Blogware spoofing FROM addresses

From: Dave Warren (maillist@devilsplayground.net)
Date: Fri Jun 11 2004 - 08:02:14 EDT


Okay guys, this is just bad. To be blunt, I'm losing a lot of the faith
I've long held in OpenSRS between the email outages, the web builder
"export" fee being advertised as a feature rather then a critical design
flaw, the lack of any real development on the domains side of things
(anybody remember domain registrations? -- You know, the thing that
built OpenSRS?)

But I digress.

</rant>
I set up a blogware trial, decided to give a few of the features a trial
run.

One of the features is an email interface -- I should be able to submit
messages via email, and get updates for other people's blogs via email
too. Great, I have users who might really use this because they hate
web interfaces nearly as much as I do.

I could even put up a system status page, hosted off-network (in case
EVERYTHING is down on my side) and tie it to my email notification
system. Not impossible to do otherwise, but since a trial account of
$0.50/weblog/month is more then enough, why the heck not?

I left the confirmation on initially just to see what happens and
emailed a post to my blog. I waited and waited and waited for the
confirmation, nothing. Weird... Check the mail server, no backlog.
Happen to look at my incoming spam folder, and what do you know,
blogware is forging a domain it does not own or host and has never been
authorized to send from, and as a result my mail server flagged it as spam.

Well isn't that fancy. In today's world even big slow moving behind the
times .COMs like eBay are in the process of fixing their systems so that
they don't forge sender email addresses, so I find it rather astounding
that OpenSRS found a developer clueless enough to create a system that
forges sender information.
</rant>

I'm sorry if this seems offensive, but frankly, somebody needs a smack
upside the head.

-- 
1832-Curling is introduced to the U.S., giving Americans
a sport combining the surface of hockey with the thrill
of watching paint dry.



This archive was generated by hypermail 2.1.3 : Tue Oct 19 2004 - 23:37:57 EDT