Re: Re: faked from addresses getting through to my lists

On Tue, 15 Jun 2004 15:26:00 -0400, James P. Howard, II wrote
> 
> I've toyed with keeping a whitelist of accepted PGP keys and only
> accepting email from users who provide a valid signature.  Is this
> even someone reasonable?

I wouldn't think that'd be to difficult to put together.

After I sent my message I thought "what else could Terry do if he was really desperate to 
implement a screen?" and came up with this (FWIW):

(warning: lots of work and hardly worth the effort unless a whole lot of spoofing is going on)

1) go through all the list's archives and match information in the bottom-most Received: line to 
the subscriber's address. Keep all of this in a database (not the dist file).

2) when a post comes in check to see if the Received:-line information matches any of the 
stored values for that subscriber -- if so accept the message

3) if it doesn't match but the sender is in the subscriber list then send the message for 
moderator approval and add the Received:-line info to the database

4) if not approved -- dump the message to a spamfile

It's still not going to be proof against a determined spoofer but should eliminate the casual 
spammers.

Rich