North American Fruit Explorers mailing list at ibiblio

[tanis grif <tanisgrif@yahoo.com>]

The notice I received said my address caused too many bounces.  I probably 
wouldn't know the reason for that if I saw it.  Did your notice offer a 3-day 
window to sign back in?  That seems too short, considering the number of 
people who can only check emails once per week.  I signed back on with my 
other email address, in case the old address is no good for rcving now. 

On Tuesday, April 15, 2014 6:52 PM, Road's End Farm 
<organic87@frontiernet.net> wrote:
  

On Apr 15, 2014, at 4:42 PM, tanis wrote:

> Got list-serv ?
>                           

Hey, I had to do that a couple of days ago!

-- Rivka; Finger Lakes NY, Zone 6A now I think
Fresh-market organic produce, small scale




__________________
>From lfljvenaura@gmail.com  Sat Apr 19 21:10:20 2014
Return-Path: <lfljvenaura@gmail.com>
X-Original-To: nafex@lists.ibiblio.org
Delivered-To: nafex@lists.ibiblio.org
Received: by lists.ibiblio.org (Postfix, from userid 20217)
        id B30F923D12; Sat, 19 Apr 2014 21:10:20 -0400 (EDT)
X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on 
mailman1.ibiblio.org
X-Spam-Level:
X-Spam-Status: No, score=-0.6 required=5.0 tests=AWL,BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,HK_RANDOM_FROM,HTML_MESSAGE,MISSING_HEADERS,
        RCVD_IN_DNSWL_NONE autolearn=no version=3.3.1
Received: from mail-qg0-f53.google.com (mail-qg0-f53.google.com
        [209.85.192.53])
        by lists.ibiblio.org (Postfix) with ESMTP id 16AEC23D01
        for <nafex@lists.ibiblio.org>; Sat, 19 Apr 2014 21:10:18 -0400 (EDT)
Received: by mail-qg0-f53.google.com with SMTP id f51so2845439qge.26
        for <nafex@lists.ibiblio.org>; Sat, 19 Apr 2014 18:10:18 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s 120113;
        h=mime-version:in-reply-to:references:from:date:message-id:subject:cc
        :content-type; bh=4vegQ5QE7DJ5LbndXSp1ObWwtAcnRTuuZn4XtkJ+9GU=;
        b=qCzby4CUFfi+c5cJpoIbWO+9U0ngTBUNEE6agc6bveRcJI0hbMODzE8/LuhitlXzZ+
        mWxHBpzzgsNZqw1Fe9/ptVzkB3GACyHDzclG3d+2COODc1NVHXm8p/HxugOjPKy5jFZ3
        R1hLJeW3NEp6HT+y9oCNIwElyQBJX/Eo0pwN6vg393NdvrawvakzNczz83AiZwSsUv1J
        3h/qVXgo32xdL51/Jxk3jjmWzVI/mXvO7OWabDqNvzN0r3k/g27fgHSjcwebOvTlYZjR
        pJKZhT8HnCIOiVlx6GNd8vcjNwyR4oPPQwdxWgWrTWY8z4Xtw65N3+lxbXGhfQ5GTgy0
        19MQ=X-Received: by 10.224.66.4 with SMTP id 
l4mr29338687qai.70.1397956218524; Sat,
        19 Apr 2014 18:10:18 -0700 (PDT)
MIME-Version: 1.0
Received: by 10.96.97.226 with HTTP; Sat, 19 Apr 2014 18:09:58 -0700 (PDT)
In-Reply-To: <1397949443.61816.YahooMailNeo@web121706.mail.ne1.yahoo.com>
References: <BAY176-W16FB3AED15F6BA0FBE0509CF500@phx.gbl>
        <0B5AAF3F-6A07-4316-BEAF-E7C65047C921@frontiernet.net>
        <1397949443.61816.YahooMailNeo@web121706.mail.ne1.yahoo.com>
From: Lawrence London <lfljvenaura@gmail.com>
Date: Sat, 19 Apr 2014 21:09:58 -0400
Message-ID: 
<CA+j2Q+BMivskNSLi_e3SW7QN9RidPLKzTsfw+3kJcg432FkgTg@mail.gmail.com>
Cc: nafex mailing list at ibiblio <nafex@lists.ibiblio.org>
Content-Type: text/plain; charset=UTF-8
X-Content-Filtered-By: Mailman/MimeDel 2.1.12
Subject: Re: [nafex] testing my re-enable
X-BeenThere: nafex@lists.ibiblio.org
X-Mailman-Version: 2.1.12
Precedence: list
Reply-To: nafex mailing list at ibiblio <nafex@lists.ibiblio.org>
List-Id: nafex mailing list at ibiblio <nafex.lists.ibiblio.org>
List-Unsubscribe: <http://lists.ibiblio.org/mailman/options/nafex>,
        <mailto:nafex-request@lists.ibiblio.org?subject=unsubscribe>
List-Archive: <https://lists.ibiblio.org/sympa/arc/nafex/>
List-Post: <mailto:nafex@lists.ibiblio.org>
List-Help: <mailto:sympa@lists.ibiblio.org?subject=HELP>
List-Subscribe: <http://lists.ibiblio.org/mailman/listinfo/nafex>,
        <mailto:nafex-request@lists.ibiblio.org?subject=subscribe>
X-List-Received-Date: Sun, 20 Apr 2014 01:10:20 -0000

The problem is not yours or ibiblio's, it is yahoo's.

A full description is here, link provided by someone in my permaculture
list:

http://jrl.guru/Email/yahoobomb.html

07 Apr 2014

*Yahoo addresses a security problem by breaking every mailing list in the
world <http://jrl.guru/Email/yahoobomb.html>* Email

DMARC is what one might call an emerging e-mail security scheme. It's
emerging pretty fast, since many of the largest mail systems in the world
have already implemented it, including Gmail, Hotmail/MSN/Outlook, Comcast,
and Yahoo.

DMARC lets a domain owner make assertions about mail that has their domain
in the address on the From: line. It lets the owner assert that mail will
have a DKIM signature with the same domain, or an envelope return (bounce)
address in the same domain that will pass SPF validation. The domain owner
can also offer policy advice about what to do with mail that doesn't have
matching DKIM or SPF, ranging from nothing to reject the mail in the SMTP
session. The assertions are in the DNS, in a TXT record at _dmarc.*domain*.
You can see mine at _dmarc.taugh.com.

For a lot of mail, notably bulk mail sent by companies, DMARC works great.
For other kinds of mail it works less great, because like every mail
security system, it has an implicit model of the way mail is delivered that
is similar but not identical to the way mail is actually delivered.

Mailing lists are a particular weak spot for DMARC. Lists invarably use
their own bounce address in their own domain so they can collect the error
reports from list mail, so the SPF doesn't match. Lists generally modify
messages via subject tags, body footers, attachment stripping, and other
useful features that break the DKIM signature. So on even the most
legitimate list mail, most of the mail fails the DMARC assertions, not due
to the lists doing anything "wrong".

The reason this matters is that over the weekend Yahoo published a DMARC
record with a policy saying to reject all yahoo.com mail that fails DMARC.
I noticed this because I got a blizzard of bounces from my church mailing
list, when a subscriber sent a message from her yahoo.com account, and the
list got a whole bunch of rejections from gmail, Hotmail, Comcast, and
Yahoo itself. This is definitely a DMARC problem, the bounces say so.

The problem for mailing lists isn't limited to the Yahoo subscribers. Since
Yahoo mail provokes bounces from lots of other mail systems, innocent
subscribers at Gmail, Hotmail, etc. not only won't get Yahoo subscribers'
messages, but all those bounces are likely to bounce them off the lists. A
few years back we had a similar problem due to an overstrict implementation
of DKIM ADSP, but in this case, DMARC is doing what Yahoo is telling it to
do.

The DMARC mailing list issue has been argued at length among us nerds, and
one of the counter arguments has been that mail systems know who is sending
mailing list mail, so they will whitelist those lists or otherwise avoid
the problem. We now know that is not true. I've been running lists for
years, no spam at all (they're all noncommercial stuff like my church,
CAUCE's newsletter, and a group of folk dancers), and every possible
technical feature including DKIM, SPF, correct forward and reverse DNS, you
name it. As noted above it didn't help, and I have heard from many other
list managers with the same problem, thanking me for explaining what
happened.

I understand, from the always interesting Word to the Wise
blog<https://wordtothewise.com/blog/>,
that Yahoo has severe phishing problems, with crooks sending mail to Yahoo
users, pretending to be yahoo.com administrators. Yahoo chased the crooks
off their own servers, so now the crooks are (as I understand it) sending
mail to Yahoo from the outside, pretending to be Yahoo. While I sympathize
with their problems, and this is not exactly swatting a fly with a
sledgehammer, it's a nail that needs a regular hammer, and the sledgehammer
is demolishing the surrounding plaster every time it whacks the nail.
Concretely, Yahoo should be able to figure out ways to reject non-Yahoo
mail going into their own servers without abusing DMARC to screw up
everyone else.

I hope they get their act together, but in the meantime here are some
suggestions for people who run mailing lists or other mail software that
might legitimately pass on a yahoo.com message:

   - Suspend posting permission of all yahoo.com addresses on any mailing
   lists you run, to limit the damage.
   - Tell Yahoo users to get a new mail account somewhere else, pronto, if
   they want to continue using mailing lists.
   - If you have source code for your list software, as a band-aid, see if
   you can add a hack to check for yahoo.com From: addresses and change
   them to something like "Address redacted", which will avoid triggering
   DMARC. I did that on my lists.
   - If you know people at Yahoo, ask if perhaps this wasn't such a good
   idea.



On Sat, Apr 19, 2014 at 7:17 PM, tanis grif <tanisgrif@yahoo.com> wrote:

>   The notice I received said my address caused too many bounces.  I
> probably wouldn't know the reason for that if I saw it.  Did your notice
> offer a 3-day window to sign back in?  That seems too short, considering
> the number of people who can only check emails once per week.  I signed
> back on with my other email address, in case the old address is no good for
> rcving now.
>
> On Tuesday, April 15, 2014 6:52 PM, Road's End Farm <
> organic87@frontiernet.net> wrote:
>
> On Apr 15, 2014, at 4:42 PM, tanis wrote:
>
> > Got list-serv ?
> >
>
> Hey, I had to do that a couple of days ago!
>
> -- Rivka; Finger Lakes NY, Zone 6A now I think
> Fresh-market organic produce, small scale
>
>
>
>
> __________________
>
>
>


--
Lawrence F. London
lfljvenaura@gmail.com
http://www.avantgeared.com
https://plus.google.com/+Avantgeared
Skype: lawrence.f.london