Re: You have been removed from

["Thomas Schmitt" <scdbackup@gmx.net>]

Hi,

Greg Wooledge wrote:
> you can go back to my original post at the start of this thread.

I did several times meanwhile. It's all that a have as base for
my speculations.


> I included the full text of what bendel sent to me.  You can very clearly
> see the headers, and the complete lack of the string "wooledge" anywhere
> in the headers.

My theory is that your mail address is in the SMTP envelope of the
bounce mail which gets sent to bendel.debian.org. Maybe in "RCPT TO",
not in "MAIL FROM, as i initially wrote.

Inside the envelope of a bounce there are three parts, according to
  https://en.wikipedia.org/wiki/Bounce_message#Format

  1. a human readable explanation;
  2. a machine parsable message/delivery-status, a list of
     "name: type; value" lines that state several possible fields; and
  3. the original message, or a portion thereof, as an entity of type
     message/rfc822.

Reading your initial mail, i would say that it shows only part 3 of the
bounce message. That part could be completely made up by the sender
and designed to deceive the human reader.


The idea of backscattering came to me because of your mail from
Wed, 6 Oct 2021 09:49:27 -0400, Message-Id [🔎] YV2pZ8MbbCDttlGA@wooledge.org
where you first mentioned "forged bounce messages".
I remember that years ago i riddled about such bogus bounces. Meanwhile
my mail provider seems to catch them.
Problem with bendel.debian.org was that it did not forward the forged
bounces but counted them until finally the threshold was reached for
unsubscription.


> if you continue posting to debian-user often enough, you'll probably
> start getting unsubbed after each one of your messages just like the
> rest of us frequent-posters are seeing.

I understand that this will not happen as easily any more.
See Andrew M.A. Cater's recent post (8 Oct 2021 17:33:26 +0000) and
piorunz' report (8 Oct 2021 19:41:31 +0100) of a mail with:
  "This is a test mailing, to check if the address piorunz@gmx.com
  causes bounces, [...]
  If no unsubscription occurs you can safely ignore this message."


> Then you can see your own version
> of the message from bendel containing the **stop** message from OVH.

Probably those headers and message parts will from now on stay inside
bendel.debian.org and we will see only the test mailings.
They won't bounce, hopefully. I disable as much spam filtering at GMX
as possible. But at rare occasions GMX seems to hate mails from bendel
and bounces them.


Have a nice day :)

Thomas