Re: Advice sought on how to convince irresponsible Megapath ISP.

2014-08-16 Thread Karsten Bräckelmann
On Fri, 2014-08-15 at 19:06 -0700, Linda A. Walsh wrote:
 My old email service was bought out by Megapath who is letting alot of 
 services slide.
 
 My main issue is that my incoming email scripts follow the SMTP RFC's and if
 the sender address isn't valid, then it's not a valid email that should be
 forwarded. 
 
 My script simply check for the domain existing or not - if it doesn't exist,
 then it rejects it.  This causes about 100-200 messages a month that get
 stuck in an IMAP queue waiting for download -- only to be downloaded and 
 rejected due to the sender domain not existing.

Linda, your are rather vague on details, and definitely confusing terms
and terminology.

You state your ISP would forward mail to you. While on the other hand, a
sub-set of the mail is not accepted by your scripts, thus stuck in an
IMAP account waiting for download. Both, the usage of IMAP as well as
mentioning download shows, your ISP is not forwarding mail, but you
fetching mail.

Similarly, your scripts do not reject messages, but choose not to fetch
them.


Pragmatic solution: If you insist on your scripts to not fetch those
spam messages (which have been accepted by the MX, mind you), automate
the manual download and delete stage, which frankly only exists due to
your choice of not downloading them in the first place. Make your
scripts delete, instead of skipping over them.

Be liberal in what you accept, strict in what you send. In particular,
later stages simply must not be less liberal than early stages.

Your MX has accepted the message. At that point, there is absolutely no
way to not accept, reject it later. You can classify, which you use SA
for (I guess, given you posting here). You can filter or even delete
based on classification, or other criteria.


 The only response my ISP will give is to turn on their spam filtering. 
 I tried that. In about a 2 hour time frame, over 400 messages were
 blocked as spam.  Of those less than 10 were actually spam, the rest
 were from various lists.
 
 So having them censoring my incoming mail isn't gonna work, but neither will
 the reject the obvious invalid domain email.
 
 I can't believe that they insist on forwarding SPAM to their users even 
 though they know it is invalid and is spam. 

There is no censoring. There is no forwarding.

 Any ideas on how to get a cheapo-doesn't want to support anything ISP to 
 start blocking all the garbage the pass on?

Change ISP. You decided for them to run your MX.

It is your choice to aim for a cheapo service (your words). If you're
unhappy with the service, take your business elsewhere. Better service
doesn't necessarily mean more expensive, but you might need to shell out
a few bucks for the service you want.


-- 
char *t=\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4;
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;il;i++){ i%8? c=1:
(c=*++x); c128  (s+=h); if (!(h=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}



RE: Hotfix/phishing spam

2014-08-16 Thread Karsten Bräckelmann
On Thu, 2014-08-14 at 19:37 -0500, John Traweek CCNA, Sec+ wrote:
 Usually an end user has to request the hotfix and fill out a form on
 the MS site and then MS will send out an email with the URI.

Pardon my ignorance, but... WHY!?

Why would anyone require filling out a web form, to send an automated
email with a link as response? Why not simply, you know, put the link in
the page the user gets in return after sending that completed form
anyway?

Using an email message as response to an HTTP GET or POST request to
transfer a http(s) URI is beyond clusterfuck.


(Yes, I do realize you merely described what MS does, and you're not
responsible for their lame process.)


 So to answer your question, yes, MS does send out emails with
 hotfixes, but only when an end user requests it, at least in my
 experience… 
 
 If the end user did not specifically fill out a form/request the hot
 fix, then I would be very suspicious…


-- 
char *t=\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4;
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;il;i++){ i%8? c=1:
(c=*++x); c128  (s+=h); if (!(h=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}