The plague has returned

[Paul Smith]

---------- Forwarded message ----------
From: AntiSpam UOL 
Date: Nov 30, 2005 3:01 PM
Subject: RE: Re: Getting a text file rid of all superfluous blank lines
To: phhs80

ANTISPAM UOL » TIRA-TEIMA 	 	
    	 			 				
    				  					
    					Olá,

Você enviou uma mensagem para [e-mail]
    					Para que sua mensagem seja encaminhada, por favor, clique aqui

Esta confirmação é necessária porque
[e-mail] usa o Antispam UOL, um programa que elimina
mensagens enviadas por robôs, como pornografia, propaganda e
correntes.

As próximas mensagens enviadas para [e-mail]
não precisarão ser confirmadas*.
    					*Caso você receba outro pedido de confirmação, por favor, peça
para [e-mail] incluí-lo em sua lista de autorizados.

Atenção! Se você não conseguir clicar no atalho acima, acesse este endereço:
    					http://tira-teima.as.uol.com.br/challengeSender.html?data=DRiCCD%2FZjgOUQLMJ...
________________________________
    
    	 			 				
    				  					
    					Hi,

You´ve just sent a message to [e-mail]
    					In order to confirm the sent message, please click here

This confirmation is necessary because
[e-mail] uses Antispam UOL, a service that avoids
unwanted messages like advertising, pornography, viruses, and spams.

Other messages sent to [e-mail] won't need to
be confirmed*.
    					*If you receive another confirmation request, please ask
[e-mail] to include you in his/her authorized e-mail
list.

Warning! If the link doesn´t work, please copy the address below and
paste it on your browser:
    					http://tira-teima.as.uol.com.br/challengeSender.html?data=DRiCCD%2FZjgOUQLMJ...
    	 	 	
Use o AntiSpam UOL e proteja sua caixa postal

[James Kosin]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: RIPEMD160

Paul Smith wrote:
> ---------- Forwarded message ---------- From: AntiSpam UOL
>  Date: Nov 30, 2005 3:01 PM
> Subject: RE: Re: Getting a text file rid of all superfluous blank
> lines To: phhs80
>
> ANTISPAM UOL » TIRA-TEIMA Olá,
>
> Você enviou uma mensagem para [e-mail] Para que
> sua mensagem seja encaminhada, por favor, clique aqui
>
> Esta confirmação é necessária porque [e-mail] usa
> o Antispam UOL, um programa que elimina mensagens enviadas por
> robôs, como pornografia, propaganda e correntes.
>
> As próximas mensagens enviadas para [e-mail] não
> precisarão ser confirmadas*. *Caso você receba outro pedido de
> confirmação, por favor, peça para [e-mail]
> incluí-lo em sua lista de autorizados.
>
> Atenção! Se você não conseguir clicar no atalho acima, acesse este
> endereço:
> http://tira-teima.as.uol.com.br/challengeSender.html?data=DRiCCD%2FZjgOUQLMJ...
> ________________________________ Hi,
>
> You´ve just sent a message to [e-mail] In order to
> confirm the sent message, please click here
>
> This confirmation is necessary because [e-mail]
> uses Antispam UOL, a service that avoids unwanted messages like
> advertising, pornography, viruses, and spams.
>
> Other messages sent to [e-mail] won't need to be
> confirmed*. *If you receive another confirmation request, please
> ask [e-mail] to include you in his/her authorized
> e-mail list.
>
> Warning! If the link doesn´t work, please copy the address below
> and paste it on your browser:
> http://tira-teima.as.uol.com.br/challengeSender.html?data=DRiCCD%2FZjgOUQLMJ...
> Use o AntiSpam UOL e proteja sua caixa postal

Testing 1..2..3..4

Just checking to see if I get the plague too...

James
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.1 (MingW32)
> Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org
>
> iD8DBQFDjcY0kNLDmnu1kSkRA5d9AJwLIR8cFCWeUtL9EMf5zAQtQa46VACbBVD1
> fRk2dYnWz2QCtdsO2/+elqg=
> =3WpW
> -----END PGP SIGNATURE-----

[James Kosin]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: RIPEMD160

<< -- SNIP -->>

Ok, it is back again.  Can we figure out who is doing this and tell
them they need to fix it.
I do know many people are ignorant of the fact some ISP's are doing
this without their customer's OK... which they have a right to do.

My next step may be to email the ISP provider directly to let them
know that some of their users are subscribing to public lists with
100's if not 1000's of subscribers and it would be IMPOSSIBLE for them
to add everyone to their list without taking over their servers.

James
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.1 (MingW32)
> Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org
>
> iD8DBQFDjcj7kNLDmnu1kSkRA/vVAJ4pwh9laUonBbZFgARIbu5ssEkLkgCfZQmz
> JeqrM28nlbmACRZ0ecuOP44=
> =fHYK
> -----END PGP SIGNATURE-----

[Michael A. Peters]

On Wed, 2005-11-30 at 10:45 -0500, James Kosin wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: RIPEMD160
>
> << -- SNIP -->>
>
> Ok, it is back again.  Can we figure out who is doing this and tell
> them they need to fix it.
> I do know many people are ignorant of the fact some ISP's are doing
> this without their customer's OK...

Not very many.
I know a couple users who use those services specifically - though not
for list traffic.

I just add the addresses those messages come from to my blacklist - and
they bother me no more.

[Mike McCarty]

James Kosin wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: RIPEMD160
>
> << -- SNIP -->>
>
> Ok, it is back again.  Can we figure out who is doing this and tell
> them they need to fix it.

[snip]

Yes, we can. I have already suggested two means by which the list
managers can do this.

Mike

[John Summerfield]

James Kosin wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: RIPEMD160
>
> << -- SNIP -->>
>
> Ok, it is back again.  Can we figure out who is doing this and tell
> them they need to fix it.

It doesn't seem to be Peter Whalley this time.

If they're reading their bounces, they know:-)

[Tim]

On Wed, 2005-11-30 at 15:11 +0000, Paul Smith wrote:
> ---------- Forwarded message ----------
> From: AntiSpam UOL 
> Date: Nov 30, 2005 3:01 PM

If you'd included the full headers, it *may* have been of use to someone
here to determine the how and why this is happening, and possibly some
way to deal with it.

[James Kosin]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: RIPEMD160

Tim wrote:
> On Wed, 2005-11-30 at 15:11 +0000, Paul Smith wrote:
> > ---------- Forwarded message ----------
> > From: AntiSpam UOL 
> > Date: Nov 30, 2005 3:01 PM
>
> If you'd included the full headers, it *may* have been of use to someone
> here to determine the how and why this is happening, and possibly some
> way to deal with it.

No, I looked at the headers, there wasn't anything useful other than
it definitely came from uol.com.br domain.  Other than that, the
original sender is using a private special IP or hiding their
originating IP with a BOGUS one and there is no originating email
address other than [e-mail] ....

James
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.1 (MingW32)
> Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org
>
> iD8DBQFDjyxFkNLDmnu1kSkRA1q2AJ0c78FSkMIZY7MulD5z10pKn7trjACfRXLO
> 33U0HyVvvgNzndit8+z+o4E=
> =ntW+
> -----END PGP SIGNATURE-----

[Gilboa Davara]

On Wed, 2005-11-30 at 15:11 +0000, Paul Smith wrote:
> ---------- Forwarded message ----------
> From: AntiSpam UOL 
> Date: Nov 30, 2005 3:01 PM
> Subject: RE: Re: Getting a text file rid of all superfluous blank lines
> To: phhs80

It's time to block everything @uol.com.br.

Gilboa

[Michael A. Peters]

On Wed, 2005-11-30 at 18:14 +0200, Gilboa Davara wrote:
> On Wed, 2005-11-30 at 15:11 +0000, Paul Smith wrote:
> > ---------- Forwarded message ----------
> > From: AntiSpam UOL 
> > Date: Nov 30, 2005 3:01 PM
> > Subject: RE: Re: Getting a text file rid of all superfluous blank lines
> > To: phhs80
>
> It's time to block everything @uol.com.br.

no no - just blacklist

*[e-mail]

IE in user_prefs (for spamassassin):

blacklist_from *[e-mail]

That way - you can receive legitimate e-mail from [e-mail] - it's
only the automated responses from their spam challenge that gets
rejected.

[Vivek J. Patankar]

On 11/30/05, Michael A. Peters  wrote:
> no no - just blacklist
> *[e-mail]
> IE in user_prefs (for spamassassin):
> blacklist_from *[e-mail]
> That way - you can receive legitimate e-mail from [e-mail] - it's
> only the automated responses from their spam challenge that gets
> rejected.

Chances are that this might not work as expected. Receiving message
from [e-mail] will be fine, but xyz will not receive your
message or the list message, until you respond to the spam challenge.

vjp

--
Registered Linux User #374218

Minister of Offense, Preserver of the Way
of the Great Llama, Ambassador to India
for the Republic of Loungevania

[Michael A. Peters]

On Wed, 2005-11-30 at 23:08 +0530, V P wrote:
> On 11/30/05, Michael A. Peters  wrote:
> > no no - just blacklist
> > *[e-mail]
> > IE in user_prefs (for spamassassin):
> > blacklist_from *[e-mail]
> > That way - you can receive legitimate e-mail from [e-mail] - it's
> > only the automated responses from their spam challenge that gets
> > rejected.
>
> Chances are that this might not work as expected. Receiving message
> from [e-mail] will be fine, but xyz will not receive your
> message or the list message, until you respond to the spam challenge.

That's their problem - not mine.

[James Kosin]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: RIPEMD160

Michael A. Peters wrote:
> On Wed, 2005-11-30 at 23:08 +0530, V P wrote:
> > On 11/30/05, Michael A. Peters  wrote:
> > > no no - just blacklist
> > > *[e-mail]
> > > IE in user_prefs (for spamassassin):
> > > blacklist_from *[e-mail]
> > > That way - you can receive legitimate e-mail from [e-mail] - it's
> > > only the automated responses from their spam challenge that gets
> > > rejected.
> >
> > Chances are that this might not work as expected. Receiving message
> > from [e-mail] will be fine, but xyz will not receive your
> > message or the list message, until you respond to the spam challenge.
>
> That's their problem - not mine.

I'm going to refuse all mail from uol.com.br ....  There users are
abusing their service and doing a disservice to both them and the users.

James
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.1 (MingW32)
> Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org
>
> iD8DBQFDjhc2kNLDmnu1kSkRA60WAJ94+GqM0phWq4XOf/QMlpbuyjtAhgCfd2dc
> oezZwaZgmv83pK/swOP9pIk=
> =TVor
> -----END PGP SIGNATURE-----

[jdow]

From: "Michael A. Peters"
> On Wed, 2005-11-30 at 18:14 +0200, Gilboa Davara wrote:
> > On Wed, 2005-11-30 at 15:11 +0000, Paul Smith wrote:
> > > ---------- Forwarded message ----------
> > > From: AntiSpam UOL 
> > > Date: Nov 30, 2005 3:01 PM
> > > Subject: RE: Re: Getting a text file rid of all superfluous blank lines
> > > To: phhs80
> >
> > It's time to block everything @uol.com.br.
>
> no no - just blacklist
>
> *[e-mail]
>
> IE in user_prefs (for spamassassin):
>
> blacklist_from *[e-mail]
>
> That way - you can receive legitimate e-mail from [e-mail] - it's
> only the automated responses from their spam challenge that gets
> rejected.

If you are a private user running your own blocking the entire uol.com.br
is probably worthless. If you run an ISP then you must, perforce, forward
their denial of service attacks called Challenge/Response messages if you
are to be fully compliant with the RFCs. Some one of your customers may
need to contact some poor honest sucker at uol.com.br. So let them.

In my case, I don't have to. I have uol.com.br trapped to a ~/mail/uol_crap
mail file. I just checked it. (First time in quite awhile.) It contained
exactly one message, a spam. So I did not miss anything important at all.
The C/R's simply get tagged as spam here and I ignore them. I quit simply
ignoring them when I got over 6 C/R messages from UOL for each message to
this list - all from petsupermart or whatever it was. THAT earns an entry
in .procmailrc diverting the email to a "check it once in a great while"
repository.

{^_^}

[thomas cameron]

On Wed, 2005-11-30 at 15:11 +0000, Paul Smith wrote:
> ---------- Forwarded message ----------
> From: AntiSpam UOL 
> Date: Nov 30, 2005 3:01 PM
> Subject: RE: Re: Getting a text file rid of all superfluous blank lines
> To: phhs80

People - this has been hashed and rehashed on the list countless times.

Just make a rule to delete this crap.  Whether it's with Evolution,
Outlook/Outlook Express, procmail, Thunderbird or whatever, please just
set up a rule to delete this trash.

Everyone including the list admin knows this is a problem, but it is
impossible to determine who the offending user is for reasons previously
discussed.

Posting this kind of stuff to the list is just exacerbating the problem.

Thomas

[Mike McCarty]

Thomas Cameron wrote:
> On Wed, 2005-11-30 at 15:11 +0000, Paul Smith wrote:
> > ---------- Forwarded message ----------
> > From: AntiSpam UOL 
> > Date: Nov 30, 2005 3:01 PM
> > Subject: RE: Re: Getting a text file rid of all superfluous blank lines
> > To: phhs80
>
> People - this has been hashed and rehashed on the list countless times.
>
> Just make a rule to delete this crap.  Whether it's with Evolution,
> Outlook/Outlook Express, procmail, Thunderbird or whatever, please just
> set up a rule to delete this trash.
>
> Everyone including the list admin knows this is a problem, but it is
> impossible to determine who the offending user is for reasons previously
> discussed.

It is not impossible to find out which subscriber is responsible for
this.

Here is one of the headers:
> From: AntiSpam UOL 
> Date: Nov 30, 2005 3:01 PM
> Subject: RE: Re: Getting a text file rid of all superfluous blank lines
> To: phhs80

If the list manager sends each subscriber one (1) one message with a
subject matter dependent on the subscriber, like

Subject: This message sent to [e-mail]

then a few challenges would come back, each identifying a subscriber.

I, for one, am willing to put up with one (1) one message like that
in order to fix this.
> Posting this kind of stuff to the list is just exacerbating the problem.
>
> Thomas

Hopefully, this one message clarifies a misconception you have.

Mike

[John Summerfield]

Mike McCarty wrote:
> > From: AntiSpam UOL 
> > Date: Nov 30, 2005 3:01 PM

Mine was for a different user at uol. I set up a header check in postfix 
to bounce Fom:.*AntiSpam.*uol.com.br which I figure should do the job.