[Beowulf] Apologies for the spam/virus yesterday

[Robert G. Brown]

On Wed, 8 Feb 2006, Donald Becker wrote:

> The bottom line is that we are considering a message board format to
> replace the mailing list.  It would have required logins to
> post, and retroactive moderation to delete advertising and trolls.
> Any opinions?

Dear Don,

Sigh.  A pain in the ass, obviously, for everybody involved:-(

I'm more than a bit concerned (as, I'm sure, are you) that moving to a
message board with authentication and everything would "kill" the
dynamism of the list that is one of its greatest assets.  I personally
participate in the list as much as I do (which yes, may be "too much":-)
BECAUSE it is inline with my regular email processing every day.  I
spend hours a day processing my mail as it comes in, and if a message or
thread on the list catches my eye I join in.  I suspect that everybody
else on the list does much the same -- email is asynchronous so nobody
HAS to participate if they are busy, but it is very easy to graze
through the list threads and jump in where there is time or motivation
to do so.

Would I take the additional time every day to deliberately visit a web
or other interface to the list?  To login and authenticate every time I
wanted to post?  I don't know.  It certainly would be another barrier, a
fairly significant one, to participation, as instead of it taking two
minutes to dash off a reply (typing like the wind:-) it would take five,
with most of it spent "messing with things" instead of just hitting R.
I also think that it would form a significant barrier to joining the
list, although I could be wrong -- there are certainly linux-central
sites that do maintain decent user participation, but I tend to think of
this too as being a bit of a hassle.

On the other hand, I do appreciate the problem.  SpamAssassin traps
between 60 and 80 MB of mail per week to me PERSONALLY, all eliminated
without my ever looking at it.  Every day the ratio of spam/virus crap
noise to desired signal IN WHAT REMAINS AND MAKES IT THROUGH is
something like 9:1 or maybe even worse.  I'm thinking of writing some
custom traps for the worst classes of stealth spam that is making it
through SA's filters, and I'm pretty certain that I'm losing a fraction
of 1% of mail sent to me as false positives (I do not, cannot, check the
rejects -- I'd go insane and never get ANY work done).  Spam and viruses
are horribly expensive, but Congress is too busy passing stuff like the
DCMA to take notice. (Grrrr)

There are two things to consider, though, before you make any large and
irreversible change in the way the list operates.  One is that I would
EXPECT that all sane humans ON this list already have SA or some other
virus/spam filter in place on the receiving end as well.  The other is
that I would EXPECT that the overwhelming majority of list participants
are running linux, freebsd, or a variant of Unix and hence are more or
less invulnerable to 99.9% of the free range viruses in the email
universe.

Between the two of them, I personally didn't notice that the virus DID
slip through your filters.  It either was filtered out before I ever saw
it (I don't whitelist nothin' outside of duke.edu, not even
beowulf.org:-) or I deleted it in passing without even thinking twice
about it, along with the OTHER fifty virus hits I get every day that
make it through the filters.  Since there has been little to no on-list
outrage about getting the virus, I can only assume that this is the most
common experience of list members.  Nobody noticed, nobody who DID
notice cared, nearly everybody protected and not terribly vulnerable to
what makes it past their protection.

I'm personally pretty satisfied with the way the list has been run and
think that you do a great job.  I also think that any people on list who
ARE stupid enough to a) run Windows with something like Outlook as their
primary email interface and b) don't run some sort of firewall, spam
filter, and above all expensively up to date antivirus program on their
system to protect it "deserve" what happens to them (not really of
course) and can hardly hold you or this list responsible for the rare
virus or spam that slips through.

Ultimately, I think that the only solution to the spam/virus problem is
one of purely practical social/legal engineering.  Something like
electroshock therapy applied to delicate body parts of first-time
offenders while they are forced to delete an infinite stream of spam and
listen to Beethoven would be nice.  Embedding the feet of repeat
offenders in concrete and pitching them into a nearby bay would be even
better -- I'll bet you could raise cheering crowds to watch and help
with the pitching.

Sigh.  However much we can dream -- ultimately, y'all are in a corporate
gig and have to pay humans or time to run the list.  I certainly don't
think you need to spend MORE time to keep the list clean, and as noted
above think you could probably get away with less and let the list
recipients deal with a little more of what slips through.  I personally
would rather see this than a message board, but if you feel that the
latter is all that you can manage I understand.

    rgb

-- 
Robert G. Brown	                       http://www.phy.duke.edu/~rgb/
Duke University Dept. of Physics, Box 90305
Durham, N.C. 27708-0305
Phone: 1-919-660-2567  Fax: 919-660-2525     email:rgb at phy.duke.edu