MESSAGE
| DATE | 2010-02-25 |
| FROM | Ruben Safir
|
| SUBJECT | Re: [NYLXS - HANGOUT] this should not get through
|
On Thu, Feb 25, 2010 at 09:27:52AM -0500, Ron Guerin wrote:
> Ruben Safir wrote:
> >
> > So I noticed. Majordomo seems to parse on the From: header instead of
> > the From header.
> >
>
> That's because there isn't a "From " header, that's a convention of
> mbox, which wouldn't be there if you were using something else like Maildir.
>
> - Ron
With all due respect, that isn't true.
For example:
>From conspire-bounces-at-linuxmafia.com Mon Feb 8 22:48:48 2010
X-UIDL: +>`"!XQN!![~I"!^i-at-!!
Return-Path:
X-Original-To: ruben-at-mrbrklyn.com
Delivered-To: ruben-at-mrbrklyn.com
Received: from linuxmafia.com (linuxmafia.COM [198.144.195.186])
by www2.mrbrklyn.com (Postfix) with ESMTP id 259D2399E3
for ; Mon, 8 Feb 2010 22:48:48 -0500 (EST)
Received: from localhost ([127.0.0.1] helo=linuxmafia.com)
by linuxmafia.com with esmtp (Exim 4.69)
(envelope-from )
id 1Neh51-0000Z9-Ev; Mon, 08 Feb 2010 19:48:03 -0800
Received: from mail-ww0-f44.google.com ([74.125.82.44])
by linuxmafia.com with esmtp (Exim 4.69)
(envelope-from ) id
1Neh4q-0000Yq-4c
for conspire-at-linuxmafia.com; Mon, 08 Feb 2010 19:48:00 -0800
Received: by wwa36 with SMTP id 36so1917746wwa.31
for ; Mon, 08 Feb 2010 19:47:45 -0800
(PST)
MIME-Version: 1.0
Received: by 10.216.153.208 with SMTP id
f58mr2052005wek.36.1265687264863;
Mon, 08 Feb 2010 19:47:44 -0800 (PST)
X-Originating-IP: [75.79.67.11]
In-Reply-To: <4B70C170.6000101-at-sbcglobal.net>
I added the initial > to prevent the mailbox from being broken.
But there is an addition issue which I'm frankly not certain of, which
is that the headers aren't necessarily the envelope and I'm not certain
of the exact relationship, or how Majordomo parses its list.
Theoretically, from what I've seen so far, and I haven't completely
finished investigating this issue, but it looks to me that anyone
running mutt who changes the from line with f can spoof a known
address and send spam through the mailing list. That isn't great.
I'm going to end up hacking majordomo itself, something I'm very much
dreading. It might be just easier for me to right my own mailing list
server. I probably have about half of the libraries written to do just
that since I wrote so much custom mail handling software.
Ruben
|
|
