Subject: Re: [pilc] Who maintains this list server?

From: Vernon Schryver <[email-masked]>
Date: Thu, 9 Jan 2003 07:56:36 -0700 (MST)

> Received: from www1.ietf.org (ietf.org [132.151.1.19])
> 	by calcite.rhyolite.com (8.12.7.Beta0/8.12.7.Beta0) with ESMTP id h098WiDd020984
> 	for <[email-masked]> env-from <[email-masked]>;
> 	Thu, 9 Jan 2003 01:32:46 -0700 (MST)
> Received: from www1.ietf.org (localhost.localdomain [127.0.0.1])
> 	by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h098GJJ03491;
> 	Thu, 9 Jan 2003 03:16:19 -0500
> ...

> From: Phil Karn <[email-masked]>
> To: [email-masked]

> Who maintains ietf-mx.ietf.org, 132.151.6.1? This machine handles the 
> [email-masked] mailing list, which has been getting spammed regularly. 
> When I forward the spam to spamcop, their scripts erroneously conclude 
> that the spam originated with ietf-mx.ietf.org. That's because this 
> machine is putting on an incorrect Received header with its own IP 
> address instead of the sender's actual IP address.

The PILC list forwarder could be improved but that last is because
SpamCop is hopelessly broken by design, and not only in the complete
craziness of trusting any Received headers except those added by
your own computers.  The only Received header that any sane person
should trust in my copy of your message is first one added by
calcite.rhyolite.com.  As the SpamCop people know perfectly well,
all Received headers except the last ones could ahve been forged
by the previous hop.  ("Ones" plural in case you have control over
more than one of the last SMTP servers.)

For another example of the brokeness by design of SpamCop, the reason
I am not still getting demands from saruman.julianhaight.com that I
shut down spammers sending from rhyolite.com is because the SpamCop
people have finally managed to add entries to their exception database
to ignore the headers added locally by SpamAssasin when that spam
filter gets a hit from the DCC.  SpamCop is willing to send complaints
to any domain found in any URL in spam except those in some list at
SpamCop-Central.

Vernon Schryver    [email-masked]
_______________________________________________
pilc mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pilc
http://www.ietf.org/html.charters/pilc-charter.html
http://pilc.grc.nasa.gov/

---

From: Phil Karn <[email-masked]>
Date: Thu, 09 Jan 2003 15:25:34 -0800

Vernon Schryver wrote:

> The PILC list forwarder could be improved

Yes, because it's broken. It needs to be fixed.

> SpamCop is hopelessly broken by design,

Spamcop has its limitations because it must work by heuristics. But it's 
still useful in automating a lot of work that would otherwise be done by 
hand, and it does give you the chance to override it.

Phil