Cohousing-L Mailing List: Cohousing listserv spam incident explained

[Fred H Olson (fholson]

This is an explanation of the Dec 9, 2003 problem with the Cohousing-L
listserv.

Cohousing-L experienced a major problem Tuesday Dec 9, 2003 around 
noon USA Central Time (GMT-0600) when about 80 mostly spam messages were
distributed individually in about 84 minutes to all subscribers (about 879
addresses).  Digest and no mail subscribers received individual messages.

I very much regret the inconvenience this caused.  It was not the result
of a malicious attack.  I think it was the result of at least two problems
which seem unlikely to occur together again. (See some more detailed  
explanation at end if you are interested.) 

I think we did fairly well by stopping the problem in about 84 minutes. 
Of course, it would have been nice to catch it in 15 minutes but at least
it was not hours. 

Thank you Rick Birmingham for quick work (Rick was on vacation but at work
anyway).  


Where now?

The list will not start distributing messages the usual way till I am
satisfied it is working properly. I am not sure when this will be.
I want to get no mail mode and digest mode subscriber status restored.
Til that is achieved the list will be in full moderated mode and I will 
distribute at most one message per day.

I'm thinking of experimenting with putting normal messages directly
in the archives and distribute an "index" to new messages in the daily
email.  Would I contrive to get people to try reading messages in the
archives?  Maybe.

You can send messages to cohousing-L as usual tho I can't promise how /
when they will be handled.  This may get me more into an editorial
function than I care to do.  We'll see. 

A few people wrote that they did not know how they got on the list and
wanted off. I suspect some of these people had been subscribed in no mail
mode for a long time and did not remember being subscribed.  The spam
may have made the "Evil Clone" of cohousing-L look so different that
some people did not recognise the normally spam free cohousing-L.

Normally one can unsubscribe (and many other things)  from the Cohousing-L
Info Page: http://www.cohousing.org/cohousing-L

I may be reloading the subscriber list so changes made at this time may
not "stick".

Fred, cohousing-L list manager




Some detail about what happened -- the Evil Clone Rampage.
 
It was not a result of extraordinary SPAM attacks on the list or the
software the list runs on.  Instead accumulated (not yet deleted) "normal"
spam got distributed unintentionally.

Two problems combined to cause it.  Many mostly spam "rejects"  ( messages
sent to the list but not distributed because they were not sent by
subscribers)  had accumulated in the list admin "pending requests" area. 
They had accumulated because Fred as list manager could not get to them to
deal with them.  We think the access problem was due to a data error in
the cohousing-L subscriber data or list setup. 

To resolve the problem the technical volunteer rebuilt the cohousing-L
list using an old subscriber list and default setup.  The list got setup
so anyone could post (not just subscribers).  Apparently the accumulated
rejects were then distributed.  If there were 80 messages and 500
subscribers, the list would attempt to send 40,000 messages in one burst. 

In addition to numerous email messages and a few phone calls I received,
Rick who manages the listserver software got some email.  The first call
(voice mail) did not convey the spam nature / size of the problem to me.
When I became aware of the dimensions of the problem I went into emergency
phone mode and tried to tracked down help.  Rick may have been aware of
the problem by email direct to him by about the same time.

Again, I'm very sorry that this happened.  I do not think it will happen
again.

Fred, cohousing-L list manager

--
Fred H. Olson  Minneapolis,MN 55411   (near north Mpls)
fholson [at] cohousing.org 612-588-9532 (7am-10pm Cent time)
List manager of Cohousing-L & Nbhd-tc  Ham radio:WB0YQM
http://www.cohousing.org/fholson




_______________________________________________
Cohousing-L mailing list
Cohousing-L [at] cohousing.org
http://www.communityforum.net/mailman/listinfo/cohousing-l