Login | Register For Free | Help
Search for: (Advanced)

Mailing List Archive: Wikipedia: Wikitech

Re: hi

 

 

Wikipedia wikitech RSS feed   Index | Next | Previous | View Threaded


erik_moeller at gmx

Oct 21, 2005, 1:27 PM

Post #1 of 5 (308 views)
Permalink
Re: hi

why should I?


rowan.collins at gmail

Oct 21, 2005, 1:48 PM

Post #2 of 5 (299 views)
Permalink
Re: Re: hi [In reply to]

On 21/10/05, erik_moeller [at] gmx <erik_moeller [at] gmx> wrote:
> why should I?

Erm... Null context exception: Reply has no parent.

--
Rowan Collins BSc
[IMSoP]
_______________________________________________
Wikitech-l mailing list
Wikitech-l [at] wikimedia
http://mail.wikipedia.org/mailman/listinfo/wikitech-l


erik_moeller at gmx

Oct 21, 2005, 2:20 PM

Post #3 of 5 (296 views)
Permalink
Re: Re: hi [In reply to]

Rowan Collins:
> On 21/10/05, erik_moeller [at] gmx <erik_moeller [at] gmx> wrote:
>
>>why should I?
>
>
> Erm... Null context exception: Reply has no parent.
>

This message was not sent by me, but by
host213-186.pool8173.interbusiness.it, as the headers show. It uses a
forged From: line. It is, in fact, the W32/Netsky.AN worm or a variation
thereof, which uses subject lines like "Re: hi" and body text like "why
should I?".

http://www.pspl.com/virus_info/worms/netskyan.htm

Like many email worms, it uses addresses picked up from the infected
system, that is, the forged sender is *not* the infected user.
wikitech-l allows posts from subscriber addresses immediately to the
list, but it strips attachments, so you don't get the actual worm payload.

Authentic email from me always includes my real name in the From: line
(though this is of course by no means sufficient to verify its origin).

HTH,

Erik
_______________________________________________
Wikitech-l mailing list
Wikitech-l [at] wikimedia
http://mail.wikipedia.org/mailman/listinfo/wikitech-l


nospam-abuse at bloodgate

Oct 21, 2005, 2:24 PM

Post #4 of 5 (294 views)
Permalink
Re: Re: hi [In reply to]

-----BEGIN PGP SIGNED MESSAGE-----

Moin,

On Friday 21 October 2005 23:20, Erik Moeller wrote:
> Rowan Collins:
> > On 21/10/05, erik_moeller [at] gmx <erik_moeller [at] gmx> wrote:
> >>why should I?
> >
> > Erm... Null context exception: Reply has no parent.
>
> This message was not sent by me, but by
> host213-186.pool8173.interbusiness.it, as the headers show. It uses a
> forged From: line. It is, in fact, the W32/Netsky.AN worm or a
> variation thereof, which uses subject lines like "Re: hi" and body text
> like "why should I?".
>
> http://www.pspl.com/virus_info/worms/netskyan.htm
>
> Like many email worms, it uses addresses picked up from the infected
> system, that is, the forged sender is *not* the infected user.
> wikitech-l allows posts from subscriber addresses immediately to the
> list, but it strips attachments, so you don't get the actual worm
> payload.
>
> Authentic email from me always includes my real name in the From: line
> (though this is of course by no means sufficient to verify its origin).

Maybe you should start signing your email with PGP :-)

Mail from me always has a @bloodgate.com message-id, is signed by me with
gnupg, and usually comes via relay.pair.com - just for the record :)

Best wishes,

Tels

- --
Signed on Fri Oct 21 23:23:29 2005 with key 0x93B84C15.
Visit my photo gallery at http://bloodgate.com/photos/
PGP key on http://bloodgate.com/tels.asc or per email.

"People who are rather more than six feet tall and nearly as broad
across the shoulders often have uneventful journeys. People jump out at
them from behind rocks then say things like, 'Oh. Sorry. I thought you
were someone else.'" -- Terry Pratchett

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iQEVAwUBQ1lcmncLPEOTuEwVAQEz2wf+PAtbXq5EzRdGQiRb9lkorKSVBOi+QHnd
xhnoKXWei9C9kC50Qnuc7G4ZfCtzi4znyxY458UohIMz8gGPPfMASySftAo1CmQs
jfge0bim50hPuqM0anIX3s2VmYMOwPPlB79zaCzjR0x7BVYP50S+Z3/MjdR7TiFb
yVo5vYYDYxrqKmECsvTrUdJ0iYIyaVfZejZ70bbDl2NjwRgbKaaMUNiRHcxfgldl
RZLvmt4frQHlbOYPXJC8euDKvbpzFhAlFApWNLeGge83iS0mRWoA+8oS/lwK78JC
RopuKNTQRVxPXV+189kevmmgnxMsRyA3wHJ5Hma/EU3D63g6Xcn7Ug==
=Z0aQ
-----END PGP SIGNATURE-----
_______________________________________________
Wikitech-l mailing list
Wikitech-l [at] wikimedia
http://mail.wikipedia.org/mailman/listinfo/wikitech-l


rowan.collins at gmail

Oct 21, 2005, 4:07 PM

Post #5 of 5 (289 views)
Permalink
Re: Re: hi [In reply to]

On 21/10/05, Erik Moeller <erik_moeller [at] gmx> wrote:
> Rowan Collins:
> > On 21/10/05, erik_moeller [at] gmx <erik_moeller [at] gmx> wrote:
> This message was not sent by me, but by
> host213-186.pool8173.interbusiness.it, as the headers show. It uses a
> forged From: line. It is, in fact, the W32/Netsky.AN worm or a variation
> thereof, which uses subject lines like "Re: hi" and body text like "why
> should I?".

D'oh! Should have thought of that. Damn spoofable protocols. And damn
non-human e-mails. And, obviously, damn worms [and their writers].

Out of interest, I thought there was an SPF filter running on the
mailing list server; the only "Received-SPF" header I can see seems to
be comparing against the line "Sender:wikitech-l-bounces@..." and
succeeding. Is it just obscuring the previous one?

Anyway, sorry.

--
Rowan Collins BSc
[IMSoP]
_______________________________________________
Wikitech-l mailing list
Wikitech-l [at] wikimedia
http://mail.wikipedia.org/mailman/listinfo/wikitech-l

Wikipedia wikitech RSS feed   Index | Next | Previous | View Threaded
 
 


Interested in having your list archived? Contact Gossamer Threads
 
  Web Applications & Managed Hosting Powered by Gossamer Threads Inc.