Nearly-spam mail causes unsubscription threat

[Thomas Schmitt]

Hi,

i just received a message from the list server that my mail provider
GMX has rejected a spam message which the Debian list allowed to pass
by a tiny not-spam margin.
From this quite unsuspicious situation the automat of Debian Listmaster
Team derived the threat to unsubscribe me.

I see the potential for a bounce troll, like we had a few years ago.
(Whenever one of us posted to the list, the troll faked a bounce from
our mail providers.)

Do other experience the same ?

(I would propose that list server shall please refrain from
unsubscription threads if the mail in question gets a near-spam score in
the Debian list system.)


---------------------------------------------------------------------
Details:

The list server quotes a reply from the GMX mail servers.

https://lists.debian.org/bounces/FVOZui8Ui2aBD+8obfofFQ
shows
"For explanation visit
https://postmaster.gmx.net/de/case?c=r0701&i=ip&v=82.195.75.100&r=1MYcpl-1siPQU12EF-00K6HO"
...
X-Spam-Status: No, score=3.9 required=4.0 ...,DATE_IN_FUTURE_06_12,...
...
Received: from mail-wr1-x443.google.com ...
by bendel.debian.org (Postfix) with ESMTPS id 2121E2049B
for <debian-***@lists.debian.org>;
Sun, 11 Aug 2024 10:21:41 +0000 (UTC)
Received: by mail-wr1-x443.google.com ...
for <debian-***@lists.debian.org>; Sun, 11 Aug 2024 03:21:41 -0700 (PDT)
...
Date: Sun, 11 Aug 2024 11:21:27 -0700

The web says that DATE_IN_FUTURE_06_12 from Spamassassin means that
the mail's Date is 6 to 12 hours in the future relative to the time it
was received.

My provider takes more offense:

https://postmaster.gmx.net/de/case?c=r0701&i=ip&v=82.195.75.100&r=1MYcpl-1siPQU12EF-00K6HO
"Die Zeitangabe im Date-Header weicht zu stark von der tatsächlichen
Zeit ab."
= "The time stamp of the Date header deviates too much from the
actual time."


Have a nice day :)

Thomas

[Eike Lantzsch ZP5CGE / KY4PZ]

Post by Thomas Schmitt
Hi,
i just received a message from the list server that my mail provider
GMX has rejected a spam message which the Debian list allowed to pass
by a tiny not-spam margin.
From this quite unsuspicious situation the automat of Debian
Listmaster Team derived the threat to unsubscribe me.
I see the potential for a bounce troll, like we had a few years ago.
(Whenever one of us posted to the list, the troll faked a bounce from
our mail providers.)
Do other experience the same ?

Yep, Thomas, same here, but it was just one bounce.

vy 73 de Eike

Post by Thomas Schmitt
(I would propose that list server shall please refrain from
unsubscription threads if the mail in question gets a near-spam score
in the Debian list system.)
---------------------------------------------------------------------
The list server quotes a reply from the GMX mail servers.
https://lists.debian.org/bounces/FVOZui8Ui2aBD+8obfofFQ
shows
"For explanation visit
https://postmaster.gmx.net/de/case?c=r0701&i=ip&v=82.195.75.100&r=1MY
cpl-1siPQU12EF-00K6HO" ...
X-Spam-Status: No, score=3.9 required=4.0
...,DATE_IN_FUTURE_06_12,... ...
Received: from mail-wr1-x443.google.com ...
by bendel.debian.org (Postfix) with ESMTPS id 2121E2049B
Sun, 11 Aug 2024 10:21:41 +0000 (UTC)
Received: by mail-wr1-x443.google.com ...
-0700 (PDT) ...
Date: Sun, 11 Aug 2024 11:21:27 -0700
The web says that DATE_IN_FUTURE_06_12 from Spamassassin means that
the mail's Date is 6 to 12 hours in the future relative to the time it
was received.
https://postmaster.gmx.net/de/case?c=r0701&i=ip&v=82.195.75.100&r=1MY
cpl-1siPQU12EF-00K6HO "Die Zeitangabe im Date-Header weicht zu stark
von der tatsächlichen Zeit ab."
= "The time stamp of the Date header deviates too much from the
actual time."
Have a nice day :)
Thomas

[Andy Smith]

Hi,

Post by Thomas Schmitt
i just received a message from the list server that my mail provider
GMX has rejected a spam message which the Debian list allowed to pass
by a tiny not-spam margin.
From this quite unsuspicious situation the automat of Debian Listmaster
Team derived the threat to unsubscribe me.

What you have interpreted as "a threat" was simply a procedural
warning that if your address continues to be undeliverable then you
will be automatically unsubscribed. Almost every single mailing list
in the world works this way, but some do not warn you that your
mail is bouncing.

The difference between "a threat" and "a procedural warning" is
semantic and subtle, but what you have experienced is commonplace
and not a cause for concern - we can assume it will be rare that GMX
and Debian will disagree over spam score and as soon as you receive
a successful delivery, the list software will reset its bounce
counter for you. Which will already have happened.

Post by Thomas Schmitt
(I would propose that list server shall please refrain from
unsubscription threads if the mail in question gets a near-spam score in
the Debian list system.)

I suppose it would be possible and you could submit a wishlist bug
to that effect, but to be honest I do not think it would receive
much attention. However I could easily be wrong, perhaps it would
grab the attention of a listmaster, so you'd have to submit it to
find out.

Personally what I do is silently discard spammy emails from known
list servers instead of rejecting them at SMTP time (which is
otherwise and usually desirable). Doing that does require running
your own mail server though, which almost no one does.

Thanks,
Andy

[Thomas Schmitt]

Hi,

Post by Andy Smith
What you have interpreted as "a threat" was simply a procedural
warning that if your address continues to be undeliverable then you
will be automatically unsubscribed.

It is a threat, because debian-user is the only mailing list where i
ever witnessed that a troll exploited the unscubscription habits to
throw out multiple users.
See the threads under
https://lists.debian.org/debian-user/2021/10/msg00248.html
https://lists.debian.org/debian-user/2021/10/msg00335.html
https://lists.debian.org/debian-user/2021/10/msg00337.html

I myself had to challenge the offender to get thrown out too.
https://lists.debian.org/debian-user/2021/10/msg00434.html
So it was a human or a very smart AI.

It lasted a few days until a remedy was developed. I had to re-subscribe
after each message i posted.

So i want to prepare for possible real problems by first asking how many
mail providers differ slightly from the list servers assessment and
reaction.
As next step i would ask the list masters to consider ignoring bounces
if the mail has a nearly-spam score on the Debian list. In such a case
it is likely that other servers see a barely-spam score and let bounce.

(The usual attempts of spam catching are futile at best and really
annoying when not only obvious spam comes through, but also legit mails
are rejected or even unsubscriptions are enforced.
It is easier for me to cope with all unfiltered spam than with
half-working attempts to protect me from falling victim to social
engineering.)

Post by Andy Smith
we can assume it will be rare that GMX and Debian will disagree over
spam score

I refrain from developing a proof-of-concept how to exploit the current
behavior. But i am quite sure it is possible to do so.

Post by Andy Smith
Personally what I do is silently discard spammy emails from known
list servers instead of rejecting them at SMTP time (which is
otherwise and usually desirable). Doing that does require running
your own mail server though, which almost no one does.

This is hardly feasible for me in these days.
DKIM, SPF, DMARC, ... not a problem for the spammers, but hard for the
innocent, old, and clueless.


Have a nice day :)

Thomas

[Andy Smith]

Post by Thomas Schmitt

Post by Andy Smith
What you have interpreted as "a threat" was simply a procedural
warning that if your address continues to be undeliverable then you
will be automatically unsubscribed.

It is a threat

You are assigning human motivations to an automated process.

Post by Thomas Schmitt
because debian-user is the only mailing list where i ever
witnessed that a troll exploited the unscubscription habits to
throw out multiple users.

I was here when those events occurred and that is not what happened.

It was just a bug in Debian's list software combined with a
badly-behaving subscriber system. Some subscriber was bouncing mails
back to the actual list address. The Debian list software was
(correctly) detecting them as bounce messages and (correctly)
avoiding to send these on to the list, but it was incorrectly
parsing out the subscriber it thought they were coming from. The
result was that it was accumulating bounce score for whoever sent
the mail that was being bounced, not the system bouncing the email.
I explained this in the thread you linked to:

https://lists.debian.org/debian-user/2021/10/msg00524.html

This was not some "troll campaign" to get people unsubscribed. There
was no malicious action intended, it was just interaction of broken
software. I don't know if it was fixed on the Debian side by
tightening up the bounce handling or just locating the broken
subscriber.

I want to also stress that those events of 2021 also bear very
little relation to what you have just experienced, as the former
case was about the mishandling of actual bounce emails sent by a
third party whereas this one now is the correct handling of a
directly rejected SMTP conversation by your mail provider.

Post by Thomas Schmitt
So i want to prepare for possible real problems by first asking how many
mail providers differ slightly from the list servers assessment and
reaction.

It is an overreaction because this case is not like the other case;
as soon as the next mail is delivered to you correctly the bounce
score resets, so it is quite hard to get unsubscribed for rejecting
spam.

Post by Thomas Schmitt

Post by Andy Smith
we can assume it will be rare that GMX and Debian will disagree over
spam score

I refrain from developing a proof-of-concept how to exploit the current
behavior. But i am quite sure it is possible to do so.

When you are starting from a misunderstanding of how it actually
works it seems unlikely but if I had to hazard a guess I'd say
probably not much has been fixed for the case from 2021 and it might
be possible to cause some small; degree of havoc by bouncing mails
directly back to debian-***@lists.debian.org as that misbehaving
system did in 2021.

This event you have experienced now though is run of the mill
ordinary and I don't think has much scope for maliciousness as you
have to be a party to the SMTP conversation to do it, i.e. you can
only really do it to yourself by rejecting the SMTP conversation.

To do it to others you'd have to craft an email that is sufficiently
spammy that it *causes* subscribers to reject it but not spammy
enough that Debian rejects it. You won't be able to guess which
subscribers will reject it. And their scores will be reset the
moment there is another successful mail.

So in grand scheme of things it doesn't seem like a very efficient
form of attack.

Thanks,
Andy

[Thomas Schmitt]

Hi,

Post by Andy Smith

Post by Thomas Schmitt
debian-user is the only mailing list where i ever
witnessed that a troll exploited the unscubscription habits to
throw out multiple users.

I was here when those events occurred and that is not what happened.
[...]
It was just a bug in Debian's list software combined with a
badly-behaving subscriber system. Some subscriber was bouncing mails
back to the actual list address.

How do you then explain that it lasted 2 days until i got affected
exactly after i challenged the (potential) troll by stating:
"although i seem not to be worth to be targeted by our bounce assassin,"

Between the first report by Greg Wooledge and this challenge i had posted
half a dozen mails. No problems were to see. Many others posted and did
not report unsubscriptions.

So why did this bug not affect everybody ?
My theory is that it was exploited in a targeted way.


Have a nice day :)

Thomas

[Andy Smith]

Hello,

Post by Thomas Schmitt
How do you then explain that it lasted 2 days until i got affected
"although i seem not to be worth to be targeted by our bounce assassin,"
Between the first report by Greg Wooledge and this challenge i had posted
half a dozen mails. No problems were to see. Many others posted and did
not report unsubscriptions.
So why did this bug not affect everybody ?

I think it was either random sampling or threshold based on how many
bounce replicas were seen.

Note that anyone anywhere can send mails to this list pretending to
be from anyone, so if it were malicious then there is actually no
reason why it would have stopped. I think the broken subscriber was
simply removed from the list based on complaints to listmaster.

Post by Thomas Schmitt
My theory is that it was exploited in a targeted way.

I can see I can't convince you that it wasn't a malicious attack on
you and a small group of others.

Nevertheless it's a fact that your most recent interaction with the
mailing list software was by a different route than the 2021
incident and caused by a different mechanism, namely GMX rejecting a
connection from the list software, and not anything to worry about.

Thanks,
Andy

[Karen Lewellen]

As a side note..I got the message, assuming you mean the one indicating it
was from new service with account statement or some such.
Naturally, I did not so much as open the item.
seems like a broad list attempt, assuming this is the post you are
referencing of course.
Kare

Post by Andy Smith
Hello,

Post by Thomas Schmitt
How do you then explain that it lasted 2 days until i got affected
"although i seem not to be worth to be targeted by our bounce assassin,"
Between the first report by Greg Wooledge and this challenge i had posted
half a dozen mails. No problems were to see. Many others posted and did
not report unsubscriptions.
So why did this bug not affect everybody ?

I think it was either random sampling or threshold based on how many
bounce replicas were seen.
Note that anyone anywhere can send mails to this list pretending to
be from anyone, so if it were malicious then there is actually no
reason why it would have stopped. I think the broken subscriber was
simply removed from the list based on complaints to listmaster.

Post by Thomas Schmitt
My theory is that it was exploited in a targeted way.

I can see I can't convince you that it wasn't a malicious attack on
you and a small group of others.
Nevertheless it's a fact that your most recent interaction with the
mailing list software was by a different route than the 2021
incident and caused by a different mechanism, namely GMX rejecting a
connection from the list software, and not anything to worry about.
Thanks,
Andy
--
https://bitfolk.com/ -- No-nonsense VPS hosting

[Thomas Schmitt]

Hi,

Post by Karen Lewellen
As a side note..I got the message, assuming you mean the one indicating it
was from new service with account statement or some such.

Yes. The message which was bounced by GMX is in the list archive as

https://lists.debian.org/debian-user/2024/08/msg00366.html

Obvious spam.

Post by Karen Lewellen
Naturally, I did not so much as open the item.

If i would trust in my web browser to protect me then i would look at
what lurks behind the link "TERMS OF SERVICE" at docs.google.com.
But i am not _that_ curious.


Have a nice day :)

Thomas

[d***@howorth.org.uk]

Post by Andy Smith
Personally what I do is silently discard spammy emails from known
list servers instead of rejecting them at SMTP time (which is
otherwise and usually desirable). Doing that does require running
your own mail server though, which almost no one does.

You don't need to run a mailserver to do something similar. I simply
told my ISP (Zen) not to filter spam out of my mail. They send it
unfiltered* to me and my MUA filters it out using bogofilter. Works
very well for me; I suppose you do have to have a 'sensible' ISP.

* they do actually filter some extreme stuff out that I believe is
required by law or somesuch. I never see it, so I don't know exactly
what it is.

[Thomas Schmitt]

Hi,

Post by d***@howorth.org.uk
You don't need to run a mailserver to do something similar. I simply
told my ISP (Zen) not to filter spam out of my mail.

Normally GMX puts spam into a separate box where i can unjail it if
i deem it not guilty. (Happens often enough.)

Post by d***@howorth.org.uk
* they do actually filter some extreme stuff out that I believe is
required by law or somesuch. I never see it, so I don't know exactly
what it is.

The mail in question was not put into any mail box. I only became
aware when i was informed by the Debian list automat that bad things
would happen if ...

Post by d***@howorth.org.uk
I suppose you do have to have a 'sensible' ISP.

Well, the advantage of GMX is that it is big and well integrated in the
mail server community.
The disadvantage is that it is big and thus the preferences of a single
user don't matter.


Have a nice day :)

Thomas

[e***@gmx.us]

Post by Thomas Schmitt
Normally GMX puts spam into a separate box where i can unjail it if
i deem it not guilty. (Happens often enough.)

Post by d***@howorth.org.uk
* they do actually filter some extreme stuff out that I believe is
required by law or somesuch. I never see it, so I don't know exactly
what it is.

The mail in question was not put into any mail box. I only became
aware when i was informed by the Debian list automat that bad things
would happen if ...

Yes, and not only can you not disable their anti-spam measures, you have to
log into webmail each time to undo it. On the odd occasion where they catch
something I'd rather not see, I leave it there. Frankly, I'd rather it be
local rather than a web browser + login away. I mean, I didn't install
spamassassin for practice using apt.

Post by Thomas Schmitt
Well, the advantage of GMX is that it is big and well integrated in the
mail server community.
The disadvantage is that it is big and thus the preferences of a single
user don't matter.

What you said.

--
A little rudeness and disrespect
can elevate a meaningless interaction into a battle of wills
and add drama to an otherwise dull day.
-- Calvin discovers Usenet

[Hanno 'Rince' Wagner]

Hi Thomas,

Post by Thomas Schmitt
From this quite unsuspicious situation the automat of Debian Listmaster
Team derived the threat to unsubscribe me.

There is no threat. the mail is an information that - if there are
more bounces (and there is a number and a total number in x days _and_
a number in percent) that if the threshold is surpassed you will be
unsubscribed.

There is no threat. Only an information.

Post by Thomas Schmitt
I see the potential for a bounce troll, like we had a few years ago.
(Whenever one of us posted to the list, the troll faked a bounce from
our mail providers.)

that would need a lot of bounces which have to be unique.

best regards, Hanno Wagner
--
| Hanno Wagner | Member of the HTML Writers Guild | ***@IRC |
| Eine gewerbliche Nutzung meiner Email-Adressen ist nicht gestattet! |
| 74 a3 53 cc 0b 19 - we did it! | Generation @ |
#... und dann bauen wir Heiko einen Laser an das rechte Ohr, damit er auch
#sagen kann: "I am admin at fub. sendmail is useless. Maps are obsolete.
#Prepare to be assimilated." -- smail 3.1 Commercial

[Alex King]

I offer a reflection on keeping the list on track.

Post by Hanno 'Rince' Wagner
Hi Thomas,

Post by Thomas Schmitt
From this quite unsuspicious situation the automat of Debian Listmaster
Team derived the threat to unsubscribe me.

There is no threat. the mail is an information that - if there are
more bounces (and there is a number and a total number in x days _and_
a number in percent) that if the threshold is surpassed you will be
unsubscribed.
There is no threat. Only an information.

As a point of information, there was a threat.  The definition of threat
from https://dictionary.cambridge.org/dictionary/english/threat includes
"a suggestion that something unpleasant or violent will happen."  If
Thomas finds being automatically unsubscribed from the list as
unpleasant, then a threat was made.  Another definition of threat from
the same page: "the possibility that something unwanted will happen."
Again, if Thomas doesn't want to be unsubscribed, then a threat has been
made.

A threat (and a promise) are suggestions or notifications or information
that a future action will be performed.  A notification of a future
action is a threat if it is perceived as negative, and it is a promise
if it is perceived as positive.

Concepts (such as threat or promise) which rely on human subjectivity
(e.g. Thomas finds this email threatening, Hanno does not) are most
usefully evaluated in the frame of a particular person.  We sow the
seeds for flame wars when we discuss subjective concepts as if they are
facts.  When we assume or imply a universal "normal" frame of reference,
not acknowledging that each person has a unique way of viewing things.

To keep the signal-to-noise ratio on the list high, we could all benefit
from using a "robust code" principle: accept a wide variety of (e.g.
subjective) input (without taking offense, or objecting to another
person's subjective assessment) and output clear (fact/observation
based, not subjective) outputs.

So Thomas could have phrased the initial contribution in non subjective
terms:

Triggered by this bounce situation the Debian List System told me it would unsubscribe me in future on certain conditions.

Or Thomas could acknowledge his frame of reference:

From this (to me) quite unsuspicious situation the automat of Debian Listmaster
Team notified to unsubscribe me, which I perceive as a threat.

Regardless of how Thomas has phrased it (subjective or observational,)
Hanno can start the email acknowledging Thomas's point of view:

I understand you perceive a threat, since you are being notified of possible unsubscription which you'd prefer didn't happen. The mail is an information that - ...


As Andy did (acknowledge Thomas's view):

What you have interpreted as "a threat" was

although Andy then goes on to say Thomas was incorrect,  and tries to
differentiate

between "a threat" and "a procedural warning"

when in fact the warning is well described as both a threat and a
procedural warning.  Thomas's subjective point of view is of course not
wrong, it is simply a point of view and as valid as anyone else's.

Andy also offers:

It is an overreaction because this case is not like the other case...

Instead, Andy could acknowledge the subjective concept of overreaction:

I see that as an overreaction because this case is not like the other case...

Or leave out the subjective and (in my opinion) unnecessary overreaction
concept without any (in my view) loss of meaning:

This case is not like the other case...

It all depends whether we're trying to discuss a technical subject (how
the list handles bounces) and discuss requests for what might make
things better for us (e.g. not count emails that score just below the
spam threshold in the unsubscription algorithm), or whether we're
(perhaps unconsciously) trying to play a game of who's right and wrong....

Cheers,
Alex

[piorunz]

Hi Thomas,

Same here, I am on GMX mailbox too, received a warning recently that I
will be unsubscribed forcibly because my e-mail provider GMX rejected
spam Debian list is sending towards me. LOL. Maybe Debian e-mail server
could improve filtering so I don't receive any spam in the first place?
It's so easy to spot this spam, IDK why server is not trained to
recognize typical spam words in these e-mails.

Post by Thomas Schmitt
Hi,
i just received a message from the list server that my mail provider
GMX has rejected a spam message which the Debian list allowed to pass
by a tiny not-spam margin.
From this quite unsuspicious situation the automat of Debian Listmaster
Team derived the threat to unsubscribe me.
I see the potential for a bounce troll, like we had a few years ago.
(Whenever one of us posted to the list, the troll faked a bounce from
our mail providers.)
Do other experience the same ?
(I would propose that list server shall please refrain from
unsubscription threads if the mail in question gets a near-spam score in
the Debian list system.)
---------------------------------------------------------------------
The list server quotes a reply from the GMX mail servers.
https://lists.debian.org/bounces/FVOZui8Ui2aBD+8obfofFQ
shows
"For explanation visit
https://postmaster.gmx.net/de/case?c=r0701&i=ip&v=82.195.75.100&r=1MYcpl-1siPQU12EF-00K6HO"
...
X-Spam-Status: No, score=3.9 required=4.0 ...,DATE_IN_FUTURE_06_12,...
...
Received: from mail-wr1-x443.google.com ...
by bendel.debian.org (Postfix) with ESMTPS id 2121E2049B
Sun, 11 Aug 2024 10:21:41 +0000 (UTC)
Received: by mail-wr1-x443.google.com ...
...
Date: Sun, 11 Aug 2024 11:21:27 -0700
The web says that DATE_IN_FUTURE_06_12 from Spamassassin means that
the mail's Date is 6 to 12 hours in the future relative to the time it
was received.
https://postmaster.gmx.net/de/case?c=r0701&i=ip&v=82.195.75.100&r=1MYcpl-1siPQU12EF-00K6HO
"Die Zeitangabe im Date-Header weicht zu stark von der tatsächlichen
Zeit ab."
= "The time stamp of the Date header deviates too much from the
actual time."
Have a nice day :)
Thomas

--
With kindest regards, Piotr.

⢀⣴⠾⠻⢶⣦⠀
⣾⠁⢠⠒⠀⣿⡁ Debian - The universal operating system
⢿⡄⠘⠷⠚⠋⠀ https://www.debian.org/
⠈⠳⣄⠀⠀⠀⠀

[t***@tuxteam.de]

Post by Hanno 'Rince' Wagner
Hi Thomas,
Same here, I am on GMX mailbox too, received a warning recently that I
will be unsubscribed forcibly because my e-mail provider GMX rejected
spam Debian list is sending towards me. LOL. Maybe Debian e-mail server
could improve filtering so I don't receive any spam in the first place?
It's so easy to spot this spam, IDK why server is not trained to
recognize typical spam words in these e-mails.

Spam is... difficult [1]. And you can't expect the Debian mailing list
server to agree with each and every one and their dog's mail provider's
servers on what is spam. There will always bee disagreements.

Moreover: mail providers are growing more and more hysterical about
rejecting mails.

I think it's OK to discuss possible improvements with the listmasters,
but one would have to start with realistic premises. And "the list servers
should have the same spam criteria as GMX" is not realistic.

Cheers

[1] especially its last 0.5%. More so when you define "spam" to include
the recipient's parameters (which you have to start doing to catch
the last 5%). More so when you let the definition to move over time
(which you also have to do for those last 5%)