Belling the cat

[Daniel Weaver <dan.weaver@znyx.com>]

Hello Pci-sig members,

I am the listmaster for the pci-sig mailing list and I have been fighting
spam on this list for the last few years.  I get the impression that
some of you have wrong idea of the magnitude of the problem.

Spammers scan the Internet looking for mailto addresses.  When they
find one they assume that the address is inviting mail both on and
off topic.  These addresses are compiled and sold to other spammers as
opt-in lists.  Meaning, they are sold as people who want spam.

The pci-sig mailing list address is posted a number of places on the net.
our mailto is easy to find and so our name goes on many lists.

Submitting an article to pci-sig is totally automated.  If the article
passes my spam filters then it is broadcast to the list.  My filters
include catch phrases commonly used by spammers and generally do a
good job.  When spam sneaks past my filters I go back and analyze
the message and try to find some other phrase or identifying mark
that I can use to filter out a recurrence of the same message.  This
is an ad hoc approach to fighting a battle that I will ultimately lose.
The more sophisticated spammers know they are being filtered and avoid
those phrases.  Some use very short messages which are very hard to
filter because they don't say much.

This month I have gotten over 500 spam messages sent to pci-sig and
pci-sig-request.  The trend is increasing.  It would be nice if there
were a check box that I could enable to stop spam but I can't.  Each
message must be stopped on it's own merit.  From: address and IP address
are useless in stopping spam.  The From: address is usually a made up
temporary name and the IP is typically a dial up account.

Saying you want the spam to stop and doing something about is much like
putting a bell on the cat.  It's a great idea but who is going to do it?

If you are serious about stopping spam I suggest you write your Congressman
and ask him/her to make it illegal.

At a more local level if you would like to volunteer to moderate this
list I would be glad to hand the problem over to you.

Other possible solutions would be to restrict submissions to names
already on the list.  Non-member submissions would be moderated.

Up to now our policy has been that quick posts and open submissions
have been important to this list.  The price for this freedom is
tolerance.  When the spam reaches the intolerable level some freedom
will be lost.

Sincerely,
Dan Weaver
pci-sig listmaster
-----------------------------
Dan Weaver, ZNYX Networks
dan.weaver@znyx.com