Mailing List Archive: SPF: SRS

Tres uncool :(

Index | Next | Previous | View Threaded

admin at asarian-host

Feb 28, 2004, 4:46 AM

Post #1 of 17 (5413 views)
Permalink

Tres uncool :(

Hey, this is tres uncool. The spamassassin list apparently checked my
subscription address against the envelope! ;(

------------------------------------------
From Sat Feb 28 12:37:14 2004
Received: from mail.apache.org (daedalus.apache.org [208.185.179.12])
by asarian-host.net (8.12.11/8.12.11) with SMTP id i1SBb9s3014648
for <SRS0=+vls3/+=F4=asarian-host.net=admin [at] asarian-host>; Sat,
28 Feb 2004 12:37:13 +0100 (CET)
Message-Id: <200402281137.i1SBb9s3014648 [at] asarian-host>
Received: (qmail 40105 invoked for bounce); 28 Feb 2004 11:37:08 -0000
Date: Sat, 28 Feb 2004 11:37:14 GMT
From: MAILER-DAEMON [at] apache
To: SRS0=+vls3/+=F4=asarian-host.net=admin [at] asarian-host

Hi. This is the qmail-send program at apache.org.
I'm afraid I wasn't able to deliver your message to the following addresses.
This is a permanent error; I've given up. Sorry it didn't work out.

<spamassassin-users [at] incubator>:
Sorry, only subscribers may post. If you are a subscriber, please forward
this message to spamassassin-users-owner [at] incubator to get your
new address included (#5.7.2)
------------------------------------------

This thing was not supposed to happen.

- Mark

System Administrator Asarian-host.org

---
"If you were supposed to understand it,
we wouldn't call it code." - FedEx

-------
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?listname=srs-discuss [at] v2

mengwong at dumbo

Feb 28, 2004, 9:33 AM

Post #2 of 17 (5308 views)
Permalink

Re: Tres uncool :( [In reply to]

On Sat, Feb 28, 2004 at 11:46:27AM +0000, Mark wrote:
| Hey, this is tres uncool. The spamassassin list apparently checked my
| subscription address against the envelope! ;(

Yes. It's something that's alway annoyed me about ezMLM.

Every other MLM I know of looks at the header From:.

| ------------------------------------------
| From Sat Feb 28 12:37:14 2004
| Received: from mail.apache.org (daedalus.apache.org [208.185.179.12])
| by asarian-host.net (8.12.11/8.12.11) with SMTP id i1SBb9s3014648
| for <SRS0=+vls3/+=F4=asarian-host.net=admin [at] asarian-host>; Sat,
| 28 Feb 2004 12:37:13 +0100 (CET)
| Message-Id: <200402281137.i1SBb9s3014648 [at] asarian-host>
| Received: (qmail 40105 invoked for bounce); 28 Feb 2004 11:37:08 -0000
| Date: Sat, 28 Feb 2004 11:37:14 GMT
| From: MAILER-DAEMON [at] apache
| To: SRS0=+vls3/+=F4=asarian-host.net=admin [at] asarian-host
|
| Hi. This is the qmail-send program at apache.org.
| I'm afraid I wasn't able to deliver your message to the following addresses.
| This is a permanent error; I've given up. Sorry it didn't work out.

-------
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?listname=srs-discuss [at] v2

mw-list-srs-discuss at csi

Feb 29, 2004, 8:02 AM

Post #3 of 17 (5306 views)
Permalink

Re: Tres uncool :( [In reply to]

On Sat, Feb 28, 2004 at 11:33:44AM -0500, Meng Weng Wong wrote:
> On Sat, Feb 28, 2004 at 11:46:27AM +0000, Mark wrote:
> | Hey, this is tres uncool. The spamassassin list apparently checked my
> | subscription address against the envelope! ;(
>
> Yes. It's something that's alway annoyed me about ezMLM.
>
> Every other MLM I know of looks at the header From:.

ezmlm-idx lists can be told to look at the From: header instead.
Looking at the envelope sender is more economical and reliable; in
particular, it is contained in the environemnt variable $SENDER.
Presently, there is no reason to change the default behavior.

In case of Mark: he decided to change the envelope sender address, and
complains that the list manager has become suspicious. His
expectations are hardly reasonable. But he can still post to the
list, by subscribing his new envelope sender address to the `allow'
list.

Mate
--
---
Mate Wierdl | Dept. of Math. Sciences | University of Memphis
Please avoid sending me Word or PowerPoint attachments.
See http://www.fsf.org/philosophy/no-word-attachments.html

-------
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?listname=srs-discuss [at] v2

greg at wooledge

Feb 29, 2004, 8:23 AM

Post #4 of 17 (5340 views)
Permalink

Re: Tres uncool :( [In reply to]

mw-list-srs-discuss [at] csi (mw-list-srs-discuss [at] csi) wrote:

> But he can still post to the
> list, by subscribing his new envelope sender address to the `allow'
> list.

You've totally missed the point -- the new envelope sender address
is *dynamically* generated. It changes every day or so. I'm doing
the same thing Mark is, but in a slightly different way. I haven't
run into any problems yet, but I'm not on any mailing lists that
check the envelope sender.

--
Greg Wooledge | "Truth belongs to everybody."
greg [at] wooledge | - The Red Hot Chili Peppers
http://wooledge.org/~greg/ |

-------
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?listname=srs-discuss [at] v2

Attachments:

signature.asc (0.18 KB)

mengwong at dumbo

Feb 29, 2004, 9:07 AM

Post #5 of 17 (5311 views)
Permalink

Re: Tres uncool :( [In reply to]

On Sun, Feb 29, 2004 at 10:23:10AM -0500, Greg Wooledge wrote:
|
| You've totally missed the point -- the new envelope sender address
| is *dynamically* generated. It changes every day or so. I'm doing
| the same thing Mark is, but in a slightly different way. I haven't
| run into any problems yet, but I'm not on any mailing lists that
| check the envelope sender.
|

The irony, of course, is that ezMLM pioneered the use of VERP.

-------
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?listname=srs-discuss [at] v2

admin at asarian-host

Feb 29, 2004, 9:34 AM

Post #6 of 17 (5343 views)
Permalink

Re: Tres uncool :( [In reply to]

----- Original Message -----
From: <mw-list-srs-discuss [at] csi>
To: <srs-discuss [at] v2>
Sent: Sunday, February 29, 2004 4:02 PM
Subject: Re: [srs-discuss] Tres uncool :(

> In case of Mark: he decided to change the envelope sender address, and
> complains that the list manager has become suspicious. His
> expectations are hardly reasonable.

Whoa! :) SRS is soley predicated upon the premiss of not mixing layers.
IMNSHO, mailing list software should not mix the SMTP envelope layer with
message headers. Both belong to entirely different strata.

If recipient verification callouts are made against the envelope-from,
instead of the header-from, and this would be common practice, then SRS is
effectively unusable. I believe in all our weeks of introducing/discussing
SRS, it was generally believed those layers would not mix.

- Mark

System Administrator Asarian-host.org

---
"If you were supposed to understand it,
we wouldn't call it code." - FedEx

-------
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?listname=srs-discuss [at] v2

mw-list-srs-discuss at csi

Feb 29, 2004, 8:24 PM

Post #7 of 17 (5327 views)
Permalink

Re: Tres uncool :( [In reply to]

On Sun, Feb 29, 2004 at 10:23:10AM -0500, Greg Wooledge wrote:
> mw-list-srs-discuss [at] csi (mw-list-srs-discuss [at] csi) wrote:
>
> > But he can still post to the
> > list, by subscribing his new envelope sender address to the `allow'
> > list.
>
> You've totally missed the point -- the new envelope sender address
> is *dynamically* generated.

I doubt it. As I said, you can configure an ezmlm list to do
verifications based on anything. Or, if you do not have control over
the ezmlm list you have problems with, you can "dynamically"
subscribe/unsubscribe the address to the allow list.

But you seem to agree with the original poster that since the default
behavior of ezmlm does not play well with your experiments, it is tres
uncool.

Mate
--
---
Mate Wierdl | Dept. of Math. Sciences | University of Memphis
Please avoid sending me Word or PowerPoint attachments.
See http://www.fsf.org/philosophy/no-word-attachments.html

-------
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?listname=srs-discuss [at] v2

spf at anarres

Mar 1, 2004, 2:22 AM

Post #8 of 17 (5383 views)
Permalink

Re: Tres uncool :( [In reply to]

On Sat, 28 Feb 2004, Mark wrote:

> Hey, this is tres uncool. The spamassassin list apparently checked my
> subscription address against the envelope! ;(

I think you are performing unconditional SRS rewrites on all outgoing
mail. This was not forseen in the design of the standard. It was assumed
that addresses would only be rewritten as they went over forwarding hosts.

In this case, the mailing list would only break if there was a forwarder
pointing to it, which would be extremely rare.

I suggest you alter your deployment only to rewrite forwarded mails. If
the domain name embedded in the SRS address is the same as the domain name
rewritten to, SRS is not necessary.

Perhaps I should code this check explicitly as a feature into the
software.

S.

--
Shevek http://www.anarres.org/
I am the Borg. http://www.gothnicity.org/

-------
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?listname=srs-discuss [at] v2

dwmw2 at infradead

Mar 1, 2004, 2:36 AM

Post #9 of 17 (5336 views)
Permalink

Re: Tres uncool :( [In reply to]

On Sun, 2004-02-29 at 10:23 -0500, Greg Wooledge wrote:
> You've totally missed the point -- the new envelope sender address
> is *dynamically* generated. It changes every day or so. I'm doing
> the same thing Mark is, but in a slightly different way. I haven't
> run into any problems yet, but I'm not on any mailing lists that
> check the envelope sender.

Likewise. But then I'm not on the SA lists because last time I tried I
think they sent their confirmation requests without a Message-ID so I
rejected them :)

--
dwmw2

-------
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?listname=srs-discuss [at] v2

spf at anarres

Mar 1, 2004, 2:57 AM

Post #10 of 17 (5338 views)
Permalink

Re: Tres uncool :( [In reply to]

On Mon, 1 Mar 2004, David Woodhouse wrote:

> On Sun, 2004-02-29 at 10:23 -0500, Greg Wooledge wrote:
> > You've totally missed the point -- the new envelope sender address
> > is *dynamically* generated. It changes every day or so. I'm doing
> > the same thing Mark is, but in a slightly different way. I haven't
> > run into any problems yet, but I'm not on any mailing lists that
> > check the envelope sender.
>
> Likewise. But then I'm not on the SA lists because last time I tried I
> think they sent their confirmation requests without a Message-ID so I
> rejected them :)

And thereby violated [the traditional interpretation of] RFC1958 section
3.9. :-) [0]

I do note with interest and relevance to SRS, section 3.7 of that RFC:

3.7 In many cases it is better to adopt an almost complete solution
now, rather than to wait until a perfect solution can be found.

S.

[0] Yes, this is a troll.

--
Shevek http://www.anarres.org/
I am the Borg. http://www.gothnicity.org/

-------
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?listname=srs-discuss [at] v2

admin at asarian-host

Mar 1, 2004, 5:56 AM

Post #11 of 17 (5331 views)
Permalink

Re: Tres uncool :( [In reply to]

----- Original Message -----
From: <spf [at] anarres>
To: "SRS-Discuss Forum" <srs-discuss [at] v2>
Sent: Monday, March 01, 2004 10:23 AM
Subject: Re: [srs-discuss] Tres uncool :(

> On Sat, 28 Feb 2004, Mark wrote:
>
> > Hey, this is tres uncool. The spamassassin list apparently checked my
> > subscription address against the envelope! ;(
>
> I think you are performing unconditional SRS rewrites on all outgoing
> mail. This was not forseen in the design of the standard. It was assumed
> that addresses would only be rewritten as they went over forwarding hosts.

Not forseen, perhaps; but the idea behind SRS signing all outgoing mail --
as initially envisioned by others, and later adopted by me -- was so that
"raw" DSN recipients could be rejected.

Last week, when I argued the case that, in real life, recipient verification
callouts are being made against the envelope-from, I was being told that
either I was mistaken, or that such probes would be broken. It seems reality
caught up with this.

- Mark

-------
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?listname=srs-discuss [at] v2

mw-list-srs-discuss at csi

Mar 1, 2004, 7:51 AM

Post #12 of 17 (5306 views)
Permalink

Re: Tres uncool :( [In reply to]

On Mon, Mar 01, 2004 at 09:57:13AM +0000, spf [at] anarres wrote:
> On Mon, 1 Mar 2004, David Woodhouse wrote:
>
> > On Sun, 2004-02-29 at 10:23 -0500, Greg Wooledge wrote:
> > > You've totally missed the point -- the new envelope sender address
> > > is *dynamically* generated. It changes every day or so. I'm doing
> > > the same thing Mark is, but in a slightly different way. I haven't
> > > run into any problems yet, but I'm not on any mailing lists that
> > > check the envelope sender.
> >
> > Likewise. But then I'm not on the SA lists because last time I tried I
> > think they sent their confirmation requests without a Message-ID so I
> > rejected them :)
>
> And thereby violated [the traditional interpretation of] RFC1958 section
> 3.9. :-) [0]

It is easy to check if "I think ... what I am saying is true" is really true.
Here is my experiment

$ mail spamassassin-users-subscribe-mw-public=csi.hu [at] incubator < /dev/null

$ grep -iA1 message-id: Maildir/new/1078152250.14109.thales.memphis.edu
Message-ID: <1078152224.5086.ezmlm [at] incubator>
From: spamassassin-users-help [at] incubator
--
Message-ID: <20040301144407.14103.qmail [at] thales>
From: mw [at] csi

Mate

--
---
Mate Wierdl | Dept. of Math. Sciences | University of Memphis
Please avoid sending me Word or PowerPoint attachments.
See http://www.fsf.org/philosophy/no-word-attachments.html

-------
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?listname=srs-discuss [at] v2

wayne at midwestcs

Mar 1, 2004, 10:13 AM

Post #13 of 17 (5339 views)
Permalink

Re: Tres uncool :( [In reply to]

In <Pine.LNX.4.53.0403010921000.13192 [at] astray> <spf [at] anarres> writes:

> I think you are performing unconditional SRS rewrites on all outgoing
> mail. This was not forseen in the design of the standard. It was assumed
> that addresses would only be rewritten as they went over forwarding hosts.
>
> In this case, the mailing list would only break if there was a forwarder
> pointing to it, which would be extremely rare.

I don't think it would be that rare for someone to sign up for mailing
lists using their pobox.com email addresses.

-wayne

-------
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?listname=srs-discuss [at] v2

dwmw2 at infradead

Mar 1, 2004, 10:17 AM

Post #14 of 17 (5332 views)
Permalink

Re: Tres uncool :( [In reply to]

On Mon, 2004-03-01 at 11:13 -0600, wayne wrote:
> I don't think it would be that rare for someone to sign up for mailing
> lists using their pobox.com email addresses.

Shevek means a forwarder pointing at the _list_, rather than at one of
the subscribers.

I'm not sure how common that would be, but it's possible. Some people
might want to run lists at their virtual domains, but not have the
facility do to so -- so they forward to somewhere they _can_ run a list.

I don't think I've actually _seen_ such a setup though.

--
dwmw2

-------
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?listname=srs-discuss [at] v2

wayne at midwestcs

Mar 1, 2004, 10:19 AM

Post #15 of 17 (5322 views)
Permalink

Re: Tres uncool :( [In reply to]

In <20040301145140.GA13852 [at] csi> mw-list-srs-discuss [at] csi writes:

>> On Mon, 1 Mar 2004, David Woodhouse wrote:
>>
>> > Likewise. But then I'm not on the SA lists because last time I tried I
>> > think they sent their confirmation requests without a Message-ID so I
>> > rejected them :)
>
> It is easy to check if "I think ... what I am saying is true" is really true.
> Here is my experiment
>
> $ mail spamassassin-users-subscribe-mw-public=csi.hu [at] incubator < /dev/null

It is my understanding that the SA list recently switched to using
apache.org. David's claim may well have been true, and such problems
may well have been part of the reason for the SA move.

-wayne

-------
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?listname=srs-discuss [at] v2

dwmw2 at infradead

Mar 1, 2004, 10:26 AM

Post #16 of 17 (5356 views)
Permalink

Re: Tres uncool :( [In reply to]

On Mon, 2004-03-01 at 11:19 -0600, wayne wrote:
> It is my understanding that the SA list recently switched to using
> apache.org. David's claim may well have been true, and such problems
> may well have been part of the reason for the SA move.

Indeed. I seem to recall it being at sf.net when I tried. If it's moved,
I'll attempt again to subscribe.

--
dwmw2

-------
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?listname=srs-discuss [at] v2

mw-list-srs-discuss at csi

Mar 1, 2004, 10:45 AM

Post #17 of 17 (5312 views)
Permalink

Re: Tres uncool :( [In reply to]

On Mon, Mar 01, 2004 at 11:19:47AM -0600, wayne wrote:
> In <20040301145140.GA13852 [at] csi> mw-list-srs-discuss [at] csi writes:
>
> >> On Mon, 1 Mar 2004, David Woodhouse wrote:
> >>
> >> > Likewise. But then I'm not on the SA lists because last time I tried I
> >> > think they sent their confirmation requests without a Message-ID so I
> >> > rejected them :)
> >
> > It is easy to check if "I think ... what I am saying is true" is really true.
> > Here is my experiment
> >
> > $ mail spamassassin-users-subscribe-mw-public=csi.hu [at] incubator < /dev/null
>
> It is my understanding that the SA list recently switched to using
> apache.org. David's claim may well have been true, and such problems
> may well have been part of the reason for the SA move.

But then his comment has nothing to do with ezmlm. If you think it
does, please explain.

Mate
--
---
Mate Wierdl | Dept. of Math. Sciences | University of Memphis
Please avoid sending me Word or PowerPoint attachments.
See http://www.fsf.org/philosophy/no-word-attachments.html

-------
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?listname=srs-discuss [at] v2

Index | Next | Previous | View Threaded

Interested in having your list archived? Contact Gossamer Threads