On Tue, Mar 09, 1999 at 09:55:06AM -0600, [EMAIL PROTECTED] wrote:
> Rick McMillin <[EMAIL PROTECTED]> writes on 9 March 1999 at 09:30:22 -0600
> > OK, by now I'm sure you've all heard about this thread that's
> > been going around about this program that connects to your
> > SMTP server, runs through a built in dictionary of addresses
> > verifying the validity of each address. It then takes the results
> > and sends emails to the ones it knows exists. It does something
> > like this.
>
> And qmail gives it a positive on every name it tries. This has
> up-sides and down-sides. If everybody did this, the attack wouldn't
> work at all and wouldn't be tried. It's sort-of like building one of
> those infinite mazes of web-pages with invalid addresses on every page
> to try to pollute the mailing lists of people harvesting web
> addresses.
I may be giving them too much credit, but it's conceivable that this software
considers a 100 percent positive rate as meaning what it does mean--that the
results are meaningless. If that's the case, then qmail is immune to this
attack.
Chris
