967107 - Block spammers from the Webmaker newsgroup

Status: RESOLVED FIXED

(Infrastructure & Operations Graveyard :: Servicedesk, task)

Description

[Matt Thompson (@OpenMatt :OpenMatt)]

* We've recently had an issue with spam from non-members on the Webmaker newsgroup. 
https://lists.mozilla.org/admin/webmaker/
https://groups.google.com/forum/#!forum/mozilla.webmaker


For example, here's some recent spam:
https://groups.google.com/forum/#!topic/mozilla.webmaker/CBQtR6YPgsY
https://groups.google.com/forum/#!topic/mozilla.webmaker/Rx5PWe6B05g

* On the mailman side, our list is set to only allow posts from members -- and neither of these spammers are list members. So we're not sure how this is getting through. 

* This makes me think the problem could be coming from the Google Group side.

QUESTIONS:

1) Any advice? 

2) How do we access admin settings / blacklisting functionality on the Google Group side? Should we do that?

Thanks for any help with this!

Comment 1

[Matt Thompson]

More spam just came through today -- from the same users. our users are complaining. 

* Gerv: do you have any experience with this?

Comment 2

[Jonathan Lin - Not watching NI/offline [:jlin] [[e-mail]]]

mailman lists usually are put into postini for spam filtering. need to check if this is active.

Comment 3

[Jonathan Lin - Not watching NI/offline [:jlin] [[e-mail]]]

ann added the list to postini. the owner of the list will be receiving the postini spam-filtered notice emails and will need to approve / whitelist emails as needed. Hope this helps with the spam problems!

Comment 4

[Gervase Markham [:gerv]]

I have no special powers here; server-ops know what can be done, if anything.

I clear spam out of the Mailman moderation queue every few days, and very little gets through - one or two a month, perhaps. If you are seeing significantly more than that, there may be a config problem.

Gerv

Comment 5

[Zilmar]

Hey guys!
have you tried this [1]?

1 - http://www.washington.edu/itconnect/connect/email/mailman/list-configuration-options/#discard_these_nonmembers

Comment 6

[Matt Thompson]

@ Zilmar: thanks for this! I can't find where to access that setting in the admin interface though.

Comment 7

[Matt Thompson]

* Is there any way to use content filtering to block any messages that contain a particular word? Like the word "webslavery," which appears in the spam we've been getting?

Comment 8

[Zilmar]

(In reply to Matt Thompson from comment #6)
> @ Zilmar: thanks for this! I can't find where to access that setting in the
> admin interface though.

Matt, I never accessed any mailman config, so I don't know where to find it. Maybe this will help: http://www.gnu.org/software/mailman/mailman-admin/node8.html

Comment 9

[Matt Thompson]

* Thanks Zilmar
* This page allows us to set spam filters: https://lists.mozilla.org/admin/webmaker/privacy/spam
* But I'm unclear on what values to enter to this field to block the "webslavery" messages we're getting: https://lists.mozilla.org/admin/webmaker/?VARHELP=privacy/spam/header_filter_rules

Comment 10

[Zilmar]

(In reply to Matt Thompson from comment #9)
> * Thanks Zilmar
> * This page allows us to set spam filters:
> https://lists.mozilla.org/admin/webmaker/privacy/spam
> * But I'm unclear on what values to enter to this field to block the
> "webslavery" messages we're getting:
> https://lists.mozilla.org/admin/webmaker/?VARHELP=privacy/spam/
> header_filter_rules

Great! Aren't they from the same sender?

Comment 11

[Matt Thompson]

No. We've received the same spam message from:

[e-mail]
[e-mail]
[e-mail]
[e-mail]

Comment 12

[Jonathan Lin - Not watching NI/offline [:jlin] [[e-mail]]]

Jen Hayashi from my team might be able to give some advice. I've cc'ed her.

Comment 13

[Zilmar]

(In reply to Matt Thompson from comment #11)
> No. We've received the same spam message from:
> 
> [e-mail]
> [e-mail]
> [e-mail]
> [e-mail]

Try this: http://lists.stcloudstate.edu/mailman/admin/mailman/?VARHELP=privacy/spam/bounce_matching_headers
You could use a regular expression to filter the Subject field and block "webslavery".

Comment 14

[Matt Thompson]

ok I've added a filter there I hope will help. Thanks!

Comment 15

[Zilmar]

(In reply to Matt Thompson from comment #14)
> ok I've added a filter there I hope will help. Thanks!

Awesome!
We can test it. Just send an e-mail with that subject.

Comment 16

[Jonathan Lin - Not watching NI/offline [:jlin] [[e-mail]]]

did that filter alleviate the spams?

Comment 17

[Matt Thompson]

I just turned emergency moderation off, so messages should be coming through automatically again. Let's see. I'll do a test right now.

Comment 18

[Matt Thompson]

* I just tried sending a test message with a blocked term in the subject
* The test message *did* make it through to the Google Group side, here:
https://groups.google.com/forum/#!topic/mozilla.webmaker/ZgDHW6Dfv1s
** (I'm not sure if that's expected behavior or not)

Comment 19

[Matt Thompson]

* The other surprising change is that when I click "Tend to pending moderator requests," here, zero messages appear
* https://lists.mozilla.org/admindb/webmaker

Comment 20

[Zilmar]

Are there any config that allows moderation only for messages coming from non-members?

Comment 21

[Matt Thompson]

* The list is already set to hold messages from non-members

Comment 22

[William Duyck [:fuzzyfox]]

@Matt are we forcing approval to join the list? If not that might help to stop some of the spam as well... even if its just for a short time till this wave passes.

We can do human based checking of the people trying to join, and just not approve obvious spam addresses.

Comment 23

[Jonathan Lin - Not watching NI/offline [:jlin] [[e-mail]]]

I've added the keywords to the filter - and I haven't gotten a spam message since subscribing to this over the weekend. hopefully this is the end of our spam troubles. 

fuzzyfox : I can enable approval to join if needed.

Comment 24

[Jonathan Lin - Not watching NI/offline [:jlin] [[e-mail]]]

Going to mark this as closed. We've been trapping spammers and moderation works so far.

Please reopen if you see anything that gets through.

Thanks all!

Comment 25

[[:dajbelshaw] Doug Belshaw]

Just to add my $0.02 that this is now super confusing. I wrote my message about five times thinking I was doing something wrong before turning to IRC. 

There's no error message (or 'your post is subject to moderation' message) via the Google Group. I fear many will just give up.

Can we give clear instructions to the community as to what they should be doing? This can be done above the message list - as the Open Badges Google Group does: https://groups.google.com/forum/#!forum/openbadges