Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×
Spam

Looping E-mails Beat The Net Down 206

Posted by CmdrTaco from the i-want-my-smtp dept.
Staili writes "Singapore-based women's magazine caused problems when it forwarded its mails to a large list of recipients, mainly mailing lists. In addition to security@suse.com, some help and subscribe lists were included; the type of addresses that tend to send out an automatic reply confirming receipt. And the loop was ready." I'm sure anyone who's messed with mail enough has accidentally created a loop or two in their day, but this is really slimey.
This discussion has been archived. No new comments can be posted.

Looping E-mails Beat The Net Down More

Looping E-mails Beat The Net Down

Comments Filter:
  • If a "solved" problem like email actually brought the net down... for a while. How do you get patches for a sendmail program without using the internet?

  • Singapore-based women's magazine..

    I remember an artical on /. about the blocking of Asian emails (mostly b/c of spam), and this mentions a Singapore-based magazine. Is it really time to consider the firewalling of certain asian email though we have to remember that many western businesses do business w/ eastern companies. If we let some isps through spammers will just route through them.

    • Re:Asia Problem (Score:4, Informative)

      by mccalli ( 323026 ) on Saturday March 02, 2002 @01:35PM (#3098048) Homepage
      Is it really time to consider the firewalling of certain asian email...

      Right, well I've been to Singapore and I have to tell you that its IT and communications are in a very good state. In fact, I'm rather hoping someone actually from Singapore will chip in here

      Singapore was the first place I saw ADSL in. It has a row of internet 'phone' booths on its most popular shopping street (Orchard Road). In my hotel, 24 internet access was available for a ridiculously low fee (12 SGD I think). It was cheaper for me to phone the UK from my my hotel than it was for a person in the UK to phone me. Cheaper from a hotel phone.

      There seems to be some insidious 'oh, it's those clueless Asians' thread running through so many Slashdot posts recently that I think it's time the balance was addressed. The US's mobile phone system, for example, is an utter shambles compared to the Asian systems. I was reading on a UK's paper site that BT was planning to roll out the world's first internet booths - I was reading it from an internet booth in Singapore.

      I can assure everyone that the people I worked with in Singapore were quite bright enough to run systems properly, and every bit as interested as their Western equivalents in doing so.

      Cheers,
      Ian

      • And I don't see a significant number of people in the UK or USA with cellphones that have color displays and digital cameras built in. They have some crazy stuff in Japan. You can take a picture of yourself, and send it to a friend via the phone. They might even have cellphones in general circulation that can send live video back and forth too, but I'm not so sure on that one.

        As the USA and UK are generally heralded as technological equals to Japan, this is pretty lame.

      • Re:Asia Problem (Score:2, Informative)

        by Genie1 ( 224205 )
        It has a row of internet 'phone' booths on its most popular shopping street (Orchard Road)

        I am not a Singaporean but I stay here. These internet 'phone' booths are not working. I believe that the plan is to implement them later on, but not yet. Right now, it is just a couple of information kiosks.

        I do agree that the infrastructure in Singapore is really really good. There are a few broadband plans going for about $60-70 Singapore dollars a month. That is about $30 USD. Plus the all the service is linked to a national high speed network.

        Plus, corruption in this Asian nation is almost non-existent. Bloody incredible.

      • Nonsense (Score:5, Insightful)

        by FreeUser ( 11483 ) on Saturday March 02, 2002 @01:58PM (#3098143)
        There seems to be some insidious 'oh, it's those clueless Asians' thread running through so many Slashdot posts recently that I think it's time the balance was addressed.

        That thread is based on the emperical experience of thousands of mail admins throughout the world (not just the US, as your slashdot bash inaccurately implies). If those whose ISPs (and in some cases, countries) are being blocked wish to demonstrate otherwise, all they have to do is administer their mail servers competently and close down their open relays.

        Until then, their inaction will speak louder than your words, be they from Singapore, Korea, or wherever. As one who has travelled to those places I am reluctant to block entire countries, but my boss doesn't want his mailbox filled with SPAM and if blocking half of Asia is how I appease him, then half of Asia will be blocked, period. My personal fondness of Asia (and, for that matter, Africa, and Europe, and other places I have had the privelege of visiting in the last several years) will play absolutely no role in this decision, and no role in my opinion of the (in)competence of ISP mail adminsitrators in those locations. The only metric of any concern is how many open relays there are, and how those responsible act (or, in the case of many notorious Asian providors, particularly in Korea, don't act) when the issue is brought to their attention.

        As for the differences in phone systems, you are comparing apples and oranges, and assuming one causation (lack of technical knowhow) when a completely different causation (lack of well defined, enforcable government standards resulting from a lassaiz-faire market mentality in the last several administrations) is responsible, then trying to apply the erroneous conclusion derived from your erroneous assumption back to another issue that is, in any case, completely unrelated.

        Internet booths are another example of the logical fallacy you have fallen into in making this argument. In a country in which more than half the homes have their own PCs, and just about every public library is already on the net (along with many schools), internet booths would be a profound waste of money. In other words, you have brought up another completely unrelated topic and misapplied it to your original argument, namely what approaches empower the most people to use the internet under what conditions, with those conditions in Singapore quite different from the United States, which in turn is very different from the UK or the rest of Europe. Clearly that has absolutely nothing whatsoever to do with the competency level of mail administrators in Asia, Africa, America, Antarctica, Mars, Pluto, the NGC-1 Nebula, or anywhere else for that matter.

        • Re:Nonsense (Score:5, Insightful)

          by mccalli ( 323026 ) on Saturday March 02, 2002 @02:29PM (#3098256) Homepage
          That thread is based on the emperical experience of thousands of mail admins throughout the world...all they have to do is administer their mail servers competently and close down their open relays.

          Excellent example of the insidious nature I mentioned. This topic isn't even about open relays - it's about a mailing loop. Read the rest of the replies and you find most examples of these have been Western. Yet this simple, newbie slip-up is used as a yet more proof that the whole of Asia should be firewalled.

          It's ridiculous.

          Cheers,
          Ian

          • More nonsense (Score:3, Insightful)

            by FreeUser ( 11483 )
            Excellent example of the insidious nature I mentioned. This topic isn't even about open relays - it's about a mailing loop.

            The two are related, as any rudimentary understanding of how mail systems work will make clear. Without the open relays the SPAM could not be sent to the mailing lists with their header information forged and hiding the sender's online identity. The offending messages resulting in these mail loops are originating from open relays, most of which are in Asia.

            But be that as it may, you miss the point entirely (perhaps willfully?).

            It's ridiculous.

            No, its the only option the Asian providors are leaving us. Making a "newbie" mistake, as you misleadingly put it, is one thing. Willfully refusing to fix the problem when it is brought to your attention is something else again. Those "western" sites you refer to either fix their open relays (the most common response) or get blocked themselves.

            What is more, for the last half decade almost all mail servers come with open relaying shut off by default, which means these "clueless newbies" almost certainly had to turn open relaying on, deliberately.

            It is not unreasonable to infer from two deliberate actions, namely turning on open relaying in the first place, then refusing to fix the problem when it is abused and people complain, that the administrators of these sites are either appallingly incompetent or obscenely complacent. In either event we can be certain of one thing: if we want to stop receiving SPAM from these sites, we have to filter them. Period.
      • It has a row of internet 'phone' booths on its most popular shopping street (Orchard Road).

        Those things? All you can do is look up a few info pages (shopping directory, etc.) and video chat with people in other booths on Orchard Road.

        It was cheaper for me to phone the UK from my my hotel than it was for a person in the UK to phone me. Cheaper from a hotel phone.

        Singapore has a great policy wherein hotels are not permitted to mark up phone charges. So you are billed at the regular direct dial rate for calls.

        I can assure everyone that the people I worked with in Singapore were quite bright enough to run systems properly, and every bit as interested as their Western equivalents in doing so.

        Well, they have their share of idiots like anyone else, but at least they speak English, lah, so they can deal intelligently with complaints from the rest of the world, and keep up on security updates.

        I was reading on a UK's paper site that BT was planning to roll out the world's first internet booths - I was reading it from an internet booth in Singapore.

        I don't know when you were there, but I saw internet phone booths in the Netherlands long before in Singapore, and even in Malaysia there were internet kiosks (half BSOD'd at any given time, granted) before such were spotted in Singapore.

        Nevertheless, the general point obtains. They do pay a lot of attention to new technology and tend to be early adopters. Why not - they manufacture the stuff.

      • Is singapore the same place with the shitty record on human rights? Is this the same, Oh What a Beautiful former Colony with supa Internet you are referring to?

        Is the US State Department then a bunch of liars when it says this about the wonderful country:

        "The Government has wide powers to limit citizens' rights and to handicap political opposition. "

        "The authorities sometimes infringe on citizens' privacy rights. Government intimidation and pressure to conform result in the practice of self-censorship among journalists. Government leaders historically have utilized court proceedings, in particular defamation suits, against political opponents and critics."

        "During the year, a prominent opposition figure was convicted for speaking in public without a permit. Despite a continuing discussion of the possibility of an expansion of free speech rights and the Government's role regarding these rights, the Government still did not take significant concrete steps to change the wide array of laws and government practices, or the informal levers of government influence, that lie behind the limitations on civil and political rights. The Government significantly restricts freedom of assembly and association. Jehovah's Witnesses and the Unification Church are banned.

        "The Government has moved actively to counter societal discrimination against women and minorities, but some discrimination persists. Foreign workers are vulnerable to mistreatment and abuse."

        That's swell. What a wonderfuckingful place. I'm moving my business there so I can take advantage of all the superior technology, and hopefully get persecuted and my female employees harassed and discriminated against.

        Don't take my word for it:
        http://www.state.gov/www/global/human_rights/ 1999_ hrp_report/singapor.html

        I think I'll stick with my backasswords western life, even if I can't look at slashdot from a pay phone.
      • Back in '97 in Stockholm, Sweden, I remember seeing and using net booths in town from which I could send e-mails. I've seen net booths in a lot of European airports for already quite some time... What else is new?

        The deployment of GPRS and later 3G mobile webpads it will perhaps render these booths as obsolete as mobile phones have managed to eliminate most public phone booths in European towns.

        /max
    • Blocking all of Asia wouldn't have helped. The article (go and read it) says that the provider/hosting company was based in the US. It's possible, even likely, that the people in Singapore at the magazine didn't have anything to do with setting up the mail server.

  • Why was the header stripped... (Score:3, Interesting)

    by zubernerd ( 518077 ) on Saturday March 02, 2002 @01:23PM (#3097998)
    My question is: Is it normal for a server to strip the headers from e-mails...
    FROM THE ARTICLE: ["At savoixmagazine.com the mail headers were cut so it was almost impossible to find out where the mail originated from," said Drahtmuller. The everyday analogy is a letter stripped of its envelope that had the original return address printed on it, repackaged in a new envelope with a different return address, and forwarded on. "Usually mail loops like this are not possible with Unix systems because they always maintain the headers," he added.]
    I'm not a e-mail expert, but why where those headers missing? (I did not see any reason given in the article.)

    • Re:Why was the header stripped... (Score:5, Informative)

      by Corgha ( 60478 ) on Saturday March 02, 2002 @01:49PM (#3098115)
      Somehow, few people seem to be able to get the autoresponder/autoforwarder thing right, despite the fact that it doesn't seem that hard and has been done correctly before. (Then again, there seems to be a dearth of good systems programmers around these days; I'm becoming increasingly cynical about such things.) Every day, I get auto-replies to MAILER-DAEMON's bounce messages, and every once in a while, some b0rken forwarder creates a mail loop. Unfortunately, when I try to tell the people responsible why what they are doing is a bad idea, they're usually not interested in hearing about the danger of mail loops.

      Here are some things I've come up with over the years:
      1) Never, ever auto-reply to MAILER-DAEMON or Postmaster (procmail has good regex macros for this -- use them or copy them).

      2) Preserve the headers of messages you forward.

      3) Set an X-Loop header and check for it (or *any* X-Loop header if you want to be paranoid).

      4) Don't autoreply to the same address twice during [definable time period].

      Those things just seem like common sense to me. Maybe someone else here knows more about the subject than I do. There has to be a HOWTO somewhere.
      • 5) If you're sending spam using a list/alias, always set the Reply-to address correctly so ppl don't end up replying to the list if that is not desired behaviour.
      • 1) Never, ever auto-reply to MAILER-DAEMON or Postmaster (procmail has good regex macros for this -- use them or copy them).

        Error messages sent by mail servers should have a NULL sender/return-path. Therefore your mail server should easily be able to tell what is an error message from a machine, and not reply to it.

        2) Preserve the headers of messages you forward.

        I think you're confusing what is going on here. There is the type of forwarding that regular people do with their mail clients. And then there is the forwarding that SMTP servers do with email messages. All proper SMTP servers are required to keep all Received: headers intact, as well as to append a Received: header giving information about how that server received the message. Apparantly one of the mail servers involved here was munging the Recieved: headers, either on accident or on purpose.

        3) Set an X-Loop header and check for it (or *any* X-Loop header if you want to be paranoid).

        I've never heard of an 'X-Loop' header, but any good mail server will count the number of Received: headers and kill the message if an exorbitant number of Received: headers is found. Of course, you have to rely on all the mail servers in the loop maintaining the Received: headers as they are supposed to, just like you'd have to count on them not removing an X-Loop header if you added one. However, since Received: is covered in the SMTP RFC, it's a better bet.

        4) Don't autoreply to the same address twice during [definable time period].

        The Received: header counting above is a more maintainable solution to loop prevention for SMTP servers.

        Those things just seem like common sense to me. Maybe someone else here knows more about the subject than I do. There has to be a HOWTO somewhere.

        I've written an SMTP server in Java for my company. The HOWTO is called the SMTP (and related) RFC's.
        • I think you're missing the point entirely (or you're just trolling, but if so, then I'll humor you). Yes, it is possible to write good forwarders and auto-responders. Yes, any bonehead should be able to do so. My point is that most boneheads don't, and so I gave a list that illuminated areas in which they often go wrong, and then I went further and noted that some are resistant to even considering mail loops in their program design. Saying that it's possible to do it right doesn't address either of those issues or add anything new.

          Error messages sent by mail servers should have a NULL sender/return-path. Therefore your mail server should easily be able to tell what is an error message from a machine, and not reply to it.

          Yes, they should have a NULL envelope from, and the auto-responders should be able to identify that, but as I said in my previous post, many people screw it up. The results end up in my inbox every day (which should have clued you in to the fact that I don't need a lecture on how email works).

          [...aforementioned lecture...] All proper SMTP servers are required to keep all Received: headers intact, as well as to append a Received: header giving information about how that server received the message.

          Yes, they should, but, again, my point is that a lot of people don't get that, and try to build a completely new set of headers, which you then go on to admit:

          Apparantly one of the mail servers involved here was munging the Recieved: headers, either on accident or on purpose.

          ... which makes your point even less clear (unless it's some bizarre variation on "no true Scotsman"). Also, you seem to be implying that the MTA is doing the forwarding. However, in many cases, it happens via the MDA.

          I've never heard of an 'X-Loop' header

          It has long been a standard ingredient in many procmail(1)/formail(1) recipies. A similar variant is 'X-Been-There', which, IIRC, Mailman uses.

          any good mail server will count the number of Received: headers and kill the message if an exorbitant number of Received: headers is found.

          Whereas an X-Loop header will stop it on the first loop. That's why people use it. They also use it because many auto-responders and forwarders are implemented outside of the MTA, as procmail recipies, perl scripts, and so on. They often act as MUAs that happen to be invoked directly by the MDA, since they are acting on a user's behalf. There's no real reason why an auto-responder or a forwarder should be part of an SMTP implementation, unless you want your MTA to be a "jack of all trades, master of none." Down that path lies madness (and Microsoft). In any case, it would be unwise for the forwarder (and especially the auto-responder) to rely upon the MTA for loop protection, so smart programmers put in a loop-protection header, just in case. Redundant safety features are a Good Thing(tm).

          4) Don't autoreply to the same address twice during [definable time period].

          The Received: header counting above is a more maintainable solution to loop prevention for SMTP servers.

          What does that have to do with what I said? You can count Received headers all you want, but it will still be annoying as hell when an auto-responder gets on a mailing list or starts replying to another auto-responder. Any sort of header-based loop protection against auto-responders is questionable because they tend to generate an entirely new message in reply to the trigger message (though formail(1), for instance, retains the X-Loop header). That's why, for instance, vacation(1) won't reply to the same recipient twice. The newer versions also don't reply to Precedence: (list|bulk), which eliminates even the first "please rob my house" message sent to a list submission address, and further cuts down on loops.

          I've written an SMTP server in Java for my company.

          Well, I'm sure that will solve the world's loop problems.

    • Many administrators strp portions of the headers in order to provide some obscurity for their internal network structure. The (usually closed) SMTP relay in the DMZ accomplishes this task.

      My guess is that some administrator decided that the more obscurity, the better... (but at the same time, I laugh at them)
      • Many administrators strp portions of the headers in order to provide some obscurity for their internal network structure.

        ... which is in direct violation of SMTP [ietf.org]:

        As discussed in section 2.4.1, a relay SMTP has no need to inspect or act upon the headers or body of the message data and MUST NOT do so except to add its own "Received:" header (section 4.4) and, optionally, to attempt to detect looping in the mail system (see section 6.2).

  • Mail chauvinist pigs (Score:3, Funny)

    by leonbrooks ( 8043 ) <SentByMSBlast-No ... .brooks.fdns.net> on Saturday March 02, 2002 @01:24PM (#3097999) Homepage
    I'm guessing that's the magazine's view of us, anyway. (-:
    • Pigs... In chain mail... Mmmmmmmm... I don't care if they're chauvinists, I want them, *now*!
      • Pigs... In chain mail... [...] I want them, *now*!

        Ah, another Hogfather fan... (-:

        If you then practiced, er, discipline with them, could they then be mail order pigs without being Catholic? The Catholics seem to have a monopoly on male-order pigs...

  • Mmmh (Score:1)

    by NWT ( 540003 )
    Yep, I've seen this before, it happened with two web.de [www.web.de] mail accounts which had both set up reply messages that the mail had arrived and guess what happened ... but i think they've done something against it, at least i hope it!

  • Haven't we all done this? (Score:3, Interesting)

    by Charles Dodgeson ( 248492 ) <jeffrey@goldmark.org> on Saturday March 02, 2002 @01:28PM (#3098018) Homepage Journal
    I don't think that there is an email admin around who hasn't managed to be part of such a loop. It is remarkably hard to put together systems which will interact correctly with all of the other ways that other systems might be broken.

    And for anyone who thinks that email is a "solved" problem, should read my rant about broken autoresponders [goldmark.org]. (which is not about loops, but does cover how "solved" things can be broken).

  • Normal (Score:3, Informative)

    by dnoyeb ( 547705 ) on Saturday March 02, 2002 @01:28PM (#3098019) Homepage Journal
    This happens at my job all the time, and I assume it happens other places with internal mail servers.

    Management sends out a promotion announcement or some such to everyone, those on vacation autoreply...To ALL recepients. And the war is on!

    I think enough people slapped management that they finally started using BCC. But sometimes someone new comes and they forget.
    • I don't understand. Why don't your lusers just autoreply to sender only? Are they that stupid?

      • Re:Normal (Score:2, Funny)

        by desertfool ( 21262 )
        You've obviously never worked at tech support for a large company. Many of them are idiots.

        • Oh but I have, as a mail admin amongst other things, with 2000 users.

          I can't remember clearly but perhaps Lotus Notes 'Out of Office Agent' just doesn't allow "autorespond to all recipients". And that's probably sensible.

          Broken users or broken MUAs?
      • To be blunt - Yes.

        I joined one company (names have been deleted to protect the fuck-witted) about a week after the "I Love You" virus came out. There were about 500 I Love You's a day going to everyone, because they were all too stupid to set a message rule to delete anything with "Iloveyou" in the subject.

        This was also a company where 3000+ items in you inbox was a sign you were doing your job right, because you didn't have time to delete/organise them... :|
        • > because they were all too stupid to set a message rule to delete anything with "Iloveyou" in the subject.

          Sounds like the admins job to me. I agree, however, that it's like pulling teeth to get users to watch out for some of the most obvious and simple problems.

          The staff/faculty of our campus has been hit a bunch of times with new e-mail viruses that are new and not removed by our Exchange AV program. Even though all of them have been a part of the chaos that has ensued in the past, and ALL of them have been told countless times not to open strange attachments, I've seen some of the most senior faculty persons open some of the most obviously shady attachments you could find. And then they call the Help Desk and curse about virus makers while we are digging through call logs looking for the last time the person was told not to open strange attachments.
    • we solved that... We wrote a script to lock the user-account and mailbox of anyone that sends more than 5 emails in a minute. Anyone found to have set the stupid (I'm out of the office...blah blah...) is usually reprimanded... Yes the CTO himself was locked, we bounced all his email for a week and the It department head told him that it will happen again if he abuses company resources.

      I love management that actually has balls.

  • happened at my school once... (Score:4, Interesting)

    by jeffy124 ( 453342 ) on Saturday March 02, 2002 @01:28PM (#3098022) Homepage Journal
    back when i was a freshman in college someone managed to assemble an email list of all the students/faculty/staff. It was first used by someone outside the school to spam the entire campus, with all the addresses in the To and Cc fields, making the list available to anyone who received it. So someone attempted to sell their Chem Eng books, and you can picture the hell that broke out.

    Quickly the list became nothing but people hitting reply-all and saying "knock it off!" and "get me off the list!" Of course, all those emails and addresses in the emails meant trouble for the mail server, causing mail to get delivered multiple times and DOS'ing normal mail.

    It got so bad that I had about 100 emails in a five minute span at one point. It took a Dean's sending out an email to an announcements list pointing out school policy on mass mailings to stop it.

    Thankfully, everyone from those trying to sell stuff to those saying "quit it!" all had to write a 500-word essay about why what they did was wrong.
    • back when i was a freshman in college someone managed to assemble an email list of all the students/faculty/staff. It was first used by someone outside the school to spam the entire campus, with all the addresses in the To and Cc fields, making the list available to anyone who received it. So someone attempted to sell their Chem Eng books, and you can picture the hell that broke out. Quickly the list became nothing but people hitting reply-all and saying "knock it off!" and "get me off the list!"

      I find this story very hard to believe, unless you attended that tiny western college with 12 students.

      Say a typical email address is 20 characters. Say that a smallish school has 4000 students and 500 faculty/staff. That's a 90K header. How many MUAs can parse that? Not many. Even fewer in sufficient time that your random punter would hang around waiting for it to happen.

      • the email list had more than 15,000 addresses in it, combined with an email server that (at the time) couldnt handle the load and wound up delivering messages multiple times. When I said that I got 100 messages in a few minutes, it was actually something like 20 unique messages times 5 copies = 100.
    • Now repeat 500 times:

      I must not repeatedly send out email messages.
      I must not repeatedly send out email messages.
      I must not repeatedly send out email messages.
      :
      :
      :
    • I think he's joking with this quote: "Thankfully, everyone from those trying to sell stuff to those saying "quit it!" all had to write a 500-word essay about why what they did was wrong." So don't get your panties into a bunch about it, ok?

      I've actually seen this happen here at UC Berkeley a few times where there's a mass mailing and some jackass replies to all asking to be taken off the list. The some other jackass replies to all telling him to shut up and stop sending out crap to everyone. The everyone replies asking to eb taken off, and bamn! The system gets overloaded. Usually the mail admins are quick enough to pull the plug on the list such that it doesn't go on forever. This happened recently with the list of students graduating this May.

  • Outlook... (Score:1, Informative)

    by Anonymous Coward
    Ah, the classic Outlook 'Out of Office' Autoreply springs to mind - great when the recipient is on a mailing list, it replies... posts itself... replies... etc...

    This has happened 4 or 5 times to me in teh last few weeks...

  • When I decided to create a mailing list, I kept the list of address in a BCC field, in an address book entry on my computer. There's no way for anyone besides me to mail everyone. If mail bounces it just comes back to my address.

    Why would anyone make a list that bounces all replies back to the entire list again? It doesn't say if this was the first time they tried using the list or not, but I would figure it if was set up to do that once, it would have done it before. I mean, addresses on my list are constantly falling out of service, and I'd hate for everyone else to get all the "could not deliver" notices and the like. I find it a little hard to believe that someone would set something up like that as an accident.

    • Because - negative as it may sound - humans and spanners are fuckwits.
    • Um, what we are talking about is not the same thing as what you set up. A mailing list proper uses a program, such as majordomo, listserv, mailman, etc. that allows anyone to subscribe to the list and receive mail. Everyone gets a copy of the email that is sent, and usually everyone can in turn send mail to the list.

      I manage such lists with majordomo, and the program works fairly well.

      Yahoo Groups does this (which used to be OneList, which used to be...) as a service, as does several other portals. In addition, software packages often keep mailing lists for the users of said software, as a way of tracking bugs, asking newbie questions, etc.

      In the case we are discussing, the security email list for the SuSE linux distribution was one of the ones hit by the email storm, due to a misconfiguration by the Singapore women's magazine list.

  • Oh man, this is just hilarious:

    When Drahtmuller contacted savoixmagazine.com's hosting company in the U.S., the situation slipped into the ridiculous as the hosting company tried to reply in Drahtmuller's native German language. "Even though we contacted them in English, they ran their response through Babelfish (translation software) so we couldn't understand what they were saying," he told ZDNet U.K. "In the end we blocked their servers from our mail exchanges. We did what we could but the problem still existed."
    • Just guessing, but perhaps the Singapore admin(s) could not understand English and used Babelfish or some other translation software to translate it into Chinese; then wrote a reply in Chinese and translated it into German.

      • Read the article.

        SuSE contacted Sa Voix Magazine's hosting company in the US. I would expect a US hosting company to use English.

        Also, send emails to enquiries@savoixmagazine.com ... if we slashdot their mail servers, they might just decide to get a clue...

      • Why would they translate it into chinese considering the main language of singapore is Malay?

        Its funny reading slashdiot, a misconfigured mailing is "more spammers from korea, BLOCK THEM ALL!!".
        • The main language used in Singapore (I'm a citizen here) is English (road signs, application forms, just about everything uses English). The official languages are English, Chinese, Malay and Tamil (if there is space and the requirement for it, e.g. tax return forms and warning signs, all four languages will be provided). The official official language is Malay (national song, military drill commands). Just about everyone here speaks their mother tongue and English fluently.
    • Or, as the fish put it (via Spanish and Chinese):

      The Oh person, this one nearly does not smile: When the Drahtmuller input contact with accepts to the company in E.E.U.U. savoixmagazine.com's, the situation slides in the laughable situation looks like recibimiento experiments the company answers in Drahtmuller. local German language " although we deliver them contact with use English, carries out his answer and Babelfish (software logic translation) we has not so been able to understand its what said, " we think ZDNet Reino unites " we which stops the mail in finally us exchanges its server. What were we us can but still exist this question "

  • List readers' fault (Score:3, Insightful)

    by MagPulse ( 316 ) on Saturday March 02, 2002 @01:34PM (#3098043)
    So SuSE was relaying large amounts of e-mail from two sources from what I can tell:
    1. E-mail from the Singapore magazine
    2. Replies from well-intentioned SuSE list readers complaining about it
    #1 is easy, just firewall the magazine. #2 is the SuSE list users' fault. You get a bunch of spam, so you spam the list about it? I guess SuSE had no choice then but to shut down the list, but I hope they send out an e-mail before they do advising people on where they should send their complaints next time this happens.
    • List readers' fault : advising people on where they should send their complaints

      Any solution that relies on lots of people doing the right thing is bound to fail.

  • caused problems when it forwarded its mails to a large list of recipients, mainly mailing lists.

    Clearly it was spam (the UBE sort).. This magazine needs a little netiquette lesson, and a slap on the wrist.

    In addition to security@suse.com, some help and subscribe lists were included; the type of addresses that tend to send out an automatic reply confirming receipt. ... but this is really slimey.

    Yes, it certainly is slimy.. It's bad that someone would subscribe an address to a mailing list (and then autoforward mail from the address), and it is also bad that list servers don't provide some protection against this [ie: automatically blocking mail they're bombed with]

    • I think you're right that it was done intentionally. Assuming these mailing lists require new subs to confirm subscriptions, then someone who could receive mail at the magazine's address had to do the confirmation in order to get the loop going. If that's the case, I'd guess that it was an employee there who was pissed off at someone and who decided to do some damage. OTOH, if the mailing lists don't require confirmation, then anyone could have done it. All they'd have had to do was sub the magazine's address to the mailing list and vice versa.

  • I remember back in the day we did this to a certain guy we knew, we set up these "free email forwarding" accounts and had 5 accounts. Each of them was set up so that when it received an email, it would forward to the other four and our mark. It took oh, about an hour for his email box to receive 16,000 emails saying "your hard drive is now full" (he ran his own mail server at the time.) Those were the days.....

  • Anecdote (Score:4, Funny)

    by eyeball ( 17206 ) on Saturday March 02, 2002 @01:36PM (#3098059) Journal
    Before my bank's introduced their online banking, you could submit your email address on their site if you wanted to be notified of their beta test. Well, one late Friday afternoon I got an email notifying myself and all the others of the beta test progress. Unfortunately the person sending out the email put as many people as they could fit into the To: address. People started reply-ing to all, saying things like "Please unsubscribe" and complaining about getting so many emails, etc.. Of course because this was sent out on a friday, so this went on all weekend. Hundreds of replies went out by monday, when they asked nicely for everyone to stop hitting reply-all.

    Epilogue: I wrote the VP of the company and expressed my concern that if they weren't competent enough to use email, how was I going to trust them with my money online. The VP sent me an apology and a $50 traveler check gift!

    • Re:Anecdote (Score:4, Insightful)

      by glitch! ( 57276 ) on Saturday March 02, 2002 @02:07PM (#3098172)
      Of course because this was sent out on a friday, so this went on all weekend.

      I have never been able to figure out why so many people pull this kind of crap. Obviously they were trying something new or different than usual. Otherwise the problem would have come up earlier.

      This also happens occasionally with the phone company. For some reason, the retarded assholes will make some circuit change on a Friday evening, break something, and then go home for the day (and weekend). Why not do it on Tursday morning, or some other time that allows the nitwit that made the change to fix it immediately when the customer calls in a trouble ticket? (Because all the skilled telco employees were "downsized", and only the retards are left?)

      Actually, this can apply to any situation where someone makes an important change or tries something new that might have a large, unexpected effect. How about replacing a bunch of ecommerce scripts just before going on vacation? (And did you verify that your "vacation" program is working correctly?) Or how about changing your BGP filters just before leaving for the night (any night)? Or how about something more mundane, like going on a long driving trip just after changing something important, like the water pump?

      I believe that this really boils down to a single factor. Does the person in question really give a shit about the consequences of his or her actions? One could argue that this person is simply too stupid to realize the potential cost of failure, but I believe that anyone who cares about his or her job will take the time to KNOW, not hope. And this person should be prepared to deal with the unexpected, and have a "worst case" fallback plan.
      • Of course because this was sent out on a friday, so this went on all weekend.

        I have never been able to figure out why so many people pull this kind of crap. Obviously they were trying something new or different than usual. Otherwise the problem would have come up earlier.

        Time-Warner Cable did this to me just last night. They 'sent out an upgrade' to the cable modems, and some of them didn't take. So the built-in DHCP server gave me a 192.168 address and I knew I was screwed. Tech support had me reboot everything, and it stayed screwed, at which point I was told I needed a new modem.

        Of the handful of retail locations open today, the one I had a chance to get to before they closed didn't have any replacements (Hmmm. I wonder why they ran out? Could it be they had a few other people bring theirs in, too?) - at least that were working. Since tech support (including the guy who told me to go to that store) works upstairs from that particular retail location, I pointed out this fact and asked if there were any spares up there.

        After much discussion via AIM between Customer Service and Technical Support, a friendly soul emerged from upstairs with 'their test modem', which I gladly accepted, knowing that it would therefore be in good order, which is how I found out about this 'update' thing.

        Since only half of their retail outlets are even open on Saturday (with abbreviated hours) and none on Sunday, it seems to me like Friday night is exactly the worst time to send out an 'update' with the potential of breaking something.

      • down boy, down! (Score:3, Interesting)

        by Erris ( 531066 )
        Why not do it on Tursday morning, or some other time that allows the nitwit that made the change to fix it immediately when the customer calls in a trouble ticket? (Because all the skilled telco employees were "downsized", and only the retards are left?)

        Downsizing can make anyone look retarded. When there are not enough people to do the work, the work does not get done.

        Downsizing is only half the problem anyway. There are whole industries where the average age of engineers and craftsmen is around 50. Those companies have not hired waves of new people for 20 years or so, and fired many of those that were lucky enough to get on. Think that 60 year old overworked survivor really cares about training sucessors? Nope, they are looking for a package and will give the job to you the way they got it, learn as you burn. Many great mistakes will be repeated. I believe that this really boils down to a single factor. Does the person in question really give a shit about the consequences of his or her actions?

        You are entitled to your opinion. Most normal people quit jobs where things are starting to fail. The lucky ones find good alternatives. The loyal ones get stuck with a job that much more difficult. How many years of your life are you willing to give up to hopeless causes? Everyone knows the general rules. Some are lucky enough to put the big changes off as good practice, sometimes the law, demands.

        I feel awful for people who do real work at the telcos. Change sucks, and they are getting plenty of it. Imagine starting your career there before deregulation. Off you whent to serve the regulated monopoly and the public. You accepted low salaries in exchange for stability and pride of serving one of the best and cheapest telco services in the world. You also put up with the more inane political nonsense and tried to just do your job.

    • And who the hell uses the "reply to all" anyway?

      I don't think I've ever used it. Maybe that means I should get out less, or something.

      • I know a CS professor who promotes OSS at every turn.. She encourages the use of SourceForge and absolutely loves Linux.. She uses the Reply to All option everytime she responds to a note.. I guess it just proves that Linux is making progress on the clueless desktop user front!

      • If I want to respond to a mailing list group, I use reply to all and take out the sender's address (so he/she doesn't get the message twice). If I just hit reply, then only the sender's address is in the To: field, which I have to delete then type the list address. Reply to all is much eaiser in that case (though I would prefer a "reply to group" option).

        Just a thought.
  • A similar misconfiguration resulted in a mailing loop a couple years ago with asynchrony-projects.com: somehow members-bounce@ was rewritten to members@; the net result was that a single incorrect subscribed email address caused a about a hundred emails to be sent out to 1000+ subscribers to the mailing list.

    These problems are easy to fix, but people make mistakes... personally I'm surprised the number of mistakes has been so limited thus far.

  • E-Mail Database (Score:3, Interesting)

    by yintercept ( 517362 ) on Saturday March 02, 2002 @01:46PM (#3098099) Homepage Journal
    I am actually surprised by the number of times people send out email not knowing who will receive it or the number of people in their CC list. Most email clients don't let the end user see how much damage they have done. The goal of a developer is to give the users the power to get their job done, but so often you find people are clueless on what the power is or how to use it.

    Personally, I would like to see email merge with databases. With a good relational DB, it is easy to show users what's gone through the pipe and how many emails your company has sent to a client, etc.. You can integrate the email into your CRM, etc. You can also place constraints on the system that can prevent this type of mailing list abuse that generates so much unwanted garbage.

    Working with pure email clients (sendmail, exchange, whatever) seems to be like trying to fit a round cat through a square hole. [rgreetings.com]

  • Linux developers are clueless (Score:5, Funny)

    by FarHat ( 96381 ) on Saturday March 02, 2002 @01:47PM (#3098104)
    Its obvious that the women readers of the said magazine have the hots for German Linux developers and they tried to show their interest in them. True it wasn't in the best possible way but they did give a signal which the Suse guys completely misinterpreted. Sad.
  • Why didn't these mailing lists just restrict who can post onto their lists to those actually on the list?
  • The date says the article was written yesterday but I remember being in this loop 6 months ago and getting 600 messages or so one night.

    The funny thing was that I'm not on any Suse email list or on savoixmagazine.

    Perhaps it happenned again but missed me. I've been out of the loop a lot recently.

    • > The date says the article was written yesterday but I remember being in this loop 6 months ago and getting 600 messages or
      > so one night.

      Looking back in the mess that is my mail archives, I see this happened towards the end of the week of Saturday 30 November 2001. When a search thru NANAE did not turn up anything about savoixmagazine, I decided this was just another weirdness of the Innernet, & forgot about it.

      > The funny thing was that I'm not on any Suse email list or on savoixmagazine.

      One theory a couple of the folks caught up in it suggested was that somehow somebody at savoixmagazine got ahold of the Linux Counter Project mailing list & added this to the mail list in question.

      FWIW, after experiencing this mess, I have a little more sympathy for the bewildered user who sends off an email ``Take me off this list." I inadvertently added to the spew before I saw the email from the folks at SuSe -- which was buried in dozens of emails with the subject lines of ``Urgent", ``You have been subscribed toSuSe-security", ``You have been unsubscribed from SuSe-security". You have to get your fingers burned at least once in order to remember to sit no them before trying to solve a problem.

      Geoff
  • From the article, the German sysadmin says:

    Even though we contacted them in English, they ran their response through Babelfish (translation software) so we couldn't understand what they were saying

    You've got to laugh. Rebecca Ore once told of her colleague trying to deal with some francophone Canadian sysadmins. "He just babelfished them until they gave up and started using English."

  • oh yeah, i created a loop (Score:5, Interesting)

    by legLess ( 127550 ) on Saturday March 02, 2002 @02:04PM (#3098162) Journal
    I once inherited a smallish network (70 nodes) that was using an NT box as a web gateway and mail server. It was running something called Xtramail, which is a truly bloody horrible piece of software. While I was trying to figure out how to gracefully get rid of this box (a 486 on ISDN), one of the users wanted to create a mailing list.

    Ok, no problem. Read the docs, slurp this list, check these buttons, viola. One of the cute little checkboxes was "Only allow owner to send list mail." Duh - I checked it. The guy sent his email (only about 200 list members) and we went home.

    I came in the next morning to 20,000 emails just in the queue. That fucker sent our tens of thousands of emails overnight, because the send restrict wasn't working. There were a couple dead addresses on the list, and they of course bounced - and Xtramail politely returned those bounces to the entire list. Wash, rinse, repeat. If that place had had a real server and a real 'net connection, it could have sent millions of emails in that time. As it was, many people on the list were (quite justifiably) pissed.

    So I called up whoever owned Xtramail at that time (Artisoft at that time, but a different company now - can you say, "hot potato?") and had a slightly polite shit fit. The guy flat-out refused to acknowledge it was a problem, until I made him go through the same steps on his local copy.

    Crickets.

    "Uh, looks like that option isn't working. I'll have to file a bug report." Then I spent another 45 minutes trying to get accounting to refund the $200 I'd given them for the support call.

    They never did fix the bug, but I gave up my plans to have a graceful transition. I pulled that POS out the same day and installed another little NT mailer, quite a nice one, until I replaced the whole thing with a qmail FreeBSD box.

    No moral to the story, really ('cept I should have been more paranoid, and tested the list more). But I bet more than a few readers have had that quick "oh shit" feeling as they saw the queue filling up.
  • I bet some choice congressmen would find this kind of thing 'Innovative'...

    I know, it's bad...
  • about a year ago, the Internet in my state near collapsed. It was all the problem of a very large mailing list managed by one of the major telecom companies of our state, aimed to thousands of lawyers. This mailing list was supposed to be "one way only", that is, the company would send the lawyers daily news about law, but one smart lawyer replied with an unsubscribe message, and all of them got it. They all started complaining, and you know lawyers, they cannot be objective, but wants to show the others how they can write "beautifully". The next step was the threats of suing the others, and this threats, of course, were also "replied to all". In a few hours the traffic was so high that all users (since there were lawyers in most ISPs), could not use the internet. After the mail server was shut down, and the policy of the mailing list changed so that only the moderator could post, the problem started to disappear.

    Clueless lawyers.

    • Sharks (Score:3, Funny)

      by Skapare ( 16644 )

      Even sharks are not that bad. They do sometimes bite each other in a feeding frenzy, but this is much less often than lawyers threatening to sue each other. I love this story. I'm going to send it to all the lawyer mailing lists I know of.

    • about a year ago, the Internet in my state near collapsed. It was all the problem of a very large mailing list managed by one of the major telecom companies of our state, aimed to thousands of lawyers.

      If the internet in your state nearly collapsed, what's to keep this from being applied, maliciously, on a wider scale across a nation or the world?

      Idea #1: Several e-mail worms exploited sending mail to all addresses in users' address books. The impact was rather dramatic. What if the e-mails were ALSO sent to mailing lists instead of just individual e-mail accounts?

      Idea #2:Could a malicious user subscribe to a number of mailing lists, using different e-mail accounts, and then auto-forward all the accounts to each other? Maybe with a few auto-responders in the bunch? (Not sure of the specifics, here, but the idea is to get an e-mail that comes in, to automatically go back out to at least one, if not several, other accounts and/or mailing lists.)

      Up until the time that the accounts are cross-forwarded, everything looks normal. Could even sign up these accounts with known spammers to get a good-sized stream of e-mail flowing.

      At some point, just cross-forward / auto-respond / etc. the accounts and wait for the first e-mail to a mailing list to get the ball rolling. If enough lists are signed up, and accounts cross-forwarded... well, by the time it's figured out, there'd be so many people replying to the messages that the impact could be pretty massive.

      Idea #3:Opt-in many large mailing lists to many known spammers.

      These seem like obvious ideas to me, so I'm wondering if I'm missing something obvious? What's to kep these from happening?

  • This happens too often... (Score:4, Insightful)

    by tcc ( 140386 ) on Saturday March 02, 2002 @02:16PM (#3098196) Homepage Journal
    Just read the article, reminds me of when sometimes you apply to participate in a beta testing of something, and 2 weeks later you're putted on a mailing list with no warning other than the message, and there's always some newbies (and total idiots) that put their email addresses everywhere and wonder why "out loud" after.

    You start receiving message from people that are asking "WTF" and then people replying to get out of the list and the gazillion "me too" posts and then the bitching following because they aren't putted out and receiving another million of people bitching at the last million emails...then a moderator jumps in, exmplain the situation, then you get another bunch of emails because people didn't read it, and it goes on until the moderator +M the list.

    What's the mistake?

    1. not taking the people for complete idiots

    Not meant in a insulting way, but rather that taking for granted that people will understand X and Y and Z, it's not because they signed up for a beta, or whatever, that they are mature people or good with internet/communicating/netiquette. So if you take for granted that you will operate a bunch of monkeys for a start, you won't get this problem, and the more you see how the list is, the more slack you can cut off.

    Basically it's like a server, if you open all access to everything, and cut after, it's hell with the users. If you start strick and cut some slack, it's always better (best example being the quota, people flood your drives, and blam!. the other way around is people manage their space, and welcome the added storage). This is a stretched example but the concept can apply to a mailing list when all the posts needs to be moderated (pain in the ass and you don't get instant feedback) versus when they go freely in the list, to people that KNOW they will receive the email and will react correctly.

    2. The lack of experience at managing mailing list.

    Just go to egroups and looks at all the flame/crap going around in some mailing lists... sometimes it goes out of control and gets ugly, a good moderator knows when to jump in and how to so nobody gets offended and people drop it willingly instead of being forced to.

    3. Lack of technical expertise and lack of communication

    Something lame, but if you setup a mailing list for your customers for example, and you don't know what the "digest versus individual email" mode does, and you don't even bother to check, (well this is a lame example again but you get the idea) well if you have an average 20 emails a day for lets say, update on a product or different security patches for different modules and some will concern everyone some won't but you send them anyways, maybe you should be sure of every switch you'll turn on on the mailing list software, and be sure to ask the customers over the phone if they'd like an email for every fixes or a batch in 1 email every day for example (or better, give them the option and explain it clearly).

    And also, never forget that you are dealing with human being, this might sound stupid, but everyone here that ever ran a BBS, or a mailing list, knows what this means and the implications (flame, mistakes, etc).

    Sometimes Mailing list are a good thing, most time, people tend to forget that FORUMS can do as much and even better (search, no need to give out email addresses, etc). A counter-example would be to issue security alerts, for this, email rules. You have to weight the for and against for the project you are working on, and if you are to be moderator, be sure you know exactly what you are dealing with, both the software and the target people, and setup with these previous raw guidelines in mind, and unless you make a big mistake, it should go fine.

    My $0.02 :)

  • Mail loops, and circle jerks (Score:5, Interesting)

    by Peter H.S. ( 38077 ) on Saturday March 02, 2002 @02:17PM (#3098199) Homepage
    Mail loops, and mail circle jerks can be a nasty experience;
    This is my tiny war story.

    I do some volunteer work as a sysadmin in our local Internet club (300 apartments sharing a 2Mbit, soon-to-be 4Mbit line). When we started however, we only had a 512Kbit line, so in our wisdom we configured our MTA (Qmail) to bounce mails above 20Mbyte in size. We also thought it would be a good idea, to use our inet-feed provider as a backup mail relay, so in case our servers were down, mail would queue up there, ready to be delivered, when we went online again.

    But one of our users had set up his Outlook mail account on his work, to forward all mail to his mail account at our network. So far so good, but then, just before leaving work one day, he mailed his home account at our network a 300Mbyte attachment (splitted up in 10 30Mbytes parts).

    This is what happenend then;
    Qmail recieved each attachment, but didn't bounce them, until the entire mail was recieved.
    To my knowlegde, Qmail then appended the right RFC error message header to the mail, and bounced it, headers, attachement and all.
    But the mailserver on the other end (MS Exchange) didn't respect that, but instead it forwarded the bounced mail to our server again, while rewriting the headers and subject.
    The two mailservers now bombarded each other with 30Mbyte mails, and since we had the slimmer pipe, we were losing the battle. (I believe that this scenario is called a "mail circle jerk").

    It took some time, to straighten things out. Oh, and we discovered that the back up mail relay really did work, since it kicked into action, when we brought our mailserver up, and promptly tried to deliever a +Gigabyte of bounced and resend mail.

    Lessons to be learned; mail qoutas can have nasty sideeffects, backup mail releays can be a double-edged sword when things turns nasty. Automatic forwarding is can be very nasty indeed. And finally; How does your MTA or MUA forwarding rules react to a RFC error messages?
    • When complaining about "mail too large", don't append the entire mail to the error notice. If your Qmail had just included the subject plus 5 first lines of text, this wouldn't have happened: the first bounce would have been far less than the limit, and would have been forwarded correctly to the recipient.

      Conclusion: use sendmail. Especially now, after your article taught every script kiddy and his dog how to efficiently "tease" Qmail admins...

  • From article: Savoixmagazine.com was not available for comment.

    I wonder if the author tried emailing webmaster@savoixmagazine.com [mailto].
  • Wow, it's always rewarding to find one of your theories proven.

    I actually wrote an article for the hacker community on this exact problem about a year ago. I hosted the article at myhometechie.com - which is my own web site. I also submitted the article to hackcanada, and 2600.com - which is the authority for hacking issues.

    Well, despite my long trek and obvious dedication to showing up at 2600's conference, H2K, in July of 2000 - they didn't feel like printing my article ; and I definately did not want to test my theory.

    Oh well. Their loss. This could have been averted if the problem of looping auto-repliers had become common knowledge.

    You can find my article here [myhometechie.com].

  • Drahtmuller's belief was that the system administrators running savoixmagazine.com's server "didn't know what they were doing."

    Will the last h4x0r out of the savoixmagazine.com honeypot please shut down the server?

    Thanks,

    -Rothfuss
  • Justices of the Supreme Court
    Supreme Court of the United States
    Washington, DC 20543

    Dear Justices:

    Please make it completely legal to spray gratuitous amounts of napalm on spammers.

    Sincerely,

    Ryan Bruels
  • L-Soft Software [lsoft.com] has been producing and at times selling their LISTSERV email-list manager since 1985. It's always been high-function, extremely reliable, and beloved by both its users and its administrators. Before it, there was nothing - just sendmail alias lists and "-request" addresses. Ever sent a "subscribe" command to an autoresponder? That's LISTSERV or one of its many lower-grade imitators.

    LISTSERV started out on BITNET as freeware, shipped with full source, and ran on IBM VM mainframe systems. By the time the primary author decided to make it his full-time job in the early 1990s, it already had all sorts of facilities for auto-detecting mail loops and doing things like auto-banning loop senders and ran on a wide variety of systems, Unices included. Even today, LISTSERV is available free for smallish lists as long as there's no profit involved.

    Don't wast your time on imitations (Majordomo, etc.), start using the program that inspired all the wannabes. An admin's time is too short to waste monitoring lists.
  • Sad to say but we used to do this on purpose back in the early nineties.

    Invariably you'll send someone an email on a saturday and get an out of office autoreply. We'd find two people who had autoreplies, and fake-mail one of them with the from address of the other one.

    Boom, instant loop that would bring down both mail servers in an hour. For added points, do it with 3 or 4 people at the same time (they almost always replied-all). For bonus round, do it with 2 or 3 customer support addresses (the ones that send out a form mail automatically)

    Most auto replies these days are smart enough to detect a loop and avoid it.. but back then virtually none of them were.

    Could you "bring down the internet" with this trick? No. Could you bring down a few mail servers? Yup.

  • MS Exchange 2000 "Out of the office agent" problem (Score:3, Informative)

    by forged ( 206127 ) on Saturday March 02, 2002 @04:25PM (#3098732) Homepage Journal
    A large corporation I am affiliated with, has recently moved 1000's employees from a perfectly working unix-based mail system, to MS Exchange 2000 for political reasons more than technical.

    One of the 'Features' we discovered in E2K, is that whenever one emails a mailing list and that some people on this list have activated the out of the office agent ("OOA"), a reply from each one of these people is generated, even though none of these recipients were in To: or CC: field in the first place. Microsoft has yet to produce a fix, if ever.

    This is a devious method for finding out who's on vacation and who isn't, but the side effect (when one doesn't understand what's happening) is surprising to say the least, and all of this is unsollicited email (spam).

    Some good pointers to the OOA debate:
    A. http://www1.ietf.org/mail-archive/ietf/Current/msg 12543.html [ietf.org]
    Q. http://www1.ietf.org/mail-archive/ietf/Current/msg 12544.html [ietf.org]

    Unfortunately, there was no further follow-up on this last question.

    Also, from http://www.slipstick.com/rules/autoreply.htm [slipstick.com] :

    "If you are using OOA, be sure to keep a list of all the mailing lists you have subscribed to, so that you can either unsubscribe or change your list settings so that you receive no message from the list while you have OOA turned on. It's rude to send OOA messages to mailing lists."

    From the above text, their workaround is to unsubscribe from any mailing lists you may be subscribed to when turning on the OOA. This doesn't scale when the company has got 30,000+ roaming workers making extensive use of the OOA, when each worker must unsubscribe/resubscribe to 10's of mailing lists each time (would _you_ do it ?).

    Their sentence ``It's rude to send OOA messages to mailing lists.'' perfectly summarizes what this is all about, and how certain problems are generated in the first place.

    I rest my case. Thank you for reading this far.

  • I received a large amount of email due to this, and the amount of hatemail that hit my box, against SuSE (who was just another victim here) was incredible.



    Of course, people didn't respond well when I started blasting them for their idiocy.



    Thank goodness KMail has Outlook-style filtering rules. I have a ruleset that's still left over from that fiasco. I had one lady from NYC that started spewing venom at me for spewing venom at someone who was sending the email. She's still in the ruleset.

    • I received a large amount of email due to this, and the amount of hatemail that hit my box, against SuSE (who was just another victim here) was incredible.

      Of course, people didn't respond well when I started blasting them for their idiocy.

      Of course not, anti-spam zealots are beyond reason. If you question any premise, any measure, you're as bad as the spammer. Kinda reminds me of the current US administration.
  • Das is nicht gut! Vee are in Trabule, Ja
    Trabule, Vhat Trabule Vee are in?
    Der Dreded Spam LOOP!
    Der Dreded Spam LOOP? Vas is Das? Dreded Spam LOOP.
    Der Dreded Spam LOOP is making der Mobius Loop look like a kindergarten loolipop
    Spam! Endless Spam! Der Endless Nacht has begun Und Vee are DOOMED!
    Is der no one, no one who can save us from dis Spam monster?
    There is one. ONE. Der is ONE WITH THE FORCE! VEE MUST CALL OUT TO HIM.
    ROMAN, ROMAN DRATHMULLER SECURITY UBER GEEK VEE CALL OUT TO YOU IN OUR TIME OF NEED
    Roman Drathmuller? He ist gut?
    Nein, nicht gut, ROMAN DRATHMULLER IST BAAAAAAAD! JA
    Dat sound. He is coming vit der russling sound of newpapers wind blown in der streets of Brazil, ust like Robert De Niro.
    I am herring yer call ja und herr I am
    Roman, Roman Drathmuller you have come in ust der nich of time. It is der Dreded Spam LOOP. Der Headless Harassment of der Net Vorld.
    O Dis is nich gut it has grown too powerful. It is now der Spam Borlag! Der is only von vay vee must BLACK HOLE DER MAILING LIST UND SEND DIS MONSTER BACK TO DER HELL THAT SPAWNED IT!
    Der Mailing List it grows ever darker, svirling, svirling into darkness
    IT is dying ja dying, Roman, Roman Darthmuller you have saved us!
    IT IS DONE! It vill bother you no more
  • In '94 or so I was on a Y2K mailing list when somebody turned on an unusually dumb vacation program. It was, essentially, responding to itself and taking the rest of us along for the ride.

    Needless to say there was a tremendous amount of traffic, and a tremendous amount of whining because many of the readers where Very Important People (in their own mind) who didn't have time for this nonsense.

    Someone eventually found the culrprit's coworker's phone number and got the vacation program turned off. Everyone breathed an aggrieved sigh of release...

    ... until I pointed out that this was a good exercise in what Y2K may be like. Even if 99% of the systems ride through it without problems, a single 1% that failed could flood email channels, or take out local phone systems, etc. The self-annointed VIPs got real quiet about then - these were mostly non-technical managers who had been shielded from technology gone bad in the past.
  • Yes, I've made mail loops, too. But Exim was able to detect the loop after some number of runs through, and terminated such messages. I forget exactly where, but it dumped the dead mail in a place where I could examine the headers, learn what I'd done wrong, and fix the problem.
  • Over the last few days, I got a torrent of messages into my inbox. Though they didn't seem to come from suse or savoix; they came from someplace called lusopeople.com. I wonder if this has anything to do with them or not? The majority of them are all just foreign garbled messages.

    At any rate, the torrent seems to have abated; perhaps it's over now.

  • People and their innapropriate use of TO and CC: (Score:4, Funny)

    by nettdata ( 88196 ) on Sunday March 03, 2002 @06:52AM (#3100788) Homepage
    Not much pisses me off more than people that put their entire list of "SPAM" (good or bad) email recipients in the CC or TO field instead of putting them in the BCC field.

    Recently, my cousin was one of these abusers, and, being family, was totally fair game for some retribution. He was about 6 weeks away from leaving his job to go back to school, so he emailed his hotmail account a message, and CC'd that message to EVERYONE in his contact list at work, all so it was easier for him to import their addresses into Hotmail. There were over 350 people in this list. If this wasn't bad enough, he mis-spelled his hotmail address on the first message he sent out so he sent a SECOND message.

    Well, that was the final straw.

    Now, little known to Steve, me, being somewhat of a techie, had acquired his SteveLastname.com domain name as an upcoming birthday present. I proceded to send out an email to EVERYONE on his CC list, pointing out the totally innapropriate way in which Steve had used his email, and made a general call for embarrassing pics, stories, etc., that we could use to shame him.

    Well, within 2 minutes, his dad sent in a Christmas pic of Steve when he was 7, his brother sent in his 1st date pic, and friends from work sent in pics and stories from the bar, etc. Each time something new came in, it was put up on his site and the email list was notified. It's interesting to note that the opt-out was included in the first response, and at the end of the day, only 2 guys had done so.

    Now, let me fill you in a little bit on the scope of this little prank. You see, Steve was working at the largest investment bank in Canada, and probably 80% of the people on the list were his fellow workers. Well, word spread. Within an hour of the first notification, the site had been hit almost 1,000 times. At the end of a fun, 4 day run, the site had been hit almost 60,000 times (page views). To top it off, the top execs at the company (CEO, CTO, CIO, etc.) all made a field trip at the end of one of their exec meetings to come down and say good-bye to Steve in person. Now, Steve was a little terrified over this attention from the execs, but it was nicely relieved when they proceded to hand him a letter of reccommendation signed by all of them and they all had a good laugh about it.

    All in all, it was pretty fun, and Steve was a good sport, but at the end of the day, email abusers still piss me off!

Slashdot Top Deals

He has not acquired a fortune; the fortune has acquired him. -- Bion

Close