Text 26376, 67 rader
Skriven 2015-07-30 08:20:14 av Matt Bedynek (1:19/10)
  Kommentar till text 26369 av Michiel van der Vlist (2:280/5555)
Ärende: Routing 200MB of echomail via an unsuspecting system
============================================================
Michiel,

Thursday July 30 2015 14:43, you wrote to me:

 MV> I am not sure squishmail still qualifies as comtemporary...

If you can demonstrate how it is inadequate in today's fidonet then I will
accept this statement.

 MV> Of course if you recreate an environment from the past, what worked
 MV> in the past will still work in that environment.

If you were familiar with squish and reviewed my "lab" configuration would
understand that the scenario I tested for could happen in the real world
easily.  The addition of the INTL was artificial but it demonstrated that once
in the netmail processing flow was initiated that the flow could be manipulated
in a malacious way.   The first scenario was common mistake in that it happened
in the past.  The second scenario was purely academic.

 MV> If it behaves that way by default I say it is a design flaw.
 MV> Routing echomail is an anomaly. The normal way to send echomail via
 MV> a go between is not to route it as if it were netmail, but to have
 MV> it forwarede by a tosser at the node of the go between.

I agree it is an anomaly.  To be clear, I use the term 'routed echomail' to
describe a type of traffic. No one ever made pretentions that it was a
legitimate function or form of traffic.  I still believe the author assumed
there might be a future use case so permiitted the behavior.

Bjorn as an accomplished FTN programmer with access to the source code claimed
he could fix any anomaly discovered.  He further stated stated that his system
runs squish but is not succeptilble to the behavior.  I believe him.  There is
no reason for people to be petty about observations.  If he has made a fix to
the code he should release it so that those who also run the software can
benefit.

 MV> I can see no reason why on earth one would use routing for
 MV> echomail.

I saw not one claim it was legitimate use of the technology.

 MV> OTOH, if the test succeeds, that would prove beyond any shadow of
 MV> doubt that it IS possible.

I disagree.  We both know that each system can be configured uniquely.  Such a
test would contain too many variables and require a /lot/ of cooperation.  
Much like trying to find out whether the NAB or Fidoweb lost the message I
raised issue over in FIDO_SYSOP.  I would rather you guys use that energy to
adopt standards over in the FTSC.

A proper way to conduct regression would be to create a controlled environment
and test each commonly used mail tosser with a minimal common configuration
individually.   All supplemental processing tools (packet sorters, nobogus[if
people still use it], and netmail trackers) should be disabled.  You want to
evaluate whether the software is succeptable not the system.

Unfortunately, my concerns in that regard are a little selfish as I do not have
time to test every piece of software used.  I already offered to make the parts
used in my test available for people to do so individually.


Take care,

Matt

---
 * Origin: The Byte Museum - An IPV6 Capable System (1:19/10)