full-disclosure - Re: facebook

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <237115.1325566979@turing-police.cc.vt.edu>
Date: Tue, 03 Jan 2012 00:02:59 -0500
From: Valdis.Kletnieks@...edu
To: t0hitsugu <tohitsugu@...il.com>
Cc: "full-disclosure@...ts.grok.org.uk" <full-disclosure@...ts.grok.org.uk>
Subject: Re: facebook

On Mon, 02 Jan 2012 18:39:56 PST, t0hitsugu said:

> I'm more confused as to why he replied when I had messaged this board

Because he has a stupid autoresponder that blabs out to the From: address
without bothering to figure out if it's actually addressed to him personally,
or if it's traffic to a list he subscribes to. There's a number of really good
heuristics, none of which his autoresponder actually did:

1) Check Return-Path: and Sender: for the patterns owner-*@, *-request@, and *-bounces@
2) Check for a List-ID: header
3) Check if an address of yours is listed in the To: or cc: fields.
4) For bonus credit, don't send a note if you've sent a note to the same address
since the autoresponder was turned on (helps prevent loops).

Content of type "application/pgp-signature" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/