UOL spam issue

[Paul Howarth]

Tim wrote:
> On Mon, 2006-01-23 at 16:26 -0800, Kenneth Porter wrote:
> 
>>The page says that the challenge message preserves only the subject
>>line. How about injecting the subscriber ID into the subject line of
>>the monthly reminder emails? (I auto-file those to a separate
>>Administrivia folder.)  That's the one regular message coming from the
>>list itself (ie. not a  subscriber) so the bounce goes back to the
>>list admin where it can be analyzed to remove the miscreants.
>>
>>The mailman patch should be published so that other lists can benefit
>>from this. I googled the uol.com.br domain and see the problem
>>reported on a lot of other lists.
> 
> 
> Other mailing lists that I've been on avoid this sort of thing by having
> a double confirmation when you sign up:  You sign up, get sent back a
> confirmation e-mail, you reply back to confirm, and another message is
> sent to you confirming all of that.
> 
> The process requires interaction from you for the confirmations to work,
> and a bounce message from a stupid anti-spam system wouldn't confirm
> you, so you wouldn't get any list mail (and, therefore, couldn't send
> idiotic bounces back to the list one way or another).

This list already uses a confirmation step. Thus the twit must have 
received the confirmation message somehow and been able to follow the 
instructions in it. Since the culprit appears to be forwarding mail from 
some other domain to uol.com.br, it's possible that he or she may be 
receiving their mail at multiple addresses and managed to confirm from 
an address not behind the challenge-response spam system.

Paul.