Bug#164344: Bug#160529: (ITP of ASK) should not be packaged
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Hello Branden,
On Thu, Oct 14, 2004 at 03:25:54PM -0500, Branden Robinson wrote:
>> Notice that this mail-loop was created by a clueless user inserting the
>> mailing-list address on the "blacklist" (something that we urge users not to
>> do). There is really no protection against this kind of behavior. A similar
>> situation can happen for many reasons, including a badly configured procmail
>> rule, for instance.
>Of course there is protection against it.
>
>Each message that ASK sends out should include a cookie, consisting of the
>hash of a characteristic of the message plus a local secret that can stay
>invariant on a per-installation basis.
>
>You can use a simple symmetric encryption algorithm using the local cookie
>plus the message's unique identifier (the Message-ID would work well if you
>create that yourself per the appropriate RFC) as a key. You encipher the
>same message for every outbound ASK mail, for instance: "THIS MESSAGE
>GENERATED BY ACTIVE SPAM KILLER."
>
>When you get a purported ASK message back, you have the ciphertext, and the
>message-specific part of the key in plaintext alongside it (e.g., the
>Message-Id).
This is a good idea, and implemented to some degree in ASK. The problem is
that *nothing* is guaranteed to survive a reply. Adding a cookie to the body
of the email is not 100% foolproof, as there's no guarantee that the reply
will contain the cookie. Adding a specific header with the cookie will also
take us nowhere, as headers mostly discarded in replies. One option is the
Message-ID header, but my experiments showed that a large population of MUAs
(many versions of MS Out-Of-Luck, for instance) trash the Message-ID and
don't put it in the "In-Reply-To" field when responding to an email.
The only "guaranteed" way to know if an email is a reply to something you
sent is to use VERPs, but this creates enormous difficulties for users that
do not have full email control in their servers (users).
In any case, the original problem with the mailing list has nothing to do
with this, but rather with insanity of one of ASK's users.
ASK has a whitelist, an ignorelist and a blacklist. The blacklist sends back
a "nastygram" informing the user that we do not want to receive further
messages from him/her. Unfortunately (and yes, this is my fault), I never
imagined someone would add a mailing-list to his blacklist (sounds just too
insane, doesn't it?). Well, it happened, and I'm now dumping the blacklist
feature entirely to protect the community from people who use it incorrectly.
Regards,
Paga
- --
Marco Paganini | UNIX / Linux / Networking
paganini@paganini.net | PGP: http://www.paganini.net/pgp/
http://www.paganini.net | Magnus Frater te spectat...
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2 (GNU/Linux)
iD8DBQFBbvhaL2FWjNfH2XwRAi8RAJ95GWsVh1VXLAY1+dV1KVzsL0v+ZQCePUrs
AD287f/yXBWkspLE39jayKQ=
=zbzz
-----END PGP SIGNATURE-----
Reply to: