[Tutor] Ethics in programming

[kirk Bailey]

Dman, I have 2 concenrs; preventing my users from being spammed, and
preventing my tools I produce from being used TO spam. This is why I
am sitting on a guardian program to handle transmission to large
lists.


dman wrote:
> 
> On Wed, Jan 16, 2002 at 02:29:41PM -0500, kirk Bailey wrote:
> | Gang, I still amd thinking about how to handle large lists. and how to
> | impede spam.
> 
> Check this out.  I just set up spamassassin on my system.  It is
> really cool.  I have exim pipe all incoming messages through
> spamassassin, and spamassassin gives it back with some headers added.
> In my filter I then drop all messages tagged as spam into a junk
> folder so I can double check it (in case it gives a false positive).
> 
> | I can use a method of a second alias to sent out the large list, and
> | the original list is simply the address for that alias. TL become in
> | effect a message processor, and the second alias handles the huge
> | outbound list transmission. This is the method used by majordomo.
> | However,  that second alias is totally open to spam input.
> 
> How about getting rid of the open alias?
> 
> In TinyList you will pipe the message to spamassassin, then read the
> tagged message from its stdout.  Then you check the X-Spam-Flag:
> header.  If that header exists, then spamassassin thinks the message
> is spam.  In that case you drop it somewhere for the list admin to
> verify that it is spam (this is so false positives can be corrected by
> the admin).  If the message isn't spam, you continue by piping it to
> your MTA with the list of recipient addresses.
> 
> | This uses the sendmail function :include: which when aliases are
> | compiled by sendmail, includes the reference to the subscriber file in
> | it's definition.
> 
> Why not have TinyList itself manage the subscriber list, instead of
> sendmail.  No aliases are needed then, you just stick all the
> addresses on the sendmail command line.  Something like :
> 
Actually, as of now, it does. It uses the smtplib functions to talk to
sendmail and send one envlope per recipient. this is GOOD, there is no
unsecured alias sitting there waiting to be found like there is with
majordomo.

Also, someone could use TLwebmanager to manage SENDMAIL lists. Would
never reccomend it, as sendmail lists are not secure at all. But they
could. Such a subscriber list is a simple flat text file, samo as used
by TL. Just write a .info file for it and it shows up on the menu!

You DID know that majordomo uses a unguarded unfiltered outbound alias
for EVERY list used,
and that most people never deviate from the example in the manuals of 

 (listname)-outbound::include:/pathtofile/subscriberfilename

right? Yep. EVERY majordomo user is hosting a major spamshark feeding
ground waiting for the
right person to come along and exploit it.

The technique to discover prime read meat is simple: Subscribe to a
list there, any list. Send a test message to
'listname'-outgoing@thatplace.foo; see if you get it. This is a
postmaster psycology test to see if they used a random name or went
with the forms used in the manuals as examples- which it then tells
you not to do. Well, people are creatures of habit. Many still went
and built majordomo lists with the -outgoing part as per example. if
would be spam artist gets that letter, that site's lists are his to
spam; just email listname-ouotgoing and all them folk are going to get
a letter. NO WAY TO STOP IT.

By chance, do you host any lists?

Try that on TL, abject failure. TL is SECURE. I am loathe to abandon
that.

> # 'message' is a string-representation of the entire spam checked message
> 
> f = file( "subscriberlist" , "r" )
> slist = f.readlines()
> f.close()
> slist = map( string.strip , slist ) # strip out the newlines
> for subscriber in slist :
>     bounce_addr = "bounce-<listname>=%s@<your_domain>" % \
>             subscriber.replace( "@" , "=" )  # you get the idea
>     pipe = os.popen( "sendmail" , "-f %s" % bounce_addr , subscriber )
>     # check for errors returned from the pipe!
>     pipe.write( message )
>     pipe.close()
> 
> I think you get the idea here.  In this setup each subscriber gets
> their own copy of the message (no long recipient lines) and bounces
> are sent back to you for processing by your bot (which you have yet to
> write).
> 
> -D
> 
> --
> 
> Contrary to popular belief, Unix is user friendly.
> It just happens to be selective about who it makes friends with.
>                                                -- Dave Parnas
> 
> _______________________________________________
> Tutor maillist  -  Tutor@python.org
> http://mail.python.org/mailman/listinfo/tutor

-- 
 

 -Respectfully,
              -Kirk D Bailey 
               Consulting Loose Cannon

end



  www.howlermonkey.net                 highprimate@howlermonkey.net
  www.sacredelectron.org                         idiot1@netzero.net
  www.tinylist.org                              grumpy@tinylist.org
----------------------------------------------------
Sign Up for NetZero Platinum Today
Only $9.95 per month!
http://my.netzero.net/s/signup?r=platinum&refcd=PT97