mainSavannah Administration - Support: sr #103775, From address used in CVS log...

 
 

sr #103775: From address used in CVS log messages

Submitter:  Onno Molenkamp <onno>
Submitted:  Thu 13 Jan 2005 06:59:55 PM UTC
   
 
Category:  Savannah mail server Priority:  5 - Normal
Severity:  3 - Normal Status:  Postponed
Privacy:  Public Assigned to:  Beuc
Operating System:  None Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Jump to the original submission

Tue 01 Feb 2005 06:30:20 PM UTC, comment #10: 

So, reply from Jim at http://lists.gnu.org/archive/html/savannah-hackers-public/2005-01/msg00029.html

The interesting point is the distinction From:/envelop sender, which deal with several concerns I had.

Next time, I promise to document myself more thoroughly.

Sylvain Beucler <Beuc>
Tue 18 Jan 2005 08:09:44 PM UTC, comment #9: 

Waiting for his reply...

Sylvain Beucler <Beuc>
Tue 18 Jan 2005 06:38:10 AM UTC, comment #8: 

And what did he have to say about it?

Onno Molenkamp <onno>
Thu 13 Jan 2005 09:02:13 PM UTC, comment #7: 

True: confused license and technology
False: I didn't mention that GPG would solve the problem, it's just a working solution for authentication that is not vulnerable to MITM.

Now, we do not have any control on gnu.org MX fields, and we cannot satisfy both you and the people who check whether the sender exists.

I'll ask the person in charge of the gnu.org mail system what are his thoughs on these technologies.

Sylvain Beucler <Beuc>
Thu 13 Jan 2005 08:05:47 PM UTC, comment #6: 

It's not about you, it's about interopability with the rest of the world. Sender-ID is an adaptation of SPF with a Microsoft license. Apache won't accept it, and they're right. However, they /do/ support SPF. Apache's SpamAssassin 3.0 /does/ support SPF.

GPG keys are nice for client-side verification, but don't stop anything at the SMTP level. They solve a different problem. And if your mail doesn't arrive because you're forging addresses, GPG will never even get the chance to prove it's legitimate mail..

Onno Molenkamp <onno>
Thu 13 Jan 2005 07:59:17 PM UTC, comment #5: 

As I said, I already have a solution that works quite well and is far more convenient; plus GPG keys if I want real signatures.

Besides, http://www.apache.org/foundation/docs/sender-id-position.html

Sylvain Beucler <Beuc>
Thu 13 Jan 2005 07:51:25 PM UTC, comment #4: 

You /really/ have to read about ongoing developments in the SMTP world before making decisions like these...

Go read http://spf.pobox.com. Go read http://antispam.yahoo.com/domainkeys.

Realize that sites with SPF records include gnu.org, nongnu.org, savannah.nongnu.org, big sites like gmail.com. Gmail also employs DomainKeys, as does Yahoo.

And no, you won't be able to send mails from your own server anymore using a From address that isn't yours. But that's not a bad thing. Every half-decent mailclient supports setting an outgoing mailserver per identity. Or just use an address in a domain that's controlled by yourself.

Onno Molenkamp <onno>
Thu 13 Jan 2005 07:42:32 PM UTC, comment #3: 

I do hope that such a solution, that among others prevent people from using their own SMTP server, will not be used.

Incidentally, my current mail provider (ovh.com) received both kind of cvs notifications, and I receive a low amount of spam. That's what I think is a well-configured mail system :)

Also, I'm curious, how will your mail system know whether I am forging a mail, or simply relaying a message in the context of a mailing-list?

Sylvain Beucler <Beuc>
Thu 13 Jan 2005 07:35:29 PM UTC, comment #2: 

Then you'll have a big problem when more sites start deploying SPF, DomainKeys, etc. and your mails will be dropped.

It might be your personal view that it's ok to forge addresses, but in general this isn't considered acceptable.

In case of a mailinglist, there are mechanisms to make it work, if the original mail /was/ sent by an approved mailserver. That's not the case here.

Onno Molenkamp <onno>
Thu 13 Jan 2005 07:20:58 PM UTC, comment #1: 

This cannot be done, because addresses @savannah.gnu.org are not valid (no MX field in the DNS, no SMTP server). This caused other people to miss notifications.

As far as I am concerned, I expect a SMTP server to be able to forge e-mails. I send all my mails using different addresses using the same SMTP server.

Likewise, the mailing lists server send mail on behalf of the subscribees.

Sylvain Beucler <Beuc>
Thu 13 Jan 2005 06:59:55 PM UTC, original submission:  

For a while, -email is unavailable- was used as From address in CVS log mails. This is the correct thing to do.

But now, the user specified address is used again. Can this be changed back? The current behaviour doesn't work with SPF and other spam fighting mechanisms, because you're simply forging the From address. Your mail server isn't authorized to send mails on behalf of /other/ domains, and they will be rejected by the receiving mailserver.

Onno Molenkamp <onno>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

CC list is empty

 

There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

Only logged-in users can vote.

 

Follow 4 latest changes.

Date Changed by Updated Field Previous Value => Replaced by
2005-02-01 Beuc StatusWont Do Postponed
    Open/ClosedOpen Closed
2005-01-13 Beuc StatusNone Wont Do
    Assigned toNone Beuc

Back to the top

Powered by Savane 3.13-02a9.
Corresponding source code