[clue-admin] Spam Routing Question: Why didn't it just bounce?

[Jed S. Baer]

On Thu, 16 Dec 2004 10:00:44 -0700
David Anselmi wrote:

> Jed S. Baer wrote:
> [...]
> > Yeah, OK. The To: header is forged. I tested by sending a mail
> > directly to clue-dev-admin, and I get the same result -- Mailman (or
> > something which looks suspiciously like it) sends the message to
> > clue-dev-owner, whence it comes to me.
> > 
> > Well, one thing is, the "admin" variants of the mailing list addresses
> > should be live, shouldn't they? (Well, obviously they're being
> > handled.)
> 
> Why do you think mailman is involved?  Oh, I see.  You just gave us the 
> spam header, not the header of the message you received.  I missed that 
> originally.
> 
> It seems that this is just the behavior of spam sent to the 
> clue-dev-admin address.  Mailman takes it in and generates a message to 
> clue-dev-owner.

Well, it isn't just that. It's that it generates a bounce notification,
and the way it constructs it is just plain misleading. It didn't help that
the first instance of this I saw was, in fact, spam. I suppose I ought to
mention this to the Mailman folks, but I'm still uncertain, except for a
bit of semantic oddity, what is really happening internally.

> Eventually I found docs on mailman's email interface here:
> 
> http://www.list.org/mailman-member/node10.html

Where it states that the -admin address is there for compatibility only.
So maybe it can go away? IIRC, this used to be used for [un]subscribe
requests and such. Well, that's a pretty hazy recollection.

> so maybe that helps you.  But it seems to indicate that -owner and 
> -admin behave the same and clearly they don't.
> 
> Interestingly, exim puts the envelope to in the Recieved: header and 
> postfix seems not to. That might have made it more obvious what was 
> happening.

Well, what Mailman does is send out a message which starts out, "The
attached message was received as a bounce, ...", when what it sends is the
message which it sent out to the list, resulting in a bounce.

I guess I'll state for the record that I don't want to become the
Postfix/Mailman maintainer. I have CVS things to work on, and then there's
getting the membership websites back up. (Hmm, I should start a thread for
that, I guess.)

jed
-- 
http://s88369986.onlinehome.us/freedomsight/

... it is poor civic hygiene to install technologies that could someday
facilitate a police state. -- Bruce Schneier