Subject: CCL spam defences and what to do if your mail is rejected

From: Jan Labanowski <[email-masked]>
Date: Fri, 14 Jun 2002 09:16:11 -0400 (EDT)

Dear CCL subscribers...

First, I wanted to thank those of you who recently helped my by sending
the donations and orders. I am processing them busily. For those who still
wonder if this is time to help, please see if you can be lured into it
by reading my sponsorship pages available as links from our home page:

  http://www.ccl.net

I wanted to tell you about our measures to fight spam. CCL is famous and
usually receives a few hundred stupid, often offending, spam messages a day.
We have many filters to catch them. Initially humans were scanning all
suspected mail. (Sometimes humans were making mistakes, and clicked
on the wrong button, but it was rare).

The spam and virus situation is going out of control. I do not want to go
into details, but only want to warn you that you may be even getting spam
mail which presents itself as coming from CCL or from me personally (some
people already complained). When you analyze header lines of your message
(Received: records) you will discover that the From: line is forged, and
that ccl.net or ccl.net domain was never in the path of the message.

Please note that in our setup the fact that the author is a subscriber to CCL
is not a factor in distributing the message. While on first instinct you
would say that this is the best way to ensure that only subscribers can post,
believe me, it is not. You often post from different addresses then you are
subscribed. Also, scores of suspected spammers are subscribing every day
hoping that subscription will grant them rights to post the message.
I have no resources and rights to run background checks on people. Moreover,
the From: line of the message can be trivially forged.

Manually scanning all CCL incoming mail can become a full time job.
While we have a great Web based interface to do this, it is still a lot of
work. So we decided to reject some messages without human reading them.
We keep our own database of spammers (I know about commercial blacklists, 
and we may move in this direction, but this is not an easy decision for many
reasons). We decided to block those C class subnets from which spam had come
to CCL or to my private mailbox from posting to CCL. We are using the
/etc/mail/access database of sendmail and place there the appropriate REJECT
records.

This has an unwanted consequence... Some innocent civilians are being hurt.
If you belong to ISP which allows spammers to send junk mail, you may end up
not being able to post messages to CCL, since they will be rejected.
Note that many ISPs give people a chance to "try for free". This is anonymous
access which which spammers often use to send garbage mail. And you may
belong to the ISP which does this (many big ones do, like AOL, for example).
If your mail gets rejected from CCL, first send the bounce to my address at
[email-masked] (which I still do not block). Also, try to send a message from
some other address. We are overzealous and "one strike you are out", but
we will gladly put you back. If we do not know about the problem, we cannot
resolve it. I am sorry if you are having problems, but it seems that
we will soon lock ourselves in cages, and criminals will be running free.

Jan

Jan K. Labanowski            |    phone: 614-292-9279,  FAX: 614-292-7168
Ohio Supercomputer Center    |    Internet: [email-masked] 
1224 Kinnear Rd,             |    http://www.ccl.net/chemistry.html
Columbus, OH 43212-1163      |    http://www.ccl.net/