On Jul 25, 2006, at 10:34 AM, Geoffrey Odhner wrote:
> From this header you can see that DirectMail initiated the mailing
> on my local machine, anemone, and sent it directly to
> kelvin.pobox.com, the initial destination, which is a forwarder,
> which forwarded it to my primary account on odhner.net, which is a
> domain hosted on the domain pro60.cedant.com.
>
>
>> What is not clear though, is whether that code, once activated, is
>> creating a security hole that spammers can exploit. That would be
>> like jumping from a hot frying pan right into the fire!
>
> Yes, this approach could facilitate spamming, I'm afraid. It's
> certainly not why I got this software, and I did think twice before
> buying it, because I don't like to support a software vendor who's
> intentions are to support spammers, but since I don't really know his
> intentions, I bought the software I need. On the other hand, if
> you're asking whether this creates a hole in *your* system that
> spammers can exploit, then I really don't think so. It's just like
> any other program you run that initiates a connection to the outside
> world. Unless you have an existing hole already, this should make no
> difference to your security.
It connected outward directly, without using a local sendmail or
postfix. There's no reason to believe it used a mail command, rather
than SMTP code built in (SMTP is trivial for simple sending).
Try sending to an invalid address at pobox.com. See whether it warns
you about the invalidity. Try sending to someplace which does
greylisting (and where your current IP/sending address/recipient
address are unknown); see what it does about the 4xx error associated
with the greylisting. If it queues and tries again, that means it's
doing some of the harder part of SMTP sending (it probably is).
But the real issue with respect to your turning into a relayer of
spam is whether it receives messages from outside. It probably does
not, because
a. it has no reason to (bounces after acceptance will use your
regular incoming mail path)
b. Verizon may or may not forward port 25 to your gateway
c. unless you have an unusual home setup, your gateway wouldn't
send port 25 connections to your machine anyhow.
Test: Have DirectMail running and execute in Terminal the command
netstat -nv
You'll see lines like
Proto Recv-Q Send-Q Local Address Foreign Address
(state)
...
tcp4 0 0 127.0.0.1.1033 127.0.0.1.1015
ESTABLISHED
...
(And some more for udp4, which you can ignore.
The ones you care about are the ones with your machine's LAN IP
address (which I removed for my machine in the above). The number
after the 127.0.0.1 IP address above is the port being listened to
(1033 is "netinfo-local"). (Or leave the -n out of the command, and
*some* of the port numbers will be translated to service names
("netinfo-loca" above--as truncated).
Further test, if your machine IS listening on port 25: check your
current public IP (eg, with
http://www.showmyip.com --ignore the
sales pitch) then, from another, non-Verizon machine, telnet to that
IP at port 25 (or have a friend do so)--you're hoping to see the
connection refused (or time out).
My guess is that you are in no danger of relaying without working
hard to do so. (If your machine runs a web server visible to the
world with PHP forms which do mailing, you're in much greater danger.)
This part of the first pobox Received: header
Received: from anemone.local
is bad news...as you can see later, that earned you a spam score:
FORGED_RCVD_HELO
(the text anemone.local is syntactically correct, and true, but
"impossible" as the public name of a machine, hence "forged").
Try executing, in Terminal (as an admin user, although that and the
sudo are probably overkill) assuming the bash shell
HOSTNAME=pool-70-104-90-61.pskn.east.verizon.net
before you retry your test. (Use your then-current name for your
then-current IP.) You should see the FORGED_RCVD_HELO go away, and
the spam score decrease. The HTML_SHORT_LENGTH will likely go away
for the real newsletter (just as well, because the real newsletter
will no doubt get other points).
This part of the spam testing: MPART_ALT_DIFF is also bad news...it
seems to say that the plain text part of the message doesn't match
the HTML part. Spam points.
Some sites are likely to give spam points for
X-Mailer: Direct Mail for Mac OS X
or to score the other things differently, or both. You're getting 1.8
+ points already, even with the negative points for passing SPF as
Verizon saw it (I don't know how Verizon scores that--the as-shipped
SpamAssassin gives each of those two passes a very small negative
score as sort of a place holder. (You passed SPF because pobox.com
took care of that for you--that's why the
Return-Path: <SRS0=cjSb=BK=Franklin.com=Geoff_Odhner@bounce2.pobox.com>
is what it is. The address pobox.com would use to send along a
bounce to you is encoded into that local part along with magic which
validates the address (for a while).
Bottom line is that some of your recipients will get the message and
some won't. But that's normal for mailing lists, unfortunately
(thanks, spammers). But it's certainly worth a try (and if your
recipients have the sending address you use for the newsletter
whitelisted at their provider and/or present in their address book,
they have a better chance of receiving the messages). Your AOL
recipients will probably NOT receive your messages, and you won't get
bounces to say so.
All in all, DirectMail indeed looks useful for your purpose.
(Anything that sends directly will have the same problem with AOL.)
--John
mayo-ireland.ie![[F]](/Images/i7/site.gif){kind=small}
TidBITS 
TidBITS 