DMARC-Filter: OpenDMARC Filter v1.4.1 sourceware.org DDAF03853C01
Subject: Re: META: Fix the signup procedure?
To: cygwin <cygwin@cygwin.com>
References: <CANV2+nXG7dm9Lab+wb0=3Efd_rLqQd7YsdqzLXJz6VL1XUgLQQ@mail.gmail.com>
Message-ID: <f6ddede5-4e09-5d77-eabf-bd2060e57de9@iol.it>
Date: Thu, 12 Aug 2021 12:36:12 +0200
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101
 Firefox/60.0 SeaMonkey/2.53.8.1
MIME-Version: 1.0
In-Reply-To: <CANV2+nXG7dm9Lab+wb0=3Efd_rLqQd7YsdqzLXJz6VL1XUgLQQ@mail.gmail.com>
Precedence: list
From: Valerio Messina via Cygwin <cygwin@cygwin.com>
Reply-To: Valerio Messina <efa@iol.it>
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset="us-ascii"; Format="flowed"
Errors-To: cygwin-bounces+archive-cygwin=delorie.com@cygwin.com
Sender: "Cygwin" <cygwin-bounces+archive-cygwin=delorie.com@cygwin.com>

On 8/11/21 1:26 PM, Russell VT via Cygwin wrote:
> Can one of you powerful folks, please, fix the signup approvals and make it
> a bit more difficult to signup and account that is "allowed" to post on
> this list?

as now the subscribe procedure is a simple:
0) open the web page: https://cygwin.com/mailman/listinfo/cygwin/
1) fill form with name, email and pass
2) press the Subscribe button
3) receive a confirmation mail
4) follow the link in the mail
5) press the subscribe button in the new web page
all steps are easily script-able with 'curl'
So in my opinion first thing to do is to add a CAPTCHA [1] in the step 1


I tried to contact the list admin sent from IP: 8.43.85.97
that is <noc@redhat.com> asking for removal of spammers once we received 
every spam, but spamming continue.


I also noted a big increase in spam directed to my email, once I made a 
post to the list. This is probably related to the fact the list archive 
is freely available to web spiders at:
https://cygwin.com/pipermail/cygwin/
with email sender visible as first line once you open an mail.
So second action to do is report the 'name' of sender but not the email 
in those pages, or at least blacken the domain part @domain.tld


[1] https://en.wikipedia.org/wiki/CAPTCHA

thank you,
-- 
Valerio

-- 
Problem reports:      https://cygwin.com/problems.html
FAQ:                  https://cygwin.com/faq/
Documentation:        https://cygwin.com/docs.html
Unsubscribe info:     https://cygwin.com/ml/#unsubscribe-simple