Re: [gentoo-project] Spoofing on list -> Infra response re SPF

[Raymond Jennings]

Be forewarned that deliberate evasion of blocking methods in some
jurisdictions could be construed as harassment, computer trespass, or both.

I would strongly recommend that anyone doing so immediately cease and
desist to avoid possible criminal charges.

On Mon, Dec 5, 2016 at 2:05 PM, William L. Thomson Jr. <wlt-ml@××××××.com>
wrote:

> On Monday, December 5, 2016 9:52:26 PM EST Robin H. Johnson wrote:
> >
> > Why did your mail server (mail1.obsidian-studios.com) allow the
> > forgeries to be sent? Even as an authenticated client allowed to relay
> > email, it should be checking the envelope sender (and ideally the From
> > header inside the email as well).
>
> I am looking into such. It reveled a series of problems. I filed 2 bugs
> already
> with KDE.
> https://bugs.kde.org/show_bug.cgi?id=373313
> https://bugs.kde.org/show_bug.cgi?id=373314
>
> I am looking into what happened with ASSP. I have one inquiry there already
> https://sourceforge.net/p/assp/mailman/message/35533609/
>
> ASSP likely did a SPF lookup but due to relaxed rules it did not flag nor
> reject. Plus I am sending from internal authorized so may be bypassing some
> checks. I have another issue where assp is not working with syslog
> anymore. I
> cannot look into logs to see what occurred. I never spoof emails, nor did
> I do
> it intentionally. I have to go see how this happened.
>
> I will take all the blame for something I stumbled across. So its my
> problem.
> Though anyone else in the world could have stumbled across it just the
> same.....
>
> > Your MUA should have issued a warning, but it's not an error in any way.
>
> I agree, I filed a bug on such.
>
> --
> William L. Thomson Jr.
>