5:02 p.m.
Bruno Wolff III wrote:
Christoph Frieben wrote:
> Does anybody have a good idea how to avoid the appearance of real mail
> addresses in the body of postings to fedora-devel/test-list when people
> reply to an earlier message? Could additional technical measures be taken to
Yes. Don't include your real address in your from header.
You have to include a real address, otherwise the list kicks it back and
won't post it. Only subscribed members can post.
1:39 a.m.
New subject: Real mail addresses in list postings and resulting **SPAM**
On Thu, Sep 24, 2009 at 17:02:28 -0500,
Allen Kistler <an037-ooai8(a)yahoo.com> wrote:
Bruno Wolff III wrote:
> Christoph Frieben wrote:
>> Does anybody have a good idea how to avoid the appearance of real mail
>> addresses in the body of postings to fedora-devel/test-list when people
>> reply to an earlier message? Could additional technical measures be taken to
>
> Yes. Don't include your real address in your from header.
You have to include a real address, otherwise the list kicks it back and
won't post it. Only subscribed members can post.
Nope. The list checks the envelope sender address, not what's in the From
header.
2:44 a.m.
New subject: Real mail addresses in list postings and resulting **SPAM**
Bruno Wolff III wrote:
Allen Kistler wrote:
> Bruno Wolff III wrote:
>> Christoph Frieben wrote:
>>> Does anybody have a good idea how to avoid the appearance of real mail
>>> addresses in the body of postings to fedora-devel/test-list when people
>>> reply to an earlier message? Could additional technical measures be taken to
>>
>> Yes. Don't include your real address in your from header.
>
> You have to include a real address, otherwise the list kicks it back and
> won't post it. Only subscribed members can post.
Nope. The list checks the envelope sender address, not what's in the From
header.
Fair enough. Possibly even true. I'll admit I haven't tried it.
Is there a handy mailer that can create envelopes with values different
from the body? Sending mail as root on the command line doesn't count
as "handy."
So trying to keep this thread relevant to Fedora, is there one in
Fedora? I use Thunderbird, so I'm pretty sure that won't do it.
7:08 a.m.
New subject: Real mail addresses in list postings and resulting **SPAM**
Allen Kistler wrote:
Bruno Wolff III wrote:
> Allen Kistler wrote:
>> Bruno Wolff III wrote:
>>> Christoph Frieben wrote:
>>>> Does anybody have a good idea how to avoid the appearance of real mail
>>>> addresses in the body of postings to fedora-devel/test-list when people
>>>> reply to an earlier message? Could additional technical measures be taken
to
>>> Yes. Don't include your real address in your from header.
>> You have to include a real address, otherwise the list kicks it back and
>> won't post it. Only subscribed members can post.
> Nope. The list checks the envelope sender address, not what's in the From
> header.
Fair enough. Possibly even true. I'll admit I haven't tried it.
Is there a handy mailer that can create envelopes with values different
from the body? Sending mail as root on the command line doesn't count
as "handy."
So trying to keep this thread relevant to Fedora, is there one in
Fedora? I use Thunderbird, so I'm pretty sure that won't do it.
With apologies to Allen, I take this chance to show just how easy it is
to forge email.
For those interested in checking whether this is a forgery (or at last
from a different source from the one I'm quoting), just check the headers.
The key point is that it's trivial to set an alternative identity (I'm
using seamonkey which might be another clue I'm not Allen), but
Thunderbird can do it too.
8:47 a.m.
New subject: Real mail addresses in list postings and resulting **SPAM**
On Fri, Sep 25, 2009 at 02:44:39 -0500,
Allen Kistler <an037-ooai8(a)yahoo.com> wrote:
Is there a handy mailer that can create envelopes with values different
from the body? Sending mail as root on the command line doesn't count
as "handy."
I thought gmail did this (allowed other email address while using a gmail
envelope sender address), but I don't have a gmail account to verify that.
It probably depends on what you are using to inject email. If you are using
sendmail and mutt, then you can turn off 'envelope_from' and sendmail
will use the user name and host name to make the envelope sender address
which then could be different than what mutt puts in the from header.
The -f option is used by sendmail (and probably most lookalikes that
provide a sendmail command) to specify an envelop sender address different
than the local user name and host name. I belive it is possible to configure
this so that you need to be special to use the -f option to affect, but
I doubt this is the default any more.
9:55 a.m.
New subject: Real mail addresses in list postings and resulting **SPAM**
Bruno Wolff III wrote:
Allen Kistler wrote:
> Is there a handy mailer that can create envelopes with values different
> from the body? Sending mail as root on the command line doesn't count
> as "handy."
I thought gmail did this (allowed other email address while using a gmail
envelope sender address), but I don't have a gmail account to verify that.
Gmail probably does what Yahoo! does: lets you set BOTH to something
that's not gmail/yahoo, as long as you can verify that the substitute
value is also a valid email address that you own. But I don't have a
Gmail account, either.
3:58 p.m.
New subject: Real mail addresses in list postings and resulting **SPAM**
not Allen Kistler wrote:
Allen Kistler wrote:
> So trying to keep this thread relevant to Fedora, is there one in
> Fedora? I use Thunderbird, so I'm pretty sure that won't do it.
With apologies to Allen, I take this chance to show just how easy it
is to forge email.
For those interested in checking whether this is a forgery (or at last
from a different source from the one I'm quoting), just check the
headers.
The key point is that it's trivial to set an alternative identity (I'm
using seamonkey which might be another clue I'm not Allen), but
Thunderbird can do it too.
Sorry. I can't check your headers, since I get the digest. The only
thing I get is your TZ is +8, while mine is -5.
I know that Thunderbird (or virtually any other client) can set
alternative identities. Wholesale forgery is easy. We're after
something subtler.
When you sent the message to the list, did you do it with an envelope
that identified you as you or did you do it with an envelope that
identified you as me?
The trick is to do it with an envelope that identifies you as you, but a
message header that identifies you as, say, invalid(a)invalid.invalid.
Thunderbird sets them to be the same, without an option to change that.
(Hmm... Maybe an extension?) Bruno mentioned mutt allows them to be
different.
8:28 p.m.
New subject: Real mail addresses in list postings and resulting **SPAM**
Allen Kistler wrote:
not Allen Kistler wrote:
> Allen Kistler wrote:
>> So trying to keep this thread relevant to Fedora, is there one in
>> Fedora? I use Thunderbird, so I'm pretty sure that won't do it.
> With apologies to Allen, I take this chance to show just how easy it
> is to forge email.
>
> For those interested in checking whether this is a forgery (or at last
> from a different source from the one I'm quoting), just check the
> headers.
>
> The key point is that it's trivial to set an alternative identity (I'm
> using seamonkey which might be another clue I'm not Allen), but
> Thunderbird can do it too.
Sorry. I can't check your headers, since I get the digest. The only
thing I get is your TZ is +8, while mine is -5.
Here are all the headers I received:
Return-Path: <fedora-test-list-bounces(a)redhat.com>
Received: from murder ([unix socket])
by ns.demo.lan (Cyrus v2.2.12-Invoca-RPM-2.2.12-9.RHEL4) with LMTPA;
Fri, 25 Sep 2009 20:08:31 +0800
X-Sieve: CMU Sieve 2.2
Received: from hormel.redhat.com (hormel1.redhat.com [209.132.177.33])
by ns.demo.lan (Postfix) with ESMTP id 128E8474FCB
for <debian(a)herakles.homelinux.org>; Fri, 25 Sep 2009 20:08:31 +0800 (WST)
Received: from listman.util.phx.redhat.com (listman.util.phx.redhat.com
[10.8.4.110])
by hormel.redhat.com (Postfix) with ESMTP id CDEC361A824;
Fri, 25 Sep 2009 08:08:27 -0400 (EDT)
Received: from int-mx01.intmail.prod.int.phx2.redhat.com
(nat-pool.util.phx.redhat.com [10.8.5.200])
by listman.util.phx.redhat.com (8.13.1/8.13.1) with ESMTP id
n8PC8POF008445 for <fedora-test-list(a)listman.util.phx.redhat.com>;
Fri, 25 Sep 2009 08:08:25 -0400
Received: from mx1.redhat.com (ext-mx05.extmail.prod.ext.phx2.redhat.com
[10.5.110.9])
by int-mx01.intmail.prod.int.phx2.redhat.com (8.13.8/8.13.8) with ESMTP
id n8PC8PA0014882
for <fedora-test-list(a)redhat.com>; Fri, 25 Sep 2009 08:08:25 -0400
Received: from js.id.au (dsl-58-6-192-22.wa.westnet.com.au [58.6.192.22])
by mx1.redhat.com (8.13.8/8.13.8) with ESMTP id n8PC8EWv011998
for <fedora-test-list(a)redhat.com>; Fri, 25 Sep 2009 08:08:15 -0400
Received: from ns.demo.lan (unknown [192.168.4.10])
by js.id.au (Postfix) with ESMTP id E589B5F408B
for <fedora-test-list(a)redhat.com>; Fri, 25 Sep 2009 20:08:11 +0800 (WST)
Received: from bobtail.demo.lan (Bobtail.demo.lan [192.168.9.109])
by ns.demo.lan (Postfix) with ESMTP id 9DFC9474FCB
for <fedora-test-list(a)redhat.com>; Fri, 25 Sep 2009 20:08:11 +0800 (WST)
Message-ID: <4ABCB2AB.40905(a)yahoo.com>
Date: Fri, 25 Sep 2009 20:08:11 +0800
From: Allen Kistler <an037-ooai8(a)yahoo.com>
User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US;
rv:1.8.1.19) Gecko/20090222 SeaMonkey/1.1.14
MIME-Version: 1.0
To: For testers of Fedora Core development releases
<fedora-test-list(a)redhat.com>
References: <4ABBEC74.6070509(a)yahoo.com> <20090925063952.GA16327(a)wolff.to>
<4ABC74E7.3050705(a)yahoo.com>
In-Reply-To: <4ABC74E7.3050705(a)yahoo.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
X-RedHat-Spam-Score: 1.508 * (FORGED_YAHOO_RCVD,RDNS_DYNAMIC)
X-Scanned-By: MIMEDefang 2.67 on 10.5.11.11
X-Scanned-By: MIMEDefang 2.67 on 10.5.110.9
X-loop: fedora-test-list(a)redhat.com
Subject: Re: Real mail addresses in list postings and resulting **SPAM**
X-BeenThere: fedora-test-list(a)redhat.com
X-Mailman-Version: 2.1.5
Precedence: junk
Reply-To: For testers of Fedora Core development releases
<fedora-test-list(a)redhat.com>
List-Id: For testers of Fedora Core development releases
<fedora-test-list.redhat.com>
List-Unsubscribe:
<https://www.redhat.com/mailman/listinfo/fedora-test-list>;,
<mailto:fedora-test-list-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/fedora-test-list>
List-Post: <mailto:fedora-test-list@redhat.com>
List-Help: <mailto:fedora-test-list-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/fedora-test-list>;,
<mailto:fedora-test-list-request@redhat.com?subject=subscribe>
Sender: fedora-test-list-bounces(a)redhat.com
Errors-To: fedora-test-list-bounces(a)redhat.com
I know that Thunderbird (or virtually any other client) can set
alternative identities. Wholesale forgery is easy. We're after
something subtler.
When you sent the message to the list, did you do it with an envelope
that identified you as you or did you do it with an envelope that
identified you as me?
The trick is to do it with an envelope that identifies you as you, but a
message header that identifies you as, say, invalid(a)invalid.invalid.
Thunderbird sets them to be the same, without an option to change that.
(Hmm... Maybe an extension?) Bruno mentioned mutt allows them to be
different.
I recently (days) saw an option to add an arbitrary header. I don't
recall whether it was Thunderbird or Seamonkey - I have the Seamonkey
2.0 beta on Windows- but the config editor for Thunderbird and both
versions of Seamonkey I have on Windows show what looks like it. See
mail.compose selections.
It's a config-time option, not compose-time so it's not useful to me.
--
Cheers
John
-- spambait
1aaaaaaa(a)coco.merseine.nu Z1aaaaaaa(a)coco.merseine.nu
-- Advice
http://webfoot.com/advice/email.top.php
http://www.catb.org/~esr/faqs/smart-questions.html
http://support.microsoft.com/kb/555375
You cannot reply off-list:-)
1:42 a.m.
New subject: Real mail addresses in list postings and resulting **SPAM**
El jue, 24-09-2009 a las 17:02 -0500, Allen Kistler escribió:
Bruno Wolff III wrote:
> Christoph Frieben wrote:
>> Does anybody have a good idea how to avoid the appearance of real mail
>> addresses in the body of postings to fedora-devel/test-list when people
>> reply to an earlier message? Could additional technical measures be taken to
>
> Yes. Don't include your real address in your from header.
You have to include a real address, otherwise the list kicks it back and
won't post it. Only subscribed members can post.
Hello,
I think the best solution it's education.
If the mail client uses bad practices and includes the mail address in
the reply quote (such as "$DATE, Jhon Doe <jhon.doe(a)whatever.dom>
wrote:", please edit it by hand and at least remove the domain part from
the mail address.
Sometime ago this was called "netiquette" :)
Regards,
Juanjo
2 a.m.
New subject: Real mail addresses in list postings and resulting **SPAM**
On Fri, Sep 25, 2009 at 08:42:43 +0200,
"Juan J. Martínez" <jjm(a)usebox.net> wrote:
If the mail client uses bad practices and includes the mail address in
the reply quote (such as "$DATE, Jhon Doe <jhon.doe(a)whatever.dom>
wrote:", please edit it by hand and at least remove the domain part from
the mail address.
Sometime ago this was called "netiquette" :)
Accept this practice was never widely accepted. (Because it doesn't
actually work.)
If you want to keep your email address secret don't publish it.
6:56 a.m.
New subject: Real mail addresses in list postings and resulting **SPAM**
Bruno Wolff III wrote:
On Fri, Sep 25, 2009 at 08:42:43 +0200,
"Juan J. Mart�nez" <jjm(a)usebox.net> wrote:
> If the mail client uses bad practices and includes the mail address in
> the reply quote (such as "$DATE, Jhon Doe <jhon.doe(a)whatever.dom>
> wrote:", please edit it by hand and at least remove the domain part from
> the mail address.
>
> Sometime ago this was called "netiquette" :)
Accept this practice was never widely accepted. (Because it doesn't
actually work.)
If you want to keep your email address secret don't publish it.
I've just rejoined this list after leaving it a short while ago. I
figured I was wasting too much time in debates such as this.
First, I've described my antispam measures in an article at
isay.js.id.au. A lot of people here could probably adapt the measures to
their own needs. It does require that you manage your own mail service.
I think that the best allround countermeasure is for the list-management
software to obliterate all email addresses before sending. There's
little likelihood of getting everyone who archives the list to do so. A
DCMA (did I get the acronym right) action against an archive site would
be interesting. It might, however, be the end o archives, at least in USA.
Not obfuscate, obliterate. Here's why:
http://www.google.com/search?hl=en&safe=active&num=100&c2coff...
That gives me about 12 gigapages to look for yahoo email addresses. I
don't even have to go the sites, I can just pull them out of Google's
cache. Can anyone spot an address here?
se enter me! thetometraveller *at* yahoo(dot) com. I follow!
Trust me, it's not hard to write some perl to discover quite a few
addresses in text like that. 50-100 lines at a guess.
Obfuscation doesn't work. In fact, I reckon I could find addresses more
quickly if they're obfuscated.
As someone already said, all one needs to harvest addresses from this
list is to subscribe to it. You get the address of everyone who posts to it.
Do people really do that? Well, let me tell you!
I once created a website. I dreamed up a domain name - I already had a
wildcard so it was just a matter of picking a name and configuring Apache.
It still exists, it's here:
http://portgeographe.environmentaldisasters.cds.merseine.nu/
I didn't really announce it, I just added the URL to my sig, and posted,
as I do here, to the Debian users' list. Nothing about my new site, just
something properly in context with an ongoing discussion.
Within the hour I had my first visitor. It wasn't you or me, it was
(according to the log) a bot. Not one from Google or Yahoo, one from
Microsoft, as identified by its IP address. I assume it was looking for
warez, it never returned, and everyone knows what a hotbed of software
traders those Debian people are.
What individuals could do, and I have thought about this, is enroll two
addresses. Get both confirmed. Post _from_ one, say throwaway(a)yahoo.com,
but never ever read it. Instead, read the one from which you never post.
It wouldn't work well from me, I use (at least) two different email
clients on each of several computers.
--
Cheers
John
-- spambait
1aaaaaaa(a)coco.merseine.nu Z1aaaaaaa(a)coco.merseine.nu
-- Advice
http://webfoot.com/advice/email.top.php
http://www.catb.org/~esr/faqs/smart-questions.html
http://support.microsoft.com/kb/555375
You cannot reply off-list:-)
5326
days inactive
5329
days old
10 comments
4 participants
participants (4)
-
Allen Kistler -
Bruno Wolff III -
John Summerfield -
Juan J. Martínez