731497 - Advice on community-ignite list spam?

Status: RESOLVED FIXED

(mozilla.org Graveyard :: Server Operations, task)

Description

[Ben Moskowitz]

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:12.0a2) Gecko/20120228 Firefox/12.0a2
Build ID: 20120228042013




Expected results:

Hey all, any advice on how to tackle extensive spam on [e-mail]?

I poked around in Mailman but was not clear on how to ameliorate the problem.

Want to fix the problem before growing the list.

Any advice would be much appreciated.

Comment 1

[Gervase Markham [:gerv]]

Ben: is the list moderated? Most of the newly-created lists are, and that means the admin is the only person who has to deal with spam (by clearing the list once every few days). Are you seeing spam getting through to the actual list? All I see in the newsgroup version is a test post from you. What access method are you using to read it?

Gerv

Comment 2

[Ben Moskowitz]

Hey Gerv, it is in fact moderated.

I don't mind being the human shield for spam—though there is a high volume of it.

Are there any other filters we can enable, above and beyond my own gatekeeping? :)

Many thanks.

Comment 3

[Gervase Markham [:gerv]]

justdave/rbryce: is there an "automatically bounce mail from non-subscribed people" option, and are there disadvantages to enabling it?

How is the work on improving the spam filter coming on? I still get several spam a day in the groups I manage...

Gerv

Comment 4

[Gervase Markham [:gerv]]

justdave/rbryce: ping?

Gerv

Comment 5

[Ben Moskowitz]

Ping!

Comment 6

[Reed Loden [:reed]]

Let's try kicking it to server-ops.

Comment 7

[Ben Moskowitz]

Hey all—

Can postini be enabled on an alias for this list?

I think that is the right solution, if it's possible. That's what we're using on other public-facing lists.

Alternately, let me know if there are more intelligent settings in Mailman.

Much appreciated!

-Ben

Comment 8

[Dave Miller [:justdave]]

Postini is not available for this domain at all at the moment.  If we set it up we'd have to set it up for the whole domain.  We could still configure it to pass everything through blindly except for the addresses we ask to have spam-filtered.  But it'd be a big step to take.

That said, we *did* just move to new servers using RHEL6 instead of RHEL5 on the back end, which comes with much newer versions of Amavis and SpamAssassin and so forth.  With the datacenter move (vacating MPT) out of the way there's more time for dealing with things like this as well. It's possible we could make some headway with configuration and training in SpamAssassin.

One of my fears with sicking Postini on this job is that a lot of the mail is going to be coming from the same source (Google Groups' "mail to moderator for posting" sending systems) and Postini may quickly learn that's a spam source and decide to block it altogether, and we wouldn't have much control over it doing so.  You'll still wind up having to go into Postini's interface and releasing false-positives to the list frequently.

One thing we haven't done in the past is any of the bayesean training in SpamAssassin.  It has a training function which we've never hooked.  It's very similar to the automatic system within Thunderbird which I actually find to work pretty well these days.  If we find a way to hook the final post-to-list decision function within Mailman's moderator interface into that training function in SpamAssassin it would likely help A LOT.

Comment 9

[Dave Miller [:justdave]]

(In reply to Dave Miller [:justdave] from comment #8)
> You'll still wind up having to go into Postini's
> interface and releasing false-positives to the list frequently.

What I meant by this is you'd be trading Mailman's moderator UI for Postini's moderator UI, and still having to deal with it either way.

Comment 10

[Rick Bryce [:rbryce]]

I put in a rule to block messages that get marked by SpamAssassin  with a score about 3.  This should but down on the spam.  If not, I can  bump the threshold up.  Please re-open if you having anymore issues.