[Mailman-Users] Re: Malicious web subscription requests

2025-06-25 Thread Rich Kulawiec
I've observed this as well, in two incidents over the past 60 hours. I do not recommend captchas (for this or anything else) because they were thoroughly defeated ~15 years ago. I recommend firewall rules: there is no reason in the world to continue to allow access by people, systems, or networ

[Mailman-Users] Re: Malicious web subscription requests

2025-06-24 Thread Bill Cole
On 2025-06-24 at 00:53:55 UTC-0400 (Tue, 24 Jun 2025 04:53:55 + (UTC)) Stephen J. Turnbull is rumored to have said: Jayson Smith writes: [...] I also don't quite understand the motivation for subscribe form flooding. What does the bad actor gain from sending out tons of subscribe request

[Mailman-Users] Re: Malicious web subscription requests

2025-06-23 Thread Stephen J. Turnbull
Jayson Smith writes: > Thanks for this information. However, I'm not sure this type of > CAPTCHA is very effective any more. All CAPTCHAs are effective to some degree. Whether a "dumb" text captcha would be effective depends on the sophistication of the attacker. I don't know about the subscr

[Mailman-Users] Re: Malicious web subscription requests

2025-06-23 Thread Jayson Smith
Hi again, Thanks for this information. However, I'm not sure this type of CAPTCHA is very effective any more. The problem is that LLM's can, in my experience, effortlessly answer the types of self-referencing questions that have been quite popular with these types of challenges in the past (W

[Mailman-Users] Re: Malicious web subscription requests

2025-06-23 Thread Mark Sapiro
On 6/23/25 19:19, Jayson Smith wrote: I know there's been lots of discussion about the topic of malicious web subscribes in the past. However, with the two lists I run, there's a special situation. Almost all people subscribing to these lists are blind, so a visual CAPTCHA is entirely inappro