From: Robert Hettinga <rah@shipwright.com>
Date: Fri, 27 Dec 1996 06:26:39 -0800 (PST)
To: cypherpunks@toad.com
Subject: Re: Forged addresses
Message-ID: <v0300784eaee975274827@[139.167.130.248]>
MIME-Version: 1.0
Content-Type: text/plain



--- begin forwarded text


Date: Fri, 27 Dec 1996 00:24:51 -0800
From: Chuq Von Rospach <chuqui@plaidworks.com>
Subject: Re: Forged addresses
To: listmom-talk@skyweyr.com
Mime-Version: 1.0
Precedence: Bulk
Reply-To: listmom-talk@skyweyr.com

At 12:53 PM -0800 12/26/96, Kass Johns wrote:

>I only joined this listserv a few days ago, and suddenly, I got (on
>Christmas Eve), about 25 (assumed) bogus subscribers. I had never had any
>bogus ones before.

well, *that* sounds familiar. Same time, same size... do any of these
sites sound familiar? isp-inter.net? softcell.net? superhot.com?
mid-night.com? strutyourstuff.com?

I'll bet they do... A lot of what got spammed onto my sites were
various forms of internet commerce (superhot.com is net-porn-chat or
some such, at least two of the others are unsolicited email houses.
strutyourstuff is a pretty noxious one, from what little I saw of what
they're doing. A pox on all their houses, so to speak, but don't do it
with my server, dammit...)

But that wasn't it. Someone got mad at the cypherpunks, and spammed
their list. And for some godawful reason, the webcrawler admin lists.
Someone -- possibly two someones -- were making some interesting
political statements....

This christmas eve spam was pretty well planned. It seems to have been
exceptionally widespread, aimed at some segments of the internet
certain high-and-righteous types find unacceptable, and issued at a
time when it was pretty much guaranteed nobody was watching the servers
too closely. And it seems pretty widespread in the number of servers
hooked into the spam.

>My thought is, is there someone who
>is lurking among this group who just lies in wait for new folks to
>subscribe and add their list to their sick little spamming game?

Well, if I were trying to build lists of places to send spam mail from,
this is one place I'd watch. That's why, if you don't mind, I won't go
into details about my anti-spamming traps in public here. Except in
generalities. I've learned to just assume that they're watching. Of
course, with any luck they'll figure out I have full logging of the
information needed to catch spammers, too, and not take chances with
me, because I don't take prisoners...

Oh, heck. Gotta run. As I type, the cyberpromo folks are trying to log
onto my lists again and setting off my alarms.

Oh, before I go, a note on those folks. Make sure that under no
circumstances you allow any addresses from:

cyberpromo.com
cybercastle.com

onto your lists. These are folks that will happily sign onto your
lists, suck the addresses of people posting to your lists, and add them
to their cyberspam mass mailings. These are also the folks AOL's been
fighting in court. No ethics, and don't even bother trying to talk to
them. Just keep them out. They may be using a third domain these days,
but I've caught them sneaking onto lists from various accounts in both
domains. Just lock the entire puppy out. That way, they can't spam your
lists, and can't suck your lists out and spam them away from your
server. You *do* have subscriber lists kept private on your server,
right? Nobody can get them, right?






--
           Chuq Von Rospach (chuq@solutions.apple.com) Software Gnome
       Apple Server Marketing Webmaster <http://www.solutions.apple.com/>

 Plaidworks Consulting (chuqui@plaidworks.com) <http://www.plaidworks.com/>
   (<http://www.plaidworks.com/hockey/> +-+ The home for Hockey on the net)

I got no name or number/ I just hand out the lumber.
But if I get a chance to play/ I'm going to show 'em.
		-- Stick Boy (The Hanson Brothers, SUDDEN DEATH)

--- end forwarded text



-----------------
Robert Hettinga (rah@shipwright.com), Philodox,
e$, 44 Farquhar Street, Boston, MA 02131 USA
"The cost of anything is the foregone alternative" -- Walter Johnson
The e$ Home Page: http://www.vmeng.com/rah/