[MURG] A lesson about deleting our spam

[Eugen Leitl]

On Fri, May 07, 2004 at 12:42:47PM -0400, Randal A. Koene wrote:

> Well, I guess I got rid of our spam too fast. I just spoke with Eric and
> he suggested someone is spoofing his address. What a sad outcome if Eric

I presume a worm/virus went over the list, spoofing Eric's From: header.
There's no way to lock down a list save of obligate digital signatures for
subscribers, but you can reject Windows executables at
MTA level (do we run Postfix? I can provide recipes for that).

> has to get a new address so we can block this stuff... so I'm trying to
> find out what common (regex) pattern of the posts I can filter for
> instead. I only have two sample spam posts left to compare for strings to
> filter, so I hope I got it right.

Don't waste your time with this, it's a solved problem. Just websearch for
your MTA name and spam/virus/worm regexp, or something.

> BTW, Eric's address is active again and can post to MURG.

-- 
Eugen* Leitl <a href="http://leitl.org">leitl</a>
______________________________________________________________
ICBM: 48.07078, 11.61144            http://www.leitl.org
8B29F6BE: 099D 78BA 2FD3 B014 B08A  7779 75B0 2443 8B29 F6BE
http://moleculardevices.org         http://nanomachines.net
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 198 bytes
Desc: not available
Url : http://askja.bu.edu/pipermail/murg/attachments/20040507/1f13ea2f/attachment.pgp