On Thu, May 30, 2002 at 10:11:43AM -0700, Jason Baker wrote: | On May 30, 2002 09:34 am, dman wrote: | > On Thu, May 30, 2002 at 03:32:55PM +0200, Tony L. Svanstrom wrote: | > | I stopped /dev/null:ing e-mails a day or so ago, just to check if there | > | are any false hits there (partly due to spam passing SA and going to my | > | inbox). | > | | > | Today when I sent a question regarding the number of hits a certain | > | e-mail got by the CVS-version things started going wrong... Someone had | > | an autoreply- system set up, and since this list wasn't whitelisted a | > | message was sent to my e-mailaddress, which of course meant that the | > | keywords in it triggered my auto- reply... and when I wrote a message to | > | their autowhitelist-system I didn't do anything about the keywords, so | > | then I got another autoreply which in turn triggered an autoreply from | > | me... | > | > The solution is to not use broken autoresponders. | > | > AUTO-RESPONDERS MUST NOT SEND MESSAGES TO ANY ADDRESS OTHER THAN THE | > ENVELOPE SENDER. THEY ALSO MUST NOT REPLY TO "DSN" MESSAGES (sender | > is '<>'). | | It sounds like they were.
Ok, on a closer re-reading that might be the case.
| The envelope sender of the autoreply system will most likely still
| be the same as the user it's autoreplying for.
That's bad practice. This is why end-user-agents are not suitable for
autoresponsders.
| Also, auto-whitelisting like TMDA where you need to reply to a specific magic
| address to get your mail into the whitelist for a while don't send DSN
| messages, as far as I've seen, just a typical autogenerated message.
Yeah, I saw one of those messages ... it was sent to a mailling list
with a return address of @localhost.localdomain.
| > If you pick addresses by any other means to autorespond to, then
| > you're just asking for trouble. In addition, you SHOULD add some
| > X-Loop header to your automessage for detecting, and breaking, loops
| > like that.
|
| I wouldn't think X-Loop would catch it either. We're not talking about the
| same message being ping-ponged back and forth, we're talking about an email
| that triggers a script that sends a -new- email back, which triggers another
| script, etc, etc. New headers each time, so X-Loop would vanish at each end.
Autoresponders that don't include references to the message they're
responding to are worthless. If the other (broken) autoresponder
includes at least the beginning or the headers (or both) of the first
autoresponders message then it can detect the loop.
Autoresponders really should rate-limit themselves too. (this would,
at the very least, limit the problem above)
| But yes, this isn't a SA thing, it's a detecting when automated scripts are
| nattering at each other.
For the interested parties, here are some decent links :
http://marc.merlins.org/~merlin/netrants/autoresponders.txt
http://www.goldmark.org/netrants/auto-resp/
(this is part of a long discussion on the decent and wrong
behavior of autoresponders)
http://www.exim.org/pipermail/exim-users/Week-of-Mon-20010514/026283.html
(this is mostly a rather amusing set of annotated examples of the
wrong behavior)
http://www.ling.helsinki.fi/users/reriksso/mail/autoresponder-faq.html
HTH,
-D
--
(A)bort, (R)etry, (T)ake down entire network?
GnuPG key : http://dman.ddts.net/~dman/public_key.gpg
msg05683/pgp00000.pgp
Description: PGP signature
