I recieved this email three times from three different addresses. The first was some random gmail address, then one came an email address starting with aa at my university (I assume someone found a list of students and just picked the first one), and the last came from yael at my university.

The emails were sent half an hour apart. Here's the kicker: the second two seem to have been sent BY the university's mail servers.

Received: from mta04.redacted.edu (LHLO mta04.redacted.edu)
 (583.289.7.707) by mail12.redacted.edu with LMTP; Mon, 11 Feb 2013
 17:32:00 -0600 (CST)
Received: from localhost (localhost.localdomain [127.0.0.1])
	by mta04.redacted.edu (Postfix) with ESMTP id EAAF72A0ECC;
	Mon, 11 Feb 2013 17:31:59 -0600 (CST)

Here's the content of the emails, which differed in number of newlines between various "paragraphs".

Attention Our Valued Social Webmail user!

It has come to our notice that You have exceeded the maximum size set
for your mailbox, therefore we have place your email on security update.

Click or copy this link on your browser to increase the size of your
mailbox instantly

http://www.[REDACTED]financialloanfirm.com/webmail/account-validator/Email~Quota.php

Last Warning: failure to increase the mailbox size will definitely result in
permanent inability to log-in to your mailbox.

--
This message has been scanned for viruses and dangerous content by
OpenProtect(http://www.openprotect.com)and is believed to be clean.

Yes, I'm supposedly required to remove my email off security update by copying a link my browser and going to some random financial loan firm's website. If I don't do this, I will apparently be permanently locked out of my email, and unable to read these three emails.

TRWTF: People who fall for this stuff

Every once in a while I have to send an SMS to my boss saying that his e-mail quota has been exceeded, so he can clean out his garbage and get nice fresh new garbage in there.

Dumb question: Why can't e-mail systems have a phone number for you where it can send an SMS itself when you're over quota?

 The school board my wife works for is large enough to have some of these "over quota" phising attacks crafted for them. They exactly replicate a legitimate over-quota messages, including the board logo, font style, etc.  Except it also includes a "click here" link to either a credential stealing site, or a malware dump.

Every time one of these emails makes the round, there's a follow up angry email from the IT department to all staff yelling at them for falling for the trick.

Now, TRWTFs are:

1) The IT staff's response is to publicly yell at less than tech-savvy users. Note that this is the ONLY "training" provided. You can imagine how well it goes over.

2) The IT dept has set such a low quota, that teachers are hit with legitimate "Go empty your fucking inbox" messages. The solution isn't, of course, to increase the per-user quota. Especially not since the users have to use their board email address for all official correspondence, and are heavily encouraged to keep all correspondences just in case of a lawsuit or something.

3) The IT dept spends all their time yelling at users to not fall for the same trick over and over (for exaggerated values of 'all users' and 'over and over')-- rather than installing a spam filter. Any spam filter. Even the most simplest of ones to say "IF email fuzzy contains 'Your mailbox is over quota' AND source <> Our Own Fucking Goddamn Server THEN Murder it!".  Because that would require-- umm, skill? Technical knowledge? Basic competency?

4) How do these people get jobs, aside from being friends with a board administrator. Or, wait, that IS how they get the job? Frowny face. 

TRWTF is under-funded schools. Poor IT seems to be a staple. I went to a sixth form where the computing teacher was against people using email. How else was I supposed to communicate with my friend who had left the sixth form for another college?

Lorne Kates:

4) How do these people get jobs, aside from being friends with a board administrator. Or, wait, that IS how they get the job? Frowny face. 

 

 

1) Structure is small, so you only need 1 it guy. So the people interviewing the it guy are not computer savvy. There is no career to do when you are alone. Most competent people do not apply for such job. You end up with an incompetent that can convince that is (bad) way is "how it is done"

2) Structure grow, you need  more people. Guess who has to choose new IT guys?If you were incompetent, would you choose coworker that would prove your incompetecy?If you were convinced your bad way is the good way, would you accept something telling the opposite?

 

Shoreline:

TRWTF is under-funded schools. Poor IT seems to be a staple. I went to a sixth form where the computing teacher was against people using email. How else was I supposed to communicate with my friend who had left the sixth form for another college?

Schools generally aren't under funded (in the US, but I know Lorne isn't in any of the 57 states). They just don't spend wisely.

Lorne Kates:

2) The IT dept has set such a low quota, that teachers are hit with legitimate "Go empty your fucking inbox" messages. The solution isn't, of course, to increase the per-user quota. Especially not since the users have to use their board email address for all official correspondence, and are heavily encouraged to keep all correspondences just in case of a lawsuit or something.

That sounds like half of a fairly common "solution". The other half is the part where the tiny mailboxes are worked around by having all the corporate workstations set up to download all mail to local .pst files via POP3 so that the mailboxes stay somewhat clean. Of course Outlook is the mandatory mail client, because that Just Happens when we install Office and no we don't know how to change it and anyway why would you want to eat anything but wraps? No, of course we don't back up .pst files, or anything else for that matter, off people's own workstations. If you want it backed up, save it on the server. What do you mean, you can't find your .pst file? Just because Outlook stuffs it inside some obscure hidden folder? Fucking users. Who needs em.

AndyCanfield:

Dumb question: Why can't e-mail systems have a phone number for you where it can send an SMS itself when you're over quota?

 

I thought newer version of MSExchange has SMS alerting functionality. Any Windows postmaster sysadmins care to enlighten us?

Lorne Kates:

4) How do these people get jobs

 

Two options:

1. They're not skilled or competant enough to get a real job
2. The position pays so poorly that it doesn't attract anyone with the skills required to properly fulfill responsibilities but inexperienced/inept kiddiots that can fudge their way through.

Lorne Kates:

aside from being friends with a board administrator

Okay, so there's a third option: "your son knows a bit aobut computers, eh? How'd he like to come work for us?"

flabdablet:

<snip obvious Devil's advocate about obnoxious incompetant IT staff> Fucking users. Who needs em.

 

Sadly, I've encountered too many "network admins" with this perception.

Cassidy:

I thought newer version of MSExchange has SMS alerting functionality. Any Windows postmaster sysadmins care to enlighten us?

I'm not an admin on such a system, but it does have such a capability if set up right. And if the flying elephant is whistling the fandango at the correct tempo. (Oh well, at least our Exchange system has been configured with a healthy amount of disk space and no spavined quotas.)

Last week the head of IT sent around an email warning about the latest crop of phishing emails and how you should't fall for them by clicking on any of the links in the email. As a part of the email he included a link to a page that describes how phishing attacks occur and also a re-assuring description that "this is a valid link".

boomzilla:

Shoreline:

TRWTF is under-funded schools. Poor IT seems to be a staple. I went to a sixth form where the computing teacher was against people using email. How else was I supposed to communicate with my friend who had left the sixth form for another college?

Schools generally aren't under funded (in the US, but I know Lorne isn't in any of the 57 states). They just don't spend wisely.

 

Yes, the unfortunate fad is to spend millions of dollars on football stadiums, and then drop a bunch of useful classes like workshops to make up for it.

OzPeter:

As a part of the [warning] email he included a link to a page that describes how phishing attacks occur and also a re-assuring description that "this is a valid link".

My usual response to this sort of idiocy, is to forward the mail to the department responsible for both filtering this sort of thing and sending such warnings out, indicating that their filters are still letting that sort of thing through.

PJH:

My usual response to this sort of idiocy, is to forward the mail to the department responsible for both filtering this sort of thing and sending such warnings out, indicating that their filters are still letting that sort of thing through.

 

.. or forward it to the company with the heading "if you receive a message from $PHB telling you to click on a link then IGNORE IT because it's PHISH!"

AndyCanfield:

Every once in a while I have to send an SMS to my boss saying that his e-mail quota has been exceeded, so he can clean out his garbage and get nice fresh new garbage in there.

Dumb question: Why can't e-mail systems have a phone number for you where it can send an SMS itself when you're over quota?

I would answer, "because the entire concept of quotas is fucking retarded and needs to go away."

doomsought:

boomzilla:

Shoreline:

TRWTF is under-funded schools. Poor IT seems to be a staple. I went to a sixth form where the computing teacher was against people using email. How else was I supposed to communicate with my friend who had left the sixth form for another college?

Schools generally aren't under funded (in the US, but I know Lorne isn't in any of the 57 states). They just don't spend wisely.

Yes, the unfortunate fad is to spend millions of dollars on football stadiums, and then drop a bunch of useful classes like workshops to make up for it.

Actually, the biggest problem seems to be beefing up on administrative personnel (not to mention generous benefit packages). Not that a lot of money isn't wasted in other creative ways. But stuff like construction, IME, is typically funded through long term borrowing, not annual budgets, and isn't included in the per student spending figures.

OzPeter:

Last week the head of IT sent around an email warning about the latest crop of phishing emails and how you should't fall for them by clicking on any of the links in the email. As a part of the email he included a link to a page that describes how phishing attacks occur and also a re-assuring description that "this is a valid link".

 

A load of Oxford University email accounts got hit by this type of scam last week. My college's IT admin decided that the best course of action was to forward us an example - with the link to the (google docs powered) phishing page still live!

blakeyrat:

I would answer, "because the entire concept of quotas is fucking retarded and needs to go away."

 

And you would be wrong.

The concept behind quotas is limiting consumption. Without this level of control, business services can be impacted when capacity becomes a premium.

blakeyrat:

AndyCanfield:

Every once in a while I have to send an SMS to my boss saying that his e-mail quota has been exceeded, so he can clean out his garbage and get nice fresh new garbage in there.

Dumb question: Why can't e-mail systems have a phone number for you where it can send an SMS itself when you're over quota?

I would answer, "because the entire concept of quotas is fucking retarded and needs to go away."

That is the correct answer.  Seriously.  People can set up a "file locker" website and store terabyte after terabyte of porn, warez, whatever . . . but you've got a "quota" on your employees email?  WTF indeed.

 

Ben L.:

http://www.[REDACTED]financialloanfirm.com/webmail/account-validator/Email~Quota.php

Huh.  I got all excited when they left directory browsing enabled and there was a subdirectory called 'login', but I didn't find a list of phished emails and pws there.

 

blakeyrat:

AndyCanfield:

Every once in a while I have to send an SMS to my boss saying that his e-mail quota has been exceeded, so he can clean out his garbage and get nice fresh new garbage in there.

Dumb question: Why can't e-mail systems have a phone number for you where it can send an SMS itself when you're over quota?

I would answer, "because the entire concept of quotas is fucking retarded and needs to go away."

And then you get to try to explain that to one of your customers, who discovered that the Windows 2000 box that was running their payroll app is about to die, so they ran out and bought a new Windows 7 desktop to replace it.  Good luck convincing these guys to buy a bigger hard drive for the mail server.

FrostCat:

And then you get to try to explain that to one of your customers, who discovered that the Windows 2000 box that was running their payroll app is about to die, so they ran out and bought a new Windows 7 desktop to the Salvation Army and bought the same looking computer to replace it.  Good luck convincing these guys to buy a bigger hard drive for the mail server.

 

Saddingly realistic-ized that for you.

Ben L.:

This message has been scanned for viruses and dangerous content by OpenProtect(http://www.openprotect.com)and is believed to be clean.

 I dunno. It says right there that they scanned the email for viruses, so it's probably on the up and up. If they take the extra care to make sure the email doesn't have viruses I'm sure the manual redirect site is legit.

boomzilla:

Shoreline:

TRWTF is under-funded schools. Poor IT seems to be a staple. I went to a sixth form where the computing teacher was against people using email. How else was I supposed to communicate with my friend who had left the sixth form for another college?

Schools generally aren't under funded (in the US, but I know Lorne isn't in any of the 57 states). They just don't spend wisely.

According to the company SEC documents, I work for a multi-billion dollar international company that is making money hand-over-fist and we only got relief from our 250meg mailbox limit a year ago. I would suspect that "adequate funding" and "good IT decisions" don't have a strong correlation.

 We have 20,000 employees, and 250MB - 400MB mailbox limits each (naturally, users have PST files ranging from 500MB to 3GB).  Without this limit, our Exchange servers alone would consume over 20TB of our SAN storage.  We have better things to use 20TB on.

That entire post can be summarized as, "I do not know the concept of 'false economy'."

OzPeter:

As a part of the email he included a link to a page that describes how phishing attacks occur and also a re-assuring description that "this is a valid link".

How do you know that's where it went? Clicked on it, did you?

I sent around one of those once. The link target on mine phished their existing Windows logon password, and triggered a cgi script that checked whether they'd typed in the real one and disabled their AD account if they had. It was a pretty good way to generate needed conversations with those who outed themselves as clueless.

blakeyrat:

That entire post can be summarized as, "I do not know the concept of 'false economy'."

There is actually a real issue behind this. Too many people are sharing official documents through e-mail. When I have to share a document within my team or between teams, I always do it through a version controlled system. Depending on the classification of the document, it either goes into our own TFS (project related), Sharepoint site (Team related), Network Share (software) or the official company document repository (in case the information is needed by other teams as input for their work, signed documents,...)

I'm only mailing links to people, never documents. So there is NEVER discussion on what is the latest version of a document. When I receive a link to a document, I add it to my OneNote notebook and then delete the mail. If someones sends me a document, I save it to a local folder, delete the mail and ask the sender to share it according to the company guidelines.

The official document repository is very important to the client I'm currently working for. They don't want important documents to only live inside someone's mailbox. A small quota on your mailbox, forces you to think about proper document sharing.

 

blakeyrat:

That entire post can be summarized as, "I do not know the concept of 'false economy'."

 

 I agree at the enterprise level. Storage ain't that expansive, and denying it have the same economic sense as denying pencils, or making your IT staff clean the floor instead of hiring a dedicated team. (I have seen that in a small shop).

 But there can be a true economy for the IT staff, which is that they don't have to make the effort to get thoses ressources. They can be a lot of administrative shenanigan to have anything that is not self-evident sometime.

El_Heffe:

blakeyrat:

I would answer, "because the entire concept of quotas is fucking retarded and needs to go away."

That is the correct answer.  Seriously.  People can set up a "file locker" website and store terabyte after terabyte of porn, warez, whatever . . . but you've got a "quota" on your employees email?  WTF indeed.

I'm not certain I follow your logic here.

Because a website offers a terabyte storage facility, we shouldn't impose limits upon mail servers...?

flabdablet:

I sent around one of those once. The link target on mine phished their existing Windows logon password, and triggered a cgi script that checked whether they'd typed in the real one and disabled their AD account if they had.

 

My boss did something similar, except I coded a script to show who (and when) users had clicked on it, with a note to say that they've been added to the list of gullible users that currently looks like [list] in an attempt to name and shame those who fell for it.

Your approach goes further and amuses me greatly.

TheLazyHase:

I agree at the enterprise level. Storage ain't that expansive, and denying it have the same economic sense as denying pencils, or making your IT staff clean the floor instead of hiring a dedicated team. (I have seen that in a small shop).

 

Storage, like anything else, is a resource that needs to be shared out amongst users of that service and is often a fixed entity: usually there is a finite amount of storage and it'll be consumed slowly or quickly according to behaviour or practise. Capacity Management is often a race between users trying to fill up storage versus storage managers trying to free up required capacity. Quotas simply put some artificial stick in the sand that both cannot overtread.

People who claim "storage is cheap" often overlook the hidden costs associated with management of that storage: longer to backup/restore/search with more data, shaping behaviour away from wasteful consumption towards good housekeeping, possible downtime for disk upgrades (which - in this day of hotswap systems - is a solved problem), etc. Quotas and limits are simply a method used to prevent over-consumption from one area impacting adversely upon another.

I agree that some limits are set stupidly low (look at Snoofle's stories of DBAs that refuse to raise soft limits but expect people to throw larger money at workarounds) but that's not a reason for not having them. That's a fault of those who set the limits, not of the limitation mechanism itself.

As with anything, abuse or misuse of a control feature is not a reason to deactivate that feature. There's a reason it exists: use it properly and appropriately and it serves its purpose. Neglect it - or bypass it - and control falls back to human intervention... and by then, it's often too late.

flabdablet:

OzPeter:

As a part of the email he included a link to a page that describes how phishing attacks occur and also a re-assuring description that "this is a valid link".

How do you know that's where it went? Clicked on it, did you?

Actually I did not click on it :P My knowledge of where it went was based on the link being something like Domain.com/attacks/stupidity/phishing/description So assuming it was valid then the link went where you expected it. But given that I don't click on things that look like they come straight out of "Phishing attacks 101" I'll just never know where it goes.

Cassidy:

Storage, like anything else, is a resource that needs to be shared out amongst users of that service and is often a fixed entity: usually there is a finite amount of storage and it'll be consumed slowly or quickly according to behaviour or practise. Capacity Management is often a race between users trying to fill up storage versus storage managers trying to free up required capacity. Quotas simply put some artificial stick in the sand that both cannot overtread.

 

 Then again, storage space is the same as pencil. It's possible that sometime user abuse of it,but using quota is akin to count pencil per pencil. If it spiral out of control, you may take measures and ask people to hoard less, but it's more the clue that something is rotten somewhere than something that happen with any regularity.

 

bjolling:

A small quota on your mailbox, forces you to think about proper document sharing.

It may force you to think, but it forces normal users to archive everything to their local drives, which are usually not backed up.

PedanticCurmudgeon:

bjolling:

A small quota on your mailbox, forces you to think about proper document sharing.

It may force you to think, but it forces normal users to archive everything to their local drives, which are usually not backed up.

Also, if you really want large documents moved to some alternate storage, why not have the email server just do it automatically in the first place? Why force the users to do manual work when you could easily do it for them? Then there can't be any screwups, the users get a more friendly experience, and everybody's happy, right? Duh?

And seriously, 20 TB for 20,000 employees? That's peanuts. PEANUTS! And yes I know what redundant backed-up storage costs, it's still fucking peanuts. Imagine that 20,000 employees' health coverage costs. Your storage is a tiny fraction of one percentage of that. The fact that he thinks it's some kind of issue means he has NO idea what things cost at all. Talk to your company's head accountant, give them the cost of your drives, and they'd laugh you out of their office going, "don't bother me with that petty shit, just do it!"

Lorne Kates:

FrostCat:

And then you get to try to explain that to one of your customers, who discovered that the Windows 2000 box that was running their payroll app is about to die, so they ran out and bought a new Windows 7 desktop to the Salvation Army and bought the same looking computer to replace it.  Good luck convincing these guys to buy a bigger hard drive for the mail server.

 

Saddingly realistic-ized that for you.

That's a funny "FTFY," but this was a true story. Customer called, asking for some app installation help for "the new server," and when the meeting started, it was a Win7 box. Fortunately for me, this is what passes for a WTF where I work, most of the time.

Kyanar:

 We have 20,000 employees, and 250MB - 400MB mailbox limits each (naturally, users have PST files ranging from 500MB to 3GB).  Without this limit, our Exchange servers alone would consume over 20TB of our SAN storage.  We have better things to use 20TB on.

I know SAN != "mirrored RAID," but 20TB of commodity disks is ~$1600 (going by the price of the first 1TB drive I saw on Newegg.) As the very next post to yours says, "That entire post can be summarized as, "I do not know the concept of 'false economy'."" How much time is spent every day by users deleting old mail to keep under the limit? At the last place I worked at that was dumb enough to have quotas, I probably spent 10-20 minutes every week prioritizing what I felt I could live without.

bjolling:

Depending on the classification of the document, it either goes into our own TFS (project related), Sharepoint site (Team related), Network Share (software) or the official company document repository (in case the information is needed by other teams as input for their work, signed documents,...)

 

I guess having Four Official Document Repositories is better than having none...

 

Ridiculously short retention policies are more of a problem with email management than small disk quotas, in my opinion.   If you weigh the risk of potential legal action over something mentioned offhand in an email 5 years ago, and the risk of important knowledge falling down the memory hole after 90 days, and decide that the former is more important, I question your business judgment.

 

 

FrostCat:

At the last place I worked at that was dumb enough to have quotas, I probably spent 10-20 minutes every week prioritizing what I felt I could live without.

Your problem wasn't the storage quota.

 

Kyanar:

 We have 20,000 employees, and 250MB - 400MB mailbox limits each (naturally, users have PST files ranging from 500MB to 3GB).  Without this limit, our Exchange servers alone would consume over 20TB of our SAN storage.  We have better things to use 20TB on.

GMail gives me 10 GB and I don't work for them nor do I pay a dime for this service, and I'd bet my next paycheck that they far exceed 20,000 users.

A mid-range Dell rack server with a ~20 TB (RAID 6) data drive runs like $10K. That should be bare minimum for a company your size, and $0.50 per user to give them each a 1 GB mailbox. But then again business don't look at things in that perspective, even the small company I work for will quibble about store-brand vs name-brand soda in the break room while simultaneously writing themselves 5-digit bonus checks.

 

Cassidy:

AndyCanfield:

Dumb question: Why can't e-mail systems have a phone number for you where it can send an SMS itself when you're over quota?

 

I thought newer version of MSExchange has SMS alerting functionality. Any Windows postmaster sysadmins care to enlighten us?

 

 

Correct! But need help for configuration and also talk with vodafone to set it up.

 

PedanticCurmudgeon:

bjolling:

A small quota on your mailbox, forces you to think about proper document sharing.

It may force you to think, but it forces normal users to archive everything to their local drives, which are usually not backed up.

 

 

Do not provide local drive. Force them to save all to network drive. Work on this trick and you have back up of everything.

 

Nagesh:

Force them to save all to network drive.

 

.. which still brings about the capacity issues discussed earlier.

Mail stored in a mail spool or in a separate PST file that's held on a network drive is still going to consume space - just in a different place.

I'm not really sure which suggested option is better (in/out of mail server)

Cassidy:

Nagesh:

Force them to save all to network drive.

 

.. which still brings about the capacity issues discussed earlier.

Mail stored in a mail spool or in a separate PST file that's held on a network drive is still going to consume space - just in a different place.

I'm not really sure which suggested option is better (in/out of mail server)

I suggest that the answer is always "in the mail server". That way the mail product's indexing and antimalware and backup features can operate on all messages.

FrostCat:

I know SAN != "mirrored RAID," but 20TB of commodity disks is ~$1600 (going by the price of the first 1TB drive I saw on Newegg.) As the very next post to yours says, "That entire post can be summarized as, "I do not know the concept of 'false economy'."" How much time is spent every day by users deleting old mail to keep under the limit? At the last place I worked at that was dumb enough to have quotas, I probably spent 10-20 minutes every week prioritizing what I felt I could live without.

Most businesses needing a 20TB SAN aren't going to be using using off-the-shelf stuff from Newegg, I just burned $15k on a 24TB storage array for 50 users. Still, storage can be cheap for media but there are a lot of other costs involved in adding that storage. I just finally got the greenlight to upgrade our ancient MS Exchange server and here are some of the financial implications of this process:

• Server old, larger drives are much more expensive than current tech so we replace server
• New server has more than 4GB of RAM so we upgrade to 64-bit O/S
• Old Exchange is no-go on 64-bit O/S so we upgrade Exchange
• This takes time, which as the only IT person for a company with heavy IT needs I do not have for such a large project, so we hire consultant to do it

So for us it's not as easy as just slapping in new drives and losing the quotas, just because some people are too f'n lazy to cleanup all the chain emails and Facebook notification spam from their mailboxes.

error_NoError:

So for us it's not as easy as just slapping in new drives and losing the quotas, just because some people are too f'n lazy to cleanup all the chain emails and Facebook notification spam from their mailboxes.

You're still missing the fucking point. It's a waste of your employee's time to clean up stuff from their mailbox. Your job as an IT person is to help people do their jobs, not give people MORE work to do. And regardless of your hardware and support costs, it's much less than the cost of all those employees having to STOP THEIR ACTUAL JOB and clean up their mailboxes.

You are the reason people hate IT. Stop it. We want people to like IT.

Manni_reloaded:

But then again business don't look at things in that perspective, even the small company I work for will quibble about store-brand vs name-brand soda in the break room while simultaneously writing themselves 5-digit bonus checks.

Parkinson's law of triviality?