On Monday 15 March 2004 08.03, Steven T. Hatton wrote:

On Monday 15 March 2004 01:43 am, Anders Johansson wrote:

...

...

Received: (qmail 4303 invoked by alias); 15 Mar 2004 04:51:29 -0000

What does the above line signify? "alias"? Some say "network". What's the distinction?

if the mail is received through a network connection on port 25 (or whatever) it will say "invoked by network" The above line signifies that suse is running qmail hiding behind another mail server (with the greeting string 'Would you like freedom fries with that :) and that mail server in turn invokes qmail and the ezmlm mailing list manager <snip>

That's the part that surprises me. I just assumed the originating host would somehow be recorded in the header information added by the list server.

Some do. Here it's stripped when the mail is placed on the outgoing queue. People like their privacy

On Monday 15 March 2004 08.15, Anders Johansson wrote:

On Monday 15 March 2004 08.07, Anders Johansson wrote:

...

The above line signifies that suse is running qmail hiding behind another mail server (with the greeting string 'Would you like freedom fries with that :) and that mail server in turn invokes qmail and the ezmlm mailing list manager

Actually, forget that. That is indeed the setup on lists.suse.com, but that is not what 'invoked by alias' means. I just looked, and suse's qmail says 'invoked by network' so it gets a net connection. 'invoked by alias' is on deem's side. I'm not sure what it means

Argh, sorry. Both come from suse. OK, I have *really* no idea what that means

The Monday 2004-03-15 at 02:19 -0500, Steven T. Hatton wrote:

That is one of the biggest threats spam poses, IMO. In oder to stop it, sources will have to be more specifically identified. That means privacy and anonymity for legitimate purposes will be lost as collateral damage.

Since the problem really is doing harm to the viability of Internet mailing systems, it's bound to result in more demanding identification requirements.

Except on the list, where most of the receipts headers before reaching the SuSE server are striped, there is always enough info to determine which server really sent the email. The problem is that you have to determine which are false headers, and which real. Then, once you have the IP you can determine who really sent it; it depends on countries, but at least in Spain the dial up providers keep records of all connections made, correlating phone numbers with IPs and login used. But you need a court order to make use of them. So... there is no need to pay per email sent, as some advocate. The means are there: just identify the spammers, and put them in jail. -- Cheers, Carlos Robinson

The Monday 2004-03-15 at 22:09 -0000, Dylan wrote:

...

So... there is no need to pay per email sent, as some advocate. The means are there: just identify the spammers, and put them in jail.

I'm sorry, you are wrong. Spammers can use open relays, introduce backdoor trojans into insecure systems, use false signup info, make up invalid from addresses, ... need I go on?

I know that very well. But there is at least one or two headers that are true, the one where the email spam enters "the internet"; usually, that is the destination isp server header. Reading from top to bottom, we find the last added headers; first my own Linux server headers, then my provider's, and then one by me provider that says where it got that email from. So far, those headers are true. Below... depends, but at some point start the faked headers by the spammer program or whatever. It may be using some other server he broke into, like a some clueless business with an unsecured wifi. If the ISPs want to find them (the spammers), they can. They just have to invest money and effort, and coordinate ISPs. -- Cheers, Carlos Robinson