Subject: Re: block bad mail addresses?

From: "Geoff Terry" <[email-masked]>
Date: Tue, 14 Oct 1997 08:57:55 +1000

Kent,
Why bother to create distinct entries for particular clients?
There are so many vendors and versions all with slightly different
configuration semantics that differentiating across clients will not really
add any value.

To my way of thinking it only complicates things, better to just check to
see if they have something like a full email address and possibly do a DNS
lookup on the domain to check and rebuke with a general message if it
fails.

Geofft

----------
> From: Kent Landfield <[email-masked]>
> To: [email-masked]
> Subject: Re: block bad mail addresses?
> Date: Tuesday, October 14, 1997 1:21 AM
> 
> Michael Finken <[email-masked]> wrote:
> # > I see a lot of connections where the anonymous user uses 'IE30User@'
or
> # > 'mozilla@' as password.  I want people to use their real mail
addresses.
> # > Can I configure a filter for e-mail addresses in WU-FTPD?
> 
> Becki Kain <[email-masked]> responded:
> # I'm not certain how you get people to change that - that is the default
> # when they goto your site from internet exploder and netscape agitator.
> 
> This has been bothering me for a long time too.  Changes would need to be

> made to the code to deal with this.  I'm just brainstorming here so... 
> (Warning Will Robinson!) I'd suggest extending the ftpaccess file
directive 
> passwd-check usage from
> 
>     passwd-check  <none|trivial|rfc822>  [<enforce|warn>]
> 
>                        to
> 
>     passwd-check  <none|trivial|rfc822|rfc822-limit>  [<enforce|warn>]
> 
> The passwd-check for rfc822-limit would read an exclusion list in a file
> somewhere and an associated message file.  The exclusion file would have
> an entry such as
> 
>    # Email  - Message file
>    IE30User   noieuser.msg
> 
> and the noieuser.msg file might contain 
> 
>   "Please change the default email address setting in Internet Explorer
3.0.
>    Until that is done you will not be allowed anonymous access to this
site."
> 
> This way it would be generic enough to be used for any such address 
> restriction.  In the above example I was sugggesting the 'enforce' was
> being used.  If enforce was not the case then the message file would be
> tailored accordingly.  Thoughts ?
> 
> -- 
> Kent Landfield                        Phone: 1-817-545-2502             
> Email: [email-masked]             http://www.landfield.com/
> Please send comp.sources.misc related mail to [email-masked].
> Search the Usenet Hypertext FAQ Archive at http://www.faqs.org/faqs/

---

From: [email-masked] (Andy Church)
Date: Mon, 13 Oct 1997 21:38:13 EDT

>At this point I am just brainstorming. What do other's think ?

     I'm in favor of it--I get tired of seeing half my xferlogs (probably
more) filled with "mozilla@" and "IE30User@" despite the password checks.
At least I haven't had to actually use it recently, but you never know when
a nasty file will make its way on.  Obviously, people who really want to be
clever can get around anything you can devise, but for the most part, this
will hopefully get people to start giving real addresses again.  (I
remember five years ago, when there was no Netscrape or M$ Exploiter and
entering your E-mail address was a given.  Ah, for the old days...)

  --Andy Church                  | If Bell Atlantic really is the heart
    [email-masked]       | of communication, then it desperately
    www.dragonfire.net/~achurch/ | needs a quadruple bypass.

---

From: [email-masked] (Alan J Rosenthal)
Date: Tue, 14 Oct 1997 16:49:27 -0400

>  "Please change the default email address setting in Internet Explorer 3.0.
>   Until that is done you will not be allowed anonymous access to this site."
...
>Thoughts ?

Here is why I have my e-mail address in my netscape preferences configured to
"here@there".  I'd love to type my real e-mail address in to a genuine ftp
session... and I always do when I use the normal ftp program... but...

1) With a bogus return address, if I click on a mailto: link, it doesn't do
it, it complains.  That's good, I hate netscape mail and I want to send mail
in my usual mail program, if at all -- usually this comes up when I thought a
link led to INFORMATION, for hyoop's sake, not asking ME to provide
information.  Furthermore, with a complaint-generating return address,
javascript can't send bogus mail, I think.  I can't prevent other people from
sending e-mail forged as being from me, but I'd just as soon not run a program
which can help others forge e-mail from me.  'Course, I keep javascript turned
off all of the time, except occasionally, and then I might forget to turn it
back off...

2) Old versions of netscape, or at least of some browsers, send the e-mail
address with every http request.  I definitely don't want to send my e-mail
address to slimy internet advertisers who have embedded images in search
engines.  It would be one thing if I knew who they were, but embedded images
can connect to anybody and the http request is made before I even see the
image or a box or anything.  Search engines and folks like that change which
slimy company they do business with surprisingly frequently (reminds me of a
Cecil Adams column saying "businesses like this are prone to sudden changes of
address").

But the version of netscape I use on a daily basis doesn't do this.  But I
guess I'm just in the habit.

3) Even if your browser doesn't send your e-mail address for http, if it sends
your e-mail address for ftp, then slimy web sites can include ftp URLs for
embedded images.

So if you want my e-mail address, you'll have to let me type it in to a form
or something.  My web browser does a lot of creepy things behind my back
already and anything I can prevent, I do.

well, you asked for thoughts...

regards