Subject: Re: Your messages to cypherpunks
From: Greg Newby <[email-masked]>
To: mailbombbin <[email-masked]>
Cc: Karl Semich <[email-masked]>, Greg Newby <[email-masked]>
Date: Sun, 17 Sep 2023 07:43:51 -0700

Hi Karl. Thanks for your note.

There are indeed two problems. I spent several hours yesterday going
through logs and making a few adjustments to the settings on the server, so
I think I have a reasonable understanding of the situation.

For the messages that YOU send, there is definitely a problem. There are
thousands of bounces still in the queue from cypherpunks subscribers where
the email system they use, like gmail or yahoo, started rejecting message
from you saying that too many messages have been sent.

This is rate limiting by the email services. It's not just gmail and yahoo
that do this.

The end result is that your messages are not delivered immediately to
subscribers. Sometimes they bounce permanently (i.e., will never be
delivered) and other times it's a temporary issue until, after a quiet
period of at least a few hours, the messages are accepted again.

Here is the first part of an example log message that lists around 100
gmail users:
D34D811C0238   11973 Sat Sep 16 21:07:34
[email-masked]
(host alt1.gmail-smtp-in.l.google.com[209.85.202.27] said: 421-4.7.28
[69.55.231.143      15] Our system has detected an unusual rate of
421-4.7.28 unsolicited mail originating from your IP address. To protect
our 421-4.7.28 users from spam, mail sent from your IP address has been
temporarily 421-4.7.28 rate limited. Please visit 421-4.7.28
https://support.google.com/mail/?p=UnsolicitedRateLimitError to 421 4.7.28
review our Bulk Email Senders Guidelines.
n18-20020a5d4012000000b003200b1e9219si887019wrp.921 - gsmtp (in reply to
end of DATA command))

Unfortunately this doesn't just impact messages from you. Any message from
the server to those services is held or bounced.

Because cypherpunks isn't the only service on my server, this means that
some of the other activities are impacted. This includes one of my key
volunteers for Project Gutenberg who utilizes a yahoo.com email address --
my messages to him were rejected, even though he has nothing to do with
cypherpunks and it was even from a different hostname (lists.pglaf.org not
lists.cpunks.org, but they are both hosted on the same system).

I hope this longish explanation explains why the frequency of your messages
creates a big problem for the cypherpunks list, why many subscribers will
never see your messages, and why it creates indigestion for other stuff the
server needs to do.

The second problem is that someone has targeted you for the unsubscription
mail bombs. I spent awhile trying to mitigate this, and the only immediate
solution would be to remove you from the cypherpunks subscriber list and
let you subscribe from another address.

Luckily those messages seem to have stopped for now. Yesterday, for perhaps
12 hours, around one password reset per second was being sent. This
resulted in a backlog of over 30000 (!) messages that were clogging up my
server, but could not be delivered to you because of gmail rate limiting.
So, you would have gotten a whole lot more of those messages if I hadn't
deleted them all.

The attack was distributed. Each request came from a different IP address -
I counted over 200,000 of these. I'm not sure how many you got before I
deleted 30,000 and it seems the attack stopped early in the evening
Saturday night (maybe by 6pm PDT). If it hasn't stopped entirely, it is
definitely a lot less frequent now. I could take a closer look at the
logfiles if it might be helpful.

If the attack was from a single IP address or group of IP addresses I could
block them easily enough. But they came from a different address every time.

Clearly someone got on the dark web and hired a botnet army to send all of
these password reset requests against you.

So, that is also a problem because it also caused gmail (your mail service)
to start rejecting messages to anyone.

I'm going to be outside for the next 8-10 hours, and will see any messages
from you when I return. Thanks for your understanding about this. As I
tried to say below, I'm not trying to censor your messages. But the
frequency of messages should decrease to avoid the first type of problem
above, and this can be done by you sending fewer longer messages rather
than many short messages.

Best regards,
  Greg

On Sun, Sep 17, 2023 at 7:24 AM mailbombbin <[email-masked]> wrote:

> Greg thank you for messaging me about this.
>
> So you know, I have been receiving high-frequency mailbombs sent via
> the list, in the form of password recovery requests and removal
> requests. I have tens of thousands of these filtered on this address,
> and they delay the delivery and receipt of mails for me. They come
> reliably, many per hour.
>
> Is it possible this is the source of the clog on the list, rather than
> my sporadic posts?
>