Possible options for stopping spam

[Sage Gerard]

All,

I've gained administrative privileges over this list to address the spammer. I want to hear from others before I touch anything.

The spams continues because moderation is outright disabled for the list. Our other choices are to apply moderation to non-group members only, or everybody.

I cannot select the former because it does nothing for us; the list is configured to allow anyone to join the group. I cannot easily select the latter because it means accepting moderation overhead, when the community is already moving to Discourse.

I've been informed that an invite-only approach might not be appropriate, but without moderation, the only option I see is to change the privacy settings. Here are the choices Google gives us.

• Invited users only
  
• Anyone on the web can join
• Anyone on the web can ask

I lean toward "Invited users only" because it's the only option that does not carry a moderation requirement, which seems prudent given the state of the community. Assuming that I can give vetted, participating members power to invite, a path to revival for the mailing list exists without burdening the Discourse migration.

Comments welcome, but note that I do not know the chain of command. If it comes down to my judgement, please let me know.

Thanks,
~slg

[Sage Gerard]

Correction: "Invited users only" does have a moderation requirement, but I expect it is not the kind that requires daily interruption.

[David Bremner]

Sage Gerard <sa...@sagegerard.com> writes:

> All,
>
> I've gained administrative privileges over this list to address the spammer. I want to hear from others before I touch anything.
>

Thanks for putting effort into this.

> I've been informed that an invite-only approach might not be appropriate, but without moderation, the only option I see is to change the privacy settings. Here are the choices Google gives us.
>

> - Invited users only
> - Anyone on the web can join
> - Anyone on the web can ask

Wouldn't people asking to be invited be pretty much the same moderation
burden as option 3, but with less support? I guess that's a way of
saying I lean to option 3.

>
> Comments welcome, but note that I do not know the chain of command. If
> it comes down to my judgement, please let me know.
>

Pretty sure I'm not in any relevant chain of command.

d

[Sage Gerard]

> Wouldn't people asking to be invited be pretty much the same moderation burden as option 3, but with less support? I guess that's a way of saying I lean to option 3.

I see what you mean. I saw "invite-only" as the option with the most discretionary effort when volunteers are scarce, since a trusted member of this community can add a member with a presumably lower risk of introducing a spammer. Since I'm not going to be available to ban spammers forever, I'm reading these options in terms of minimizing the reasons someone has to drop what they are doing to mess with the list.

Pretty sure I'm not in any relevant chain of command.

d

--
You received this message because you are subscribed to the Google Groups "Racket Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to racket-users...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/racket-users/87r1aex5zu.fsf%40tethera.net.

[George Neuner]

Is there a way to whitelist / trust posters.  One of the other groups I follow is moderated, but is set up so that messages from trusted posters go straight through.  The moderator(s) only have to look at posts coming from untrusted sources and decide whether new posters can be trusted.

Caveat: I don't know how much effort that requires.  It just seems like a possible 4th option (if doable).

[Hendrik Boom]

On Wed, Dec 15, 2021 at 12:54:30PM -0500, George Neuner wrote:
>
> Is there a way to whitelist / trust posters.  One of the other groups I
> follow is moderated, but is set up so that messages from trusted posters go
> straight through.  The moderator(s) only have to look at posts coming from
> untrusted sources and decide whether new posters can be trusted.
>
> Caveat: I don't know how much effort that requires.  It just seems like a
> possible 4th option (if doable).

This was done for the Babylon 5 usenet group a few dacades ago.
Of course, that wasn't a Google-provided mailin list.

-- hendrik

>
>
> On 12/14/2021 10:02 PM, Sage Gerard wrote:
> >
> > > Wouldn't people asking to be invited be pretty much the same
> > moderation burden as option 3, but with less support? I guess that's a
> > way of saying I lean to option 3.
> >
> > I see what you mean. I saw "invite-only" as the option with the most

> > /discretionary/ effort when volunteers are scarce, since a trusted

> > member of this community can add a member with a presumably lower risk
> > of introducing a spammer. Since I'm not going to be available to ban
> > spammers forever, I'm reading these options in terms of minimizing the
> > reasons someone has to drop what they are doing to mess with the list.
> >
> > On 12/14/21 3:53 PM, David Bremner wrote:
> > > Sage Gerard<sa...@sagegerard.com> writes:
> > >
> > > > All,
> > > >
> > > > I've gained administrative privileges over this list to address the spammer. I want to hear from others before I touch anything.
> > > >
> > > Thanks for putting effort into this.
> > >
> > > > I've been informed that an invite-only approach might not be appropriate, but without moderation, the only option I see is to change the privacy settings. Here are the choices Google gives us.
> > > >
> > > > - Invited users only
> > > > - Anyone on the web can join
> > > > - Anyone on the web can ask
> > > Wouldn't people asking to be invited be pretty much the same moderation
> > > burden as option 3, but with less support? I guess that's a way of
> > > saying I lean to option 3.
> > >
> > > > Comments welcome, but note that I do not know the chain of command. If
> > > > it comes down to my judgement, please let me know.
> > > >
> > > Pretty sure I'm not in any relevant chain of command.
> > >
> > > d
>

> --
> You received this message because you are subscribed to the Google Groups "Racket Users" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to racket-users...@googlegroups.com.

> To view this discussion on the web visit https://groups.google.com/d/msgid/racket-users/f22fdcd2-0781-4012-d906-cad44617ddc4%40comcast.net.

[Sage Gerard]

Core team,

Sam asked me to issue bans for a troublesome spammer. I've done so, even
just today. I understand I need quorum for larger decisions. This is why
I have not yet reconfigured the list to permanently stop the spammer.
After researching the problem further, I need your urgent attention.

I found that the spam messages sometimes link to other Google group
posts affected by the spammer. A recent trail leads to a
comp.lang.python Google message in 2017. I suspect that email addresses
are scraped in unmoderated lists that freely hand out membership. After
checking the list settings, I found that this is one of those lists. I
hypothesize that our email addresses are being scraped and
cross-referenced for use in other unmoderated lists.

It's one thing to flatly complain about a spammer on this list, and
another to willingly maintain a transmission vector. We need to stop
automatically handing out group membership with our current settings. We
can have ________ issue list memberships. I need you all to fill in the
blank with "moderators" or "members." I'll translate the settings
accordingly.

Given the holidays, I respect your time. Please reciprocate with respect
for the urgency this problem creates. I will revoke my own mailing list
privileges and membership in three weeks, on January 8th, 2022. I will
leave the settings however they read at the time to prevent
interruption, and request that own messages then be deleted to limit the
role my email address plays for the spammer.

I am not volunteering to moderate membership applications, and I am not
commenting on how to verify the impact of possible email leaks. Between
the Discourse move and (majority?) perspective towards email, I'm not
sure how I would be useful doing either. If my opinion holds weight, I'd
advise the answer be "members" so that any available moderators can
focus on rule breakers while the community grows at a self-directed speed.

Let me know, and thank you.

[Matthew Flatt]

The "members" option sounds right to me. Thanks for tracking down a way
to improve the situation!

> --
> You received this message because you are subscribed to the Google Groups
> "Racket Users" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to racket-users...@googlegroups.com.
> To view this discussion on the web visit

> https://groups.google.com/d/msgid/racket-users/5fa6a8bb-88e4-37c6-f0b9-2ed372bc
> e8fe%40sagegerard.com.

[Robby Findler]

+1! Thank you. 

Robby

To view this discussion on the web visit https://groups.google.com/d/msgid/racket-users/20211218124300.343%40sirmail.smtps.cs.utah.edu.

[Matthias Felleisen]

+2! And many thanks. (I was personally spared this spam until very recently. No clue why) 

— Matthias

To view this discussion on the web visit https://groups.google.com/d/msgid/racket-users/CAL3TdOMCXH4Zio1%2B96Nj_Zgj2vByetG-%3D8i93%3DLYjTpaBrw8DA%40mail.gmail.com.

[Sage Gerard]

Alright, thanks to all of you for the quick replies. As of this writing, the list has been reconfigured to create an explicit perimeter between the non-members and members. The public can no longer let themselves in.

Not totally out of the woods yet.

1. Someone please confirm if you can invite others using Members page -> "Add Member". If not, then please follow up with me.
   
2. This model can be compromised by someone going rogue and inviting a bunch of spammers. I'm expecting that our communal trust is high enough to make this unlikely.
   

Considering the risk profile seems less scary, disregard request to delete my emails. :)

To view this discussion on the web visit https://groups.google.com/d/msgid/racket-users/649B3011-618B-466E-AE20-B4C13629CA71%40felleisen.org.

[Robby Findler]

When I follow the link at the bottom of one of these messages, click on members, I see an "add members" button and clicking on it gives me a place to add email addresses. I didn't actually add email addresses to the list and try to add them, and I might have already had special privileges on this list so that might not have been the most useful test.

Robby

To view this discussion on the web visit https://groups.google.com/d/msgid/racket-users/ef18d8d4-0305-1cf9-f657-434c19843dc2%40sagegerard.com.

[Nadeem Abdul Hamid]

I don't have any special privileges... when I view the Google group, I don't see a "Members" page at all and no where to invite anyone else. All I can access is a link "My membership settings".

--- nadeem

To view this discussion on the web visit https://groups.google.com/d/msgid/racket-users/CAL3TdOPq86_JbWu5twwmoQSOF1xYqqsfDiy%2B16a6%2BDAZKnUtBw%40mail.gmail.com.

[Sage Gerard]

Looks like I scoped invitation powers to group managers, not members. Checking on this.


Sent from ProtonMail mobile



-------- Original Message --------

[Nadeem Abdul Hamid]

In other Google groups that I'm on, when I view the group, the links in the left bar read "Conversations", "Members", "About", "My membership settings". But in the Racket Users, there isn't a link to the "Members" list.

To view this discussion on the web visit https://groups.google.com/d/msgid/racket-users/A6aJ3TPprk-SAdgoLHi-h-ZCFj_9G6ZftL9c99ajyEtioSfOrQM5AUoKXGCKJz7NKxf0yNny4SJTqcpRzGAgES70hTdG-DJP-Si2m_CGG98%3D%40sagegerard.com.

[Sorawee Porncharoenwase]

FWIW, here're the settings of racket-users from the About tab:

Anyone on the web: can see group

Group owners and managers: can view members

Anyone on the web: can view conversations

Group members: can post

Invited users: can join group

and here're the settings of racket-dev:

Anyone on the web: can see group

Group members: can view members

Anyone on the web: can view conversations

Group members: can post

Anyone on the web: can join group

It looks like racket-users might need to change "Group owners and managers: can view members" to "Group members: can view members", and racket-dev might need to change "Anyone on the web: can join group" to "Invited users: can join group".

To view this discussion on the web visit https://groups.google.com/d/msgid/racket-users/CABB5Xb-t5xQL6KgPEYH3v-LWO4AUxt%2BTGDWxo_vSMO0gJrM9JQ%40mail.gmail.com.

[Mark Bestley]

Sage Gerard <sa...@sagegerard.com> writes:

> Core team,
>
> Sam asked me to issue bans for a troublesome spammer. I've done so, even
> just today. I understand I need quorum for larger decisions. This is why
> I have not yet reconfigured the list to permanently stop the spammer.
> After researching the problem further, I need your urgent attention.
>

> Let me know, and thank you.

I follow racket mail lists through an interface to gmane.io that gives a nntp feed.

Will that still work - I assume that the gmane.io user has a mail address that was registered.

Also can we get a gmane.io bridge set up for the Discourse mail list.

--
Mark

[Sage Gerard]

Someone else wanted to chime in here. This email is just to make the thread easier for them to find.

[Sam Tobin-Hochstadt]

One thing to note here: it's now not possible to _request_ to join the
list. If someone wants to join the list, they have to know someone who
is already a member and ask them to join.

It looks like another option is "Anyone on the web can ask" to join.
It's not immediately clear who gets the emails when people ask, but
this seems like it might be a good intermediate position.

Sam

> To view this discussion on the web visit https://groups.google.com/d/msgid/racket-users/ef18d8d4-0305-1cf9-f657-434c19843dc2%40sagegerard.com.

[Robby Findler]

Probably people find out about the mailing list by the website, right? We could post an email address or two there where asks should go?

Robby

To view this discussion on the web visit https://groups.google.com/d/msgid/racket-users/CAK%3DHD%2BbpujcR6Zsc3n-PY9L-vQUZGJV3uGoNNidu8tE27s_oJQ%40mail.gmail.com.

[Sage Gerard]

Makes sense.

I'll repeat one key difference in the context of Google Groups

• Ask to join
• Racket volunteer must be available for vetting requests, on receiving them. Member starts process in Google Groups
  
• Invite only
• Racket volunteer may vet first, but must initiate contact with member. As Sam said, strangers can't start that process.
  

If you publish an email to request invites, then the process is going to be "ask to join" no matter what, so the mailing list configuration is relevant for a different reason. Do we want members to start the process in Google Groups, or by sending an email to a fixed address?

To view this discussion on the web visit https://groups.google.com/d/msgid/racket-users/CAL3TdOM8V1kS79gXomX%3DPqMVKLeXM491M60xq7C6dHz%2B0o6bTw%40mail.gmail.com.

[Robby Findler]

Sorry, I probably shouldn't have jumped in here.  I'm happy with whatever you folks decide is best!

Robby

To view this discussion on the web visit https://groups.google.com/d/msgid/racket-users/d264f944-750a-5329-96f2-1fd2fac7ba31%40sagegerard.com.

[Sage Gerard]

No no, that was helpful, thank you. We do need to figure this part out.

To view this discussion on the web visit https://groups.google.com/d/msgid/racket-users/CAL3TdOO%2BEW5Y_WOLGqX1_%3DJKxGTJhvi5aaRANn%2BfbY0M3hQ92w%40mail.gmail.com.

[Sam Tobin-Hochstadt]

Here's my suggestion: we switch to "ask to join" on Google Groups. I
think that will notify all the moderators, and thus (a) more people
can potentially respond (eg, I think I currently get those emails too)
and (b) if someone can no longer take on this responsibility, it's
easy to have someone else step up. The alternative where we specify a
specific email requires potentially changing that email address when
the responsibility changes.

Does that seem like a reasonable approach?

Sam

> To view this discussion on the web visit https://groups.google.com/d/msgid/racket-users/b7bcf283-77d6-9df5-e2d6-c0729e8a93a2%40sagegerard.com.

[Sage Gerard]

Yes. I assumed was that (b) was not true, since I thought volunteers
were hard to come by for most community tasks. "Ask only" makes more
sense if someone can be found and made available at any time.

All: I normally wait for a go-ahead from a quorum before applying
changes like this. If I don't need to wait, then please tell me.

Sam: You mentioned someone got a 404 from an invite link. 404s sometimes
disguise permission issues, so I suspect that switching to "ask to join"
will make that problem go away too.

> To view this discussion on the web visit https://groups.google.com/d/msgid/racket-users/CAK%3DHD%2BabPN9hbbCjxX5rcqPD6qTP17fZ8aFxYnhTggbvgSS6XA%40mail.gmail.com.

[Sam Tobin-Hochstadt]

On Wed, Jan 12, 2022 at 1:14 PM Sage Gerard <sa...@sagegerard.com> wrote:
>
> Yes. I assumed was that (b) was not true, since I thought volunteers
> were hard to come by for most community tasks. "Ask only" makes more
> sense if someone can be found and made available at any time.
>
> All: I normally wait for a go-ahead from a quorum before applying
> changes like this. If I don't need to wait, then please tell me.

I think if you're good with this approach, you should move forward with it.

Sam

> To view this discussion on the web visit https://groups.google.com/d/msgid/racket-users/17ffe8b4-9277-9f17-5fe3-32a13d0f40b7%40sagegerard.com.

[Sage Gerard]

Both racket-users and racket-dev have just now been changed to "Anyone
can ask."

> To view this discussion on the web visit https://groups.google.com/d/msgid/racket-users/CAK%3DHD%2BY%3Dfj45aJS%2BS9QRy3zwkqXtJ7Qngn6BJyhf0-jurLNMWA%40mail.gmail.com.

[Robby Findler]

Great! I think I get moderation messages too, and I'm happy to help out in letting people in.

Robby

To view this discussion on the web visit https://groups.google.com/d/msgid/racket-users/91c23f84-6d5f-de9c-414c-46ba9e6c12df%40sagegerard.com.

[Matthias Felleisen]

Thank you Sage for taking on this task. — Matthias