On the subject of Junk Mail to the list

[Alan Deikman <Alan.Deikman@znyx.com>]

I got a fair number of off-line responses regarding 
junk mail to the pci-sig list.  It amazed me that most
of them came within 30 minutes of my last posting.

Well, the majority consensus is that:

  1. Restricting postings to the distribution list would
     be a pain, and

  2. Although junk mail is annoying, it is not that big
     of an issue on pci-sig to warrant this change.

The anonymous summaries are as follows:

#1 wrote:

>I am on several lists which have taken that approach to limiting
>posting. It is something of a pain but worth the trouble IMHO as
>it does reduce the noise level.

#2 wrote:

>As long as a poster gets an error message indicating why the reject 
>happened, I don't see the issue. 

Unfortunately, the error message will simply give spammers an
additional clue as to how to "improve" their posting such that
it *does* get through.

#3 wrote:

>Do it.  Most other lists I'm on have already done this.  Anything 
>less is an invitation to relay spam.  

#4 wrote:

>I don't like the junk mail either, but I don't think it has been that bad a
>problem on this list.  Just one of those things you deal with these days,
like
>junk snail mail and junk telephone calls.  The solution is to throw it out,
>hang up, press the delete button, and don't let it get to you.

#5 wrote:

> I would guess that a large percentage of the junk mail postings come from
>domain names that have no subscribers on the PCI-SIG discussion group.  If
>you limit postings to subscriber domain names rather than to individual
>email addresses, you might limit a good amount of the spam. You also would
>not exclude those subscribers who go through a reflector.

This is a good suggestion, and we will look into it.  

#6 wrote:

>ok with me!

Succinct.

#7 wrote:

>I don't know about anyone else, but I haven't received more than one or
two spams
>via this list over the past 4 months.  I personally don't think this level of
>spam is worthy of much effort.....

#8 wrote:

>Considered the openness of the list I think there is very 
>little spam. We all have to keep the e-mail address from 
>the lists themselves from WWW and other places so the 
>addresses cannot be grabbed.
>
>I want to point out that I guess a lot more people are not 
>posting from their subscription address...
>
>In the Netherlands most Access Providers demand posters to
>be connected to their net since about half a year. So lots
>of people send with the mailserver from the accessprovider
>of the moment and read it from their own provider.

That's interesting.

#9 wrote:

>What about if those wise guy just simply "subscribe" and then send the junk
>mail???
>
>Those wyse guy will find a way to send thic junk, of course....

True, but most automatic mail programs are not that
sophistocated.  Yet.  My observation is that most spam 
seems to use just a static data base -- this is seen as
much more "cost efficient" than any system that has some
manual steps per address.

#10 wrote:

>  I would suggest that only the pci_sig question /answers be allowed to be
>circulated.This would involve some discipline and co-operation of all the
>subscribed
>people .We could have a protocol like the first few letters of the mail
>message
>must be some well known sequence of letters in the subject field.
>The filter should only recognize these messages as a valid pci_sig entry.
>The rest should be ignored.
> Now there is a remote chance that a spam also has the same well known
>sequence of letters.
> To be even safe we can change the sequence frequently

This is a high-maintenence suggestion, but has possibilites.  If
the subject line did not contain "PCI-SIG", for example, it would
be bit-bucketed.  I note some USENET news groups use a convention
like this.

#11 wrote:

>If the "only subscribers can submit" restriction is too onerous to some (it
>isn't to me -- the restriction would be fine here), then a halfway solution
>would be to require a specific prefix in the subject matter, such as:
>[PCI]    or    Re: [PCI].

same as above...


Let me get through my current crunch and we will see what we can
do.  For now, please be patient and thank you everyone for
participating.

Regards,
-----------------------
  Alan.Deikman@znyx.com