mindrot.org TMDA sending multiple auto-responder spams

[Damien Miller]

The challenge-response is a one-time confirmation that is required of
people who do not subscribe to the mailing list.

It is intended to provide a simple way for people who want to report
bugs, etc. without becoming involved in general list discussions. The
alternative would be to force everyone who wants to send in reports to
subscribe first and then unsubscribe later, which is far more of an
impost than replying to a one-off challenge email.

You only need to authorise yourself once and they go away - you are not
rechallenged after you have been authorised (you received two challenges
because you sent two messages without responding.)

Please direct further discussion on this topic to me rather than the
list.

-d

J. Grant wrote:
> Hi,
> 
> It is a shame I feel obliged to write this email.
> 
> I sent a single email with a possible bug in it, asking if it was
> working in a newer release.  I got 3 spam emails from mindrot.org.  Two
> asking me to confirm, and then when I was forced to confirm I got
> another auto-responder spam.  If I had wanted the 3rd spam I would have set
> "return receipt".
> 
> I got this (below) auto-responder confirmation spam as well.  I confirmed
> my email address purely so I could make the point that this approach is
> a poor solution to spam prevention.  This approach treats symptom of
> spam by wasting the time of email person with yet more spam, rather than
> tackling the cause of the problem.
> 
> Is there a logical reason for this odd approach?
> 
> I posted about these sort of flawed approaches earlier this year:
> 
> "Auto-responder anti-spam solutions"
> http://jguk.org/2005/blog_2005_06_01_auto_responder_anti_spam.html
> 
> I do not wish my email address to be listed on mindrot.org now I have
> made this point, please remove it from the list of people who are excluded
> from being spammed by default.  I will not reply to further emails unless
> there is a clear indication that this fault has been corrected and when I
> reply I will not be spammed again.
> 
> Kind regards
> JG
> 
> -------- Original Message --------
> Subject: Please confirm your message
> Date: Mon, 11 Jul 2005 01:46:01 +1000 (EST)
> From: TMDA daemon <tmda at mindrot.org>
> Reply-To: tmda+confirm+1121010361.31290.971921 at mindrot.org
> To: jg at jguk.org
> References: <42D143E4.9010305 at jguk.org>
> 
> This message was created automatically by mail delivery software (TMDA).
> 
> Your message attached below is being held because the address
> <jg at jguk.org> has not been verified.
> 
> To release your message for delivery, please send an empty message
> to the following address, or use your mailer's "Reply" feature.
> 
>       tmdaaaaaaaaaaaaaaaaaaaa90.971921 at mindrot.org
> 
> This confirmation verifies that your message is legitimate and not
> junk-mail. You should only have to confirm your address once.
> 
> If you do not respond to this confirmation request within 14 days,
> your message will not be delivered.
> 
> _______________________________________________
> openssh-unix-dev mailing list
> openssh-unix-dev at mindrot.org
> http://www.mindrot.org/mailman/listinfo/openssh-unix-dev