Re: can't receive messages from ourselves (e.g., through a mailing-list)

On Thu, 1 Apr 2004, Marco Paganini wrote:

> > Of course, you don't include your signature with your mailkey when you
> > post on the list:
> > - the mailkey is kind of secret, no need to publish it
> > - no need to clutter messages on the list with a signature :-)
> > - after all, the mailkey trick is an optional hack in ASK: in fact,
> >   you don't even bothered to configure a mailkey, you don't even have
> >   one.
>
> I think you got it all reversed here. :) The mailkey is *not* secret at
> all. It should go on every message you send out. Also, the mailkey is
> *not* optional at all. You *must* have your mailkey set up correctly or
> else ASK will not work well.

Thanks for answering. Long story short: I do not agree :-)

I do not want to send a silly signature with every message, I do not
use the mailkey system, and ASK is still working perfectly. Well,
almost perfectly, besides this minor inconvenience I am complaining
about right now.


> > Then guess what ? Each time you send a message on the list, you won't
> > receive it, it will be put in "junk". For instance, _I_ won't receive
> > this message you are reading right now. Why ? Because of this weird
> > piece of code:
>
> > in askmessage.py:__inlist():
> >
> > 		## If the sender is one of our emails, we immediately return false.
> > 		## This allows the use of "from @ourdomain.com" without having to
> > 		## worry about matching from [email protected]
> >
> > 		if self.is_from_ourselves(sender):
> > 			self.log.write(10, "  __inlist(): We are the sender (%s). No match performed." % sender)
> > 			self.list_match = ""
> > 			return 0
> >
> >
> > Marco, could you explain ?
>
> This is here because you cannot trust your own address in any manner (unless
> it contains your mailkey). Otherwise, it would be very easy for spammers to
> deliver a message to you: Just make it seem as if it's coming from you. For
> obvious reasons, ASK cannot send yourself a confirmation, so in the end, the
> choice is either deliver or junk.

I understand that, but I think it could (should?) be tested AFTER
white/black/etc list matching, so the mailkey trick would be truly
optional.

Moreover, from a pure "software engineering" perspective
(grandiloquence, sorry), I find it quite weird to test
"is_from_ourselves" in an otherwise very generic list matching
function. I think it should at least be done at a higher level.


> This is why these messages are "junked" instead of blindly deleted. This
> gives you a chance to check, from times to times, if there's something not
> quite right because you forgot to whitelist your list address, for instance.

Again, if "if self.is_from_ourselves(sender)" was tested AFTER
whitelist matching, the "junk" thing just above would also work, and
would not be dependent from the mailkey system.

I am not asking to suppress the mailkey system, just to make it
really independent from the rest, and so really optional (it is almost
already today).

Cheers,

Marc.


-------------------------------------------------------
This SF.Net email is sponsored by: IBM Linux Tutorials
Free Linux tutorial presented by Daniel Robbins, President and CEO of
GenToo technologies. Learn everything from fundamentals to system
administration.http://ads.osdn.com/?ad_id70&alloc_id638&op=click