[Mailman-Users] spam, spamcop and mailman moderation

[Patrick Bogen]

On 11/10/06, Gadi Evron <ge at linuxbox.org> wrote:
> This is not specific to mailman, but I had a lot of trouble with it. I am
> sure I am not the only one, so I figured I'll share.
>
> In recent months the problem of moderation, especially with large lists,
> has become even more significant.
>
> The amounts of spam which reach the uncomfortable moderation page is
> staggering.. but this email is not about the very inconvinient way of
> mailman moderation (even small changes such as letting me moderate
> non-members differently would have been amazing!).
>
> This email is about spamcop.
> Spamcop is blacklisting server swhich relay mailing list bounces
> containing spam. Mailing list bounces are some of the only acceptable
> bounces left on the Internet, but now that's no longer true.
>
> These bounces contain mostly spam and phishing, and bounced back to fake
> addresses belonging to real people. Therefore, even if Spamcop is
> especially evil in this case and annoy us to hell and back - they are
> right.
>
> Bouncing back a message which tells a user his original message is held
> for moderation is now a bad idea if we want to stay out of the black list
> of spamcop, not to mention to not turn our servers to willing spam
> conduits (as discussed a few months ago).
>
>         Gadi.
>

I'm not entirely sure what the point of this message was.

Bearing that in mind, you shouldn't be using moderation as a
first-line anti-spam defense. Your MTA should be tagging emails as
spam (e.g., using Spamassassin, or something better suited to your
particular configuration), greylisting, etc. With a properly
configured setup, the spam that actually reaches the moderation
interface should be minimal; most of it should be discarded (not
rejected) by mailman, at the very least.

This is fairly trivial to implement; just set up your MTA to pass mail
through spamassassin, and then add a check for the headers it adds to
mailman's list configuration, if nothing else.

If I'm understanding your concern, the key here is for you to
configure your mailman installation to discard known spam messages
rather than rejecting them. This is, in fact, one of the options on
the moderation screen (you may choose to Accept, Defer, Reject, or
Discard messages).

Additionally, as far as I know, you CAN moderate non-members
differently; although perhaps I don't have the same understanding of
that phrase as you do. You can set messages from non-members to be
automatically discarded or rejected, as you wish. See Privacy Options
> Sender Filters > generic_nonmember_action

-- 
- Patrick Bogen