Re: Bug#207300: tmda: Challenge-response is fundamentally broken
On Thu, Aug 28, 2003 at 08:21:22AM -0700, Adam McKenna wrote:
> On Thu, Aug 28, 2003 at 12:35:25PM +0100, Karsten M. Self wrote:
> > #2, Misplaced burden, is the reason for the 'grave' severity.
>
> People have a right to ask that unkown people that e-mail them confirm the
> e-mail.
the point that you keep on missing is that TMDA and similar programs send
"confirmation" emails to innocent third-parties who did *NOT* send an email.
TMDA and all C-R systems are broken-by-design, just as many stupid end-user
"autoresponders" and AV-scanners that send notifications back to the forged
sender address are broken-by-design.
such software is too brain-damaged to use. there is more than enough spam,
viruses and other garbage clogging SMTP servers around the world without making
things worse by using programs which falsely claim to be part of the solution.
junk like this does not solve the problem, it is not part of the solution - it
just amplifies the original problem: every virus or spam with forged headers
results in even more "confirmation" and/or "notification" messages being sent
in response.
in short, it is automated spamware that contributes to denial of service
attacks.
craig
Reply to: