Wine registration email - system failure

[Ace...]

To whom it may concern

I tried to register, but I received no email.
Tried anther email address - again no email.

In both cases the wine forum sys had registered me, but without the confirmation email, I couldn't get on.

I then created a yahoo web email - and this worked.

So the sys can send to web accounts but evidently not to pop accounts.

[Ace...]

Actually, it gets worse, because I just tried to change my email address to the correct address, and the system won't let me cos that email is already in use.

[dimesio]

So the sys can send to web accounts but evidently not to pop accounts.

I just tested creating a new account with a pop email account and it worked fine.

Check your spam folder; the confirmation email might have wound up there. Also check that your ISP isn't mistakenly blocking it as spam.

[Martin Gregorie]

On Tue, 2011-07-12 at 09:39 -0500, Ace... wrote:

So the sys can send to web accounts but evidently not to pop accounts.

Take a very careful look at your mail system, which sounds as if its
mis-configured.

My ISP uses POP3 for mail delivery and I have no problems receiving mail
from the Wine mailing list or anyplace else. I use two configurations
depending on where I am, but I use the Evolution mail reader, installed
on a laptop, in both cases:

Away from home:
- I have Evolution configured to collect mail from my ISP's
mail server using POP3, leaving copies of messages on the
server, and to deliver mail to it using SMTP.

At home:
- I use getmail to retrieve mail from my ISP's mailserver
using POP3, this time deleting mail from the server as it
is read.
- Getmail passes incoming mail through the Spamassassin spam
filter to a Postfix mail server, which uses dovecot to provide
a POP3 mail delivery service to my home network.
- At home Evolution is configured to get incoming mail from my
home mail server using POP3 and to send outgoing mail to my
home mail server using SMTP.
- The home Postfix server is configured to pass outgoing mail
to my ISP's mailserver for onward delivery. This uses SMTP.

Evolution allows multiple mailservers to be configured. As they can be
enabled and disabled at will, its trivial to switch the copy on my
laptop between 'home' and 'away' server usage.


Martin

[Ace...]

Thanks for the detailed responses.

What I did do was:

Check the mail in both evolution and pegasus mail.
Evolution has no spam setup.
PM has, and i checked the spam folder religously (4 times - twice per attempt)

I then checked my actual isp mailbox.

I then contacted the webmaster, who sent me an access code for AppDB, but of course that didn't help (but thanks anyway).

I was pretty thorough.

I finally contacted jnewman cos he was contactable.... maybe he notified the right people, but he never emailed me back.

It is possible that the message was stopped by the isp, due to spam complaints from a pool - it happened to me once some time ago, but I can't see that being the case with wine -+ it's not gonna be in a pool.

All this happened a couple of weeks ago, so maybe it has been fixed now (I was busy on the PMail forum).

If it is working now the that's great, however, there are 2 accounts sat there on the sys, waiting for activation.

I'd like to see them deleted, so that I can then adjust my profile email.

Perhaps what I should do, is create another email address on my pop, and then re-test.

I guess I should do that.

[dimesio]

I finally contacted jnewman cos he was contactable....

He is the webmaster.

It is possible that the message was stopped by the isp, due to spam complaints from a pool - it happened to me once some time ago, but I can't see that being the case with wine -+ it's not gonna be in a pool.

Don't be too sure of that. For awhile my ISP was blocking legitimate emails from my bank.

I'd like to see them deleted, so that I can then adjust my profile email.

The other forum site admins are DanKegel and jjmckenzie. You could try contacting one of them.

[jjmckenzie]

On Tue, Jul 12, 2011 at 1:35 PM, dimesio <[email protected]> wrote:

Ace... wrote:

I finally contacted jnewman cos he was contactable....

He is the webmaster.

It is possible that the message was stopped by the isp, due to spam complaints from a pool - it happened to me once some time ago, but I can't see that being the case with wine -+ it's not gonna be in a pool.

Don't be too sure of that. For awhile my ISP was blocking legitimate emails from my bank.

I'd like to see them deleted, so that I can then adjust my profile email.

The other forum site admins are DanKegel and jjmckenzie. You could try contacting one of them.

Send me a message and I'll delete the extra user IDs. I'll also need
an IP address/mailing address as well. DO NOT SEND ME E-MAIL!

James

[jjmckenzie]

On 7/12/11 9:09 AM, Ace... wrote:

Thanks for the detailed responses.

Deleted extraneous accounts and sent private mail to this user.

James

[Ace...]

Deleted extraneous accounts and sent private mail to this user.
James

James,
Thanks for doing that.
Sorry I didn't get back to you sooner (too busy).

I've just checked the hotmail account, and got your message (and refrained from responding).

[Ace...]

At around 10.00pm last night, I attempted once again to register with winehq forums, using my pop account.

My email address was allowed, so the deletion by james was successful.

No email confirmation was received.

I had prepared for this event by clearing my new mail box, and marking as read, my spam.

I have no filters in place on my primary isp mailbox - all filters are local via PMail.
Ie I get all messages, and they appear in either, new mail, or spam.

What To Do?

Is it possible that somebody could check the email records for around 22.00 Mon July 18th, to see if the auto out email, was returned, so that way we would at least have a record.

I note the subject line:

Welcome to WineHQ Forums Forums

Forums is repeated - I believe that repeated words can be configured as filter triggers, though whether the isp pre filters at this level, i really don't know (but i doubt it).
But still....... that is a minor error that should anyway be sorted.

Considering that other members have registered via pop accounts:

Could there be comms problems between the wine mail sys and the FREE.FR sys.

FREE is probably the largest isp in france, so that is a lot of potential wine users.

Or do we think that WineHQ has somehow got itself onto a FREE blacklist.

What I'll do is hang fire until we've had a chance to reflect, or locate the offending email record, to see what actually happened to it.

I'll then inform FREE.

[Alexandre Julliard]

"Ace..." <[email protected]> writes:

Is it possible that somebody could check the email records for around
22.00 Mon July 18th, to see if the auto out email, was returned, so
that way we would at least have a record.

SMTP error from remote mail server after end of data: host mx1.free.fr [212.27.48.6]: 550 spam detected

Looks like mx1.free.fr considers it spam. You'll have to ask them why.

--
Alexandre Julliard
[email protected]

[Ace...]

Good work that!

Perhaps you could pm or mail me the raw email.
The header data I could pass on to FREE, plus I could then activate my account.

This latter would be useful, as I could then test the "forum post alert" sys.

If i receive an email alerting a post reply (to my pop account) then we would tie the problem down to just the account activation message.

If no email alert received, we can assume that winehq is on their blacklist (cos I get plenty of alerts from other forums etc. and they are all similar in structure)

[Alexandre Julliard]

"Ace..." <[email protected]> writes:

Good work that!

Perhaps you could pm or mail me the raw email.
The header data I could pass on to FREE, plus I could then activate my account.

This latter would be useful, as I could then test the "forum post alert" sys.

I don't have the email, only the log entry.

--
Alexandre Julliard
[email protected]

[Ace...]

Okay,

Leave it with me.
I don't know their response times.

[Ace...]

So......

We have to understand that a v.large organisation is almost impossible to contact, on a straightforward basis.

They have an entire troop of people trained to deal with questions such as, where is the on/off button?

Having just spent 2 hours waiting, and then in chat, trying to explain the problem......

.... I'm a bit burned out at the mo.

The short of it is that "assistance" will not notify the email admin staff of the false spam flag.

There will be another way, but.......

.... The more I think about this, the more I think we should look at the repeated word "forum".

The log result indicated "spam detected"

Could the log be specific enough to discern between "spam detected" and "blacklist".

If spam was truly detected, then perhaps, by eliminating the repeat word, we could eliminate the spam flag.

I say this cos I don't see (as yet) anything else that might trigger a spam flag.
And this site (winehq) is far and away less likely to induce people to complain about spam (originating from winehq).

Personally, I'd like to see the repeated "forum" error eliminated first.

I have one more pop email version, so once that bug is gone, I can try again, and we'll see if that was the prob.

If it doesn't fix it, then I'll head once more into the breach with FREE - and James can once again delete the accounts.

How do you see it?

[Martin Gregorie]

On Tue, 2011-07-19 at 12:08 -0500, Ace... wrote:

And this site (winehq) is far and away less likely to induce people to
complain about spam (originating from winehq).

Don't be so sure.

Most of the spam sent in my direction is stopped by my ISP's greylisting
system: before that was implemented 80% of the mail I received was spam.
Now 8% of the mail I receive is spam, but most of that (80-90%) arrives
via the Wine mailing list and, whenever I've looked at the source, its
almost all been submitted via the CodeWeavers forum, which also feeds
into the Wine mailing list with, judging from the headers, no spam
filtering used.

I'd say that under half of this junk is computing-related.


Martin

[Ace...]

hmmm!

okay martin...
... but can you suggest something,
or, are you primarily alerting us to the fact that, for want of a better word, the wine email sys has been hacked, and has therefore, as an entity, gained a bad reputation?

[Martin Gregorie]

On Tue, 2011-07-19 at 13:25 -0500, Ace... wrote:

hmmm!

okay martin...
... but can you suggest something,

Both.

Some sort of spammer discouragement or a spam filter is needed on forum
posts. At first glance putting a spam filter between the forum and the
mailing list seems a good idea, but it ain't that easy because all
senders have an address of the form "[email protected]", so
all you have to go on is phrases and URLs in the body of the post.

I have wondered if a more complex *and intentionally time-consuming*
sign-up procedure for the forum would help. This could be something
like:

- sign-up requires a valid e-mail address, as well as a handle and
passphrase.
- the address + passphrase would be required to login to the forum
- the 'handle' would be all that appears on forum posts and as the
sender address in the linked mailing list
- sign-up involves the new user replying to a confirmatory e-mail
sent to the login address, thus capturing a valid e-mail address
for every user who completes sign-up
- wait a few hours before the confirmatory request e-mail is sent.

All this may upset a few legit. posters but hopefully would positively
discourage spammers (both human and robotic) who are trying to maximise
their output rate and generally only have a short window for spamming
before the blacklists and Bayesian spam recognisers start rejecting
their rubbish.

or, are you primarily alerting us to the fact that,
for want of a better word, the wine email sys has been hacked,
and has therefore, as an entity, gained a bad reputation?

The volume of spam coming from the Codeweavers forum has grown a lot
recently while what little used to come from Nabble has now pretty much
vanished and I don't recall ever seeing much from the WineHQ forum. I'm
reading this to mean that Nabble has improved its game and that the
WineHQ forum has some sort of filtering or maybe a sign-up procedure
that discourages spammers, but that Codeweavers don't seem concerned
about being a spam conduit.

I'll make a better effort to track where winelist spam is coming from in
future.

Currently, if I see messages that are obviously spam pushing a URL I
just snarl and add the URL to a private Spamassassin rule that fires on
Wine messages that contain listed URLs and/or product names accompanied
by sales terms.


Martin

[Ace...]

Now 8% of the mail I receive is spam, but most of that (80-90%) arrives
via the Wine mailing list and, whenever I've looked at the source, its
almost all been submitted via the CodeWeavers forum, which also feeds
into the Wine mailing list with, judging from the headers, no spam
filtering used.

Your saying 'the CodeWeavers forum feeds into the Wine mailing list'

It's not clear to me what is meant by this.
Is their forum using phpbb?
Are we sharing the same email transports sys, so that all the mail appears to originate from the same source?

If this is the case, then there is no point in me contacting the ISP admin, cos they could say that we ARE the source of spam.

Is this not something that should be worked out with php, with an implementation of anti-spam measures, such as those you have outlined?

But what I do know is that it's a bit of a bummer when WineHQ is considered such a source of spam, that its emails are simply blocked by certain ISP's.


-

[Martin Gregorie]

On Wed, 2011-07-20 at 05:13 -0500, Ace... wrote:

Martin Gregorie wrote:

Now 8% of the mail I receive is spam, but most of that (80-90%) arrives
via the Wine mailing list and, whenever I've looked at the source, its
almost all been submitted via the CodeWeavers forum, which also feeds
into the Wine mailing list with, judging from the headers, no spam
filtering used.

Your saying 'the CodeWeavers forum feeds into the Wine mailing list'

Yes: exactly that.

Here's an example. 13 spams arrived last night, all with the same From
address, all following the same delivery route and all advertising the
same Vietnamese electronics shop. Here are the relevant headers:

From [email protected] Wed Jul 20 08:31:06 2011
....
....some headers removed.....
....
Received: from wine.codeweavers.com ([209.46.25.134]) by
m1pismtp01-012.prod.mesa1.secureserver.net with ESMTP; 20 Jul 2011
00:24:17
-0700
Received: from localhost ([127.0.0.1] helo=localhost.localdomain
ident=list) by wine.codeweavers.com with esmtp (Exim 4.69)
(envelope-from
<[email protected]>) id 1QjR8Z-000558-Vt; Wed, 20 Jul 2011
02:24:11 -0500
Received: from www-data by wine.codeweavers.com with local (Exim 4.69)
(envelope-from <[email protected]>) id 1QjR8U-00054y-Ll for
[email protected]; Wed, 20 Jul 2011 02:24:02 -0500
Message-ID: <[email protected]>
From: "tony_toan" <[email protected]>
X-Generated-By: M2F: www.mail2forum.com
Date: Wed, 20 Jul 2011 02:24:02 -0500
To: [email protected]
Subject: [Wine] ABRACON - GNN Components, Co.Ltd
X-BeenThere: [email protected]
X-Mailman-Version: 2.1.11
Precedence: list
Reply-To: [email protected]
List-Id: Wine Users Mailing List <wine-users.winehq.org>
List-Unsubscribe: <http://www.winehq.org/mailman/options/wine-users>,
<mailto:[email protected]?subject=unsubscribe>
List-Archive: <http://www.winehq.org/pipermail/wine-users>
List-Post: <mailto:[email protected]>
List-Help: <mailto:[email protected]?subject=help>
List-Subscribe: <http://www.winehq.org/mailman/listinfo/wine-users>,
<mailto:[email protected]?subject=subscribe>
Sender: [email protected]
Errors-To: [email protected]

The headers I removed show the mail's path from my domain name host
(secureserver.net) to this computer, so are not relevant.

As you can see, the envelope sender is [email protected]

The message was originated by 'www-data' in the Codeweavers domain.
I know its there because their copy of the Exim MTA says the www-data
message source is local to itself, i.e. on the same server. This message
clearly didn't originate from a mail client or there would be a header
showing this and the message-ID would have identified the mail client.

The message then went through M2F, which is a bridge program that
transfers messages between web forums and mail systems. This added the
message ID and all the headers related to the wine-users.winehq.org
mailing list before passing it to the codeweavers mailserver, which sent
it to my domain host.

It's not clear to me what is meant by this.

It means that spam that appears on the Wine users mailing list is being
input through web forum software at Codeweavers.

It also appears that more of the Wine project is hosted by Codeweavers
than I realised. The headers indicate that they host the Wine forums and
mailing lists.

Its also quite clear that the only spam filters are on my side of the
Internet because these have all added headers. They are:
- my domain host, which is running IronPort
- my ISP, which is running DSPAM
- I'm running SpamAssassin on the feed to my Postfix MTA.

There are no other spam filters anywhere along the delivery chain.

Is their forum using phpbb?

I can't tell. There's nothing in the headers that identifies the forum
software.

Are we sharing the same email transports sys, so that all the mail
appears to originate from the same source?

Yes, I think so. Your message has the same set of headers as the spam I
analysed.

If this is the case, then there is no point in me contacting the ISP
admin, cos they could say that we ARE the source of spam.

Correct.

Is this not something that should be worked out with php, with an
implementation of anti-spam measures, such as those you have outlined?

Thats pretty much the case. Adding a spam filter between the web forums
and the Codeweavers MTA may catch some spam, but doing this is hard
because you're limited to looking at the body of the message: the mail
headers showing where the message originated, etc. simply aren't there
yet or have been given fixed values by the forum software and/or M2F.

General consensus seems to be that keeping spammers out of forums is the
best approach. I can't recall getting spam from a mail list or forum
that uses an e-mail challenge/response system as part of the sign-up
process.

But what I do know is that it's a bit of a bummer when WineHQ is
considered such a source of spam, that its emails are simply blocked
by certain ISP's.

Agreed. Keeping spammers out, or at least vastly reducing spamming, is
the essential first step to getting off ISP blacklists.


Martin

[dimesio]

]It means that spam that appears on the Wine users mailing list is being
input through web forum software at Codeweavers.

It also appears that more of the Wine project is hosted by Codeweavers
than I realised. The headers indicate that they host the Wine forums and
mailing lists.

Obviously you've never visited the website. Every page has a "Hosted by Codeweavers" logo on it. The Crossover forum does not feed into the wine-user's mailing list; the header you cited came from the wine user's forum.

Yes, we get lots of spam here. We delete from the forum as soon as we see it, but by then it's already gone to the mailing list.

General consensus seems to be that keeping spammers out of forums is the
best approach. I can't recall getting spam from a mail list or forum
that uses an e-mail challenge/response system as part of the sign-up
process.

You've gotten spam from this one, and the signup process clearly includes an email challenge/response--that's what this poster is having a problem with. In addition, to weed out bots, the signup process requires the person to answer a question about the history of the Wine project.
The reality is that our spammers are real human beings, and there's no way to prevent them from signing up without blocking legitimate users too.

Not long ago Dan mentioned in a thread (I forget which one) that the forum software is going to be upgraded to a version with better spam control features. Maybe that will help.

[Martin Gregorie]

On Wed, 2011-07-20 at 07:51 -0500, dimesio wrote:

Obviously you've never visited the website. Every page has a "Hosted
by Codeweavers" logo on it.

I do, but hadn't noticed it in the bottom right corner.

The Crossover forum does not feed into the wine-user's mailing list;
the header you cited came from the wine user's forum.

I know that one did, but thought I'd seen stuff from their forum
previously - obviously I misinterpreted the initial MTA-generated mail
header.

Yes, we get lots of spam here. We delete from the forum as soon as we
see it, but by then it's already gone to the mailing list.

Maybe delayed posting, if it can be arranged, would help?

The reality is that our spammers are real human beings, and there's no
way to prevent them from signing up without blocking legitimate users
too.

Never said they weren't humans. A few hours delay in issuing the
challenge e-mail is still relevant since it may make other forums with
more instant sign-up more attractive to spammers.

Not long ago Dan mentioned in a thread (I forget which one) that the
forum software is going to be upgraded to a version with better spam
control features. Maybe that will help.

I'll look forward to its arrival.


Martin

[jjmckenzie]

On Wed, Jul 20, 2011 at 5:51 AM, dimesio <[email protected]> wrote:

Martin Gregorie wrote:

]It means that spam that appears on the Wine users mailing list is being
input through web forum software at Codeweavers.


General consensus seems to be that keeping spammers out of forums is the
best approach. I can't recall getting spam from a mail list or forum
that uses an e-mail challenge/response system as part of the sign-up
process.

You've gotten spam from this one, and the signup process clearly includes an email challenge/response--that's what this
poster is having a problem with. In addition, to weed out bots, the signup process requires the person to answer a question
about the history of the Wine project.
The reality is that our spammers are real human beings, and there's no way to prevent them from signing up without
blocking legitimate users too.

We could require a 30 minute cool-down period where posters have the
ability to look through the Applications Database and to scan the
forums before posting. This should not discourage a legitimate user
but will discourage spammers.

Not long ago Dan mentioned in a thread (I forget which one) that the forum software is going to be upgraded to a version with
better spam control features. Maybe that will help.

Dan asked about updating to a newer version of PHPBB. It has better
anti-spam 'stuff'.

In the meantime, both Dan and I are looking to see where spam is
coming from and if needed blocking IPs. If the IP address could be
captured and relayed to us before deleting messages from the forum, we
would appreciate it. We are also actively taking actions to censor
spammed web sites so that the links no longer work when subsequent
spam runs are made. The best action to prevent spammers is to show
that the site is actively maintained and watched.

And thank you for the explanation that the Forums are echoed into a
mailing list and messages from the mailing list are placed in the
appropriate place in the forums.

James

[dimesio]

This should not discourage a legitimate user
but will discourage spammers.

IMO, that will annoy legitimate users and not discourage spammers one bit. I'm sure you've noticed by now how persistent they are.

In the meantime, both Dan and I are looking to see where spam is
coming from and if needed blocking IPs. If the IP address could be
captured and relayed to us before deleting messages from the forum, we
would appreciate it.

I thought deleting spam was your job now.

[jjmckenzie]

On Wed, Jul 20, 2011 at 7:47 AM, dimesio <[email protected]> wrote:

This should not discourage a legitimate user
but will discourage spammers.

IMO, that will annoy legitimate users and not discourage spammers one bit. I'm sure you've noticed by now how persistent
they are.

At this time, we are a 'juicy' target. Put in a delay for new users
and that might scare them off. Legitimate users will wait. I've
joined sites that take one day before you can do just about anything.

In the meantime, both Dan and I are looking to see where spam is
coming from and if needed blocking IPs.  If the IP address could be
captured and relayed to us before deleting messages from the forum, we
would appreciate it.

I thought deleting spam was your job now.

Someone is deleting it. I'll take this off-list and see if we can
formulate a method to pass information and remove offensive messages
as well.

James