Re: [Paddlewise] Keeping kayak club members in touch.

[ I suggest that if we're going to discuss this further we take it
off-list -or- if anyone is really interested, to Spam-L, which exists
specifically to discuss spam and related issues. ]

On Fri, Dec 19, 2003 at 01:00:41PM -0500, Michael Daly wrote:
> There've been a few comments here and backchannel about this.  There 
> seems to be a division of opinion on this - some say Yahoo is a spam 
> source, others, it's not.  

<sigh>

1. There is absolutely no question that Yahoo is (itself) a prolific
spam source.

2. There is absolutely no question that some addresses entrusted to
Yahoo quickly turn up in the hands of spammers.

This is NOT a matter of opinion.  It's a matter of demonstrable,
verified fact.  (Actually, a small mountain of facts, to which additions
are made every day.  For example, the mail logs of all the servers I
operate provide me with a continuous supply of fresh evidence.)

So if you follow the link I've previously provided:

	http://groups.google.com/groups?hl=en&lr=&ie=ISO-8859-1&safe=off&q=yahoo&btnG=Google+Search&meta=group%3Dnews.admin.net-abuse.email

you can read it about it happening over and over again.  Over a period 
of years.  From Yahoo stores.  Via Yahoo lists.  From Yahoo's mail servers.
And on and on and on.

I suggest that anyone wishing to debate this further read at least
*some* of those messages, some of which consist of detailed, rigorous
technical analyses showing that, yes, it points straight back to Yahoo,
and yes, Yahoo refuses -- even when proof is laid in front of them
that THEIR customer is spamming from THEIR network using THEIR mail
servers -- to lift a finger.

There's a *reason* there are 140,000 hits there.

> I had the idea of setting up a fake user ID and then setting up a 
> Yahoo group with that as a member.  Then I'll watch to see how much 
> spam that ID generates.  

And this is the only question that remains open, as I've explained:
not *all* addresses signed up for *all* Yahoo mailing lists get spam;
some do, and quickly; others never do; and others only get certain
kinds of spam.  (Possible explanations include spammer incompetence,
anti-spam measures at recipient's own ISP, deliberate targeting of
some lists, deliberate targeting of some classes of users, deliberate
avoidance of some lists, deliberate avoidance of some classes of users,
and about a dozen other things.)

And like I've said, many of us have already run multiple carefully
controlled instances of this experiments, and we know that sometimes the
address stays untouched for years.  But we also know that sometimes it
gets hit within hours.

All of which is very interesting, but the bottom line is that is should
NEVER happen.   The fact that it does raises extremely serious questions
about their ability to properly operate their services and responsibly
protect the security and privacy of their users.

---Rsk
***************************************************************************
PaddleWise Paddling Mailing List - Any opinions or suggestions expressed
here are solely those of the writer(s). You must assume the entire
responsibility for reliance upon them. All postings copyright the author.
Submissions:     PaddleWise_at_PaddleWise.net
Subscriptions:   PaddleWise-request_at_PaddleWise.net
Website:         http://www.paddlewise.net/
***************************************************************************