Re: Blogware spoofing FROM addresses

From: Dave Warren (maillist@devilsplayground.net)
Date: Sun Jun 13 2004 - 15:03:47 EDT


Ross Wm. Rader wrote:

>> I could even put up a system status page, hosted off-network (in case
>> EVERYTHING is down on my side) and tie it to my email notification
>> system. Not impossible to do otherwise, but since a trial account of
>> $0.50/weblog/month is more then enough, why the heck not?
>
> $0.50 for the first 30 days, after that they must upgrade to fully a
> paid account or get expired.

Well yeah... $1.43/month rather then $0.50/month... I originally thought
I could do less then 1GB of transfer, but I guess not.

>> Well isn't that fancy. In today's world even big slow moving behind
>> the times .COMs like eBay are in the process of fixing their systems
>> so that they don't forge sender email addresses, so I find it rather
>> astounding that OpenSRS found a developer clueless enough to create a
>> system that forges sender information.
>> </rant>
>>
>> I'm sorry if this seems offensive, but frankly, somebody needs a
>> smack upside the head.
>
> I quite literally have no idea what you are talking about. Headers
> below from an email confirmation I just received. There might be a
> problem here that we can fix but without getting details from you,
> I've got nothing to go on. In the meantime, the same developer that
> wrote the initial version of OpenSRS will continue down the road with
> the next release of Blogware. Drop me a note with some details and
> I'll see what I can do to fix the problem for you.

Hrmm... *sigh* This is what I get for doing too much at once. Pasted
into the wrong notepad window; it wasn't the confirmation message which
failed SPF checks. It was the "An article has been posted" message which
failed SPF. Since I use ~all instead of -all it wasn't outright
refused, so I have the headers below.

(The confirmation failed a couple other spam tests, but nothing you need
to worry about there, I'll whitelist it on this side -- That was part of
the exercise actually, to whitelist any system generated mail before
trying to sell this to my customers)

Return-path: <dave@djw.biz>
Received: from boromir.vpop.net (dns1.vpop.net [207.178.248.2])
        by bear.djw.biz (bear.djw.biz [69.44.152.70])
        (MDaemon.PRO.v7.1.1gm1.R)
        with ESMTP id md50000550907.msg
        for <dave@djw.biz>; Fri, 11 Jun 2004 05:33:21 -0600
Received-SPF: softfail (bear.djw.biz: domain of transitioning dave@djw.biz
        does not designate 207.178.248.2 as permitted sender)
        x-spf-client=MDaemon.PRO.v7.1.1gm1.R
        receiver=bear.djw.biz
        client-ip=207.178.248.2
        envelope-from=<dave@djw.biz>
        helo=boromir.vpop.net
Received: from localhost.localdomain (elrond.vpop.net [207.178.248.9])
        by boromir.vpop.net (Postfix) with ESMTP id DAD553A5F9F
        for <dave@djw.biz>; Fri, 11 Jun 2004 04:34:04 -0700 (PDT)

-- 
News: CIVIL SERVANT STAYS AWAKE ALL SHIFT LONG
"Man, I've really got to cut back on the caffeine" he says



This archive was generated by hypermail 2.1.3 : Tue Oct 19 2004 - 23:37:57 EDT