From: "Neil Brown" <[email protected]>
On Sunday June 11, [email protected] wrote:
On Sun, 2006-06-11 at 01:27 +0300, Matti Aarnio wrote:
> Now that there is even an RFC published about SPF...
Please, don't do this. SPF makes assumptions about email which are just
not true; it rejects perfectly valid mail.
http://david.woodhou.se/why-not-spf.html
Conversely, please do do this :-)
I agree with David that SPF breaks mail-as-we-know-it, but I cannot
help thinking that mail-as-we-know-it is way too permissive and bits
of it need to be broken (the old egg/omelette analogy).
And I think that kernel.org is a great place to start with pushing
SPF, because if a few mail items go astray to-or-from it really isn't
the end of the world.
- kernel.org should publish very strict SPF records that sites with
any gumption can reject forged mail claiming to be from kernel.org.
If systems drop mail incorrectly because of this, the end-recipient
can follow linux-kernel any number of other ways, and can badger
their local admins to "get it right".
Sir, I've been doing this for years already using primary source
information - the trackable message headers. So far forgeries are
not a problem. It becomes quite obvious when a message has forged
headers, obvious enough automated analysis works remarkably well.
- kernel.org should reject mail that earns an SPF 'fail' and should
grey-list mail that earns an SPF 'softfail' (so the sending system
will have to retry once). Any mail that incorrectly gets rejected
will hopefully have a link to a web page that explains the problem
and lists a number of free-mail sites where anyone can sign up and
safely send mail to kernel.org. So people who need to get mail
through still can, while they complain to their admins about
configuring things properly.
No sir. FAIL and SOFT_FAIL prove nothing. PASS proves remarkably
little. SPF is not a good criterion for much of anything.
I think kernel.org is a great site to be an early adopter because:
- the mail it transports isn't critical
- it interacts with a very large number of mail sites
- it's customers are reasonably technology-savvy.
It would be a good site to adopt it outgoing. But adopting it as an
incoming message filter is silly.
sourceforge would be another good site.
(No, SPF doesn't stop spam, but it can increase accountability so that
white/black lists can begin to be more usable).
It does not even do that conclusively. Many of us wish it did. But if
a spammer can post his own spf records he can claim what he wants
about email sources. DNS cache poisoning attacks assure that this can
take place even for sites you might control.
{^_^} Joanne Dow said that. Seriously, I recommend a pass through the
old SpamAssassin users mailing list for past discussions. An
SPF_HELO_SOFTFAIL is the only thing given a sizeable score.
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[Index of Archives]
[Kernel Newbies]
[Netfilter]
[Bugtraq]
[Photo]
[Stuff]
[Gimp]
[Yosemite News]
[MIPS Linux]
[ARM Linux]
[Linux Security]
[Linux RAID]
[Video 4 Linux]
[Linux for the blind]
[Linux Resources]
