[Mailman-Users] mail loops: list-request and vacation messages

[Barry A. Warsaw]

>>>>> "CVR" == Chuq Von Rospach <chuqui at plaidworks.com> writes:

    CVR> Could the new queueing system be set up with a timed-backoff
    CVR> delay?  you'd have to keep a fair amount of state, but the
    CVR> minimum time between postings for a given user is, say, 30
    CVR> minutes, and every time they post it doubles? (30, 1 hour, 2
    CVR> hours, 4 hours...). this sort of thing gets gnarly fast,
    CVR> though, since oyu have to start tracking when the first one
    CVR> came in and age it out of the system, or find some other way
    CVR> to keep from really honking off your legitimate, prolific
    CVR> posters.

I think the queuing system is too coarse for this kind of rate
limiting, and you're absolutely right that the tracking gets hairy
(who really understands the bounce metrics?  Other than John Viega
that is, and I bet even he doesn't remember!  ;)

    CVR> do you really want your own posts, or JC's or Dan's held
    CVR> simply beacuse they've sat down with a cup of coffee and
    CVR> answered ten pending questions all at once?

Nope, and I agree with everything you've said.  What I was thinking of
was flagging situations where you see 10 or 50 or 100 posts from the
same address in the span of a couple of minutes.  Something clearly
faster than a human can type, and which only a spammer or
out-of-control mailbot could be responsible for.  Tuning this thing
would be tricky; a slow trickle from a bad 'bot would get through this
filter, but might also be less annoying that it /does/ get through.

    CVR> If 2.1 doesn't do it, keeping track of message-id's and
    CVR> locking down repeated ones is a good idea.

I'm starting to go down this road.  I'm about to check in some changes
so that at least the message-id's of flow-thru messages will be
logged, and it's not a great leap from there to red-flagging duplicate
message-ids.
    
    CVR> So is building a suite of keywords "out of the office", "on
    CVR> vacation" that lock to admin approval.

Another area that I've been working on, with some preliminary results
hopefully checked in soon.  As I've mentioned before, the really tough
bit here is the web ui.

-Barry