On 04/11/2018 05:18 PM, Bill Cole wrote:
On 11 Apr 2018, at 17:50 (-0400), Dave Jones wrote:

On 04/11/2018 04:29 PM, billc...@apache.org wrote:
Author: billcole
Date: Wed Apr 11 21:29:08 2018
New Revision: 1828937

URL: http://svn.apache.org/viewvc?rev=1828937&view=rev
Log:
Google Forms has generated spam, befouling the google.com reputation

Modified:
     spamassassin/trunk/rules/60_whitelist_auth.cf

Modified: spamassassin/trunk/rules/60_whitelist_auth.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rules/60_whitelist_auth.cf?rev=1828937&r1=1828936&r2=1828937&view=diff ==============================================================================
--- spamassassin/trunk/rules/60_whitelist_auth.cf (original)
+++ spamassassin/trunk/rules/60_whitelist_auth.cf Wed Apr 11 21:29:08 2018
@@ -80,7 +80,6 @@ def_whitelist_auth *@visadpsmessage.com
  def_whitelist_auth *@*.pinterest.com
  def_whitelist_auth *@indeed.com
  def_whitelist_auth *@*.hyatt.com
-def_whitelist_auth *@*.google.com
  def_whitelist_auth *@*.sears.com
  def_whitelist_auth *@*.jcpenney.com
  def_whitelist_auth *@*.landsend.com



Do you have an example email of this?

Discussed on the Users list today. A mostly-Thai form with an internal Hotmail address.

If we report this to Google and they handle it properly, it doesn't mean that we need to remove this entry unless there is a major problem with trust.

I disagree. Handling complaints (which Google mostly doesn't in any case) is entirely inadequate to justify trusting mail sent by users they don't actually know with an active backend that has a track record of abuse. Google Docs has become a phishing platform and we should not be telling people to trust it by default.

A single email occurrence is not enough to remove them.

I don't have copies of the similar-sender garbage I've been rejecting because it has been aimed at bogus local addresses.

Besides, this *@*.google.com shouldn't be that common under a subdomain of google.com.  It's not *@google.com which would be a higher risk.

No, *@google.com is still apparently only Google corporate mail. The only spam I've ever seen from such addresses is stupid recruiter tricks.



I still contend that the benefits of that entry far outweigh a single report of spam that Google will handle if reported to them. They do handle abuse reports and lock accounts all of the time. I know this first hand from my own customers.

The def_white_auth entries aren't only for perfect senders but for senders that are targets of spoofing. They say that this email was from Google so we can block other non-Google senders spoofing Google Docs shares with malicious links.

No one can say that the have never sent spam outbound. It happens once in a while even to the best of us that go to great lengths to detect and prevent it. Most RBLs will tolerate a small amount junk email and only list an IP when it's persistent. These def_whitelist_auth entries should be treated the same way.

Dave

Reply via email to