Bug#359905: PTS: unsubscription fraud possible

2006-04-12 Thread Raphael Hertzog
On Wed, 12 Apr 2006, MJ Ray wrote: > > > I probably need to understand how mail gets into the system > > > better before I can see how to prepare the bounce handler. > > > > That's easy to check. Login in master and check > > /org/packages.qa.debian.org/mail/. > > I don't understand how that coul

Bug#359905: PTS: unsubscription fraud possible

2006-04-12 Thread MJ Ray
tag 359905 + patch stop Raphael Hertzog <[EMAIL PROTECTED]> > > > The best solution would be be to implement the bounce handler (with > > > VERP-like headers) but an intermediary solution would be to extract the > > > unsubscription code into a stand-alone perl script that I can call on > > > mast

Bug#359905: PTS: unsubscription fraud possible

2006-03-30 Thread MJ Ray
Thomas Bushnell BSG <[EMAIL PROTECTED]> > I recall you insisting that false positives were not a serious problem > with spam detection systems. > > I'm glad you now disagree with your previous position. I'm pretty sure you're mistaken. For example, "Any false-positive listing and you bounce valid

Bug#359905: PTS: unsubscription fraud possible

2006-03-30 Thread Thomas Bushnell BSG
MJ Ray <[EMAIL PROTECTED]> writes: > They have an attacker-specified subject line and can be loaded > with content after the stop command, to trigger spam traps. > If you expect users to flag up these messages, how can they > spot them? I recall you insisting that false positives were not a serio

Bug#359905: PTS: unsubscription fraud possible

2006-03-30 Thread Raphael Hertzog
On Thu, 30 Mar 2006, MJ Ray wrote: > > I'll include a patch which changes the subject to "Unsubscription notice" > > or something similar. > > You'll prepare it, or accept it when it arrives? Accept it if it arrives. :-) > > The best solution would be be to implement the bounce handler (with > >

Bug#359905: PTS: unsubscription fraud possible

2006-03-30 Thread MJ Ray
Raphael Hertzog <[EMAIL PROTECTED]> > Several persons complained of the *risk* but you're the first one who > tells us that he has been unsubscribed by someone with malicious intent. I have no way of telling whether or not I was, as I didn't notice soon enough to check the logs. I hope it's more l

Bug#359905: PTS: unsubscription fraud possible

2006-03-30 Thread Raphael Hertzog
On Thu, 30 Mar 2006, MJ Ray wrote: > > Because I believe it's not a bug but a feature. It can even help to be > > able to unsubscribe someone else who has troubles unsubscribing alone. > > Respectfully, I disagree. This bug is making the PTS > unreliable for co-maintainers. Several persons compla

Bug#359905: PTS: unsubscription fraud possible

2006-03-30 Thread MJ Ray
Raphael Hertzog <[EMAIL PROTECTED]> > On Wed, 29 Mar 2006, MJ Ray wrote: > > In any case, why was the bug marked done if it's known, > > but won't be fixed? > > Because I believe it's not a bug but a feature. It can even help to be > able to unsubscribe someone else who has troubles unsubscribing

Bug#359905: PTS: unsubscription fraud possible

2006-03-29 Thread Raphael Hertzog
On Wed, 29 Mar 2006, MJ Ray wrote: > Thank you for the information. I must have not seen it because > it didn't say PTS or package in its title. > > I disagree with the justification. The one and only notice > email can be missed easily and unsubscription is a pain. > Please can this be fixed? >

Bug#359905: PTS: unsubscription fraud possible

2006-03-29 Thread MJ Ray
Justin Pryzby <[EMAIL PROTECTED]> > This is briefly discussed and justified at: > > #339724: unsubscribing to bug reports from web page open to malicious use > Package: qa.debian.org; Reported by: [EMAIL PROTECTED]; Tags: pts > Done: Raphael Hertzog <[EMAIL PROTECTED]>; Will be archived in 11 days

Bug#359905: PTS: unsubscription fraud possible

2006-03-29 Thread Justin Pryzby
On Wed, Mar 29, 2006 at 02:18:34PM +0100, MJ Ray (Debian) wrote: > Package: qa.debian.org > Severity: important > > Recently, I stopped receiving bug information via the PTS for > rsnapshot (with various consequences including an NMU). I > found nothing relevant in the PTS log files but I did see

Bug#359905: PTS: unsubscription fraud possible

2006-03-29 Thread MJ Ray (Debian)
Package: qa.debian.org Severity: important Recently, I stopped receiving bug information via the PTS for rsnapshot (with various consequences including an NMU). I found nothing relevant in the PTS log files but I did see PTS mail was sent to several of my different email addresses. When tidying m