Subject: Re: block bad mail addresses?

From: Kent Landfield <[email-masked]>
Date: Mon, 13 Oct 1997 20:21:19 -0500 (CDT)

# Why bother to create distinct entries for particular clients?
# There are so many vendors and versions all with slightly different
# configuration semantics that differentiating across clients will not really
# add any value.

>From your perspective maybe.

# To my way of thinking it only complicates things, better to just check to
# see if they have something like a full email address and possibly do a DNS
# lookup on the domain to check and rebuke with a general message if it
# fails.

:)  The problem here is that I want to be able to disallow people from 
accessing the site without entering an email address.  People often do
not change the default settings on their out-of-the-box web clients. These
addresses are not valid addresses.  For these your suggestion would work.
The general message might get interesting though. ;) 

Also I want the flexibility to disallow administrative addresses as well.  
These are valid accesses from a host.  In that case your suggestion would
not serve my purposes.  Also, a single general message can be rather 
limiting.  Yes, this is just more to admin but...

At this point I am just brainstorming. What do other's think ?

# ----------
# > From: Kent Landfield <[email-masked]>
# > To: [email-masked]
# > Subject: Re: block bad mail addresses?
# > Date: Tuesday, October 14, 1997 1:21 AM
# > 
# > Michael Finken <[email-masked]> wrote:
# > # > I see a lot of connections where the anonymous user uses 'IE30User@'
# or
# > # > 'mozilla@' as password.  I want people to use their real mail
# addresses.
# > # > Can I configure a filter for e-mail addresses in WU-FTPD?
# > 
# > Becki Kain <[email-masked]> responded:
# > # I'm not certain how you get people to change that - that is the default
# > # when they goto your site from internet exploder and netscape agitator.
# > 
# > This has been bothering me for a long time too.  Changes would need to be
# > made to the code to deal with this.  I'm just brainstorming here so... 
# > (Warning Will Robinson!) I'd suggest extending the ftpaccess file directive
# > passwd-check usage from
# > 
# >     passwd-check  <none|trivial|rfc822>  [<enforce|warn>]
# >                        to
# >     passwd-check  <none|trivial|rfc822|rfc822-limit>  [<enforce|warn>]
# > 
# > The passwd-check for rfc822-limit would read an exclusion list in a file
# > somewhere and an associated message file.  The exclusion file would have
# > an entry such as
# > 
# >    # Email  - Message file
# >    IE30User   noieuser.msg
# > 
# > and the noieuser.msg file might contain 
# > 
# >  "Please change the default email address setting in Internet Explorer.
# >  Until that is done you will not be allowed anonymous access to this site."
# > 
# > This way it would be generic enough to be used for any such address 
# > restriction.  In the above example I was sugggesting the 'enforce' was
# > being used.  If enforce was not the case then the message file would be
# > tailored accordingly.  Thoughts ?

-- 
Kent Landfield                        Phone: 1-817-545-2502             
Email: [email-masked]             http://www.landfield.com/
Please send comp.sources.misc related mail to [email-masked].
Search the Usenet Hypertext FAQ Archive at http://www.faqs.org/faqs/

---

From: Michael Brennen <[email-masked]>
Date: Mon, 13 Oct 1997 20:45:43 -0500 (CDT)

Who says the email address I enter is valid?  Without emailing that
address with a cookie and getting that cookie back within N minutes in an
email response, you have no guarantee that the email address one enters
has anything to do with the logger-inner. :)

   -- Michael

---

From: Bob Luckin <[email-masked]>
Date: Mon, 13 Oct 97 21:00:17 CDT

Michael said :-
> has anything to do with the logger-inner. :)

Oh, I don't think getting your cookie back necessarily proves the email
address is valid, either, although it _probably_ proves it got somewhere,
even if just a fiendish postmaster's auto responder...

:-)

Seriously, I think one of Kent's arguments is that by disallowing the default
browser values, he'll get a much higher proportion of valid addresses than
he does now - on the reasonable assumption that most people will probably
change their browser defaults to use their real address rather than a fake one.

I'm for the suggestion.

Cheers, Bob
-- 
Bob Luckin      [email-masked]      "Coder - redo C"

---

From: Michael Brennen <[email-masked]>
Date: Mon, 13 Oct 1997 21:14:35 -0500 (CDT)

I'm not saying the suggestion is worthless, but it may not be worth much
either.  Its worth will probably be in direct proportion to the number of
newbies logging in that don't know to fake the address.  I too had thought
of all kinds of mail deviations (postmasters, hijacked user accounts,
deviated MX records, ad nauseum), but didn't mention it. 

   -- Michael

---

From: Kent Landfield <[email-masked]>
Date: Mon, 13 Oct 1997 21:20:53 -0500 (CDT)

# Who says the email address I enter is valid?  Without emailing that
# address with a cookie and getting that cookie back within N minutes in an
# email response, you have no guarantee that the email address one enters
# has anything to do with the logger-inner. :)

:) Point one Michael. :)  If people took the time to actually _enter_ a fake 
address I'd be happy.  I'm tired of the lazy people who fill my logs with 
mozilla and IE30user.  :)