Re: irritating spam
On Tue, Jan 28, 2003 at 06:20:27AM +1030, Darren Freeman wrote: On Tue, 2003-01-28 at 02:16, Dr. Richard E. Hawkins wrote: On Mon, Jan 27, 2003 at 04:41:18PM +0100, Andre Poenitz wrote: On Mon, Jan 27, 2003 at 10:35:29AM -0500, Dr. Richard E. Hawkins wrote: I actually have a line for that addres in my filters that catches both the direct spam and the stuff that comes here. The only address I've been bothered to do that for (thouhg once I get a few minutes to understand one I found that checks for 90% 8 bit high characters . . . Nevertheless, these mails are fairly big, so this is annoying... I never notice the size, sitting on top of a fat connectio :) Well, the user's list does not get it because they have a 60K message size restriction. Oh, and unlike everything else which goes to a spam folder, his go to /dev/null . . . ... which gives him the pleasure of being copied from buffer to buffer, finally ending up in kernel space, only to then be dropped ... Well, with qmail you just drop it on the floor---no copying. In any case, I just put in a filter which does not allow attachments with .pi or .pif extensions. far more than he deserves! Why not give him a reply from /dev/zero instead? ;) Or convince him to connect to your credit-card details, cleverly disguised as the CHARGEN port of a kick-arse server? Tell him it's encrypted, and to get it he first has to download the *whole* file ;) Please do not do anything like that. Remember, spammers/blackhats are doing this full time, and they will win if you openly take it up with them. Besides, the virus is probably coming to you from an infected site, and not from the creator. Looking into the list archive, none of the copies of the bigboss viruses came from the same IP. The address [EMAIL PROTECTED] of course is a fake, and has nothing to do with where the copy of the virus you receive is coming from. Notice how discussing the spam takes up more of our time and bandwidth than the original spam did? =) Yes. But it is not a spam, it is a virus, and as such should be taken care of by your ISP. Of course, there is an ultimate solution to the virus/spam problem on my end... Time is better spent perhaps discussing that. Mate
Re: irritating spam
Mate Wierdl wrote: Well, with qmail you just drop it on the floor---no copying. In any case, I just put in a filter which does not allow attachments with .pi or .pif extensions. Thanks, Mate. Of course, there is an ultimate solution to the virus/spam problem on my end... Time is better spent perhaps discussing that. This is your (tmda/qconfirm) solution? Can you recall what opposition there was (for those with an insufficiently elephantine memory such as myself?) Was any of it well founded in your view or simply an excessive conservatism? -- Angus
Re: irritating spam
On Tue, Jan 28, 2003 at 06:20:27AM +1030, Darren Freeman wrote: > On Tue, 2003-01-28 at 02:16, Dr. Richard E. Hawkins wrote: > > On Mon, Jan 27, 2003 at 04:41:18PM +0100, Andre Poenitz wrote: > > > On Mon, Jan 27, 2003 at 10:35:29AM -0500, Dr. Richard E. Hawkins wrote: > > > > I actually have a line for that addres in my filters that catches both > > > > the direct spam and the stuff that comes here. The only address I've > > > > been bothered to do that for (thouhg once I get a few minutes to > > > > understand one I found that checks for 90% 8 bit high characters . . . > > > > > Nevertheless, these mails are fairly big, so this is annoying... > > > > I never notice the size, sitting on top of a fat connectio :) Well, the user's list does not get it because they have a 60K message size restriction. > > > > Oh, and unlike everything else which goes to a spam folder, his go to > > /dev/null . . . > > ... which gives him the pleasure of being copied from buffer to buffer, > finally ending up in kernel space, only to then be dropped ... Well, with qmail you just drop it on the floor---no copying. In any case, I just put in a filter which does not allow attachments with .pi or .pif extensions. > > far more than he deserves! > > Why not give him a reply from /dev/zero instead? ;) > > Or convince him to connect to your credit-card details, cleverly > disguised as the CHARGEN port of a kick-arse server? Tell him it's > encrypted, and to get it he first has to download the *whole* file ;) > Please do not do anything like that. Remember, spammers/blackhats are doing this full time, and they will win if you openly take it up with them. Besides, the virus is probably coming to you from an infected site, and not from the creator. Looking into the list archive, none of the copies of the "bigboss" viruses came from the same IP. The address [EMAIL PROTECTED] of course is a fake, and has nothing to do with where the copy of the virus you receive is coming from. > Notice how discussing the spam takes up more of our time and bandwidth > than the original spam did? =) > Yes. But it is not a spam, it is a virus, and as such should be taken care of by your ISP. Of course, there is an ultimate solution to the virus/spam problem on my end... Time is better spent perhaps discussing that. Mate
Re: irritating spam
Mate Wierdl wrote: > Well, with qmail you just drop it on the floor---no copying. In any case, > I just put in a filter which does not allow attachments with .pi or .pif > extensions. Thanks, Mate. > Of course, there is an ultimate solution to the virus/spam problem on my > end... Time is better spent perhaps discussing that. This is your (tmda/qconfirm) solution? Can you recall what opposition there was (for those with an insufficiently elephantine memory such as myself?) Was any of it well founded in your view or simply an excessive conservatism? -- Angus
irritating spam
How do we contact Mate to get him to filter out all these messages from big at boss dot com. I though that he had a spam filter set up. In fact, he must do because this irritating bugger is the only one to get through more than once. I just noticed that his continued presence is starting to piss me off ;-) -- Angus
Re: irritating spam
On Mon, Jan 27, 2003 at 03:39:32PM +, Angus Leeming wrote: How do we contact Mate to get him to filter out all these messages from big at boss dot com. I though that he had a spam filter set up. In fact, he must do because this irritating bugger is the only one to get through more than once. I just noticed that his continued presence is starting to piss me off ;-) I actually have a line for that addres in my filters that catches both the direct spam and the stuff that comes here. The only address I've been bothered to do that for (thouhg once I get a few minutes to understand one I found that checks for 90% 8 bit high characters . . . hawk -- Richard E. Hawkins, Asst. Prof. of Economics/\ ASCII ribbon campaign [EMAIL PROTECTED] Smeal 178 (814) 375-4700 \ / against HTML mail These opinions will not be those of Xand postings. Penn State until it pays my retainer. / \
Re: irritating spam
On Mon, Jan 27, 2003 at 10:35:29AM -0500, Dr. Richard E. Hawkins wrote: I actually have a line for that addres in my filters that catches both the direct spam and the stuff that comes here. The only address I've been bothered to do that for (thouhg once I get a few minutes to understand one I found that checks for 90% 8 bit high characters . . . Nevertheless, these mails are fairly big, so this is annoying... Andre' -- Those who desire to give up Freedom in order to gain Security, will not have, nor do they deserve, either one. (T. Jefferson)
Re: irritating spam
On Mon, Jan 27, 2003 at 04:41:18PM +0100, Andre Poenitz wrote: On Mon, Jan 27, 2003 at 10:35:29AM -0500, Dr. Richard E. Hawkins wrote: I actually have a line for that addres in my filters that catches both the direct spam and the stuff that comes here. The only address I've been bothered to do that for (thouhg once I get a few minutes to understand one I found that checks for 90% 8 bit high characters . . . Nevertheless, these mails are fairly big, so this is annoying... I never notice the size, sitting on top of a fat connectio :) Oh, and unlike everything else which goes to a spam folder, his go to /dev/null . . . hawk -- Richard E. Hawkins, Asst. Prof. of Economics/\ ASCII ribbon campaign [EMAIL PROTECTED] Smeal 178 (814) 375-4700 \ / against HTML mail These opinions will not be those of Xand postings. Penn State until it pays my retainer. / \
Re: irritating spam
Dr. Richard E. Hawkins wrote: On Mon, Jan 27, 2003 at 03:39:32PM +, Angus Leeming wrote: How do we contact Mate to get him to filter out all these messages from big at boss dot com. I though that he had a spam filter set up. In fact, he must do because this irritating bugger is the only one to get through more than once. I just noticed that his continued presence is starting to piss me off ;-) I actually have a line for that addres in my filters that catches both the direct spam and the stuff that comes here. The only address I've been bothered to do that for (thouhg once I get a few minutes to understand one I found that checks for 90% 8 bit high characters . . . Sure, I can filter it. I just think that the list shouldn't let it through in the first place. -- Angus
Re: irritating spam
On Mon, Jan 27, 2003 at 03:39:32PM +, Angus Leeming spake thusly: How do we contact Mate to get him to filter out all these messages from big at boss dot com. I though that he had a spam filter set up. In fact, he must do because this irritating bugger is the only one to get through more than once. I just noticed that his continued presence is starting to piss me off ;-) -- Angus The bugger is a virus (SoBig). To my dubious satisfaction I notice that some of my spammers got infected too ;-) Martin msg51612/pgp0.pgp Description: PGP signature
Re: irritating spam
Angus == Angus Leeming [EMAIL PROTECTED] writes: Angus How do we contact Mate to get him to filter out all these Angus messages from big at boss dot com. I though that he had a spam Angus filter set up. In fact, he must do because this irritating Angus bugger is the only one to get through more than once. Angus I just noticed that his continued presence is starting to piss Angus me off ;-) This is not spam, but a virus: http://www.f-prot.com/virusinfo/sobig_a.html JMarc
Re: irritating spam
Jean-Marc Lasgouttes wrote: This is not spam, but a virus: http://www.f-prot.com/virusinfo/sobig_a.html Indeed, and as John mentioned in an earlier thread about this, we loose nothing if we ban all mails with *.pif or *.pi attachments. Jürgen.
Re: irritating spam
On Mon, Jan 27, 2003 at 05:27:55PM +0100, Jean-Marc Lasgouttes wrote: Angus I just noticed that his continued presence is starting to piss Angus me off ;-) This is not spam, but a virus: http://www.f-prot.com/virusinfo/sobig_a.html I tend to forget the difference. I there any from a practical point of view? ;-} Andre' -- Those who desire to give up Freedom in order to gain Security, will not have, nor do they deserve, either one. (T. Jefferson)
Re: irritating spam
On Tue, 2003-01-28 at 02:16, Dr. Richard E. Hawkins wrote: On Mon, Jan 27, 2003 at 04:41:18PM +0100, Andre Poenitz wrote: On Mon, Jan 27, 2003 at 10:35:29AM -0500, Dr. Richard E. Hawkins wrote: I actually have a line for that addres in my filters that catches both the direct spam and the stuff that comes here. The only address I've been bothered to do that for (thouhg once I get a few minutes to understand one I found that checks for 90% 8 bit high characters . . . Nevertheless, these mails are fairly big, so this is annoying... I never notice the size, sitting on top of a fat connectio :) Oh, and unlike everything else which goes to a spam folder, his go to /dev/null . . . ... which gives him the pleasure of being copied from buffer to buffer, finally ending up in kernel space, only to then be dropped ... far more than he deserves! Why not give him a reply from /dev/zero instead? ;) Or convince him to connect to your credit-card details, cleverly disguised as the CHARGEN port of a kick-arse server? Tell him it's encrypted, and to get it he first has to download the *whole* file ;) Notice how discussing the spam takes up more of our time and bandwidth than the original spam did? =) hawk Darren
Re: irritating spam
On Mon, Jan 27, 2003 at 04:41:18PM +0100, Andre Poenitz wrote: On Mon, Jan 27, 2003 at 10:35:29AM -0500, Dr. Richard E. Hawkins wrote: I actually have a line for that addres in my filters that catches both the direct spam and the stuff that comes here. The only address I've been bothered to do that for (thouhg once I get a few minutes to understand one I found that checks for 90% 8 bit high characters . . . Nevertheless, these mails are fairly big, so this is annoying... All I can say is that I proposed a solution (tmda/qconfirm) numerous times, but it was voted down. Believe me, many of big boss' mail (and some others) bounce to root, and since I want to now what is going on, I have to let them bounce instead of discardind them---and they do annoy the heck out of me. I'd like to mention that now sunsite.dk offers tmda and/or qconfirm filtering for its list. For example, it is used on the auctex list---not a single spam or virus in the last month. Mate
irritating spam
How do we contact Mate to get him to filter out all these messages from big at boss dot com. I though that he had a spam filter set up. In fact, he must do because this irritating bugger is the only one to get through more than once. I just noticed that his continued presence is starting to piss me off ;-) -- Angus
Re: irritating spam
On Mon, Jan 27, 2003 at 03:39:32PM +, Angus Leeming wrote: > How do we contact Mate to get him to filter out all these messages > from big at boss dot com. I though that he had a spam filter set up. > In fact, he must do because this irritating bugger is the only one to > get through more than once. > I just noticed that his continued presence is starting to piss me off > ;-) I actually have a line for that addres in my filters that catches both the direct spam and the stuff that comes here. The only address I've been bothered to do that for (thouhg once I get a few minutes to understand one I found that checks for 90% 8 bit high characters . . . hawk -- Richard E. Hawkins, Asst. Prof. of Economics/"\ ASCII ribbon campaign [EMAIL PROTECTED] Smeal 178 (814) 375-4700 \ / against HTML mail These opinions will not be those of Xand postings. Penn State until it pays my retainer. / \
Re: irritating spam
On Mon, Jan 27, 2003 at 10:35:29AM -0500, Dr. Richard E. Hawkins wrote: > I actually have a line for that addres in my filters that catches both > the direct spam and the stuff that comes here. The only address I've > been bothered to do that for (thouhg once I get a few minutes to > understand one I found that checks for 90% 8 bit high characters . . . Nevertheless, these mails are fairly big, so this is annoying... Andre' -- Those who desire to give up Freedom in order to gain Security, will not have, nor do they deserve, either one. (T. Jefferson)
Re: irritating spam
On Mon, Jan 27, 2003 at 04:41:18PM +0100, Andre Poenitz wrote: > On Mon, Jan 27, 2003 at 10:35:29AM -0500, Dr. Richard E. Hawkins wrote: > > I actually have a line for that addres in my filters that catches both > > the direct spam and the stuff that comes here. The only address I've > > been bothered to do that for (thouhg once I get a few minutes to > > understand one I found that checks for 90% 8 bit high characters . . . > Nevertheless, these mails are fairly big, so this is annoying... I never notice the size, sitting on top of a fat connectio :) Oh, and unlike everything else which goes to a spam folder, his go to /dev/null . . . hawk -- Richard E. Hawkins, Asst. Prof. of Economics/"\ ASCII ribbon campaign [EMAIL PROTECTED] Smeal 178 (814) 375-4700 \ / against HTML mail These opinions will not be those of Xand postings. Penn State until it pays my retainer. / \
Re: irritating spam
Dr. Richard E. Hawkins wrote: > On Mon, Jan 27, 2003 at 03:39:32PM +, Angus Leeming wrote: >> How do we contact Mate to get him to filter out all these messages >> from big at boss dot com. I though that he had a spam filter set >> up. In fact, he must do because this irritating bugger is the only >> one to get through more than once. > >> I just noticed that his continued presence is starting to piss me >> off ;-) > > I actually have a line for that addres in my filters that catches > both > the direct spam and the stuff that comes here. The only address > I've been bothered to do that for (thouhg once I get a few minutes > to understand one I found that checks for 90% 8 bit high characters > . . . Sure, I can filter it. I just think that the list shouldn't let it through in the first place. -- Angus
Re: irritating spam
On Mon, Jan 27, 2003 at 03:39:32PM +, Angus Leeming spake thusly: > > How do we contact Mate to get him to filter out all these messages > from big at boss dot com. I though that he had a spam filter set up. > In fact, he must do because this irritating bugger is the only one to > get through more than once. > > I just noticed that his continued presence is starting to piss me off > ;-) > > -- > Angus The bugger is a virus (SoBig). To my dubious satisfaction I notice that some of my spammers got infected too ;-) Martin msg51612/pgp0.pgp Description: PGP signature
Re: irritating spam
> "Angus" == Angus Leeming <[EMAIL PROTECTED]> writes: Angus> How do we contact Mate to get him to filter out all these Angus> messages from big at boss dot com. I though that he had a spam Angus> filter set up. In fact, he must do because this irritating Angus> bugger is the only one to get through more than once. Angus> I just noticed that his continued presence is starting to piss Angus> me off ;-) This is not spam, but a virus: http://www.f-prot.com/virusinfo/sobig_a.html JMarc
Re: irritating spam
Jean-Marc Lasgouttes wrote: > This is not spam, but a virus: > http://www.f-prot.com/virusinfo/sobig_a.html Indeed, and as John mentioned in an earlier thread about this, we loose nothing if we ban all mails with *.pif or *.pi attachments. Jürgen.
Re: irritating spam
On Mon, Jan 27, 2003 at 05:27:55PM +0100, Jean-Marc Lasgouttes wrote: > Angus> I just noticed that his continued presence is starting to piss > Angus> me off ;-) > > This is not spam, but a virus: > http://www.f-prot.com/virusinfo/sobig_a.html I tend to forget the difference. I there any from a practical point of view? ;-} Andre' -- Those who desire to give up Freedom in order to gain Security, will not have, nor do they deserve, either one. (T. Jefferson)
Re: irritating spam
On Tue, 2003-01-28 at 02:16, Dr. Richard E. Hawkins wrote: > On Mon, Jan 27, 2003 at 04:41:18PM +0100, Andre Poenitz wrote: > > On Mon, Jan 27, 2003 at 10:35:29AM -0500, Dr. Richard E. Hawkins wrote: > > > I actually have a line for that addres in my filters that catches both > > > the direct spam and the stuff that comes here. The only address I've > > > been bothered to do that for (thouhg once I get a few minutes to > > > understand one I found that checks for 90% 8 bit high characters . . . > > > Nevertheless, these mails are fairly big, so this is annoying... > > I never notice the size, sitting on top of a fat connectio :) > > Oh, and unlike everything else which goes to a spam folder, his go to > /dev/null . . . ... which gives him the pleasure of being copied from buffer to buffer, finally ending up in kernel space, only to then be dropped ... far more than he deserves! Why not give him a reply from /dev/zero instead? ;) Or convince him to connect to your credit-card details, cleverly disguised as the CHARGEN port of a kick-arse server? Tell him it's encrypted, and to get it he first has to download the *whole* file ;) Notice how discussing the spam takes up more of our time and bandwidth than the original spam did? =) > hawk Darren
Re: irritating spam
On Mon, Jan 27, 2003 at 04:41:18PM +0100, Andre Poenitz wrote: > On Mon, Jan 27, 2003 at 10:35:29AM -0500, Dr. Richard E. Hawkins wrote: > > I actually have a line for that addres in my filters that catches both > > the direct spam and the stuff that comes here. The only address I've > > been bothered to do that for (thouhg once I get a few minutes to > > understand one I found that checks for 90% 8 bit high characters . . . > > Nevertheless, these mails are fairly big, so this is annoying... All I can say is that I proposed a solution (tmda/qconfirm) numerous times, but it was voted down. Believe me, many of big boss' mail (and some others) bounce to root, and since I want to now what is going on, I have to let them bounce instead of discardind them---and they do annoy the heck out of me. I'd like to mention that now sunsite.dk offers tmda and/or qconfirm filtering for its list. For example, it is used on the auctex list---not a single spam or virus in the last month. Mate
