SourceForge.net

Greetings,

Not all MLs require subscription to post, that is configured by the
project administrators, so it cannot be guaranteed.

Thank you,

David Burley
Quality of Service Analyst, SourceForge.net

> As for already having verified the sender, we
> actually haven't. The mail system is mostly independent of the website,
a
> user account isn't required to post or subscribe to a mailing list and
> there isn't much if any glue tieing them together. So, that isn't a
valid
> method since we don't want to require a user account for their use.

I'm not referring to the verification that you do when someone gets a
sourceforge account. Anyone who subscribes to a mailing list by completing
a form like https://lists.sourceforge.net/lists/listinfo/mod-auth-users
will be verified by receiving a challenge email at that time. This is the
verification that I'm referring to, and as far as I'm aware it applies to
all subscribers.

Regards,

Phil.

Greetings,

This is one method we have and will be continuing to use to block spam for
the time being. Is it controversial, depends on who you ask, but that's
true of just about anything. As for already having verified the sender, we
actually haven't. The mail system is mostly independent of the website, a
user account isn't required to post or subscribe to a mailing list and
there isn't much if any glue tieing them together. So, that isn't a valid
method since we don't want to require a user account for their use.

Thank you,

David Burley
Quality of Service Analyst, SourceForge.net

Hi David,

Thanks for the reply. Just a couple of quick points:

> we verify that the sender is valid, and their mail server properly
configured, before
> forwarding the mails

Well, you _try_ to verify that the sender is valid. Do you know in how
many times this fails because the sender's mail server is configured to
reject these verification attempts? You may be assuming that these are
spambots when they are in fact legitimate users (like me).

You haven't addressed my comment that you have already verified that the
address works in a non-controversial way during the subscription process.

FYI, I have not seen this sort of address verification from any other
mailing list servers in the open-source world, and I'm subscribed to many
of them (and they don't seem to suffer much spam).


Regards, Phil.

Greetings,

This is a required step in combatting spam. Lots of spammers do things
incorrectly, so we verify that the sender is valid, and their mail server
properly configured, before forwarding the mails. We cache responses to not
overwhelm the other mail servers and do so in a responsible manner.

However, folks across the Internet haven't found a good way to handle
mail, and until there is a solution for it, that works, these sorts of
issues will continue to arise. If you want to whitelist our range, I
recommend you whitelist 66.35.250.1/24. Do note that our mail servers may
change IPs in the future, so this is not a permanent solution.

Thank you,

David Burley
Quality of Service Analyst, SourceForge.net