bugtraq - Re: Is predictable spam filtering a vulnerability? (silently dropping messages)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <200406251952.PAA04972@Sparkle.Rodents.Montreal.QC.CA>
Date: Fri, 25 Jun 2004 15:49:27 -0400 (EDT)
From: der Mouse <mouse@...ents.Montreal.QC.CA>
To: bugtraq@...urityfocus.com
Subject: Re: Is predictable spam filtering a vulnerability? (silently
  dropping messages)

>> A 5xx failure code is a lot more friendly than actually generating a
>> DSN.
> Well, you're causing the sending/relaying host to generate the DSN.

Only if the sending host is running a real MTA.  If it's ratware
talking to you, it won't do anything of the sort.  _That_ is the real
gain of an SMTP-layer rejection over accept-and-bounce: it doesn't
generate DSNs when talking to ratware.

> Quite possibly back to some sod who has been joe-jobbed.

But in that respect it's no worse than generating a DSN yourself.
Better sometimes and no worse the other times - sounds like a win.

/~\ The ASCII				der Mouse
\ / Ribbon Campaign
 X  Against HTML	       mouse@...ents.montreal.qc.ca
/ \ Email!	     7D C8 61 52 5D E7 2D 39  4E F1 31 3E E8 B3 27 4B