CS Department Spam Update December 2007

As you may know the University has rolled out some new spam control software recently.

Very soon the Computer Science Department will make use of this new service for email as a value-added complement to our current spam controls.
This page will give you some background and info you need to understand the small changes you will notice.

BACKGROUND

Historically the Computer Science Department has not actively participated in the University spam control program for a variety of reasons. The two most important reasons being overall efficacy, and cost.

We have been working with the University ITS group to try to resolve some of the barriers to our participation in the program. We currently employ a number of strategies to manage junk email here in CS. Our email enters the University at an ITS mail exchange and is scanned for viral attachments before it is relayed into CS. Once mail arrives here in CS, Spamassassin is the centerpiece of our anti-spam effort and has enabled our users reasonable control over the constant flood of junk entering their inboxes. The junk volumes continue to rise though. UR reports a 200% increase over the last couple of years.

HOW DOES IT EFFECT ME?

-In General
The default settings for quarantine are extremely conservative (much less aggressive than our default spamassassin settings were when we originally rolled it out). It is very unlikely that a message quarantined under the default setting is not indeed spam. This also means the default will allow a lot of spam through but very high probability messages will be held (think Viagara...).

Some people read spam. If you are one of them you can opt-out your email address or change the settings more to your liking. Maybe you actually do buy Viagara online.

If you already use a first.lastname@rochester.edu email address you are already using this system for messages addressed to that email address.

ITS Spam Management Page
http://www.rochester.edu/it/spam/
-Mailing list and alias maintainers
If you maintain a mailing alias or mailman mailing list you can identify your aliases and notify lab staff (labstaff AT cs.rochester.edu) by December 3, 2007. Include the alias name(s) and your Netid. We will arrange association of the aliases to your UR Netid prior to going live. Spam to those aliases will then go into your quarantine.

You can also add aliases after we go live by submitting a request via a web form to ITS asking that an additional email address be associated to your Netid.

If you do not associate an alias with your Netid the alias address will receive default spam filtering of very high probability spam. You will not be able to view any messages blocked to that address unless it is associated to your Netid. The default settings are very conservative and very unlikely to block a message that isn't really spam so you may choose not to bother.
-Remote Alumni, Faculty, and Grads with courtesy CS shell accounts but no URNetid
At some point after leaving the University your NetID will be deactivated by the University. Some alumni may have predated the NetID system altogether. Originally designed as a payroll login it has become a defacto single sign on id for many University services.

Without a UR Netid you won't be able to access a spam quarantine. Since the quarantine should only contain extremely high probability junk you may not care. Of course you also won't be able to change preferences from the default.
What if I don't have a NetID?
With No NetID Your options follow:
  1. You can continue to receive your mail, allowing ITS to block any high probability spam, but have no access to search for false positives, change your spam parameters, etc.
  2. You can choose to give up your URCS account (contact labstaff AT cs.rochester.edu) and allow your mail to bounce back to the sender.
  3. You can contact CS labstaff and we can explore other possible solutions or work-arounds.
If you are a former CS affiliate using your URCS account as your primary email account, it is probably a good idea to consider obtaining additional email service to use as your primary email provider.

Other FAQ's

What is the advantage of having incoming mail also scanned for SPAM at the same time the anti-virus check is performed 
(before it is relayed to CS)?
Large volumes of very obvious Spam from well known spam sources will be quarantined at ITS and safely reduce Junk mail volumes to our inboxes and reduce load on resources both human and hardware. But the most significant benefit may be that by preventing very obvious spam from reaching the CS server we reduce exposure to blacklisting when some of these messages bounce or are forwarded to other domains with aggressive spam controls and appliances.
Will this help prevent our getting blacklisted again?
Some of the more nefarious spam techniques which we can't block at our server will be severely curtailed and significantly reduce the threat of cs mail servers being blacklisted. Blacklisting occurs when a third party perceives us as a source of spam and reports our domain or servers to a blacklisting service. Anyone subscribing to the service will begin to refuse email from us. These lists once were just a minor annoyance if we were incorrectly characterized but now have become a major problem posing potential serious interruptions of service. There are usually no quick ways to be removed and there is no consultation before being added. Additionally these lists often inform a network of other lists in a viral manner and so the longer your server remains on a blacklist the more likely it is that we have to manage removal from multiple other sources as well.
When will this happen?
Anti-Spam is scheduled to be turned on for CS on December 10, 2007
What will change?
  1. Everything stays exactly the same except that very high probability spam will be held in a quarantine for two weeks which is accessible via your web browser.
  2. You can view the quarantined messages by logging in to a special page with your URNetid.
  3. You can change your preferences to be more or less lenient, just "tag and pass", or you may opt-out your email address entirely.
  4. Your CS email address will automatically be enrolled unless you contact labstaff prior to the go live date with a special request to be pre-opted-out. We will try where possible to accommodate these special requests and facilitate ITS making config changes prior to the going live.
  5. CS Email aliases you control have to be associated with your NetID for filtered messages addressed to those aliases to be placed in your quarantine.
What will not change?
  1. CS still manages it's own mail server and runs spam controls like spamassassin There is just a pre-scan done at ITS.
  2. You continue to use whatever mail reading program you do now. You don't have to change your mail client. For the most part the change is relatively transparent.
What about  TA's and Course Accounts?
For course accounts a guestNetid (and quarantine) can be obtained for the term the class is in session if required.
I am an undergrad and although I have a Netid my cs.rochester.edu email address is not associated with it. What do I do?
If your Netid is not currently associated with your cs.rochester.edu email address you should login to the spam management page and add it.

https://urspam.ur.rochester.edu/

After you login with your Netid choose:

"I want spam to be managed for a New email address"

This will provde you with a form that has a drop down list of all addresses associated with your Netid.
If your cs.rochester.edu address is not in the drop down list then fill in the

"Add new Email Address for spam management" field and hit the "Create Service Request" button.

If you don't associate your cs.rochester.edu email address to your Netid, spam addressed to your cs.rochester.edu email address will not be viewable in your online quarantine.
What if I really don't want my email quarantined?
You can contact lab staff asap (labstaff AT cs.rochester.edu) and we will opt you out before the filtering begins. You can also change your settings later (via the web). Personal preferences via the web interface that tell the system not to place any messages in the quarantine include "opt-out" and "tag-and-pass".

[Last Modified: Wednesday, 14-Nov-2007 18:02:12 EST]