Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #241030 > unrolled thread

You have been removed from

Back to article view | Back to linux.debian.user

Contents

  You have been removed from Dan Ritter <dsr@randomstring.org> - 2021-10-08 19:10 +0200
    Re: You have been removed from "Andrew M.A. Cater" <amacater@einval.com> - 2021-10-08 19:40 +0200
      Re: You have been removed from Greg Wooledge <greg@wooledge.org> - 2021-10-08 20:00 +0200
        Re: You have been removed from piorunz <piorunz@gmx.com> - 2021-10-08 20:50 +0200
        Re: You have been removed from "Thomas Schmitt" <scdbackup@gmx.net> - 2021-10-08 22:10 +0200
          Re: You have been removed from Greg Wooledge <greg@wooledge.org> - 2021-10-08 22:50 +0200
            Re: You have been removed from "Thomas Schmitt" <scdbackup@gmx.net> - 2021-10-08 23:50 +0200
        Re: You have been removed from Andrei POPESCU <andreimpopescu@gmail.com> - 2021-10-09 09:20 +0200
    Re: You have been removed from harryweaver@tutanota.com - 2021-10-08 21:00 +0200

#241030 — You have been removed from

[Multipart message — attachments visible in raw view] — view raw

Guess what I just got?

-dsr-

[toc] | [next] | [standalone]

#241034

On Fri, Oct 08, 2021 at 12:52:51PM -0400, Dan Ritter wrote:
> 
> Guess what I just got?
> 
> -dsr-

> Date: Fri,  8 Oct 2021 15:00:41 +0000 (UTC)
> From: debian-user-request@lists.debian.org
> To: dsr@randomstring.org
> Subject: You have been removed from the list

People: I just sent a private response to Dan before I realised it
might be better to send it to the list.

It may, eventually, be appropriate for someone to deny-list this host
from all Debian communications. It has been reported to abuse@ovh.net.

In the meantime, if anybody else has problems from this host - it is 
appropriate to email listmaster@lists.debian.org and explain what has
happened, including the headers and bounce email text. If they allow 
your host, they will also send an email to check that an email will
not in fact bounce.

With thanks to Steve McIntyre who has confirmed that this sort of 
thing has happened before.

With every good wish, as ever,

Andy Cater 

[toc] | [prev] | [next] | [standalone]

#241035

On Fri, Oct 08, 2021 at 05:33:26PM +0000, Andrew M.A. Cater wrote:
> In the meantime, if anybody else has problems from this host - it is 
> appropriate to email listmaster@lists.debian.org and explain what has
> happened, including the headers and bounce email text. If they allow 
> your host, they will also send an email to check that an email will
> not in fact bounce.
> 
> With thanks to Steve McIntyre who has confirmed that this sort of 
> thing has happened before.

I got one of the probe emails from listmaster, and I wasn't unsubscribed
afterward, so I guess they found no fault with my setup.

I'm still curious about what's actually happening here.  Perhaps nobody
on this list knows, which is understandable, but if someone does
happen to know the details, I'd like to hear them.

What I know so far is that someone at ovh.net is subscribed to debian-user
and has set up an auto-responder.  Every time they receive a message from
the mailing list, they generate a response message.  This response message
is sent with an envelope sender (MAIL FROM) address of
postmaster@vps268904.ovh.net and the same address in the From: header.
The Postfix MTA at bendel.debian.org logs receipt of the message from
"vps268904.ovh.net (mail.data3v.com [51.254.223.75])" according to
the Received: header which it adds.  The response message has the Subject:
header "**stop**".

The body of the response message begins with the email address of the
person who sent the responded-to message, in angle brackets.  Then a
colon, a space, and a copy of the original Subject: header.  Then a
newline, then about 128 bytes (I didn't count, just approximating) of
the original message's body, another newline, and finally the text
"Please stop the message. we have already unsubscribed our email address."

(This sentence is clearly untrue.)

Somehow, when bendel receives this response message, it treats it as a
"bounce message" from the person whose email address appears in angle
brackets at the top of the body of the response.  THIS is the part that
I don't understand, and would like to know more about.  How does an
email address that only appears in the body get counted as if it were
the sender?  Is this a bug in the mailing list software?  It sure seems
like it.

If I were to put <postmaster@vps268904.ovh.net>: at the top of the body
of this message, would it cause bendel to think that OVH had sent one
of these "bounce messages"?  Or does putting it in the middle of a line
down here toward the end of the message also count?  Then again, the
offender's subscribed address is probably something other than this.

[toc] | [prev] | [next] | [standalone]

#241036

Just get this message subjected Debian-Bounce-Test piorunz@gmx.com Fri,
08 Oct 2021 04:40:44 +0000, from listmaster@lists.debian.org:


"This is a test mailing, to check if the address piorunz@gmx.com
causes bounces, tries to challenge-response or autoresponds
back to Mailinglists, or Mailinglist-Senders.

If you get an unsubscription message afterwards, one of the above
problems has been confirmed.

Fix the problem and re-subscribe.

If no unsubscription occurs you can safely ignore this message.

Yours,
	Debian Listmaster

http://lists.debian.org"

I haven't been removed, so I guess my mail provider is ok.

--
With kindest regards, Piotr.

⢀⣴⠾⠻⢶⣦⠀
⣾⠁⢠⠒⠀⣿⡁ Debian - The universal operating system
⢿⡄⠘⠷⠚⠋⠀ https://www.debian.org
⠈⠳⣄⠀⠀⠀⠀

[toc] | [prev] | [next] | [standalone]

#241038

Hi,

Greg Wooledge wrote:
> This response message
> is sent with an envelope sender (MAIL FROM) address of
> postmaster@vps268904.ovh.net
> [...]
> How does an
> email address that only appears in the body get counted as if it were
> the sender?

I doubt that it is due to any address in the body. Rather i assume that
you are named in the MAIL FROM command of the bounce message.
See
  https://en.wikipedia.org/wiki/Bounce_address
  https://en.wikipedia.org/wiki/Bounce_message
The offender would send a bounce message to bendel.debian.org with your
address as forged sender of the bounced mail:
  https://en.wikipedia.org/wiki/Backscatter_%28email%29

What you see is the payload part of the bounce message, which is mainly
an ornament without technical function. It could be completely forged.
Only bendel.debian.org knows from where the bounce message came.


If this theory is true, then a solution would be to equip each list mail
with a unique resend id, which could be an encrypted combination of
subscribed mail address and resend time. Only if this mail header line
is included in the bounce message and matches the alleged senderi and
roughly the time, only then a bounce is credible.


Have a nice day :)

Thomas

[toc] | [prev] | [next] | [standalone]

#241039

On Fri, Oct 08, 2021 at 10:03:57PM +0200, Thomas Schmitt wrote:
> I doubt that it is due to any address in the body. Rather i assume that
> you are named in the MAIL FROM command of the bounce message.

Except, I'm *looking* at what bendel says it received, and that isn't
the case.

> What you see is the payload part of the bounce message, which is mainly
> an ornament without technical function. It could be completely forged.
> Only bendel.debian.org knows from where the bounce message came.

I'm trusting what it tells me.  It's showing me the full message that
it claims it received.  This includes both the headers and the body.

I can't imagine why it would show me something other than what it received.

If you haven't received one of bendel's "You have been removed" messages
yet, you can go back to my original post at the start of this thread.
I included the full text of what bendel sent to me.  You can very clearly
see the headers, and the complete lack of the string "wooledge" anywhere
in the headers.

https://lists.debian.org/debian-user/2021/10/msg00248.html

Or, if you continue posting to debian-user often enough, you'll probably
start getting unsubbed after each one of your messages just like the
rest of us frequent-posters are seeing.  Then you can see your own version
of the message from bendel containing the **stop** message from OVH.

[toc] | [prev] | [next] | [standalone]

#241040

Hi,

Greg Wooledge wrote:
> you can go back to my original post at the start of this thread.

I did several times meanwhile. It's all that a have as base for
my speculations.


> I included the full text of what bendel sent to me.  You can very clearly
> see the headers, and the complete lack of the string "wooledge" anywhere
> in the headers.

My theory is that your mail address is in the SMTP envelope of the
bounce mail which gets sent to bendel.debian.org. Maybe in "RCPT TO",
not in "MAIL FROM, as i initially wrote.

Inside the envelope of a bounce there are three parts, according to
  https://en.wikipedia.org/wiki/Bounce_message#Format

  1. a human readable explanation;
  2. a machine parsable message/delivery-status, a list of
     "name: type; value" lines that state several possible fields; and
  3. the original message, or a portion thereof, as an entity of type
     message/rfc822.

Reading your initial mail, i would say that it shows only part 3 of the
bounce message. That part could be completely made up by the sender
and designed to deceive the human reader.


The idea of backscattering came to me because of your mail from
Wed, 6 Oct 2021 09:49:27 -0400, Message-Id YV2pZ8MbbCDttlGA@wooledge.org
where you first mentioned "forged bounce messages".
I remember that years ago i riddled about such bogus bounces. Meanwhile
my mail provider seems to catch them.
Problem with bendel.debian.org was that it did not forward the forged
bounces but counted them until finally the threshold was reached for
unsubscription.


> if you continue posting to debian-user often enough, you'll probably
> start getting unsubbed after each one of your messages just like the
> rest of us frequent-posters are seeing.

I understand that this will not happen as easily any more.
See Andrew M.A. Cater's recent post (8 Oct 2021 17:33:26 +0000) and
piorunz' report (8 Oct 2021 19:41:31 +0100) of a mail with:
  "This is a test mailing, to check if the address piorunz@gmx.com
  causes bounces, [...]
  If no unsubscription occurs you can safely ignore this message."


> Then you can see your own version
> of the message from bendel containing the **stop** message from OVH.

Probably those headers and message parts will from now on stay inside
bendel.debian.org and we will see only the test mailings.
They won't bounce, hopefully. I disable as much spam filtering at GMX
as possible. But at rare occasions GMX seems to hate mails from bendel
and bounces them.


Have a nice day :)

Thomas

[toc] | [prev] | [next] | [standalone]

#241043

[Multipart message — attachments visible in raw view] — view raw

On Vi, 08 oct 21, 13:55:15, Greg Wooledge wrote:
> 
> I'm still curious about what's actually happening here.  Perhaps nobody
> on this list knows, which is understandable, but if someone does
> happen to know the details, I'd like to hear them.
> 
> What I know so far is that someone at ovh.net is subscribed to debian-user
> and has set up an auto-responder.  Every time they receive a message from
> the mailing list, they generate a response message.  This response message
> is sent with an envelope sender (MAIL FROM) address of
> postmaster@vps268904.ovh.net and the same address in the From: header.
> The Postfix MTA at bendel.debian.org logs receipt of the message from
> "vps268904.ovh.net (mail.data3v.com [51.254.223.75])" according to
> the Received: header which it adds.  The response message has the Subject:
> header "**stop**".
> 
> The body of the response message begins with the email address of the
> person who sent the responded-to message, in angle brackets.  Then a
> colon, a space, and a copy of the original Subject: header.  Then a
> newline, then about 128 bytes (I didn't count, just approximating) of
> the original message's body, another newline, and finally the text
> "Please stop the message. we have already unsubscribed our email address."
> 
> (This sentence is clearly untrue.)

Wild speculation: some subscriber with the domain (and e-mail) hosted at 
ovh set up some auto-responder annoyed by the apparent lack of reaction 
to (probably unsuccessful) their unsubscribe attempts.

From their perspective Debian is the spammer :(

Kind regards,
Andrei
-- 
http://wiki.debian.org/FAQsFromDebianUser

[toc] | [prev] | [next] | [standalone]

#241037

-- 
 Sent with Tutanota, the secure & ad-free mailbox. 



9 Oct 2021, 02:52 by dsr@randomstring.org:

>
> Guess what I just got?
>
> -dsr-
>
Yes, I got the initial one yesterday.
`This is just a test email, etc. etc.,'
Cheers!

Harry.

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web