Offlist spam

<hat='listadmin'>
Some folks have sent me private mail expressing concern that, if they 
post to [email protected], lately they receive maybe a dozen spams
over the following couple of days that look at first glance like mailing
list replies.

A couple of such folks have charged (in private mail to me) that our
Mailman is permitting spam _via_ the mailing list.   That is not the
case.  If you look attentively at the flurry of spams you receive,
you'll note that it's completely offlist traffic.  I've seen no reason
to think our mailing list server's being compromised.  The annoying
trick being used doesn't _need_ server compromise.

You might ask:  Can't I find out who's subscribed (apparently) with the
sole aim of sending offlist junkmail to persons who're posting?  Answer: 
I've so far found no visible connection between the non-subscribed
spam-sending entity and any specific subscriber.  (Of course, there are 
also other ways to detect posting activity, such as parsing additions to
our public archive.)  

If anyone wants to shoulder that task and thinks he/she might be better
at it, go to town.  However, I'll note that making this sort of malicious 
activity functionally impossible to track down on a public mailing list 
is pretty easy.

You might ask:  What's up with this?  My best guess:  It's a clever
evolution in spammer methods, because in 2018 the Internet's coin of the
realm is user engagement.  If you barrage with spam a user who has
provably just sent mail to a public medium, and give it the surface
appearance of a response within that medium, you make it much more
likely your Internet noise will rise above the rest of the Internet
noise hitting the user.  Meanwhile, this is yet another reason to 
dislike suddenly unexplained offlist responses to public threads, and it
might be wise to make antispam software treat such received mail as
suspect.
</hat>