I’d like to explain what happened to our mailing list server that caused the large temporary backlog of messages. We fell victim not to a focused spam attack, but to the collateral damage of a spammer, so to speak. A spammer pretended to be sending possibly millions of spam messages from one of our lists – by forging the mail they sent to make it look like it was coming from the list’s address. The result was thousands upon thousands of “bounce” messages that were sent from around the world to our Sympa server.

Spammers generally have many thousands of bad email addresses in their sneakily gathered lists, and any email to a bad address generates a bounce. That bounce is sent to the sender’s (or in this case, the faked sender’s) address. The huge number of incoming bounce messages had to be processed by the Sympa server as they arrived, and the volume of additional bounces bogged the server down terribly, causing a backlog to build up. We identified the list that had been impersonated, shut it off (so the server would no longer concern itself with bounces to that list), and began culling the bad messages from the queue.

We are investigating whether there is anything we can do in order to prevent this in the future. It is a problem plaguing many high volume list servers. The difficult part is that the bounces themselves are not spam to be filtered, and filtering all bounce messages would break an important function of email servers.

The Sympa list server is now operating as normal again, and will be caught up with its message backlog within a few hours.

Matthew Ivaliotes
Information Technology & Telecommunication Services
American Library Association
(312) 280-4266

We’ve asked the consultant to create a script to check the message queues every 5 minutes and send us an alert when there are more then 100 messages backed up. This script will be put in place on Wednesday.

Sorry for the inconvenience this may have caused.

So… Sympa will be stopped at 4:30 p.m. CST on Wednesday, March 5, 2008.  Please notify your lists as you feel necessary.  Incoming messages for all lists will be queued up and processed as soon as the upgrade is complete.  Because a) the queue time will be much shorter than Sunday’s 10 hours and b) the new server will perform better than the one Sympa is currently on, we do not expect a large backlog of messages to process, and certainly nothing that will linger into Thursday’s work hours.

After the upgrade, you will see a significantly improved “landing page” for Sympa. As part of the migration process, we will be assigning all lists to various unit and subject categories, which users may then browse. There will still be the option of viewing all lists, and searching for a list name. Please remember, though, that if a list of yours is set to be “invisible” it will not appear in the new unit and subject categories, nor will it appear in the list of all (visible) lists, nor will it appear in search results.

Please know this is a work in progress, and we welcome your ideas for improvement. If you have any questions about the upgrade/migration, please let me know.

Rob