While I was doing choir mailing list maintenance —deleting spam, that is; this is the small list on which I know everybody personally, not the big sprawling list with lots of members who tend to forget which of their accounts they’ve subscribed from— I noticed several messages purporting to come from the list itself. Now the list never sends anything by itself, it’s just a forwarding service for members’ messages, so any message from the list rather than a person must be spam. I thought I’d save myself some trouble, so I added the list address to the “Discards” filter.

Apparently, it’s not a “discard silently” filter. Every message it throws away, it notifies me of. And I get it in my mailbox with several layers of wrappers.

1. The spam handler notices that the message is in HTML and has some other points-scoring characteristics, and marks it as spam. It encapsulates it and sends it on to koor@valdyas.org, which is handled by Mailman.
2. Mailman knows that I’ve told it to discard anything from koor@valdyas.org and obligingly does so, sending koor-owner (who is me) an auto-discard notification with the message encapsulated.
3. The spam handler catches the auto-discard notification and notices that it’s mostly in HTML etcetera, and marks it as spam. It encapsulates it and sends it to koor-owner, that is, me.
4. The spam handler catches the message and notices… well, yes, that, and marks it as spam. It encapsulates it and sends it on.

I don’t know how to turn auto-discard notifications off yet, but I intend to either find out or find the filter and edit it, because this is more hassle than just telling Mailman to “discard all messages marked Defer” with a few more messages to discard. ETA: disabled auto-discard notification for both lists, and also uncaught bounce notification even though Mailman recommends against it, because I’ve never seen an uncaught bounce —even on the big list— that was anything other than a spammer’s attempt to get an answer.

I don’t really understand the last embedding: it seems to have gone through the spam handler twice. But it’s not the first time I’ve had the extra layer of encapsulation. Four is extreme, though.

Don’t send from hotmail if you can help it. I don’t know why my spam filter thought the header was forged (for all I know it was perfectly genuine) but I suspect (some of?) the hotmail gateways assign random IP addresses, without having an actual host with that address.

Also have an address without numbers if at all possible. The “likely spammer email” mentioned below was of the type “name2006”. This only got 0.4 points, but it was the straw that broke the camel’s back.

If you can’t help sending from hotmail (for instance, as in this case, because your message is the change-of-address from hotmail to something else…) try to make it send plain text. My antispam software is very suspicious of HTML. I’ve already deleted my own filters that throw away all HTML to get rid of some of the false positives, but SpamAssassin is diligent.

I don’t know the reason for the 40% to 60% Bayesian spam probability. Perhaps because there was very little text, only “Hi, my old address is X, my new address is Y, thanks”. But that didn’t give any points, so never mind.

Content analysis details: (5.4 points, 5.0 required)

pts rule name description
---- ---------------------- ------------
3.0 FORGED_HOTMAIL_RCVD Forged hotmail.com 'Received:' header found
0.4 MAILTO_TO_SPAM_ADDR URI: Includes a link to a likely spammer email
2.0 HTML_MESSAGE BODY: HTML included in message
0.0 BAYES_50 BODY: Bayesian spam probability is 40 to 60%
[score: 0.5070]

I did catch this one, but I can’t guarantee that I always will. I have SpamAssassin and the filters to avoid having to see every single message that comes in.

I don’t want to buy software, not even at reduced price. I don’t use Windows. I use Linux; there’s no need for me to buy software.

Not being in the possession of a penis, a dick or a cock, I’m not interested in ways to enlarge it. Nor am I interested in ways to make or keep it as hard as a rock. Quite apart from the question whether that would be painful. Oh, and SS. Peter and Paul aren’t interested either, thank you very much.

Also, I’m not a customer of the Bank of America, or of any other bank in America. And if my own bank has anything to tell me, they do it by snail-mail and spell my name right.

And I’m against gambling on principle. There’s no need to offer me bigger and bigger bonuses in your online casinos.

Last but not least, the real-world pharmacy I use serves all my needs and I don’t need an online one in Canada.

Having been without a computer for two weeks, I had to catch up on mailing-list management. Four mailing lists; two messages on one list from someone who forgot to subscribe with his other address before posting; all the rest, about two hundred held messages in all, were spam. Ninety-nine percent of the spam in my personal mailbox is spirited away by my various anti-spam tools, so I don’t see the really interesting subject lines, such as these:

We’ve students from all works of life. Apparently, they’re not very advanced students yet, or English isn’t what they’re studying.

Your academic qualification expired. Even if I had one, how can it expire? And even if it can, how would they know?

I love the pieces of spam I keep getting that tell me to upgrade my mail software. Sometimes they’re blunt to the point of rudeness (“Get a better mailer.”), but today I got, not for the first time, one that was actually polite:

Your Email Client does not support MIME encoding. Please upgrade to MIME-enabled Email Client (almost every modern Email Client is MIME-capable).

In fact, my Email Client does support MIME encoding (it’s KMail). It’s just that I’ve turned it off.

Five mail messages in one day, spread over three accounts, purporting to come from the Valdyas.org team and warning me that I was spreading spam and viruses, that I’d probably caught a trojan, and to use their free anti-virus tool or configure their free forwarding service.

That can’t be from us. For one thing, the Valdyas.org team is Boudewijn and me, and we never sent it. There is no such thing as “support@calcifer.valdyas.org”. If I had a virus (which seems unlikely on my Linux-only computer) the sysadmin, that is, my husband, would tell me, not send impersonal messages to each one of my accounts.

Read more ...

Found this in my inbox, with the warning “Note: This is an HTML message. For security reasons, only the raw HTML code is shown. If you trust the sender of this message then you can activate formatted HTML display for this message by clicking here.”

<FONT face=”Default Sans Serif, Verdana, Arial, Helvetica, sans-serif” size=2><div>Dag,</div><DIV>&nbsp;</DIV><DIV>Het volgende boek is voor u binnengekomen:</DIV><DIV>&nbsp;</DIV><DIV>- Voice problems of children</DIV><DIV>&nbsp;</DIV><DIV>U kunt het boek, binnen een week, afhalen aan de uitleenbalie van de Athenaeumbibliotheek.</DIV><DIV>&nbsp;</DIV><DIV>Met vriendelijke groet,</DIV><DIV>(name withheld) </DIV><DIV>Athenaeumbibliotheek</DIV></FONT>

Read more ...