spam protection on the mailing list

[Ty]

Do we not have any spam protection on the mailing lists? This is pretty bad
right now.

[Stefan Dösinger]

Am Sonntag, 30. August 2026, 22:20:25 Ostafrikanische Zeit schrieb Ty via 
Wine-Devel:
> Do we not have any spam protection on the mailing lists? This is pretty bad
> right now.

Normally we do. It must have failed somehow.

And to make matters worse it failed on a Sunday - Newman is surely out of the 
office

Cheers,
Stefan

[Jeremy Newman]

This user used a gmail address and sent through Google after subscribing themselves. I've contacted the list provider to see if anything else can be done to prevent this, and asked them what protections they use FFR.

For now, I've switched the list to have new subscriptions need approval from an admin. We'll check the incoming email against spam dbs before approving. It is manual, and could be tedious. Even then no guarantee, a freshly created email like the gmail above would probably get approved. Normally, wine-devel doesn't get all that many subscription requests, so hopefully it doesn't overwhelm us.


On Sunday, August 30th, 2026 at 2:36 PM, Stefan Dösinger via Wine-Devel <[e-mail]> wrote:
> Am Sonntag, 30. August 2026, 22:20:25 Ostafrikanische Zeit schrieb Ty via
> Wine-Devel:
> > Do we not have any spam protection on the mailing lists? This is pretty bad
> > right now.

> Normally we do. It must have failed somehow.

> And to make matters worse it failed on a Sunday - Newman is surely out of the
> office

> Cheers,
> Stefan

[Jeremy Newman]

Just to verify, I checked the bigbuto and yassmminss emails against SpamHaus and StopForumSpam, and neither of these emails are listed in either place. So these were clearly a one-off pump and dump email address. We would not have caught it just by doing a manual check.

These emails should have been caught by normal spam filters though, a Bayesian filter should have flagged them.


On Sunday, August 30th, 2026 at 9:03 PM, Jeremy Newman via Wine-Devel <[e-mail]> wrote:
> This user used a gmail address and sent through Google after subscribing themselves. I've contacted the list provider to see if anything else can be done to prevent this, and asked them what protections they use FFR.

> For now, I've switched the list to have new subscriptions need approval from an admin. We'll check the incoming email against spam dbs before approving. It is manual, and could be tedious. Even then no guarantee, a freshly created email like the gmail above would probably get approved. Normally, wine-devel doesn't get all that many subscription requests, so hopefully it doesn't overwhelm us.

>

> On Sunday, August 30th, 2026 at 2:36 PM, Stefan Dösinger via Wine-Devel <[e-mail]> wrote:

> > Am Sonntag, 30. August 2026, 22:20:25 Ostafrikanische Zeit schrieb Ty via
> > Wine-Devel:
> > > Do we not have any spam protection on the mailing lists? This is pretty bad
> > > right now.
>

> > Normally we do. It must have failed somehow.
>

> > And to make matters worse it failed on a Sunday - Newman is surely out of the
> > office
>

> > Cheers,
> > Stefan

[THOMAS SMITH]

Hello,

I got hundreds of them.  Comcast's spam filter did not catch them.
> On 08/30/2026 7:22 PM PDT Jeremy Newman via Wine-Devel <[e-mail]> wrote:
> Just to verify, I checked the bigbuto and yassmminss emails against SpamHaus and StopForumSpam, and neither of these emails are listed in either place. So these were clearly a one-off pump and dump email address. We would not have caught it just by doing a manual check.
>
> These emails should have been caught by normal spam filters though, a Bayesian filter should have flagged them.

[e-mail]

[Gerald Pfeifer]

On Mon, 31 Aug 2026, Jeremy Newman via Wine-Devel wrote:
> I've contacted the list provider to see if anything else can be done to 
> prevent this

One idea might be rate limiting, i.e., at most X mails per sender address 
per day (if the software allows for that)?

Another would be putting everybody on moderation initially and switch them 
to direct posting upon their first on topic message. I'd expect there to 
be a brief initial training period, and after a few weeks we'd have 
covered nearly all regular contributors.

Gerald

[Elizabeth Figura]

On Monday, 31 August 2026 06:03:41 CDT Gerald Pfeifer via Wine-Devel wrote:
> On Mon, 31 Aug 2026, Jeremy Newman via Wine-Devel wrote:
> > I've contacted the list provider to see if anything else can be done to 
> > prevent this
>
> One idea might be rate limiting, i.e., at most X mails per sender address 
> per day (if the software allows for that)?

We don't use the list for Wine patch submissions anymore, but it may still end up in the CC for patch submissions to other things, e.g. the Linux kernel. Large series would run afoul of something like that.