to see if they
got a copy, and if not, can contact the list manager (and they do, when
needed).

> Even legit messages being

That, IMO, is what a list manager email addr is for. Nonsubscribers can
always forward to me, and I can post on their behalf.

Understand that I tried to avoid these measures, but at this point, E2E:

	- blocks applications
	- requires subscription to post
	- silently discards nonmember posts
	- rejects (with NACK) posts tagged with no-archive
	- silently discards spam
		where spam is indicated by a spam filter,
		and the threshold is set fairly high
	- holds messages matching certain announcement types
		notifies the sender about the hold
		and are reviewed every few days

Since these rules were put in place in 2004, the amount of daily
management work has decreased to trivial, and the utility of the list
has not substantially suffered (based on posts/day).

Joe

---

From: Pekka Savola <[email-masked]>
Date: Sun, 3 Jun 2007 08:56:48 +0300 (EEST)

> 		and are reviewed every few days

Well, I'm not sure how much use it is to discuss non-IETF mailing 
lists in the context of IETF mailing lists.  At least two mechanisms 
of the above are incompatible with the IESG statement on IETF mailing 
list mail handling and as such could not be used on IETF mailing 
lists.

-- 
Pekka Savola                 "You each name yourselves king, yet the
Netcore Oy                    kingdom bleeds."
Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings

---

From: Brian E Carpenter <[email-masked]>
Date: Sun, 03 Jun 2007 08:45:37 +0200

On 2007-06-01 22:07, Jeroen Massar wrote:
...
> that you delete it, afaik that didn't happen yet though fortunately.

While I was moderating the IESG list it was getting ~100 spams for each
legitimate non-member posting; afaik I only discarded one valid
posting in 2 years, and we got it back ;-)

For lists that the secretariat is running TMDA in front of, that rate
is down to approximately zero. However, TMDA will not block the type
of forgery Brian H is suffering from, and the cost of checking a PGP
signature on every message from someone on the TMDA whitelist would
presumably be significant and possibly prohibitive.

> Having PGP signing option for a mailinglist would be very welcome.

Because of the overhead, I would suggest applying it very selectively.
I don't think making PGP a condition for unmoderated posting would
be practical in general.
> become more widespread in usage to actually use PGP.

Maybe, but you're talking about tens of thousands of email addresses,
judging by the size of the secretariat's TMDA whitelist. It would take
years for everyone to move to PGP.

    Brian
> ------------------------------------------------------------------------
>

---

From: Jeroen Massar <[email-masked]>
Date: Sun, 03 Jun 2007 13:42:02 +0100

[..]
> I don't think making PGP a condition for unmoderated posting would

Indeed, the idea is to have it enabled when a user wants to, or when
such a case like Brian Habermans occurs. This would solve that problem
at least, thus shortening queue times (I don't check the queue every 5
mins and sometimes actually sleep ;) or give the admin pass to the
individual involved and other such setups. PGP signing would solve that.

Having SMTP REJECT for Spam+Virusses on the IETF lists would already
help a lot in this respect. A simple Spamassassin/ClamAV milter setup
does miracles. Is there anything there that we can help Neustar on
trying to implement it? All mail is getting tagged/tested already;
there is also a virus/spam interface that displays the SA scores in
the mailman interface, but they are detectable on spam subject already.

See https://www1.ietf.org/mailman/spamdb/<listname> for folks who have
a list with admin access.

One can also add a filter in the form of "X-Spam-Score: .*\+\+\+"
which would mean a score of 3. The problem with this though is bounces
which will only generate more useless traffic. Setting it to discard
might cause a false-positive to never be caught. REJECT at SMTP time
though solves that, as the spammer doesn't get to deliver his message
and a real sender will receive a bounce showing that it was spam.
Of course backscatter might still happen at an open relay, but there
is not much we can do about that.

[..]
> years for everyone to move to PGP.

PGP verification is not very high I must say, though it would need
quite a bit more testing. Even though there might be 10k subscribers,
the signature would only be checked inbound.

Although it would indeed be very cool, I also don't see it happening
especially due to mailclient restrictions that some people get laid
upon them by the larger companies, and there are enough of those
participants on the list, forcing them to use gmail would not really
be productive ;)

DKIM is a similar setup, but runs into the problem that it requires
the administrator of the domain to set it up. At least in many cases
pgp-signing a message can still be done, simply plainsign it and
cut/paste it into the mailclient and hope that the client/server
doesn't modify it for you. For this situation it would thus work
better than DKIM IMHO.

Personally, I think that PGP signing messages is a good thing though,
as people who you are communicating with do know that it is you.
Although I've not heard about any forgeries of mail addresses
happening on IETF lists, except for those viruses.

Greets,
 Jeroen

---

From: Fred Baker <[email-masked]>
Date: Sun, 3 Jun 2007 08:55:25 -0400

On Jun 3, 2007, at 2:45 AM, Brian E Carpenter wrote:

> For lists that the secretariat is running TMDA in front of, that  
> rate is down to approximately zero. However, TMDA will not block  
> the type of forgery Brian H is suffering from, and the cost of  
> checking a PGP signature on every message from someone on the TMDA  
> whitelist would presumably be significant and possibly prohibitive.

Checking for the presence of a PGP signature could be done with a  
little code, and leave the validation of it to the user. Spam-bots  
don't PGP-sign their stuff, and if they spoofed it that would be  
obvious at the user end. Ditto DKIM; it might come with a signature  
from the bot's ISP, but it won't come with the signature of the  
person it putatively came from, and right now it doesn't come with a  
signature at all.

---

From: Brian E Carpenter <[email-masked]>
Date: Sun, 03 Jun 2007 17:50:50 +0200

On 2007-06-03 14:42, Jeroen Massar wrote:
...

> trying to implement it? All mail is getting tagged/tested already;

As I understand it, a lot of mail is already kicked into a junk bucket
on the basis of the Spamassassin scores, but the threshold is set
quite permissively. The junk bucket is not public, but there's a way
for the ADs to review it in case of dispute, iirc.

     Brian

---

From: Joe Touch <[email-masked]>
Date: Sun, 03 Jun 2007 10:34:33 -0700

Pekka Savola wrote:
> Well, I'm not sure how much use it is to discuss non-IETF mailing lists
> in the context of IETF mailing lists. 

It's an IRTF mailing list.

> At least two mechanisms of the
> above are incompatible with the IESG statement on IETF mailing list mail
> handling and as such could not be used on IETF mailing lists.

Proclamations by the IESG do not constitute IETF policy, IMO
I am not aware of any community consensus position that's inconsistent
with the above.

The only statement I could find on the matter is:
http://www.ietf.org/IESG/STATEMENTS/moderated-lists.txt
Nothing above is inconsistent with this statement. Is there something
else? I.e., which two?

Joe

---

From: Joe Touch <[email-masked]>
Date: Sun, 03 Jun 2007 10:37:00 -0700

Jeroen Massar wrote:
...
> might cause a false-positive to never be caught. 

That should be reasonable; IMO, posters should check to see that what
they send actually posts anyway (mail is not end-to-end reliable, i.e.,
to the destination). They can always forward a note to the list admin
when they want to post something that was getting a false spam tag.

Joe

---

From: Pekka Savola <[email-masked]>
Date: Sun, 3 Jun 2007 21:15:43 +0300 (EEST)

> I am not aware of any community consensus position that's inconsistent

This seems like a mailing list management issue.  Most IETF lists are 
WG lists.  The IESG is ultimately responsible for the management of 
WGs.  I'd feel it'd be a bit strange if the IESG wasn't allowed to 
issue management guidance on this.  But your mileage may vary, and 
debating this on this forum is probably not productive.

> Nothing above is inconsistent with this statement. Is there something

http://www.ietf.org/IESG/STATEMENTS/mail-submit-policy.txt

'silently discard non-member posts' and 'requires subscription to 
post'.

---

From: Joe Touch <[email-masked]>
Date: Sun, 03 Jun 2007 12:20:32 -0700

Pekka Savola wrote:
> This seems like a mailing list management issue.  Most IETF lists are WG
> lists.  The IESG is ultimately responsible for the management of WGs. 
> I'd feel it'd be a bit strange if the IESG wasn't allowed to issue
> management guidance on this.  But your mileage may vary, and debating
> this on this forum is probably not productive.

Guidance, agreed. I think it's productive here (to note, not to debate
in detail) because it helps direct what facilities are required for
mailling list tools.

> 'silently discard non-member posts' and 'requires subscription to post'.

I'll note that I resisted requiring subscriber-only posts on the
E2E-list, but added it only after being directed by the WG chairs.

I don't see anything that prohibits requiring subscription to
automatically post, so long as there is an avenue for posters that
doesn't require subscription (there is - email to the admin).

As to silent drops of nonsubscribers, yes, that's in direct conflict
with what the IESG recommends. The primary alternative is to set
"reject" rather than "discard" for those. That's configurable, and can
be set as preferred. The current setting is designed to reduce our
server load and interaction with spam sources; at some point, we have to
protect our resources. I can easily set that other ways if desired and
requested.

Joe

-- 
----------------------------------------
Joe Touch
Sr. Network Engineer, USAF TSAT Space Segment

---

From: Brian E Carpenter <[email-masked]>
Date: Mon, 04 Jun 2007 09:01:07 +0200

> ...IMO, posters should check to see that what
> they send actually posts anyway 

You're kidding, right? That's never going to happen.

    Brian

---

From: Brian E Carpenter <[email-masked]>
Date: Mon, 04 Jun 2007 09:12:51 +0200

> E2E-list, but added it only after being directed by the WG chairs.

Are you talking about e2e, which iirc is a closed IRTF group?

Or about e2e-interest, which iirc is an open-subscription group
loosely associated with the e2e research group?

In either case, IETF rules and practices don't apply anyway.

> with what the IESG recommends. 

More to the point, on an IETF list, it's against a deep IETF principle
that is documented in RFC 2418:

    The IETF has basic requirements for open and fair participation and
    for thorough consideration of technical alternatives.

> The primary alternative is to set
> "reject" rather than "discard" for those. 

The normal thing is to moderate all non-member posts except for
non-members that have been whitelisted. And personally I never use
"reject" for spam because that at worst helps the spammer and at best
wastes bits.

     Brian

---

From: Lars Eggert <[email-masked]>
Date: Mon, 4 Jun 2007 10:13:52 +0300

> that you delete it, afaik that didn't happen yet though fortunately.

I've had great success running spamassassin over the moderation queue  
to thin out obvious spam: http://www.waider.ie/hacks/workshop/perl/ 
mailman.pl

Lars

---

From: Brian E Carpenter <[email-masked]>
Date: Mon, 04 Jun 2007 09:20:02 +0200

On 2007-06-03 14:55, Fred Baker wrote:
> Checking for the presence of a PGP signature could be done with a little 
> code, and leave the validation of it to the user. 

That sounds like a special case: if sender is Haberman and PGP is absent,
then moderate the message. But that doesn't scale.

    Brian

> Spam-bots don't 
> PGP-sign their stuff, and if they spoofed it that would be obvious at 
> the user end. Ditto DKIM; it might come with a signature from the bot's 
> ISP, but it won't come with the signature of the person it putatively 
> came from, and right now it doesn't come with a signature at all.
>

---

From: Joe Touch <[email-masked]>
Date: Mon, 04 Jun 2007 06:37:58 -0700

Brian E Carpenter wrote:
...
> loosely associated with the e2e research group?

The latter.

> In either case, IETF rules and practices don't apply anyway.

We choose to try to follow them as best possible.

>    for thorough consideration of technical alternatives.

Everyone is welcome to subscribe, and subscription doesn't mean you need
to receive posts (there's a 'nomail' option). Posters who don't want to
subscribe are welcome to send mail to the admin, which are then posted.

So exactly how does this configuration violate this requirement?

> non-members that have been whitelisted. 

That's a ridiculous waste of resources for lists that are very popular.

> And personally I never use

Agreed.

Joe

---

From: Brian E Carpenter <[email-masked]>
Date: Mon, 04 Jun 2007 15:56:02 +0200

> So exactly how does this configuration violate this requirement?

I think it's a convenience issue. There are probably a couple of hundred
list associated with the I*TF that an individual might want to post
to very occasionally - you can't expect people to manage that many
subscriptions, and people expect to send mail to the list,
not to a human relay.

BTW to be clear - I'm not on e2e-interest at the moment, but while
I was, I had no complaints whatever at the list management policy.

> That's a ridiculous waste of resources for lists that are very popular.

Actually I didn't find that while administering the IESG list. The
number of non-spam non-member posts was quite high, of course,
but didn't cost more than a couple of minutes per day. It would
have been much more time-consuming to act as a human relay.
It was the spam that took the time, until TMDA came along.

      Brian

---

From: Joe Touch <[email-masked]>
Date: Mon, 04 Jun 2007 07:05:13 -0700

Brian E Carpenter wrote:
...
> subscriptions, and people expect to send mail to the list,

On that point we differ; I think joining a list is a low hurdle, one
that the IETF could automate in bulk (i.e., join all lists in an area at
once) if desired. I also think 'managing' a list membership is a low
hurdle; if you're going to post to a list, even occasionally, you should
check the list posting policies to see if they've changed.

At the very least, this would constitute a difference of opinion on
convenience; that's a lot less than being "against a deep IETF
principle", IMO.

> I was, I had no complaints whatever at the list management policy.

(that makes you the exception; everyone seems to want to back-seat drive
there, FWIW)

> It was the spam that took the time, until TMDA came along.

FWIW, I get a ton of non-member posts which are clearly spam but are not
caught by our spam filters. That's why we moved to subscriber only. I
think that such a move is fine where needed, and can be done in a way
consistent with IETF policy.

Joe