🚀 go-pugleaf

In article <19951222.162533.780@jupiter.sun.csd.unb.ca>,
Adrian Powell  <CIPS-L@unb.ca> wrote:
>>The last comment on the use of PGP raises in my mind a question about
>>authenticating posts to CIPS-L.  Is it somehow possible to
>
>Hey Tom, weren't you the one saying PGP should be outlawed for
>The Greater Good of our children, and our children's children?
>
>:)
>
>(sorry, couldn't resist)

>>"authenticate" posters to that list  (Kind of like a "secret
>>handshake" -- only those who know get in)?

>Several mailing lists and mail server (anon.penet.fi, InfoWar,
>etc.) require pass phrases before being accepted.  I have not
>installed majordomo or listserv or the equivallent, so I do
>not know how difficult this would be.  At any rate, I do
>not think that this will fit with the newsgroup.

You could, instead, only accept requests from members of the mailing
list.  But this is problem prone, and sort of silly if we intend to
keep the newsgroup unmoderated with a bidirectional gateway.

>The way Usenet handles this problem is to use moderators that
>are supposed to approve of new postings to a group (rec.humor.funny,
>comp.risks, as a couple of examples).  Instead of directly
>posting, submittors send mail to the moderator, and he/she
>decides whether to approve the post.  *This* could be done
>(though I will *not* advocate it)--posters would have to
>be authendicated using PGP or a pass phrase before being
>approved.

Requiring PGP approval from the posters to a moderated group isn't
necessary, and nobody does that.  We're not trying to absolutely
require 100% accuracy in From: lines.  We're trying to stop spam.
The latter is much easier.

>I don't think this will work because:
>
>*       It discourages participants, which as a small mailing list
>        is not something that I think we wish.

It's a can.* group.  How can it be a "small mailing list"?

>*       Usenet security is easy to bypass by forging the "Approved-By"
>        headers (rec.humor got spammed by the infamous "Green Card"
>        attack a few months ago)

_This_ is where PGP comes into the act.  The _moderator_ PGP signs
the posting, perhaps automatically.  Then other servers on the net
running "PGPMoose" software will detect and nuke any postings in the
group that are not PGP signed.  This service is now available, and is in
production.

>*       Mail security is easy to bypass by getting a legitimate
>        account (with a forged email address) on the list before spamming.

This is irrelevant as long as we keep in mind we're trying to stop spam.
Besides, most spammers aren't going to take the time to figure out how
to pre-subscribe in order to spam your list.  The Groseclose spammer
didn't spend hours trying to figure out how to penetrate cips-l, he
simply _posted_ (it wasn't emailed) 5,000+ copies of the damn things
to every newsgroup his server knew about.

Just limiting to valid users (on the list side) would eliminate 99%
of spam.

>*       It requires much more active involvement by a moderator.  I
>        don't think that our discussion are formal enough to
>        warrant this.

There are options here.

>There have been a couple of proposals to prevent spams such as this,
>but I've not seen one that is entirely satisfactory.  There
>are programs such as CancelMoose that hits Usenet and trys to block
>spams by canceling them, however this doesn't do much for mailing
>lists, where spams are more annoying.  One gentleman proposed
>some checks that majordomo should perform before forwarding, but
>they involved a few minor checks (which consumed a major amount
>of bandwidth and CPU time) that basically ensured that mail came from
>legitimate addresses.  However, most "good" spams have forged headers
>so they appear to come from legitimate addresses, so this won't
>work, even if it was practical.
>
>It looks like the only way to protect ourselves is to join moderated lists,
>flame spammers, and support cancel bots.

I thank you ;-)

Here are some simple things we could do:

	1) We all agree that SPAM is bad in CIPS-L, and as owner of CIPS-L,
	   we authorize you to nuke any off-topic posting you feel
	   like.  If you wish to do this, I can provide you with the
	   appropriate software.  This is known as retroactive moderation.

	2) We moderate can.org.cips and cips-l.  You reject any off-topic
	   junk.

	3) We do (2), and, rather than have you see everything, mail
	   each message off to one of a group of moderators.  This speeds
	   things up.
	
	4) We do (2), and you put filters into the injector that looks
	   for known junk patterns (I have millions of them ;-).

	   This has the advantage of not slowing the group down - it's
	   all automatic.